diff --git a/.gitea/workflows/docker.yml b/.gitea/workflows/docker.yml
index 136728d..65abb4b 100644
--- a/.gitea/workflows/docker.yml
+++ b/.gitea/workflows/docker.yml
@@ -38,8 +38,49 @@ jobs:
           node .ci/scripts/compute-release.mjs
           test -f .ci/release/release-manifest.json
 
+  backend-test:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node 22
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+
+      - name: Start PostgreSQL 18
+        shell: bash
+        run: |
+          set -euo pipefail
+          docker run -d --name mm-pg \
+            -e POSTGRES_USER=mmapp \
+            -e POSTGRES_PASSWORD=mmapp \
+            -e POSTGRES_DB=mmapp \
+            -p 5432:5432 \
+            postgres:18-alpine
+          for i in $(seq 1 40); do
+            if docker exec mm-pg pg_isready -U mmapp -d mmapp; then
+              exit 0
+            fi
+            sleep 1
+          done
+          echo "PostgreSQL не поднялся"
+          exit 1
+
+      - name: Install and test backend
+        shell: bash
+        env:
+          DATABASE_URL: postgres://mmapp:mmapp@127.0.0.1:5432/mmapp
+        run: |
+          set -euo pipefail
+          npm ci
+          npm run test --prefix backend
+
   backend-image:
-    needs: prepare-release
+    needs:
+      - prepare-release
+      - backend-test
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
diff --git a/README.md b/README.md
index b0a340b..50f126c 100644
--- a/README.md
+++ b/README.md
@@ -19,7 +19,7 @@
 | Компонент | Путь | Стек | Порт (runtime) | Docker-образ |
 |-----------|------|------|----------------|--------------|
 | Frontend | корень (`app/`, `components/`, `lib/`, …) | Next.js 16.2.4 (App Router), React 19 | 3000 | `…-frontend` |
-| Backend | `backend/` | Fastify 5, TypeScript ESM, SQLite, Drizzle | 8000 | `…-backend` |
+| Backend | `backend/` | Fastify 5, TypeScript ESM, PostgreSQL 18, Drizzle | 8000 | `…-backend` |
 | Контракты | `packages/contracts/` | Zod 4, `@mmapp/contracts` | — | встраиваются в frontend/backend |
 | Updater | `deploy/updater/` | bash, `docker:27-cli`, curl, jq | — | `…-updater` |
 | Деплой | `deploy/docker-compose.yml` | Docker Compose | — | — |
@@ -43,11 +43,11 @@ flowchart TB
     Browser["Браузер"]
     NextDev["Next.js :3000"]
     FastifyDev["Fastify :8000"]
-    SqliteDev["SQLite файл"]
+    PostgresDev["PostgreSQL 18"]
     Contracts["@mmapp/contracts"]
     Browser --> NextDev
     Browser -->|"fetch /api, CORS"| FastifyDev
-    FastifyDev --> SqliteDev
+    FastifyDev --> PostgresDev
     Contracts --> NextDev
     Contracts --> FastifyDev
   end
@@ -60,7 +60,8 @@ flowchart TB
   subgraph prod [Прод-сервер]
     FE["mmapp-frontend :3000"]
     BE["mmapp-backend :8000"]
-    DBVol["volume backend-data /app/data"]
+    PG["mmapp-postgres"]
+    DBVol["volume sqlite ETL /app/data"]
     UPD["mmapp-updater"]
     Sock["/var/run/docker.sock"]
     Reg --> FE
@@ -69,6 +70,7 @@ flowchart TB
     UPD --> Sock
     UPD --> FE
     UPD --> BE
+    BE --> PG
     BE --> DBVol
     BrowserProd["Клиент"] --> FE
     BrowserProd -->|"live + backendUrl"| BE
@@ -117,7 +119,7 @@ sequenceDiagram
 ```
 
 - Триггер workflow: `push` в ветку `main`, ручной `workflow_dispatch`.
-- Параллельные jobs: `backend-image`, `frontend-image`, `updater-image`; опционально `notify-webhook` после backend и frontend, если задан секрет `DEPLOY_WEBHOOK_URL`.
+- Параллельные jobs: `backend-test` (PostgreSQL 18), `backend-image`, `frontend-image`, `updater-image`; опционально `notify-webhook` после backend и frontend, если задан секрет `DEPLOY_WEBHOOK_URL`.
 - Теги на каждый успешный push: **`:latest`** и **`:<commit-sha>`**; платформа **linux/amd64**.
 - На сервере образы подтягиваются вручную (`docker compose pull`) и/или через **updater** (сравнение digest у тега из `targets.json`). Webhook CI **не заменяет** updater.
 
@@ -125,7 +127,8 @@ sequenceDiagram
 
 | Зависимость | Реализация |
 |-------------|------------|
-| SQLite | Не отдельный контейнер. Файл `mikrotik.db` в томе `backend-data` → `/app/data` (`DATABASE_PATH=/app/data/mikrotik.db` в образе backend). |
+| PostgreSQL | Контейнер `mmapp-postgres` (`postgres:18-alpine`). `DATABASE_URL=postgres://mmapp:…@postgres:5432/mmapp`. |
+| SQLite (ETL) | Файл `mikrotik.db` на томе `/app/data` (`DATABASE_PATH=/app/data/mikrotik.db`). При первом старте, если PG пустой, backend сам импортирует данные и ставит маркер. Повторный старт не копирует заново. |
 | Docker socket | Только у контейнера updater: `/var/run/docker.sock` — доступ к Docker API хоста (управление контейнерами, pull). |
 
 ## Локальная разработка
@@ -134,7 +137,8 @@ sequenceDiagram
 
 - **Node.js 22** (как в `Dockerfile.frontend` и `backend/Dockerfile`).
 - **npm** с workspaces; установка из корня: `npm ci` или `npm install`.
-- Для нативной сборки `better-sqlite3` на Linux может понадобиться toolchain (`python3`, `make`, `g++`); в Docker-образе backend они уже ставятся.
+- Для нативной сборки `better-sqlite3` на Linux может понадобиться toolchain (`python3`, `make`, `g++`); в Docker-образе backend они уже ставятся (нужен только для одноразового boot-ETL из `mikrotik.db`).
+- Локально нужен PostgreSQL 18 (`deploy/docker-compose.postgres.yml` или `DATABASE_URL`).
 - Backend Docker-образ ставит только workspaces `backend` + `contracts` (без корневых Next/React deps); в production логи — JSON без `pino-pretty`.
 
 ### Запуск
@@ -161,7 +165,8 @@ Backend — скопировать `backend/.env.example` в `backend/.env`:
 
 | Переменная | По умолчанию | Назначение |
 |------------|--------------|------------|
-| `DATABASE_PATH` | `./mikrotik.db` | путь к файлу SQLite |
+| `DATABASE_URL` | `postgres://mmapp:mmapp@127.0.0.1:5432/mmapp` | подключение к PostgreSQL |
+| `DATABASE_PATH` | `./mikrotik.db` | SQLite только для boot-ETL, если PG пустой |
 | `PORT` | `8000` | порт Fastify |
 | `CORS_ORIGIN` | `http://localhost:3000` | origin фронтенда для CORS |
 
@@ -179,12 +184,10 @@ Frontend — в репозитории нет корневого `.env.example`.
 npm run build -w @mmapp/contracts
 ```
 
-После изменения схем Drizzle:
+Схема PostgreSQL накатывается при старте backend из [`backend/drizzle/0000_postgresql.sql`](backend/drizzle/0000_postgresql.sql). Опциональный ETL:
 
 ```bash
-npm --prefix backend run db:generate
-npm --prefix backend run db:migrate
-npm --prefix backend run db:studio
+npm --prefix backend run db:migrate-from-sqlite
 ```
 
 ## CI/CD (Gitea Actions)
@@ -281,7 +284,8 @@ SSO auth-portal: [`docs/integrate-auth-portal.md`](docs/integrate-auth-portal.md
 
 | Сервис | `container_name` | Образ (пример) | Порты host:container | Тома | `restart` |
 |--------|------------------|----------------|----------------------|------|-----------|
-| backend | `mmapp-backend` | `git.shx.one/denozord/mikrotikmanager-backend:latest` | `8000:8000` | `backend-data` → `/app/data` | `unless-stopped` |
+| postgres | `mmapp-postgres` | `postgres:18-alpine` | нет (внутренняя сеть) | `mmapp-pgdata` | `unless-stopped` |
+| backend | `mmapp-backend` | `git.shx.one/denozord/mikrotikmanager-backend:latest` | `8000:8000` | sqlite ETL → `/app/data` | `unless-stopped` |
 | frontend | `mmapp-frontend` | `git.shx.one/denozord/mikrotikmanager-frontend:latest` | `3000:3000` | — | `unless-stopped` |
 | updater | `mmapp-updater` | `git.shx.one/denozord/mikrotikmanager-updater:latest` | не публикуются | docker.sock, `updater-state` → `/state`, `targets.json` → `/etc/updater/targets.json:ro` | `unless-stopped` |
 
@@ -297,11 +301,14 @@ SSO auth-portal: [`docs/integrate-auth-portal.md`](docs/integrate-auth-portal.md
 
 ### Переменные окружения (прод)
 
-**Backend** (в образе заданы `NODE_ENV=production`, `PORT=8000`, `DATABASE_PATH=/app/data/mikrotik.db`; в compose обычно переопределяют только CORS):
+**Backend** (в образе заданы `NODE_ENV=production`, `PORT=8000`; в compose задают `DATABASE_URL`, `DATABASE_PATH` для ETL и CORS):
 
 | Переменная | Источник в compose | Назначение |
 |------------|-------------------|------------|
 | `CORS_ORIGIN` | `${CORS_ORIGIN:-http://localhost:3000}` | origin UI, с которого браузер вызывает API |
+| `DATABASE_URL` | `postgres://mmapp:${POSTGRES_PASSWORD}@postgres:5432/mmapp` | PostgreSQL |
+| `DATABASE_PATH` | `/app/data/mikrotik.db` | SQLite на томе для одноразового ETL |
+| `POSTGRES_PASSWORD` | обязателен | пароль пользователя `mmapp` |
 
 **Frontend** (в образе: `PORT=3000`, `HOSTNAME=0.0.0.0`). URL API в образ **не** зашит — задаётся в браузере (режим live + URL бэкенда) вместе с `CORS_ORIGIN` на backend.
 
@@ -312,7 +319,7 @@ SSO auth-portal: [`docs/integrate-auth-portal.md`](docs/integrate-auth-portal.md
 | `TARGETS_FILE` | `/etc/updater/targets.json` | список целей |
 | `STATE_FILE` | `/state/updater-state.json` | digest и ошибки |
 | `POLL_INTERVAL_SECONDS` | `300` | пауза между циклами опроса |
-| `HEALTH_TIMEOUT_SECONDS` | `120` | ожидание HTTP health |
+| `HEALTH_TIMEOUT_SECONDS` | `600` | ожидание HTTP health (первый boot с ETL может занять минуты) |
 | `STOP_TIMEOUT_SECONDS` | `30` | `docker stop -t` |
 | `REGISTRY` | `git.shx.one` | registry для `docker login` |
 | `REGISTRY_USERNAME` | пусто | логин (если заданы оба с паролем) |
@@ -516,18 +523,20 @@ docker compose up -d --force-recreate
 ### Откат
 
 - **Автоматически:** updater при failed health после обновления — контейнер на `previous_digest`.
-- **Вручную:** остановить контейнер, запустить образ с нужным тегом или digest из registry, сохранив те же volume и labels. Откат **схемы SQLite** updater не выполняет — нужен отдельный backup тома `backend-data` / файла `mikrotik.db`.
+- **Вручную:** остановить контейнер, запустить образ с нужным тегом или digest из registry, сохранив те же volume и labels. Откат **схемы PostgreSQL** updater не выполняет — нужен `pg_dump` / restore или том `mmapp-pgdata`.
 
-### Резервное копирование SQLite
+### Резервное копирование PostgreSQL
 
-Том `backend-data` (или `mmapp-backend-data` при явном `docker volume create`). Пример остановки backend для консистентной копии:
+Том `mmapp-pgdata` и (до cleanup) sqlite `mikrotik.db` на `/app/data`. Из UI: Настройки → «Скачать бэкап» (`pg_dump -Fc`). С хоста:
 
 ```bash
-docker stop mmapp-backend
-docker run --rm -v backend-data:/data -v $(pwd):/backup alpine tar czf /backup/mikrotik-db-backup.tar.gz -C /data .
-docker start mmapp-backend
+docker exec mmapp-postgres pg_dump -Fc -U mmapp mmapp > mikrotik-manager.dump
 ```
 
+Восстановление: UI «Восстановить из файла» или `pg_restore --clean --if-exists -d …`.
+
+Том sqlite после успешного ETL и smoke **не удаляйте сразу** — оставьте как fallback, затем уберите `mikrotik.db`, когда маркер `data_migration.sqlite_imported_at` подтверждён.
+
 ### Отладка
 
 | Действие | Команда |
diff --git a/app/(main)/alerts/page.tsx b/app/(main)/alerts/page.tsx
index 24cb09b..2b03a87 100644
--- a/app/(main)/alerts/page.tsx
+++ b/app/(main)/alerts/page.tsx
@@ -2846,7 +2846,7 @@ export default function AlertsPage() {
             </CollapsibleTrigger>
             <CollapsibleContent className="px-3 pb-3 text-[11px] text-muted-foreground leading-relaxed space-y-2 border-t border-border/60 pt-2">
               <p>
-                Движок читает последние сэмплы из SQLite (uptime ресурсы, REST-пинг, пробы, GRE/BGP). Условие
+                Движок читает последние сэмплы из PostgreSQL (uptime ресурсы, REST-пинг, пробы, GRE/BGP). Условие
                 срабатывает только если цепочка состояний совпадает с текстом правила.
               </p>
               <ul className="list-disc pl-4 space-y-1.5">
diff --git a/app/(main)/data-collection/page.tsx b/app/(main)/data-collection/page.tsx
index 91d5a3f..ed48669 100644
--- a/app/(main)/data-collection/page.tsx
+++ b/app/(main)/data-collection/page.tsx
@@ -220,7 +220,7 @@ function SnapshotTables({ snap }: { snap: SchedulerRunSnapshot }) {
           </Alert>
         ) : null}
         <p className="text-xs text-muted-foreground">
-          Запись в SQLite на{" "}
+          Запись в PostgreSQL на{" "}
           <span className="font-mono tabular-nums">{new Date(g.sampledAt).toLocaleString("ru-RU")}</span>
           {" "}— строки GRE и BGP для движка оповещений.
         </p>
@@ -347,7 +347,7 @@ function SnapshotTables({ snap }: { snap: SchedulerRunSnapshot }) {
         <p className="text-xs text-muted-foreground">
           Снимок на{" "}
           <span className="font-mono tabular-nums">{new Date(a.sampledAt).toLocaleString("ru-RU")}</span>
-          . Данные для правил берутся из SQLite после джоб сбора (трафик, uptime, REST, GRE+BGP и т.д.).
+          . Данные для правил берутся из PostgreSQL после джоб сбора (трафик, uptime, REST, GRE+BGP и т.д.).
         </p>
         <dl className="grid grid-cols-2 sm:grid-cols-4 gap-3 text-xs">
           <div>
@@ -1215,7 +1215,7 @@ export default function DataCollectionPage() {
 
               <OpsPanel
                 title="Журнал прогонов"
-                description="SQLite `scheduler_runs` — до 80 записей; раскройте строку для полей и текста ошибки."
+                description="Таблица `scheduler_runs` — до 80 записей; раскройте строку для полей и текста ошибки."
                 headerRight={
                   <div className="flex items-center gap-2 shrink-0">
                     <label className="text-xs text-muted-foreground whitespace-nowrap" htmlFor="run-filter">
diff --git a/app/(main)/settings/page.tsx b/app/(main)/settings/page.tsx
index 9f4cd14..a7b267c 100644
--- a/app/(main)/settings/page.tsx
+++ b/app/(main)/settings/page.tsx
@@ -88,7 +88,7 @@ function DatabaseRestoreConfirm({
           </AlertDialogMedia>
           <AlertDialogTitle>Восстановить базу приложения?</AlertDialogTitle>
           <AlertDialogDescription>
-            Файл: {filename}. Текущие данные SQLite на бекенде будут полностью заменены.
+            Файл: {filename}. Текущие данные PostgreSQL на бекенде будут полностью заменены.
             Рекомендуется сначала скачать актуальный бэкап.
           </AlertDialogDescription>
         </AlertDialogHeader>
@@ -435,7 +435,7 @@ export default function SettingsPage() {
 
       <OpsPanel
         title="База данных приложения"
-        description="Резервная копия SQLite бекенда и сброс таблиц NetFlow. На время операции планировщик и коллектор IPFIX приостанавливаются. Preview: https://reui.io/preview/base/settings-16"
+        description="Резервная копия PostgreSQL (pg_dump custom) и сброс таблиц NetFlow. На время операции планировщик и коллектор IPFIX приостанавливаются. Preview: https://reui.io/preview/base/settings-16"
         contentClassName="divide-y px-5"
       >
           {!systemDbAvailable && (
@@ -446,7 +446,7 @@ export default function SettingsPage() {
           )}
           <SettingRow
             label="Скачать бэкап"
-            description="Консистентная копия файла mikrotik.db"
+            description="Консистентный дамп PostgreSQL (pg_dump -Fc)"
           >
             <Button
               variant="outline"
@@ -461,7 +461,7 @@ export default function SettingsPage() {
           </SettingRow>
           <SettingRow
             label="Восстановить из файла"
-            description="Полностью заменяет текущую базу SQLite"
+            description="Полностью заменяет текущую базу PostgreSQL (pg_restore)"
           >
             <div className="flex flex-col items-end gap-2">
               <Button
@@ -481,7 +481,7 @@ export default function SettingsPage() {
           </SettingRow>
           <SettingRow
             label="Сбросить данные NetFlow"
-            description="Удалит сессии и агрегаты из SQLite, затем VACUUM. Ключи WG и пиры не трогает"
+            description="Удалит сессии и агрегаты NetFlow в PostgreSQL. Ключи WG и пиры не трогает"
           >
             <Button
               variant="destructive"
@@ -563,7 +563,7 @@ export default function SettingsPage() {
               >
                 access.md
               </a>
-              . URL и ключ хранятся в SQLite на сервере бекенда (
+              . URL и ключ хранятся в PostgreSQL на сервере бекенда (
               <code className="font-mono bg-muted px-1 rounded">evobgp_settings</code>
               ). Каталог —{" "}
               <code className="font-mono bg-muted px-1 rounded">GET /v1/router-lists/catalog</code> через прокси.
@@ -937,8 +937,8 @@ export default function SettingsPage() {
         open={dbRestoreDialogOpen}
         onOpenChange={setDbRestoreDialogOpen}
         title="Восстановление базы данных"
-        description="Выберите файл SQLite (.db) — текущая база будет полностью заменена"
-        accept=".db,.sqlite,.sqlite3,application/octet-stream"
+        description="Выберите файл pg_dump custom (.dump) — текущая база будет полностью заменена"
+        accept=".dump,.backup,application/octet-stream"
         onImport={async (files) => {
           const file = files[0]
           if (!file) return
diff --git a/backend/.env.example b/backend/.env.example
index 7a4baa9..40a3b94 100644
--- a/backend/.env.example
+++ b/backend/.env.example
@@ -1,5 +1,9 @@
-# Path to SQLite database file
+# PostgreSQL connection string
+DATABASE_URL=postgres://mmapp:mmapp@127.0.0.1:5432/mmapp
+
+# SQLite file used only for one-shot boot ETL (empty PG + existing mikrotik.db)
 DATABASE_PATH=./mikrotik.db
+# SQLITE_IMPORT_FULL_HISTORY=true
 
 # Port for the Fastify server
 PORT=8000
diff --git a/backend/Dockerfile b/backend/Dockerfile
index 18e0302..b5fa9f6 100644
--- a/backend/Dockerfile
+++ b/backend/Dockerfile
@@ -47,8 +47,16 @@ COPY --from=build /app/node_modules ./node_modules
 COPY --from=build /app/packages/contracts ./packages/contracts
 COPY --from=build /app/backend/dist ./backend/dist
 COPY --from=build /app/backend/package.json ./backend/package.json
+COPY --from=build /app/backend/drizzle ./backend/drizzle
 # Nested install from lockfile (dotenv etc.) — ESM resolves from /app/backend/dist → ../node_modules
 COPY --from=build /app/backend/node_modules ./backend/node_modules
-RUN mkdir -p /app/data
+RUN apt-get update \
+  && apt-get install -y --no-install-recommends gnupg wget ca-certificates \
+  && wget -qO- https://www.postgresql.org/media/keys/ACCC4CF8.asc | gpg --dearmor -o /usr/share/keyrings/pgdg.gpg \
+  && echo "deb [signed-by=/usr/share/keyrings/pgdg.gpg] http://apt.postgresql.org/pub/repos/apt bookworm-pgdg main" > /etc/apt/sources.list.d/pgdg.list \
+  && apt-get update \
+  && apt-get install -y --no-install-recommends postgresql-client-18 \
+  && rm -rf /var/lib/apt/lists/* \
+  && mkdir -p /app/data
 EXPOSE 8000
 CMD ["node", "backend/dist/index.js"]
diff --git a/backend/drizzle.config.ts b/backend/drizzle.config.ts
index 491a93d..6e37e50 100644
--- a/backend/drizzle.config.ts
+++ b/backend/drizzle.config.ts
@@ -6,9 +6,9 @@ config()
 export default defineConfig({
   schema: "./src/db/schema.ts",
   out: "./drizzle",
-  dialect: "sqlite",
+  dialect: "postgresql",
   dbCredentials: {
-    url: process.env.DATABASE_PATH ?? "./mikrotik.db",
+    url: process.env.DATABASE_URL ?? "postgres://mmapp:mmapp@127.0.0.1:5432/mmapp",
   },
   verbose: true,
   strict: true,
diff --git a/backend/drizzle/0000_living_xorn.sql b/backend/drizzle/0000_living_xorn.sql
deleted file mode 100644
index a387756..0000000
--- a/backend/drizzle/0000_living_xorn.sql
+++ /dev/null
@@ -1,36 +0,0 @@
-CREATE TABLE `server_snapshots` (
-	`id` integer PRIMARY KEY AUTOINCREMENT NOT NULL,
-	`server_id` integer NOT NULL,
-	`polled_at` text NOT NULL,
-	`status` text NOT NULL,
-	`latency_ms` real,
-	`ros_version` text,
-	`board_name` text,
-	`uptime` text,
-	`cpu_load` integer,
-	`free_memory` integer,
-	`total_memory` integer,
-	`identity_name` text,
-	`raw_interfaces` text,
-	`raw_ip_addresses` text,
-	FOREIGN KEY (`server_id`) REFERENCES `servers`(`id`) ON UPDATE no action ON DELETE cascade
-);
---> statement-breakpoint
-CREATE TABLE `servers` (
-	`id` integer PRIMARY KEY AUTOINCREMENT NOT NULL,
-	`name` text DEFAULT '' NOT NULL,
-	`host` text NOT NULL,
-	`port` integer DEFAULT 443 NOT NULL,
-	`username` text DEFAULT 'admin' NOT NULL,
-	`password` text DEFAULT '' NOT NULL,
-	`use_ssl` integer DEFAULT true NOT NULL,
-	`verify_ssl` integer DEFAULT false NOT NULL,
-	`type` text DEFAULT 'home-router' NOT NULL,
-	`site` text DEFAULT '' NOT NULL,
-	`country` text DEFAULT '' NOT NULL,
-	`asn` text DEFAULT '' NOT NULL,
-	`comment` text DEFAULT '' NOT NULL,
-	`enabled` integer DEFAULT true NOT NULL,
-	`created_at` text DEFAULT (datetime('now')) NOT NULL,
-	`updated_at` text DEFAULT (datetime('now')) NOT NULL
-);
diff --git a/backend/drizzle/0000_postgresql.sql b/backend/drizzle/0000_postgresql.sql
new file mode 100644
index 0000000..1ade64f
--- /dev/null
+++ b/backend/drizzle/0000_postgresql.sql
@@ -0,0 +1,626 @@
+-- MikrotikManager PostgreSQL 18 schema (not 1:1 SQLite).
+-- Applied once at backend boot via src/db/migrate.ts
+
+CREATE TABLE IF NOT EXISTS schema_migrations (
+  id TEXT PRIMARY KEY,
+  applied_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE TABLE IF NOT EXISTS servers (
+  id BIGINT GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY,
+  name TEXT NOT NULL DEFAULT '',
+  host TEXT NOT NULL,
+  port INTEGER NOT NULL DEFAULT 443,
+  username TEXT NOT NULL DEFAULT 'admin',
+  password TEXT NOT NULL DEFAULT '',
+  use_ssl BOOLEAN NOT NULL DEFAULT TRUE,
+  verify_ssl BOOLEAN NOT NULL DEFAULT FALSE,
+  type TEXT NOT NULL DEFAULT 'home-router'
+    CHECK (type IN ('jump-host', 'exit-node', 'home-router')),
+  site TEXT NOT NULL DEFAULT '',
+  country TEXT NOT NULL DEFAULT '',
+  asn TEXT NOT NULL DEFAULT '',
+  comment TEXT NOT NULL DEFAULT '',
+  enabled BOOLEAN NOT NULL DEFAULT TRUE,
+  lan_subnet TEXT NOT NULL DEFAULT '',
+  wan_uplinks JSONB NOT NULL DEFAULT '[]'::jsonb,
+  mgmt_tunnel_ip TEXT NOT NULL DEFAULT '',
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE TABLE IF NOT EXISTS traffic_settings (
+  id BIGINT PRIMARY KEY CHECK (id = 1),
+  enabled BOOLEAN NOT NULL DEFAULT TRUE,
+  interval_sec INTEGER NOT NULL DEFAULT 30,
+  retention_days INTEGER NOT NULL DEFAULT 14,
+  last_collected_at TIMESTAMPTZ,
+  last_duration_ms INTEGER,
+  last_error TEXT,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE TABLE IF NOT EXISTS servers_api_ping_settings (
+  id BIGINT PRIMARY KEY CHECK (id = 1),
+  enabled BOOLEAN NOT NULL DEFAULT FALSE,
+  interval_sec INTEGER NOT NULL DEFAULT 120,
+  last_collected_at TIMESTAMPTZ,
+  last_duration_ms INTEGER,
+  last_error TEXT,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE TABLE IF NOT EXISTS traffic_flow_settings (
+  id BIGINT PRIMARY KEY CHECK (id = 1),
+  enabled BOOLEAN NOT NULL DEFAULT FALSE,
+  collector_ip TEXT NOT NULL DEFAULT '10.255.254.1',
+  flow_listen_port INTEGER NOT NULL DEFAULT 4739,
+  wg_listen_port INTEGER NOT NULL DEFAULT 51821,
+  prefix TEXT NOT NULL DEFAULT '10.255.254.0/24',
+  public_endpoint TEXT NOT NULL DEFAULT '',
+  host_public_key TEXT NOT NULL DEFAULT '',
+  host_private_key TEXT NOT NULL DEFAULT '',
+  hub_server_id BIGINT,
+  retention_hours INTEGER NOT NULL DEFAULT 24,
+  top_n INTEGER NOT NULL DEFAULT 200,
+  map_service_min_share_pct DOUBLE PRECISION NOT NULL DEFAULT 5,
+  last_datagram_at TIMESTAMPTZ,
+  last_exporter_ip TEXT,
+  last_error TEXT,
+  packets_received BIGINT NOT NULL DEFAULT 0,
+  peers_json JSONB NOT NULL DEFAULT '[]'::jsonb,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE TABLE IF NOT EXISTS uptime_settings (
+  id BIGINT PRIMARY KEY CHECK (id = 1),
+  enabled BOOLEAN NOT NULL DEFAULT TRUE,
+  resources_enabled BOOLEAN NOT NULL DEFAULT TRUE,
+  ping_enabled BOOLEAN NOT NULL DEFAULT TRUE,
+  speed_enabled BOOLEAN NOT NULL DEFAULT TRUE,
+  interval_sec INTEGER NOT NULL DEFAULT 15,
+  probe_interval_sec INTEGER NOT NULL DEFAULT 15,
+  speed_interval_sec INTEGER NOT NULL DEFAULT 60,
+  retention_days INTEGER NOT NULL DEFAULT 14,
+  last_collected_at TIMESTAMPTZ,
+  last_duration_ms INTEGER,
+  last_error TEXT,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE TABLE IF NOT EXISTS evobgp_settings (
+  id BIGINT PRIMARY KEY CHECK (id = 1),
+  base_url TEXT NOT NULL DEFAULT '',
+  api_key TEXT NOT NULL DEFAULT '',
+  enabled BOOLEAN NOT NULL DEFAULT FALSE,
+  updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE TABLE IF NOT EXISTS alert_telegram_settings (
+  id BIGINT PRIMARY KEY CHECK (id = 1),
+  bot_token TEXT NOT NULL DEFAULT '',
+  chat_id TEXT NOT NULL DEFAULT '',
+  message_thread_id INTEGER,
+  updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE TABLE IF NOT EXISTS acme_settings (
+  id BIGINT PRIMARY KEY CHECK (id = 1),
+  directory_url TEXT NOT NULL DEFAULT 'https://acme-v02.api.letsencrypt.org/directory',
+  cloudflare_api_token TEXT NOT NULL DEFAULT '',
+  default_zone_id TEXT NOT NULL DEFAULT '',
+  account_private_key TEXT NOT NULL DEFAULT '',
+  updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE TABLE IF NOT EXISTS certificate_renew_settings (
+  id BIGINT PRIMARY KEY CHECK (id = 1),
+  enabled BOOLEAN NOT NULL DEFAULT TRUE,
+  interval_sec INTEGER NOT NULL DEFAULT 21600,
+  renew_before_days INTEGER NOT NULL DEFAULT 30,
+  last_collected_at TIMESTAMPTZ,
+  last_duration_ms INTEGER,
+  last_error TEXT,
+  updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE TABLE IF NOT EXISTS backup_schedule_settings (
+  id BIGINT PRIMARY KEY CHECK (id = 1),
+  enabled BOOLEAN NOT NULL DEFAULT TRUE,
+  frequency TEXT NOT NULL DEFAULT 'daily' CHECK (frequency IN ('daily', 'weekly', 'monthly')),
+  hour INTEGER NOT NULL DEFAULT 3,
+  minute INTEGER NOT NULL DEFAULT 0,
+  week_day INTEGER NOT NULL DEFAULT 0,
+  month_day INTEGER NOT NULL DEFAULT 1,
+  keep_count INTEGER NOT NULL DEFAULT 7,
+  format TEXT NOT NULL DEFAULT 'rsc' CHECK (format IN ('rsc', 'backup')),
+  server_ids_json JSONB NOT NULL DEFAULT '[]'::jsonb,
+  last_run_at TIMESTAMPTZ,
+  last_duration_ms INTEGER,
+  last_error TEXT,
+  updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE TABLE IF NOT EXISTS internet_path_settings (
+  id BIGINT PRIMARY KEY CHECK (id = 1),
+  enabled BOOLEAN NOT NULL DEFAULT TRUE,
+  interval_sec INTEGER NOT NULL DEFAULT 300,
+  retention_days INTEGER NOT NULL DEFAULT 14,
+  last_collected_at TIMESTAMPTZ,
+  last_duration_ms INTEGER,
+  last_error TEXT,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE TABLE IF NOT EXISTS alert_engine_cursor (
+  id BIGINT PRIMARY KEY CHECK (id = 1),
+  last_source_finished_at TIMESTAMPTZ,
+  updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE TABLE IF NOT EXISTS data_migration (
+  id INTEGER PRIMARY KEY CHECK (id = 1),
+  sqlite_imported_at TIMESTAMPTZ,
+  sqlite_path TEXT,
+  sqlite_sha256 TEXT,
+  report_json JSONB
+);
+
+CREATE TABLE IF NOT EXISTS filter_rules (
+  id BIGINT GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY,
+  server_id BIGINT NOT NULL REFERENCES servers(id) ON DELETE CASCADE,
+  sort_order INTEGER NOT NULL DEFAULT 0,
+  community TEXT NOT NULL,
+  community_name TEXT,
+  action TEXT NOT NULL DEFAULT 'route' CHECK (action IN ('route', 'blackhole')),
+  gateway TEXT NOT NULL DEFAULT '',
+  gateway_tunnel_id TEXT NOT NULL DEFAULT '',
+  description TEXT NOT NULL DEFAULT '',
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+CREATE INDEX IF NOT EXISTS idx_filter_rules_server_sort ON filter_rules(server_id, sort_order);
+
+CREATE TABLE IF NOT EXISTS recursive_routes (
+  id BIGINT GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY,
+  server_id BIGINT NOT NULL REFERENCES servers(id) ON DELETE CASCADE,
+  sort_order INTEGER NOT NULL DEFAULT 0,
+  dst_address TEXT NOT NULL,
+  gateway TEXT NOT NULL,
+  distance INTEGER NOT NULL DEFAULT 1,
+  scope INTEGER,
+  target_scope INTEGER,
+  routing_table TEXT NOT NULL DEFAULT 'main',
+  check_gateway TEXT NOT NULL DEFAULT '',
+  country TEXT NOT NULL DEFAULT '',
+  comment TEXT NOT NULL DEFAULT '',
+  disabled BOOLEAN NOT NULL DEFAULT FALSE,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+CREATE INDEX IF NOT EXISTS idx_recursive_routes_server_sort ON recursive_routes(server_id, sort_order);
+
+CREATE TABLE IF NOT EXISTS server_snapshots (
+  id BIGINT GENERATED BY DEFAULT AS IDENTITY,
+  server_id BIGINT NOT NULL REFERENCES servers(id) ON DELETE CASCADE,
+  polled_at TIMESTAMPTZ NOT NULL,
+  status TEXT NOT NULL CHECK (status IN ('online', 'offline')),
+  latency_ms DOUBLE PRECISION,
+  ros_version TEXT,
+  board_name TEXT,
+  uptime TEXT,
+  cpu_load INTEGER,
+  free_memory BIGINT,
+  total_memory BIGINT,
+  identity_name TEXT,
+  raw_interfaces JSONB,
+  raw_ip_addresses JSONB,
+  PRIMARY KEY (id, polled_at)
+) PARTITION BY RANGE (polled_at);
+CREATE INDEX IF NOT EXISTS idx_server_snapshots_server_time ON server_snapshots(server_id, polled_at);
+CREATE INDEX IF NOT EXISTS idx_server_snapshots_polled_brin ON server_snapshots USING BRIN (polled_at);
+
+CREATE TABLE IF NOT EXISTS traffic_samples (
+  id BIGINT GENERATED BY DEFAULT AS IDENTITY,
+  server_id BIGINT NOT NULL REFERENCES servers(id) ON DELETE CASCADE,
+  interface_name TEXT NOT NULL,
+  peer_public_key TEXT NOT NULL DEFAULT '',
+  sampled_at TIMESTAMPTZ NOT NULL,
+  rx_bytes BIGINT NOT NULL DEFAULT 0,
+  tx_bytes BIGINT NOT NULL DEFAULT 0,
+  rx_bps BIGINT NOT NULL DEFAULT 0,
+  tx_bps BIGINT NOT NULL DEFAULT 0,
+  running BOOLEAN NOT NULL DEFAULT FALSE,
+  disabled BOOLEAN NOT NULL DEFAULT FALSE,
+  PRIMARY KEY (id, sampled_at)
+) PARTITION BY RANGE (sampled_at);
+CREATE INDEX IF NOT EXISTS idx_traffic_samples_server_time ON traffic_samples(server_id, sampled_at);
+CREATE INDEX IF NOT EXISTS idx_traffic_samples_server_iface_time ON traffic_samples(server_id, interface_name, sampled_at);
+CREATE INDEX IF NOT EXISTS idx_traffic_samples_sampled_brin ON traffic_samples USING BRIN (sampled_at);
+
+CREATE TABLE IF NOT EXISTS servers_rest_ping_samples (
+  id BIGINT GENERATED BY DEFAULT AS IDENTITY,
+  server_id BIGINT NOT NULL REFERENCES servers(id) ON DELETE CASCADE,
+  sampled_at TIMESTAMPTZ NOT NULL,
+  ok BOOLEAN NOT NULL,
+  latency_ms INTEGER,
+  error TEXT,
+  PRIMARY KEY (id, sampled_at)
+) PARTITION BY RANGE (sampled_at);
+CREATE INDEX IF NOT EXISTS idx_servers_rest_ping_samples_server_id ON servers_rest_ping_samples(server_id, sampled_at);
+CREATE INDEX IF NOT EXISTS idx_servers_rest_ping_samples_brin ON servers_rest_ping_samples USING BRIN (sampled_at);
+
+CREATE TABLE IF NOT EXISTS flow_buckets (
+  server_id BIGINT NOT NULL REFERENCES servers(id) ON DELETE CASCADE,
+  bucket_at TIMESTAMPTZ NOT NULL,
+  src TEXT NOT NULL,
+  dst TEXT NOT NULL,
+  proto INTEGER NOT NULL DEFAULT 0,
+  src_port INTEGER NOT NULL DEFAULT 0,
+  dst_port INTEGER NOT NULL DEFAULT 0,
+  bytes BIGINT NOT NULL DEFAULT 0,
+  packets BIGINT NOT NULL DEFAULT 0,
+  in_iface TEXT NOT NULL DEFAULT '',
+  out_iface TEXT NOT NULL DEFAULT '',
+  next_hop TEXT NOT NULL DEFAULT '',
+  flow_start_ms BIGINT NOT NULL DEFAULT 0,
+  flow_end_ms BIGINT NOT NULL DEFAULT 0,
+  PRIMARY KEY (server_id, bucket_at, src, dst, proto, src_port, dst_port, in_iface)
+) PARTITION BY RANGE (bucket_at);
+CREATE INDEX IF NOT EXISTS idx_flow_buckets_server_time ON flow_buckets(server_id, bucket_at);
+CREATE INDEX IF NOT EXISTS idx_flow_buckets_bucket_brin ON flow_buckets USING BRIN (bucket_at);
+
+CREATE TABLE IF NOT EXISTS flow_minute_stats (
+  server_id BIGINT NOT NULL REFERENCES servers(id) ON DELETE CASCADE,
+  bucket_at TIMESTAMPTZ NOT NULL,
+  bytes BIGINT NOT NULL DEFAULT 0,
+  packets BIGINT NOT NULL DEFAULT 0,
+  unique_src INTEGER NOT NULL DEFAULT 0,
+  unique_dst INTEGER NOT NULL DEFAULT 0,
+  conversations INTEGER NOT NULL DEFAULT 0,
+  PRIMARY KEY (server_id, bucket_at)
+) PARTITION BY RANGE (bucket_at);
+CREATE INDEX IF NOT EXISTS idx_flow_minute_stats_brin ON flow_minute_stats USING BRIN (bucket_at);
+
+CREATE TABLE IF NOT EXISTS flow_minute_dims (
+  server_id BIGINT NOT NULL REFERENCES servers(id) ON DELETE CASCADE,
+  bucket_at TIMESTAMPTZ NOT NULL,
+  dim TEXT NOT NULL,
+  key TEXT NOT NULL,
+  bytes BIGINT NOT NULL DEFAULT 0,
+  packets BIGINT NOT NULL DEFAULT 0,
+  PRIMARY KEY (server_id, bucket_at, dim, key)
+) PARTITION BY RANGE (bucket_at);
+CREATE INDEX IF NOT EXISTS idx_flow_minute_dims_time ON flow_minute_dims(bucket_at, dim);
+CREATE INDEX IF NOT EXISTS idx_flow_minute_dims_brin ON flow_minute_dims USING BRIN (bucket_at);
+
+CREATE TABLE IF NOT EXISTS flow_daily_dims (
+  server_id BIGINT NOT NULL REFERENCES servers(id) ON DELETE CASCADE,
+  day DATE NOT NULL,
+  dim TEXT NOT NULL,
+  key TEXT NOT NULL,
+  bytes BIGINT NOT NULL DEFAULT 0,
+  packets BIGINT NOT NULL DEFAULT 0,
+  PRIMARY KEY (server_id, day, dim, key)
+) PARTITION BY RANGE (day);
+CREATE INDEX IF NOT EXISTS idx_flow_daily_dims_day ON flow_daily_dims(day, dim);
+
+CREATE TABLE IF NOT EXISTS flow_ip_meta (
+  prefix TEXT PRIMARY KEY,
+  asn INTEGER NOT NULL DEFAULT 0,
+  country TEXT NOT NULL DEFAULT '',
+  lat DOUBLE PRECISION,
+  lng DOUBLE PRECISION,
+  holder TEXT NOT NULL DEFAULT '',
+  ok INTEGER NOT NULL DEFAULT 1,
+  fetched_at TIMESTAMPTZ NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS flow_asn_meta (
+  asn INTEGER PRIMARY KEY,
+  holder TEXT NOT NULL DEFAULT '',
+  fetched_at TIMESTAMPTZ NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS uptime_probes (
+  id TEXT PRIMARY KEY,
+  src_server_id BIGINT NOT NULL REFERENCES servers(id) ON DELETE CASCADE,
+  src_interface TEXT NOT NULL DEFAULT '',
+  name TEXT NOT NULL,
+  target TEXT NOT NULL,
+  probe_filter TEXT NOT NULL DEFAULT '—',
+  enabled BOOLEAN NOT NULL DEFAULT TRUE,
+  interval_sec INTEGER NOT NULL DEFAULT 0,
+  show_on_dashboard BOOLEAN NOT NULL DEFAULT FALSE,
+  sort_order INTEGER NOT NULL DEFAULT 0,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+CREATE INDEX IF NOT EXISTS idx_uptime_probes_server_sort ON uptime_probes(src_server_id, sort_order);
+
+CREATE TABLE IF NOT EXISTS uptime_probe_samples (
+  id BIGINT GENERATED BY DEFAULT AS IDENTITY,
+  probe_id TEXT NOT NULL REFERENCES uptime_probes(id) ON DELETE CASCADE,
+  sampled_at TIMESTAMPTZ NOT NULL,
+  rtt_ms INTEGER,
+  loss_pct INTEGER NOT NULL DEFAULT 0,
+  status TEXT NOT NULL DEFAULT 'down' CHECK (status IN ('up', 'warn', 'down')),
+  PRIMARY KEY (id, sampled_at)
+) PARTITION BY RANGE (sampled_at);
+CREATE INDEX IF NOT EXISTS idx_uptime_probe_samples_probe_time ON uptime_probe_samples(probe_id, sampled_at);
+CREATE INDEX IF NOT EXISTS idx_uptime_probe_samples_brin ON uptime_probe_samples USING BRIN (sampled_at);
+
+CREATE TABLE IF NOT EXISTS uptime_resource_samples (
+  id BIGINT GENERATED BY DEFAULT AS IDENTITY,
+  server_id BIGINT NOT NULL REFERENCES servers(id) ON DELETE CASCADE,
+  sampled_at TIMESTAMPTZ NOT NULL,
+  status TEXT NOT NULL DEFAULT 'offline' CHECK (status IN ('online', 'offline')),
+  cpu_load INTEGER NOT NULL DEFAULT 0,
+  free_memory BIGINT NOT NULL DEFAULT 0,
+  total_memory BIGINT NOT NULL DEFAULT 0,
+  free_hdd_space BIGINT NOT NULL DEFAULT 0,
+  total_hdd_space BIGINT NOT NULL DEFAULT 0,
+  uptime_seconds BIGINT NOT NULL DEFAULT 0,
+  board_name TEXT NOT NULL DEFAULT '',
+  ros_version TEXT NOT NULL DEFAULT '',
+  PRIMARY KEY (id, sampled_at)
+) PARTITION BY RANGE (sampled_at);
+CREATE INDEX IF NOT EXISTS idx_uptime_resource_samples_server_time ON uptime_resource_samples(server_id, sampled_at);
+CREATE INDEX IF NOT EXISTS idx_uptime_resource_samples_brin ON uptime_resource_samples USING BRIN (sampled_at);
+
+CREATE TABLE IF NOT EXISTS uptime_speed_probes (
+  id TEXT PRIMARY KEY,
+  src_server_id BIGINT NOT NULL REFERENCES servers(id) ON DELETE CASCADE,
+  dst_server_id BIGINT NOT NULL REFERENCES servers(id) ON DELETE CASCADE,
+  src_interface TEXT NOT NULL DEFAULT '',
+  dst_interface TEXT NOT NULL DEFAULT '',
+  protocol TEXT NOT NULL DEFAULT 'tcp' CHECK (protocol IN ('tcp', 'udp')),
+  direction TEXT NOT NULL DEFAULT 'both' CHECK (direction IN ('transmit', 'receive', 'both')),
+  duration_sec INTEGER NOT NULL DEFAULT 10,
+  enabled BOOLEAN NOT NULL DEFAULT TRUE,
+  last_run_at TIMESTAMPTZ,
+  last_tx_avg_mbps DOUBLE PRECISION,
+  last_rx_avg_mbps DOUBLE PRECISION,
+  last_status TEXT CHECK (last_status IN ('done', 'error')),
+  last_error TEXT,
+  last_ping_rtt_ms INTEGER,
+  last_ping_loss_pct INTEGER,
+  last_ping_at TIMESTAMPTZ,
+  last_ping_error TEXT,
+  sort_order INTEGER NOT NULL DEFAULT 0,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+CREATE INDEX IF NOT EXISTS idx_uptime_speed_probes_src_sort ON uptime_speed_probes(src_server_id, sort_order);
+
+CREATE TABLE IF NOT EXISTS uptime_speed_test_runs (
+  id TEXT PRIMARY KEY,
+  probe_id TEXT,
+  src_server_id BIGINT NOT NULL REFERENCES servers(id) ON DELETE CASCADE,
+  dst_server_id BIGINT NOT NULL REFERENCES servers(id) ON DELETE CASCADE,
+  src_interface TEXT NOT NULL DEFAULT '',
+  dst_interface TEXT NOT NULL DEFAULT '',
+  src_address TEXT,
+  dst_address TEXT,
+  src_interface_address TEXT,
+  dst_interface_address TEXT,
+  protocol TEXT NOT NULL DEFAULT 'tcp' CHECK (protocol IN ('tcp', 'udp')),
+  direction TEXT NOT NULL DEFAULT 'both' CHECK (direction IN ('transmit', 'receive', 'both')),
+  duration_sec INTEGER NOT NULL DEFAULT 10,
+  tx_avg_mbps DOUBLE PRECISION,
+  rx_avg_mbps DOUBLE PRECISION,
+  ping_rtt_ms INTEGER,
+  ping_loss_pct INTEGER,
+  ping_error TEXT,
+  status TEXT NOT NULL DEFAULT 'done' CHECK (status IN ('done', 'error')),
+  error TEXT,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+CREATE INDEX IF NOT EXISTS idx_uptime_speed_test_runs_created_at ON uptime_speed_test_runs(created_at);
+
+CREATE TABLE IF NOT EXISTS certificate_issue_jobs (
+  id TEXT PRIMARY KEY,
+  status TEXT NOT NULL DEFAULT 'queued' CHECK (status IN ('queued', 'running', 'done', 'failed')),
+  step TEXT NOT NULL DEFAULT 'queued',
+  source TEXT NOT NULL DEFAULT 'manual' CHECK (source IN ('manual', 'scheduler')),
+  server_id BIGINT NOT NULL REFERENCES servers(id) ON DELETE CASCADE,
+  cert_name TEXT NOT NULL,
+  domain_names JSONB NOT NULL,
+  key_type TEXT NOT NULL DEFAULT 'rsa2048',
+  trust_store TEXT NOT NULL DEFAULT 'www,api',
+  requested_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  started_at TIMESTAMPTZ,
+  finished_at TIMESTAMPTZ,
+  error TEXT
+);
+
+CREATE TABLE IF NOT EXISTS backup_entries (
+  id TEXT PRIMARY KEY,
+  server_id BIGINT REFERENCES servers(id) ON DELETE SET NULL,
+  server_name TEXT NOT NULL,
+  filename TEXT NOT NULL,
+  size_bytes BIGINT NOT NULL,
+  kind TEXT NOT NULL DEFAULT 'manual' CHECK (kind IN ('manual', 'auto')),
+  notes TEXT,
+  created_at TIMESTAMPTZ NOT NULL
+);
+CREATE UNIQUE INDEX IF NOT EXISTS idx_backup_entries_filename ON backup_entries(filename);
+CREATE INDEX IF NOT EXISTS idx_backup_entries_server_created ON backup_entries(server_id, created_at);
+
+CREATE TABLE IF NOT EXISTS alert_groups (
+  id TEXT PRIMARY KEY,
+  name TEXT NOT NULL,
+  combine_mode TEXT NOT NULL DEFAULT 'any' CHECK (combine_mode IN ('any', 'all')),
+  enabled BOOLEAN NOT NULL DEFAULT TRUE,
+  cooldown_override TEXT,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE TABLE IF NOT EXISTS alert_rules (
+  id TEXT PRIMARY KEY,
+  name TEXT NOT NULL,
+  type TEXT NOT NULL,
+  target TEXT NOT NULL,
+  condition TEXT NOT NULL,
+  severity TEXT NOT NULL CHECK (severity IN ('critical', 'warning', 'info')),
+  enabled BOOLEAN NOT NULL DEFAULT TRUE,
+  cooldown TEXT NOT NULL DEFAULT '5м',
+  rule_chat_id TEXT NOT NULL DEFAULT '',
+  confirm_stability_sec INTEGER,
+  recovery_mode TEXT NOT NULL DEFAULT 'always' CHECK (recovery_mode IN ('always', 'never', 'conditional')),
+  recovery_stability_sec INTEGER,
+  group_id TEXT REFERENCES alert_groups(id) ON DELETE SET NULL,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE TABLE IF NOT EXISTS alert_rule_targets (
+  id TEXT PRIMARY KEY,
+  rule_id TEXT NOT NULL REFERENCES alert_rules(id) ON DELETE CASCADE,
+  target TEXT NOT NULL,
+  sort_index INTEGER NOT NULL DEFAULT 0
+);
+CREATE INDEX IF NOT EXISTS idx_alert_rule_targets_rule ON alert_rule_targets(rule_id);
+
+CREATE TABLE IF NOT EXISTS alert_rule_conditions (
+  id TEXT PRIMARY KEY,
+  rule_id TEXT NOT NULL REFERENCES alert_rules(id) ON DELETE CASCADE,
+  condition_line TEXT NOT NULL,
+  sort_index INTEGER NOT NULL DEFAULT 0
+);
+CREATE INDEX IF NOT EXISTS idx_alert_rule_conditions_rule ON alert_rule_conditions(rule_id);
+
+CREATE TABLE IF NOT EXISTS alert_engine_state (
+  scope_key TEXT PRIMARY KEY,
+  last_fired_at TEXT NOT NULL DEFAULT '',
+  last_payload_hash TEXT
+);
+
+CREATE TABLE IF NOT EXISTS alert_engine_prev_live (
+  kind TEXT PRIMARY KEY CHECK (kind IN ('gre', 'bgp')),
+  payload_json JSONB NOT NULL DEFAULT '{}'::jsonb,
+  updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE TABLE IF NOT EXISTS alert_engine_confirm_pending (
+  rule_id TEXT PRIMARY KEY,
+  payload_hash TEXT NOT NULL,
+  since_at TIMESTAMPTZ NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS alert_history (
+  id TEXT PRIMARY KEY,
+  rule_id TEXT,
+  group_id TEXT,
+  rule_name TEXT NOT NULL,
+  severity TEXT NOT NULL CHECK (severity IN ('critical', 'warning', 'info')),
+  message TEXT NOT NULL,
+  sent_ok BOOLEAN NOT NULL DEFAULT TRUE,
+  fired_at TIMESTAMPTZ NOT NULL
+);
+CREATE INDEX IF NOT EXISTS idx_alert_history_fired_at ON alert_history(fired_at);
+CREATE INDEX IF NOT EXISTS idx_alert_history_rule_id ON alert_history(rule_id);
+
+CREATE TABLE IF NOT EXISTS alert_outbox (
+  id TEXT PRIMARY KEY,
+  dedupe_key TEXT NOT NULL,
+  channel TEXT NOT NULL DEFAULT 'telegram' CHECK (channel IN ('telegram')),
+  status TEXT NOT NULL DEFAULT 'pending' CHECK (status IN ('pending', 'sent', 'failed')),
+  retry_count INTEGER NOT NULL DEFAULT 0,
+  max_retries INTEGER NOT NULL DEFAULT 3,
+  next_attempt_at TIMESTAMPTZ NOT NULL,
+  payload_json JSONB NOT NULL,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  sent_at TIMESTAMPTZ,
+  last_error TEXT
+);
+CREATE UNIQUE INDEX IF NOT EXISTS idx_alert_outbox_dedupe ON alert_outbox(dedupe_key);
+CREATE INDEX IF NOT EXISTS idx_alert_outbox_status_next_attempt ON alert_outbox(status, next_attempt_at);
+CREATE INDEX IF NOT EXISTS idx_alert_outbox_pending_next ON alert_outbox(next_attempt_at) WHERE status = 'pending';
+
+CREATE TABLE IF NOT EXISTS scheduler_runs (
+  id TEXT PRIMARY KEY,
+  job_key TEXT NOT NULL,
+  started_at TIMESTAMPTZ NOT NULL,
+  finished_at TIMESTAMPTZ NOT NULL,
+  status TEXT NOT NULL CHECK (status IN ('ok', 'error')),
+  error TEXT,
+  duration_ms INTEGER NOT NULL DEFAULT 0,
+  result_json JSONB
+);
+CREATE INDEX IF NOT EXISTS idx_scheduler_runs_job_time ON scheduler_runs(job_key, started_at);
+
+CREATE TABLE IF NOT EXISTS events (
+  id TEXT PRIMARY KEY,
+  created_at TIMESTAMPTZ NOT NULL,
+  level TEXT NOT NULL CHECK (level IN ('critical', 'warning', 'info')),
+  event_type TEXT NOT NULL,
+  source_module TEXT NOT NULL,
+  title TEXT NOT NULL,
+  message TEXT NOT NULL,
+  entity_type TEXT,
+  entity_id TEXT,
+  payload_json JSONB
+);
+CREATE INDEX IF NOT EXISTS idx_events_created_at ON events(created_at DESC);
+CREATE INDEX IF NOT EXISTS idx_events_level_created_at ON events(level, created_at DESC);
+CREATE INDEX IF NOT EXISTS idx_events_source_created_at ON events(source_module, created_at DESC);
+CREATE INDEX IF NOT EXISTS idx_events_event_type_created_at ON events(event_type, created_at DESC);
+
+CREATE TABLE IF NOT EXISTS app_users (
+  id TEXT PRIMARY KEY,
+  name TEXT NOT NULL DEFAULT '',
+  login TEXT NOT NULL UNIQUE,
+  email TEXT NOT NULL DEFAULT '',
+  role TEXT NOT NULL DEFAULT 'viewer' CHECK (role IN ('admin', 'operator', 'viewer')),
+  active BOOLEAN NOT NULL DEFAULT TRUE,
+  avatar TEXT NOT NULL DEFAULT '',
+  last_seen TIMESTAMPTZ,
+  sections_json JSONB NOT NULL DEFAULT '[]'::jsonb,
+  servers_json JSONB NOT NULL DEFAULT '[]'::jsonb,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE TABLE IF NOT EXISTS user_interface_bindings (
+  id TEXT PRIMARY KEY,
+  user_id TEXT NOT NULL REFERENCES app_users(id) ON DELETE CASCADE,
+  server_id BIGINT NOT NULL REFERENCES servers(id) ON DELETE CASCADE,
+  interface_name TEXT NOT NULL,
+  interface_type TEXT NOT NULL DEFAULT 'other' CHECK (interface_type IN ('ether', 'gre', 'wg', 'other')),
+  peer_public_key TEXT NOT NULL DEFAULT '',
+  peer_name TEXT NOT NULL DEFAULT '',
+  comment TEXT NOT NULL DEFAULT '',
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  updated_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  UNIQUE (server_id, interface_name, peer_public_key)
+);
+CREATE INDEX IF NOT EXISTS idx_user_iface_bind_user ON user_interface_bindings(user_id);
+
+CREATE TABLE IF NOT EXISTS internet_path_snapshots (
+  id BIGINT GENERATED BY DEFAULT AS IDENTITY,
+  sampled_at TIMESTAMPTZ NOT NULL,
+  payload_json JSONB NOT NULL,
+  PRIMARY KEY (id, sampled_at)
+) PARTITION BY RANGE (sampled_at);
+CREATE INDEX IF NOT EXISTS idx_internet_path_snapshots_sampled ON internet_path_snapshots(sampled_at);
+CREATE INDEX IF NOT EXISTS idx_internet_path_snapshots_brin ON internet_path_snapshots USING BRIN (sampled_at);
+
+INSERT INTO traffic_settings (id) VALUES (1) ON CONFLICT (id) DO NOTHING;
+INSERT INTO traffic_flow_settings (id) VALUES (1) ON CONFLICT (id) DO NOTHING;
+INSERT INTO uptime_settings (id) VALUES (1) ON CONFLICT (id) DO NOTHING;
+INSERT INTO evobgp_settings (id) VALUES (1) ON CONFLICT (id) DO NOTHING;
+INSERT INTO servers_api_ping_settings (id) VALUES (1) ON CONFLICT (id) DO NOTHING;
+INSERT INTO internet_path_settings (id) VALUES (1) ON CONFLICT (id) DO NOTHING;
+INSERT INTO alert_telegram_settings (id) VALUES (1) ON CONFLICT (id) DO NOTHING;
+INSERT INTO acme_settings (id) VALUES (1) ON CONFLICT (id) DO NOTHING;
+INSERT INTO certificate_renew_settings (id) VALUES (1) ON CONFLICT (id) DO NOTHING;
+INSERT INTO backup_schedule_settings (id) VALUES (1) ON CONFLICT (id) DO NOTHING;
+INSERT INTO alert_engine_cursor (id) VALUES (1) ON CONFLICT (id) DO NOTHING;
+INSERT INTO data_migration (id) VALUES (1) ON CONFLICT (id) DO NOTHING;
diff --git a/backend/drizzle/meta/_journal.json b/backend/drizzle/meta/_journal.json
index 69eaba6..ea12a41 100644
--- a/backend/drizzle/meta/_journal.json
+++ b/backend/drizzle/meta/_journal.json
@@ -1,13 +1,13 @@
 {
   "version": "7",
-  "dialect": "sqlite",
+  "dialect": "postgresql",
   "entries": [
     {
       "idx": 0,
-      "version": "6",
+      "version": "7",
       "when": 1777572014210,
-      "tag": "0000_living_xorn",
+      "tag": "0000_postgresql",
       "breakpoints": true
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/backend/package.json b/backend/package.json
index 5f12a42..2ce9008 100644
--- a/backend/package.json
+++ b/backend/package.json
@@ -1,7 +1,7 @@
 {
   "name": "mikrotik-manager-backend",
   "version": "1.0.0",
-  "description": "MikroTik Manager backend — Fastify + Drizzle + SQLite",
+  "description": "MikroTik Manager backend — Fastify + Drizzle + PostgreSQL",
   "type": "module",
   "scripts": {
     "dev": "tsx watch src/index.ts",
@@ -11,11 +11,14 @@
     "db:generate": "drizzle-kit generate",
     "db:migrate": "drizzle-kit migrate",
     "db:studio": "drizzle-kit studio",
+    "db:migrate-from-sqlite": "tsx src/scripts/migrate-sqlite-to-pg.ts",
     "test:auth": "tsx src/lib/permissions.test.ts && tsx src/plugins/auth.smoke.test.ts",
     "test:wireguard": "npx tsx src/services/wireguard-config.test.ts",
     "test:traffic-rate": "tsx src/services/traffic-rate.test.ts",
-    "test:traffic-flow": "tsx src/services/traffic-flow-parse.test.ts && tsx src/services/traffic-flow-map-exporter.test.ts && tsx src/services/traffic-flow-ifaces.test.ts && tsx src/services/traffic-flow-dedup.test.ts && tsx src/services/traffic-flow-planes.test.ts && tsx src/services/traffic-flow-ip.test.ts && tsx src/services/traffic-flow-classify.test.ts && tsx src/services/traffic-flow-ripe.test.ts && tsx src/services/traffic-flow-brands.test.ts && tsx src/services/traffic-flow-ingest.test.ts && tsx src/services/traffic-flow-analytics.test.ts && tsx src/services/traffic-flow-map-hops.test.ts && tsx src/services/traffic-flow-hardening.test.ts && tsx src/services/traffic-flow-purge.test.ts && tsx src/services/sqlite-write-opt.test.ts",
-    "test:users": "tsx src/modules/users/iface-type.test.ts && tsx src/modules/users/bindings.test.ts"
+    "test:traffic-flow": "tsx src/services/traffic-flow-parse.test.ts && tsx src/services/traffic-flow-map-exporter.test.ts && tsx src/services/traffic-flow-ifaces.test.ts && tsx src/services/traffic-flow-dedup.test.ts && tsx src/services/traffic-flow-planes.test.ts && tsx src/services/traffic-flow-ip.test.ts && tsx src/services/traffic-flow-classify.test.ts && tsx src/services/traffic-flow-ripe.test.ts && tsx src/services/traffic-flow-brands.test.ts && tsx src/services/traffic-flow-ingest.test.ts && tsx src/services/traffic-flow-analytics.test.ts && tsx src/services/traffic-flow-map-hops.test.ts && tsx src/services/traffic-flow-purge.test.ts",
+    "test:users": "tsx src/modules/users/iface-type.test.ts && tsx src/modules/users/bindings.test.ts",
+    "test:pg": "tsx src/db/sql-bind.test.ts && tsx src/db/pg-schema.test.ts",
+    "test": "npm run test:alert-engine && npm run test:auth && npm run test:wireguard && npm run test:traffic-rate && npm run test:traffic-flow && npm run test:users && npm run test:pg"
   },
   "dependencies": {
     "@fastify/cors": "^11.2.0",
@@ -28,12 +31,14 @@
     "drizzle-orm": "^0.45.2",
     "fastify": "^5.8.5",
     "fastify-plugin": "^5.1.0",
+    "pg": "^8.23.0",
     "undici": "^8.1.0",
     "zod": "^4.4.1"
   },
   "devDependencies": {
     "@types/better-sqlite3": "^7.6.13",
     "@types/node": "^22.15.3",
+    "@types/pg": "^8.23.1",
     "drizzle-kit": "^0.31.10",
     "jose": "^6.2.11",
     "pino-pretty": "^13.1.3",
diff --git a/backend/scripts/inventory-sqlite.mjs b/backend/scripts/inventory-sqlite.mjs
new file mode 100644
index 0000000..8d6c4da
--- /dev/null
+++ b/backend/scripts/inventory-sqlite.mjs
@@ -0,0 +1,39 @@
+import Database from "better-sqlite3"
+import fs from "node:fs"
+
+const path = process.argv[2] ?? "./mikrotik.db"
+if (!fs.existsSync(path)) {
+  console.error("NO_SQLITE", path)
+  process.exit(2)
+}
+const st = fs.statSync(path)
+const db = new Database(path, { readonly: true, fileMustExist: true })
+const tables = db
+  .prepare(`SELECT name FROM sqlite_master WHERE type='table' AND name NOT LIKE 'sqlite_%' ORDER BY 1`)
+  .all()
+console.log("FILE_BYTES", st.size)
+console.log("TABLES", tables.length)
+for (const t of tables) {
+  const c = db.prepare(`SELECT COUNT(*) AS c FROM "${t.name}"`).get()
+  console.log(`COUNT\t${t.name}\t${c.c}`)
+}
+try {
+  const d = db.prepare(`SELECT COUNT(*) AS c FROM (
+    SELECT dedupe_key FROM alert_outbox GROUP BY dedupe_key HAVING COUNT(*) > 1
+  )`).get()
+  console.log("DUP_DEDUPE_KEYS", d.c)
+} catch (e) {
+  console.log("DUP_DEDUPE_ERR", e instanceof Error ? e.message : e)
+}
+for (const [label, sql] of [
+  ["ORPHAN_FLOW_MINUTE", `SELECT COUNT(*) c FROM flow_minute_stats s WHERE s.server_id NOT IN (SELECT id FROM servers)`],
+  ["ORPHAN_FLOW_BUCKETS", `SELECT COUNT(*) c FROM flow_buckets s WHERE s.server_id NOT IN (SELECT id FROM servers)`],
+  ["ORPHAN_BINDINGS", `SELECT COUNT(*) c FROM user_interface_bindings s WHERE s.server_id NOT IN (SELECT id FROM servers)`],
+]) {
+  try {
+    console.log(label, db.prepare(sql).get().c)
+  } catch (e) {
+    console.log(label + "_ERR", e instanceof Error ? e.message : e)
+  }
+}
+db.close()
diff --git a/backend/src/config.ts b/backend/src/config.ts
index dc0fac3..5a44b66 100644
--- a/backend/src/config.ts
+++ b/backend/src/config.ts
@@ -11,7 +11,9 @@ function boolEnv(v: string | undefined, fallback: boolean): boolean {
 const isProd = process.env.NODE_ENV === "production"
 
 const envSchema = z.object({
+  DATABASE_URL: z.string().default("postgres://mmapp:mmapp@127.0.0.1:5432/mmapp"),
   DATABASE_PATH: z.string().default("./mikrotik.db"),
+  SQLITE_IMPORT_FULL_HISTORY: z.boolean().default(false),
   PORT: z.coerce.number().int().positive().default(8000),
   CORS_ORIGIN: z.string().default("http://localhost:3000"),
   AUTH_REQUIRED: z.boolean().default(false),
@@ -21,7 +23,9 @@ const envSchema = z.object({
 })
 
 const raw = {
+  DATABASE_URL: process.env.DATABASE_URL,
   DATABASE_PATH: process.env.DATABASE_PATH,
+  SQLITE_IMPORT_FULL_HISTORY: boolEnv(process.env.SQLITE_IMPORT_FULL_HISTORY, false),
   PORT: process.env.PORT,
   CORS_ORIGIN: process.env.CORS_ORIGIN,
   AUTH_REQUIRED: boolEnv(process.env.AUTH_REQUIRED, false),
@@ -53,7 +57,9 @@ if (parsed.data.AUTH_REQUIRED && parsed.data.AUTH_JWT_SECRET.length < 8) {
 }
 
 export const env = {
+  DATABASE_URL: parsed.data.DATABASE_URL,
   DATABASE_PATH: parsed.data.DATABASE_PATH,
+  sqliteImportFullHistory: parsed.data.SQLITE_IMPORT_FULL_HISTORY,
   PORT: parsed.data.PORT,
   CORS_ORIGIN: parsed.data.CORS_ORIGIN,
   authRequired: parsed.data.AUTH_REQUIRED,
diff --git a/backend/src/db/bootstrap.ts b/backend/src/db/bootstrap.ts
new file mode 100644
index 0000000..ef21c3a
--- /dev/null
+++ b/backend/src/db/bootstrap.ts
@@ -0,0 +1,33 @@
+import { pool } from "./index.js"
+import { applySqlMigrations } from "./migrate.js"
+import { dropExpiredPartitions, ensurePartitionsAround } from "./partitions.js"
+import { importSqliteToPostgres, shouldImportSqlite } from "./sqlite-import.js"
+import { env } from "../config.js"
+
+const ETL_LOCK = 8723101
+
+export async function initDatabase(): Promise<void> {
+  await pool.query("SELECT 1")
+  await applySqlMigrations(pool)
+  await ensurePartitionsAround(pool)
+  const client = await pool.connect()
+  try {
+    await client.query("SELECT pg_advisory_lock($1)", [ETL_LOCK])
+    if (await shouldImportSqlite(pool, env.DATABASE_PATH)) {
+      console.log(`SQLite → PostgreSQL: импорт ${env.DATABASE_PATH}`)
+      const report = await importSqliteToPostgres(pool, env.DATABASE_PATH, { strict: true })
+      console.log(
+        `SQLite → PostgreSQL: готово за ${report.durationMs}ms, таблиц ${Object.keys(report.tables).length}`,
+      )
+    }
+  } finally {
+    try {
+      await client.query("SELECT pg_advisory_unlock($1)", [ETL_LOCK])
+    } catch {
+      /* ignore */
+    }
+    client.release()
+  }
+  await dropExpiredPartitions(pool)
+  await ensurePartitionsAround(pool)
+}
diff --git a/backend/src/db/index.ts b/backend/src/db/index.ts
index 4b5f1e2..417f9d5 100644
--- a/backend/src/db/index.ts
+++ b/backend/src/db/index.ts
@@ -1,1065 +1,71 @@
-import Database from "better-sqlite3"
-import { existsSync, readFileSync } from "node:fs"
-import path from "node:path"
-
-type SqliteHandle = InstanceType<typeof Database>
-import { drizzle } from "drizzle-orm/better-sqlite3"
+import { isMainThread } from "node:worker_threads"
+import pg from "pg"
+import { drizzle } from "drizzle-orm/node-postgres"
 import { env } from "../config.js"
 import * as schema from "./schema.js"
+import { bindSql } from "./sql-bind.js"
 
-export const SQLITE_BUSY_TIMEOUT_MS = 5000
-/** ~16 MiB page cache (negative = KiB). */
-export const SQLITE_CACHE_SIZE_KIB = 16_000
-export const SQLITE_WAL_AUTOCHECKPOINT_PAGES = 1000
+const INT8_OID = 20
+const DATE_OID = 1082
 
-export interface SqliteWriteStats {
-  insert: number
-  update: number
-  delete: number
-  walCheckpoint: number
+pg.types.setTypeParser(INT8_OID, (val) => {
+  const n = Number(val)
+  return Number.isSafeInteger(n) ? n : val
+})
+pg.types.setTypeParser(DATE_OID, (val) => val)
+
+export function createPool(max = 16): pg.Pool {
+  return new pg.Pool({
+    connectionString: env.DATABASE_URL,
+    max,
+    idleTimeoutMillis: 30_000,
+    connectionTimeoutMillis: 8_000,
+    statement_timeout: 120_000,
+  })
 }
 
-let writeTrace: SqliteWriteStats | null = null
+export const pool = createPool(isMainThread ? 16 : 4)
+export const db = drizzle(pool, { schema })
 
-function classifyWriteSql(sql: string): keyof Omit<SqliteWriteStats, "walCheckpoint"> | null {
-  const head = sql.trimStart().slice(0, 12).toUpperCase()
-  if (head.startsWith("INSERT")) return "insert"
-  if (head.startsWith("UPDATE")) return "update"
-  if (head.startsWith("DELETE")) return "delete"
-  return null
+export async function dbQuery<T extends pg.QueryResultRow = pg.QueryResultRow>(
+  text: string,
+  params?: unknown[] | Record<string, unknown>,
+): Promise<pg.QueryResult<T>> {
+  const q = bindSql(text, params)
+  return pool.query<T>(q)
 }
 
-function installSqliteWriteTrace(handle: SqliteHandle): SqliteHandle {
-  const origPrepare = handle.prepare.bind(handle)
-  handle.prepare = ((sql: string) => {
-    const stmt = origPrepare(sql)
-    const kind = classifyWriteSql(sql)
-    if (!kind) return stmt
-    const origRun = stmt.run.bind(stmt)
-    stmt.run = ((...args: unknown[]) => {
-      if (writeTrace) writeTrace[kind] += 1
-      return origRun(...args)
-    }) as typeof stmt.run
-    return stmt
-  }) as typeof handle.prepare
-
-  const origExec = handle.exec.bind(handle)
-  handle.exec = ((sql: string) => {
-    if (writeTrace) {
-      for (const part of sql.split(";")) {
-        const kind = classifyWriteSql(part)
-        if (kind) writeTrace[kind] += 1
-      }
-    }
-    return origExec(sql)
-  }) as typeof handle.exec
-
-  const origPragma = handle.pragma.bind(handle)
-  handle.pragma = ((source: string, options?: { simple?: boolean }) => {
-    if (writeTrace && /wal_checkpoint/i.test(source)) writeTrace.walCheckpoint += 1
-    return origPragma(source, options as never)
-  }) as typeof handle.pragma
-
-  return handle
+export async function dbAll<T extends pg.QueryResultRow = pg.QueryResultRow>(
+  text: string,
+  params?: unknown[] | Record<string, unknown>,
+): Promise<T[]> {
+  const res = await dbQuery<T>(text, params)
+  return res.rows
 }
 
-export function countSqliteWrites<T>(fn: () => T): { result: T; stats: SqliteWriteStats } {
-  const stats: SqliteWriteStats = { insert: 0, update: 0, delete: 0, walCheckpoint: 0 }
-  writeTrace = stats
+export async function dbGet<T extends pg.QueryResultRow = pg.QueryResultRow>(
+  text: string,
+  params?: unknown[] | Record<string, unknown>,
+): Promise<T | undefined> {
+  const rows = await dbAll<T>(text, params)
+  return rows[0]
+}
+
+export async function withAdvisoryLock<T>(key: number, fn: () => Promise<T>): Promise<T> {
+  const client = await pool.connect()
   try {
-    return { result: fn(), stats }
+    await client.query("SELECT pg_advisory_lock($1)", [key])
+    return await fn()
   } finally {
-    writeTrace = null
-  }
-}
-
-export function applySqlitePragmas(handle: SqliteHandle): void {
-  handle.pragma("journal_mode = WAL")
-  handle.pragma("foreign_keys = ON")
-  handle.pragma(`busy_timeout = ${SQLITE_BUSY_TIMEOUT_MS}`)
-  handle.pragma("synchronous = NORMAL")
-  handle.pragma(`wal_autocheckpoint = ${SQLITE_WAL_AUTOCHECKPOINT_PAGES}`)
-  handle.pragma("temp_store = MEMORY")
-  handle.pragma(`cache_size = -${SQLITE_CACHE_SIZE_KIB}`)
-}
-
-function openSqlite(): SqliteHandle {
-  const handle = new Database(env.DATABASE_PATH)
-  applySqlitePragmas(handle)
-  return installSqliteWriteTrace(handle)
-}
-
-let sqlite = openSqlite()
-
-sqlite.exec(`
-CREATE TABLE IF NOT EXISTS servers (
-  id INTEGER PRIMARY KEY AUTOINCREMENT,
-  name TEXT NOT NULL DEFAULT '',
-  host TEXT NOT NULL,
-  port INTEGER NOT NULL DEFAULT 443,
-  username TEXT NOT NULL DEFAULT 'admin',
-  password TEXT NOT NULL DEFAULT '',
-  use_ssl INTEGER NOT NULL DEFAULT 1,
-  verify_ssl INTEGER NOT NULL DEFAULT 0,
-  type TEXT NOT NULL DEFAULT 'home-router',
-  site TEXT NOT NULL DEFAULT '',
-  country TEXT NOT NULL DEFAULT '',
-  asn TEXT NOT NULL DEFAULT '',
-  comment TEXT NOT NULL DEFAULT '',
-  enabled INTEGER NOT NULL DEFAULT 1,
-  lan_subnet TEXT NOT NULL DEFAULT '',
-  wan_uplinks TEXT NOT NULL DEFAULT '[]',
-  created_at TEXT NOT NULL DEFAULT (datetime('now')),
-  updated_at TEXT NOT NULL DEFAULT (datetime('now'))
-);
-
-CREATE TABLE IF NOT EXISTS server_snapshots (
-  id INTEGER PRIMARY KEY AUTOINCREMENT,
-  server_id INTEGER NOT NULL,
-  polled_at TEXT NOT NULL,
-  status TEXT NOT NULL,
-  latency_ms REAL,
-  ros_version TEXT,
-  board_name TEXT,
-  uptime TEXT,
-  cpu_load INTEGER,
-  free_memory INTEGER,
-  total_memory INTEGER,
-  identity_name TEXT,
-  raw_interfaces TEXT,
-  raw_ip_addresses TEXT,
-  FOREIGN KEY (server_id) REFERENCES servers(id) ON DELETE CASCADE
-);
-
-CREATE TABLE IF NOT EXISTS filter_rules (
-  id INTEGER PRIMARY KEY AUTOINCREMENT,
-  server_id INTEGER NOT NULL,
-  sort_order INTEGER NOT NULL DEFAULT 0,
-  community TEXT NOT NULL,
-  community_name TEXT,
-  action TEXT NOT NULL DEFAULT 'route',
-  gateway TEXT NOT NULL DEFAULT '',
-  gateway_tunnel_id TEXT NOT NULL DEFAULT '',
-  description TEXT NOT NULL DEFAULT '',
-  created_at TEXT NOT NULL DEFAULT (datetime('now')),
-  updated_at TEXT NOT NULL DEFAULT (datetime('now')),
-  FOREIGN KEY (server_id) REFERENCES servers(id) ON DELETE CASCADE
-);
-CREATE INDEX IF NOT EXISTS idx_filter_rules_server_sort
-  ON filter_rules(server_id, sort_order);
-
-CREATE TABLE IF NOT EXISTS recursive_routes (
-  id INTEGER PRIMARY KEY AUTOINCREMENT,
-  server_id INTEGER NOT NULL,
-  sort_order INTEGER NOT NULL DEFAULT 0,
-  dst_address TEXT NOT NULL,
-  gateway TEXT NOT NULL,
-  distance INTEGER NOT NULL DEFAULT 1,
-  scope INTEGER,
-  target_scope INTEGER,
-  routing_table TEXT NOT NULL DEFAULT 'main',
-  check_gateway TEXT NOT NULL DEFAULT '',
-  country TEXT NOT NULL DEFAULT '',
-  comment TEXT NOT NULL DEFAULT '',
-  disabled INTEGER NOT NULL DEFAULT 0,
-  created_at TEXT NOT NULL DEFAULT (datetime('now')),
-  updated_at TEXT NOT NULL DEFAULT (datetime('now')),
-  FOREIGN KEY (server_id) REFERENCES servers(id) ON DELETE CASCADE
-);
-CREATE INDEX IF NOT EXISTS idx_recursive_routes_server_sort
-  ON recursive_routes(server_id, sort_order);
-
-CREATE TABLE IF NOT EXISTS traffic_settings (
-  id INTEGER PRIMARY KEY,
-  enabled INTEGER NOT NULL DEFAULT 1,
-  interval_sec INTEGER NOT NULL DEFAULT 30,
-  retention_days INTEGER NOT NULL DEFAULT 14,
-  last_collected_at TEXT,
-  last_duration_ms INTEGER,
-  last_error TEXT,
-  created_at TEXT NOT NULL DEFAULT (datetime('now')),
-  updated_at TEXT NOT NULL DEFAULT (datetime('now'))
-);
-
-CREATE TABLE IF NOT EXISTS traffic_samples (
-  id INTEGER PRIMARY KEY AUTOINCREMENT,
-  server_id INTEGER NOT NULL,
-  interface_name TEXT NOT NULL,
-  peer_public_key TEXT NOT NULL DEFAULT '',
-  sampled_at TEXT NOT NULL,
-  rx_bytes INTEGER NOT NULL DEFAULT 0,
-  tx_bytes INTEGER NOT NULL DEFAULT 0,
-  rx_bps INTEGER NOT NULL DEFAULT 0,
-  tx_bps INTEGER NOT NULL DEFAULT 0,
-  running INTEGER NOT NULL DEFAULT 0,
-  disabled INTEGER NOT NULL DEFAULT 0,
-  FOREIGN KEY (server_id) REFERENCES servers(id) ON DELETE CASCADE
-);
-CREATE INDEX IF NOT EXISTS idx_traffic_samples_server_time
-  ON traffic_samples(server_id, sampled_at);
-CREATE INDEX IF NOT EXISTS idx_traffic_samples_server_iface_time
-  ON traffic_samples(server_id, interface_name, sampled_at);
-
-CREATE TABLE IF NOT EXISTS traffic_flow_settings (
-  id INTEGER PRIMARY KEY,
-  enabled INTEGER NOT NULL DEFAULT 0,
-  collector_ip TEXT NOT NULL DEFAULT '10.255.254.1',
-  flow_listen_port INTEGER NOT NULL DEFAULT 4739,
-  wg_listen_port INTEGER NOT NULL DEFAULT 51821,
-  prefix TEXT NOT NULL DEFAULT '10.255.254.0/24',
-  public_endpoint TEXT NOT NULL DEFAULT '',
-  host_public_key TEXT NOT NULL DEFAULT '',
-  host_private_key TEXT NOT NULL DEFAULT '',
-  hub_server_id INTEGER,
-  retention_hours INTEGER NOT NULL DEFAULT 24,
-  top_n INTEGER NOT NULL DEFAULT 200,
-  map_service_min_share_pct REAL NOT NULL DEFAULT 5,
-  last_datagram_at TEXT,
-  last_exporter_ip TEXT,
-  last_error TEXT,
-  packets_received INTEGER NOT NULL DEFAULT 0,
-  peers_json TEXT NOT NULL DEFAULT '[]',
-  created_at TEXT NOT NULL DEFAULT (datetime('now')),
-  updated_at TEXT NOT NULL DEFAULT (datetime('now'))
-);
-
-CREATE TABLE IF NOT EXISTS flow_buckets (
-  id INTEGER PRIMARY KEY AUTOINCREMENT,
-  server_id INTEGER NOT NULL,
-  bucket_at TEXT NOT NULL,
-  src TEXT NOT NULL,
-  dst TEXT NOT NULL,
-  proto INTEGER NOT NULL DEFAULT 0,
-  src_port INTEGER NOT NULL DEFAULT 0,
-  dst_port INTEGER NOT NULL DEFAULT 0,
-  bytes INTEGER NOT NULL DEFAULT 0,
-  packets INTEGER NOT NULL DEFAULT 0,
-  in_iface TEXT NOT NULL DEFAULT '',
-  out_iface TEXT NOT NULL DEFAULT '',
-  next_hop TEXT NOT NULL DEFAULT '',
-  flow_start_ms INTEGER NOT NULL DEFAULT 0,
-  flow_end_ms INTEGER NOT NULL DEFAULT 0,
-  FOREIGN KEY (server_id) REFERENCES servers(id) ON DELETE CASCADE
-);
-CREATE UNIQUE INDEX IF NOT EXISTS idx_flow_buckets_unique
-  ON flow_buckets(server_id, bucket_at, src, dst, proto, src_port, dst_port, in_iface);
-CREATE INDEX IF NOT EXISTS idx_flow_buckets_server_time
-  ON flow_buckets(server_id, bucket_at);
-
-CREATE TABLE IF NOT EXISTS flow_minute_stats (
-  server_id INTEGER NOT NULL,
-  bucket_at TEXT NOT NULL,
-  bytes INTEGER NOT NULL DEFAULT 0,
-  packets INTEGER NOT NULL DEFAULT 0,
-  unique_src INTEGER NOT NULL DEFAULT 0,
-  unique_dst INTEGER NOT NULL DEFAULT 0,
-  conversations INTEGER NOT NULL DEFAULT 0,
-  PRIMARY KEY (server_id, bucket_at)
-);
-
-CREATE TABLE IF NOT EXISTS flow_minute_dims (
-  server_id INTEGER NOT NULL,
-  bucket_at TEXT NOT NULL,
-  dim TEXT NOT NULL,
-  key TEXT NOT NULL,
-  bytes INTEGER NOT NULL DEFAULT 0,
-  packets INTEGER NOT NULL DEFAULT 0,
-  PRIMARY KEY (server_id, bucket_at, dim, key)
-);
-CREATE INDEX IF NOT EXISTS idx_flow_minute_dims_time ON flow_minute_dims(bucket_at, dim);
-
-CREATE TABLE IF NOT EXISTS flow_daily_dims (
-  server_id INTEGER NOT NULL,
-  day TEXT NOT NULL,
-  dim TEXT NOT NULL,
-  key TEXT NOT NULL,
-  bytes INTEGER NOT NULL DEFAULT 0,
-  packets INTEGER NOT NULL DEFAULT 0,
-  PRIMARY KEY (server_id, day, dim, key)
-);
-CREATE INDEX IF NOT EXISTS idx_flow_daily_dims_day ON flow_daily_dims(day, dim);
-
-CREATE TABLE IF NOT EXISTS flow_ip_meta (
-  prefix TEXT PRIMARY KEY,
-  asn INTEGER NOT NULL DEFAULT 0,
-  country TEXT NOT NULL DEFAULT '',
-  lat REAL,
-  lng REAL,
-  holder TEXT NOT NULL DEFAULT '',
-  ok INTEGER NOT NULL DEFAULT 1,
-  fetched_at TEXT NOT NULL
-);
-CREATE TABLE IF NOT EXISTS flow_asn_meta (
-  asn INTEGER PRIMARY KEY,
-  holder TEXT NOT NULL DEFAULT '',
-  fetched_at TEXT NOT NULL
-);
-
-CREATE TABLE IF NOT EXISTS uptime_settings (
-  id INTEGER PRIMARY KEY,
-  enabled INTEGER NOT NULL DEFAULT 1,
-  interval_sec INTEGER NOT NULL DEFAULT 15,
-  probe_interval_sec INTEGER NOT NULL DEFAULT 15,
-  speed_interval_sec INTEGER NOT NULL DEFAULT 60,
-  retention_days INTEGER NOT NULL DEFAULT 14,
-  last_collected_at TEXT,
-  last_duration_ms INTEGER,
-  last_error TEXT,
-  created_at TEXT NOT NULL DEFAULT (datetime('now')),
-  updated_at TEXT NOT NULL DEFAULT (datetime('now'))
-);
-
-CREATE TABLE IF NOT EXISTS uptime_probes (
-  id TEXT PRIMARY KEY,
-  src_server_id INTEGER NOT NULL,
-  src_interface TEXT NOT NULL DEFAULT '',
-  name TEXT NOT NULL,
-  target TEXT NOT NULL,
-  probe_filter TEXT NOT NULL DEFAULT '—',
-  enabled INTEGER NOT NULL DEFAULT 1,
-  show_on_dashboard INTEGER NOT NULL DEFAULT 0,
-  sort_order INTEGER NOT NULL DEFAULT 0,
-  created_at TEXT NOT NULL DEFAULT (datetime('now')),
-  updated_at TEXT NOT NULL DEFAULT (datetime('now')),
-  FOREIGN KEY (src_server_id) REFERENCES servers(id) ON DELETE CASCADE
-);
-CREATE INDEX IF NOT EXISTS idx_uptime_probes_server_sort
-  ON uptime_probes(src_server_id, sort_order);
-
-CREATE TABLE IF NOT EXISTS uptime_probe_samples (
-  id INTEGER PRIMARY KEY AUTOINCREMENT,
-  probe_id TEXT NOT NULL,
-  sampled_at TEXT NOT NULL,
-  rtt_ms INTEGER,
-  loss_pct INTEGER NOT NULL DEFAULT 0,
-  status TEXT NOT NULL DEFAULT 'down',
-  FOREIGN KEY (probe_id) REFERENCES uptime_probes(id) ON DELETE CASCADE
-);
-CREATE INDEX IF NOT EXISTS idx_uptime_probe_samples_probe_time
-  ON uptime_probe_samples(probe_id, sampled_at);
-
-CREATE TABLE IF NOT EXISTS uptime_resource_samples (
-  id INTEGER PRIMARY KEY AUTOINCREMENT,
-  server_id INTEGER NOT NULL,
-  sampled_at TEXT NOT NULL,
-  status TEXT NOT NULL DEFAULT 'offline',
-  cpu_load INTEGER NOT NULL DEFAULT 0,
-  free_memory INTEGER NOT NULL DEFAULT 0,
-  total_memory INTEGER NOT NULL DEFAULT 0,
-  free_hdd_space INTEGER NOT NULL DEFAULT 0,
-  total_hdd_space INTEGER NOT NULL DEFAULT 0,
-  uptime_seconds INTEGER NOT NULL DEFAULT 0,
-  board_name TEXT NOT NULL DEFAULT '',
-  ros_version TEXT NOT NULL DEFAULT '',
-  FOREIGN KEY (server_id) REFERENCES servers(id) ON DELETE CASCADE
-);
-CREATE INDEX IF NOT EXISTS idx_uptime_resource_samples_server_time
-  ON uptime_resource_samples(server_id, sampled_at);
-
-CREATE TABLE IF NOT EXISTS uptime_speed_probes (
-  id TEXT PRIMARY KEY,
-  src_server_id INTEGER NOT NULL,
-  dst_server_id INTEGER NOT NULL,
-  src_interface TEXT NOT NULL DEFAULT '',
-  dst_interface TEXT NOT NULL DEFAULT '',
-  protocol TEXT NOT NULL DEFAULT 'tcp',
-  direction TEXT NOT NULL DEFAULT 'both',
-  duration_sec INTEGER NOT NULL DEFAULT 10,
-  enabled INTEGER NOT NULL DEFAULT 1,
-  last_run_at TEXT,
-  last_tx_avg_mbps REAL,
-  last_rx_avg_mbps REAL,
-  last_status TEXT,
-  last_error TEXT,
-  sort_order INTEGER NOT NULL DEFAULT 0,
-  created_at TEXT NOT NULL DEFAULT (datetime('now')),
-  updated_at TEXT NOT NULL DEFAULT (datetime('now')),
-  FOREIGN KEY (src_server_id) REFERENCES servers(id) ON DELETE CASCADE,
-  FOREIGN KEY (dst_server_id) REFERENCES servers(id) ON DELETE CASCADE
-);
-CREATE INDEX IF NOT EXISTS idx_uptime_speed_probes_src_sort
-  ON uptime_speed_probes(src_server_id, sort_order);
-
-CREATE TABLE IF NOT EXISTS uptime_speed_test_runs (
-  id TEXT PRIMARY KEY,
-  probe_id TEXT,
-  src_server_id INTEGER NOT NULL,
-  dst_server_id INTEGER NOT NULL,
-  src_interface TEXT NOT NULL DEFAULT '',
-  dst_interface TEXT NOT NULL DEFAULT '',
-  src_address TEXT,
-  dst_address TEXT,
-  src_interface_address TEXT,
-  dst_interface_address TEXT,
-  protocol TEXT NOT NULL DEFAULT 'tcp',
-  direction TEXT NOT NULL DEFAULT 'both',
-  duration_sec INTEGER NOT NULL DEFAULT 10,
-  tx_avg_mbps REAL,
-  rx_avg_mbps REAL,
-  ping_rtt_ms INTEGER,
-  ping_loss_pct INTEGER,
-  ping_error TEXT,
-  status TEXT NOT NULL DEFAULT 'done',
-  error TEXT,
-  created_at TEXT NOT NULL DEFAULT (datetime('now')),
-  FOREIGN KEY (src_server_id) REFERENCES servers(id) ON DELETE CASCADE,
-  FOREIGN KEY (dst_server_id) REFERENCES servers(id) ON DELETE CASCADE
-);
-CREATE INDEX IF NOT EXISTS idx_uptime_speed_test_runs_created_at
-  ON uptime_speed_test_runs(created_at);
-
-CREATE TABLE IF NOT EXISTS scheduler_runs (
-  id TEXT PRIMARY KEY,
-  job_key TEXT NOT NULL,
-  started_at TEXT NOT NULL,
-  finished_at TEXT NOT NULL,
-  status TEXT NOT NULL,
-  error TEXT,
-  duration_ms INTEGER NOT NULL DEFAULT 0,
-  result_json TEXT
-);
-CREATE INDEX IF NOT EXISTS idx_scheduler_runs_job_time
-  ON scheduler_runs(job_key, finished_at);
-
-CREATE TABLE IF NOT EXISTS internet_path_settings (
-  id INTEGER PRIMARY KEY,
-  enabled INTEGER NOT NULL DEFAULT 1,
-  interval_sec INTEGER NOT NULL DEFAULT 300,
-  retention_days INTEGER NOT NULL DEFAULT 14,
-  last_collected_at TEXT,
-  last_duration_ms INTEGER,
-  last_error TEXT,
-  created_at TEXT NOT NULL DEFAULT (datetime('now')),
-  updated_at TEXT NOT NULL DEFAULT (datetime('now'))
-);
-
-CREATE TABLE IF NOT EXISTS internet_path_snapshots (
-  id INTEGER PRIMARY KEY AUTOINCREMENT,
-  sampled_at TEXT NOT NULL,
-  payload_json TEXT NOT NULL
-);
-CREATE INDEX IF NOT EXISTS idx_internet_path_snapshots_sampled
-  ON internet_path_snapshots(sampled_at DESC);
-
-CREATE TABLE IF NOT EXISTS events (
-  id TEXT PRIMARY KEY,
-  created_at TEXT NOT NULL,
-  level TEXT NOT NULL,
-  event_type TEXT NOT NULL,
-  source_module TEXT NOT NULL,
-  title TEXT NOT NULL,
-  message TEXT NOT NULL,
-  entity_type TEXT,
-  entity_id TEXT,
-  payload_json TEXT
-);
-CREATE INDEX IF NOT EXISTS idx_events_created_at ON events(created_at DESC);
-CREATE INDEX IF NOT EXISTS idx_events_level_created_at ON events(level, created_at DESC);
-CREATE INDEX IF NOT EXISTS idx_events_source_created_at ON events(source_module, created_at DESC);
-CREATE INDEX IF NOT EXISTS idx_events_event_type_created_at ON events(event_type, created_at DESC);
-
-CREATE TABLE IF NOT EXISTS servers_api_ping_settings (
-  id INTEGER PRIMARY KEY,
-  enabled INTEGER NOT NULL DEFAULT 0,
-  interval_sec INTEGER NOT NULL DEFAULT 120,
-  last_collected_at TEXT,
-  last_duration_ms INTEGER,
-  last_error TEXT,
-  created_at TEXT NOT NULL DEFAULT (datetime('now')),
-  updated_at TEXT NOT NULL DEFAULT (datetime('now'))
-);
-
-CREATE TABLE IF NOT EXISTS servers_rest_ping_samples (
-  id INTEGER PRIMARY KEY AUTOINCREMENT,
-  server_id INTEGER NOT NULL,
-  sampled_at TEXT NOT NULL,
-  ok INTEGER NOT NULL DEFAULT 0,
-  latency_ms INTEGER,
-  error TEXT,
-  FOREIGN KEY (server_id) REFERENCES servers(id) ON DELETE CASCADE
-);
-CREATE INDEX IF NOT EXISTS idx_servers_rest_ping_samples_server_id
-  ON servers_rest_ping_samples(server_id, id DESC);
-
-CREATE TABLE IF NOT EXISTS alert_gre_tunnel_samples (
-  id INTEGER PRIMARY KEY AUTOINCREMENT,
-  sampled_at TEXT NOT NULL,
-  target_label TEXT NOT NULL,
-  status TEXT NOT NULL
-);
-CREATE INDEX IF NOT EXISTS idx_alert_gre_tunnel_samples_label_id
-  ON alert_gre_tunnel_samples(target_label, id DESC);
-
-CREATE TABLE IF NOT EXISTS alert_bgp_peer_samples (
-  id INTEGER PRIMARY KEY AUTOINCREMENT,
-  sampled_at TEXT NOT NULL,
-  peer_key TEXT NOT NULL,
-  state TEXT NOT NULL
-);
-CREATE INDEX IF NOT EXISTS idx_alert_bgp_peer_samples_key_id
-  ON alert_bgp_peer_samples(peer_key, id DESC);
-
-CREATE TABLE IF NOT EXISTS evobgp_settings (
-  id INTEGER PRIMARY KEY,
-  base_url TEXT NOT NULL DEFAULT '',
-  api_key TEXT NOT NULL DEFAULT '',
-  enabled INTEGER NOT NULL DEFAULT 0,
-  updated_at TEXT NOT NULL DEFAULT (datetime('now'))
-);
-
-CREATE TABLE IF NOT EXISTS alert_telegram_settings (
-  id INTEGER PRIMARY KEY,
-  bot_token TEXT NOT NULL DEFAULT '',
-  chat_id TEXT NOT NULL DEFAULT '',
-  message_thread_id INTEGER,
-  updated_at TEXT NOT NULL DEFAULT (datetime('now'))
-);
-
-CREATE TABLE IF NOT EXISTS acme_settings (
-  id INTEGER PRIMARY KEY,
-  directory_url TEXT NOT NULL DEFAULT 'https://acme-v02.api.letsencrypt.org/directory',
-  cloudflare_api_token TEXT NOT NULL DEFAULT '',
-  default_zone_id TEXT NOT NULL DEFAULT '',
-  account_private_key TEXT NOT NULL DEFAULT '',
-  updated_at TEXT NOT NULL DEFAULT (datetime('now'))
-);
-
-CREATE TABLE IF NOT EXISTS certificate_issue_jobs (
-  id TEXT PRIMARY KEY,
-  status TEXT NOT NULL DEFAULT 'queued',
-  step TEXT NOT NULL DEFAULT 'queued',
-  source TEXT NOT NULL DEFAULT 'manual',
-  server_id TEXT NOT NULL,
-  cert_name TEXT NOT NULL,
-  domain_names TEXT NOT NULL,
-  key_type TEXT NOT NULL DEFAULT 'rsa2048',
-  trust_store TEXT NOT NULL DEFAULT 'www,api',
-  requested_at TEXT NOT NULL DEFAULT (datetime('now')),
-  started_at TEXT,
-  finished_at TEXT,
-  error TEXT
-);
-
-CREATE TABLE IF NOT EXISTS certificate_renew_settings (
-  id INTEGER PRIMARY KEY,
-  enabled INTEGER NOT NULL DEFAULT 1,
-  interval_sec INTEGER NOT NULL DEFAULT 21600,
-  renew_before_days INTEGER NOT NULL DEFAULT 30,
-  last_collected_at TEXT,
-  last_duration_ms INTEGER,
-  last_error TEXT,
-  updated_at TEXT NOT NULL DEFAULT (datetime('now'))
-);
-
-CREATE TABLE IF NOT EXISTS backup_schedule_settings (
-  id INTEGER PRIMARY KEY,
-  enabled INTEGER NOT NULL DEFAULT 1,
-  frequency TEXT NOT NULL DEFAULT 'daily',
-  hour INTEGER NOT NULL DEFAULT 3,
-  minute INTEGER NOT NULL DEFAULT 0,
-  week_day INTEGER NOT NULL DEFAULT 0,
-  month_day INTEGER NOT NULL DEFAULT 1,
-  keep_count INTEGER NOT NULL DEFAULT 7,
-  format TEXT NOT NULL DEFAULT 'rsc',
-  server_ids_json TEXT NOT NULL DEFAULT '[]',
-  last_run_at TEXT,
-  last_duration_ms INTEGER,
-  last_error TEXT,
-  updated_at TEXT NOT NULL DEFAULT (datetime('now'))
-);
-
-CREATE TABLE IF NOT EXISTS backup_entries (
-  id TEXT PRIMARY KEY,
-  server_id TEXT NOT NULL,
-  server_name TEXT NOT NULL,
-  filename TEXT NOT NULL,
-  size_bytes INTEGER NOT NULL,
-  kind TEXT NOT NULL DEFAULT 'manual',
-  notes TEXT,
-  created_at TEXT NOT NULL
-);
-CREATE INDEX IF NOT EXISTS idx_backup_entries_server_created ON backup_entries(server_id, created_at);
-CREATE UNIQUE INDEX IF NOT EXISTS idx_backup_entries_filename ON backup_entries(filename);
-
-CREATE TABLE IF NOT EXISTS alert_rules (
-  id TEXT PRIMARY KEY,
-  name TEXT NOT NULL,
-  type TEXT NOT NULL,
-  target TEXT NOT NULL,
-  condition TEXT NOT NULL,
-  severity TEXT NOT NULL,
-  enabled INTEGER NOT NULL DEFAULT 1,
-  cooldown TEXT NOT NULL DEFAULT '5м',
-  rule_chat_id TEXT NOT NULL DEFAULT '',
-  recovery_mode TEXT NOT NULL DEFAULT 'always',
-  recovery_stability_sec INTEGER,
-  created_at TEXT NOT NULL DEFAULT (datetime('now')),
-  updated_at TEXT NOT NULL DEFAULT (datetime('now'))
-);
-
-CREATE TABLE IF NOT EXISTS alert_history (
-  id TEXT PRIMARY KEY,
-  rule_id TEXT,
-  rule_name TEXT NOT NULL,
-  severity TEXT NOT NULL,
-  message TEXT NOT NULL,
-  sent_ok INTEGER NOT NULL DEFAULT 1,
-  fired_at TEXT NOT NULL
-);
-CREATE INDEX IF NOT EXISTS idx_alert_history_fired_at ON alert_history(fired_at);
-CREATE INDEX IF NOT EXISTS idx_alert_history_rule_id ON alert_history(rule_id);
-
-CREATE TABLE IF NOT EXISTS alert_groups (
-  id TEXT PRIMARY KEY,
-  name TEXT NOT NULL,
-  combine_mode TEXT NOT NULL DEFAULT 'any',
-  enabled INTEGER NOT NULL DEFAULT 1,
-  cooldown_override TEXT,
-  created_at TEXT NOT NULL DEFAULT (datetime('now')),
-  updated_at TEXT NOT NULL DEFAULT (datetime('now'))
-);
-
-CREATE TABLE IF NOT EXISTS alert_rule_targets (
-  id TEXT PRIMARY KEY,
-  rule_id TEXT NOT NULL,
-  target TEXT NOT NULL,
-  sort_index INTEGER NOT NULL DEFAULT 0
-);
-CREATE INDEX IF NOT EXISTS idx_alert_rule_targets_rule ON alert_rule_targets(rule_id);
-
-CREATE TABLE IF NOT EXISTS alert_rule_conditions (
-  id TEXT PRIMARY KEY,
-  rule_id TEXT NOT NULL,
-  condition_line TEXT NOT NULL,
-  sort_index INTEGER NOT NULL DEFAULT 0
-);
-CREATE INDEX IF NOT EXISTS idx_alert_rule_conditions_rule ON alert_rule_conditions(rule_id);
-
-CREATE TABLE IF NOT EXISTS alert_engine_state (
-  scope_key TEXT PRIMARY KEY,
-  last_fired_at TEXT NOT NULL DEFAULT '',
-  last_payload_hash TEXT
-);
-
-CREATE TABLE IF NOT EXISTS alert_engine_prev_live (
-  kind TEXT PRIMARY KEY,
-  payload_json TEXT NOT NULL DEFAULT '{}',
-  updated_at TEXT NOT NULL DEFAULT (datetime('now'))
-);
-
-CREATE TABLE IF NOT EXISTS alert_engine_confirm_pending (
-  rule_id TEXT PRIMARY KEY,
-  payload_hash TEXT NOT NULL,
-  since_at TEXT NOT NULL
-);
-
-CREATE TABLE IF NOT EXISTS alert_destinations (
-  id TEXT PRIMARY KEY,
-  kind TEXT NOT NULL DEFAULT 'telegram',
-  label TEXT NOT NULL DEFAULT '',
-  telegram_chat_id TEXT NOT NULL DEFAULT '',
-  message_thread_id INTEGER,
-  enabled INTEGER NOT NULL DEFAULT 1,
-  created_at TEXT NOT NULL DEFAULT (datetime('now'))
-);
-
-CREATE TABLE IF NOT EXISTS alert_outbox (
-  id TEXT PRIMARY KEY,
-  dedupe_key TEXT NOT NULL,
-  channel TEXT NOT NULL DEFAULT 'telegram',
-  status TEXT NOT NULL DEFAULT 'pending',
-  retry_count INTEGER NOT NULL DEFAULT 0,
-  max_retries INTEGER NOT NULL DEFAULT 3,
-  next_attempt_at TEXT NOT NULL,
-  payload_json TEXT NOT NULL,
-  created_at TEXT NOT NULL DEFAULT (datetime('now')),
-  sent_at TEXT,
-  last_error TEXT
-);
-CREATE INDEX IF NOT EXISTS idx_alert_outbox_status_next_attempt
-  ON alert_outbox(status, next_attempt_at);
-CREATE INDEX IF NOT EXISTS idx_alert_outbox_dedupe
-  ON alert_outbox(dedupe_key);
-
-CREATE TABLE IF NOT EXISTS alert_engine_cursor (
-  id INTEGER PRIMARY KEY,
-  last_source_finished_at TEXT,
-  updated_at TEXT NOT NULL DEFAULT (datetime('now'))
-);
-
-CREATE TABLE IF NOT EXISTS app_users (
-  id TEXT PRIMARY KEY,
-  name TEXT NOT NULL DEFAULT '',
-  login TEXT NOT NULL UNIQUE,
-  email TEXT NOT NULL DEFAULT '',
-  role TEXT NOT NULL DEFAULT 'viewer',
-  active INTEGER NOT NULL DEFAULT 1,
-  avatar TEXT NOT NULL DEFAULT '',
-  last_seen TEXT,
-  sections_json TEXT NOT NULL DEFAULT '[]',
-  servers_json TEXT NOT NULL DEFAULT '[]',
-  created_at TEXT NOT NULL DEFAULT (datetime('now')),
-  updated_at TEXT NOT NULL DEFAULT (datetime('now'))
-);
-
-CREATE TABLE IF NOT EXISTS user_interface_bindings (
-  id TEXT PRIMARY KEY,
-  user_id TEXT NOT NULL,
-  server_id INTEGER NOT NULL,
-  interface_name TEXT NOT NULL,
-  interface_type TEXT NOT NULL DEFAULT 'other',
-  peer_public_key TEXT NOT NULL DEFAULT '',
-  peer_name TEXT NOT NULL DEFAULT '',
-  comment TEXT NOT NULL DEFAULT '',
-  created_at TEXT NOT NULL DEFAULT (datetime('now')),
-  updated_at TEXT NOT NULL DEFAULT (datetime('now')),
-  FOREIGN KEY (user_id) REFERENCES app_users(id) ON DELETE CASCADE,
-  FOREIGN KEY (server_id) REFERENCES servers(id) ON DELETE CASCADE,
-  UNIQUE (server_id, interface_name, peer_public_key)
-);
-CREATE INDEX IF NOT EXISTS idx_user_iface_bind_user
-  ON user_interface_bindings(user_id);
-`)
-
-// Lightweight schema evolution for existing databases without migrations
-{
-  const sampleCols = sqlite.prepare(`PRAGMA table_info('traffic_samples')`).all() as Array<{ name?: string }>
-  if (!sampleCols.some((c) => c.name === "peer_public_key")) {
-    sqlite.exec(`ALTER TABLE traffic_samples ADD COLUMN peer_public_key TEXT NOT NULL DEFAULT ''`)
-  }
-}
-
-{
-  const bindCols = sqlite.prepare(`PRAGMA table_info('user_interface_bindings')`).all() as Array<{ name?: string }>
-  if (!bindCols.some((c) => c.name === "peer_public_key")) {
-    sqlite.exec(`ALTER TABLE user_interface_bindings ADD COLUMN peer_public_key TEXT NOT NULL DEFAULT ''`)
-  }
-  if (!bindCols.some((c) => c.name === "peer_name")) {
-    sqlite.exec(`ALTER TABLE user_interface_bindings ADD COLUMN peer_name TEXT NOT NULL DEFAULT ''`)
-  }
-
-  const indexes = sqlite.prepare(`PRAGMA index_list('user_interface_bindings')`).all() as Array<{
-    name?: string
-    unique?: number
-  }>
-  let hasPeerUnique = false
-  for (const idx of indexes) {
-    if (!idx.name || !idx.unique) continue
-    const info = sqlite.prepare(`PRAGMA index_info(${JSON.stringify(idx.name)})`).all() as Array<{ name?: string }>
-    const names = info.map((c) => c.name)
-    if (names.includes("server_id") && names.includes("interface_name") && names.includes("peer_public_key")) {
-      hasPeerUnique = true
-    }
-  }
-  if (!hasPeerUnique) {
-    sqlite.exec(`PRAGMA foreign_keys = OFF`)
-    sqlite.exec(`
-      CREATE TABLE user_interface_bindings_new (
-        id TEXT PRIMARY KEY,
-        user_id TEXT NOT NULL,
-        server_id INTEGER NOT NULL,
-        interface_name TEXT NOT NULL,
-        interface_type TEXT NOT NULL DEFAULT 'other',
-        peer_public_key TEXT NOT NULL DEFAULT '',
-        peer_name TEXT NOT NULL DEFAULT '',
-        comment TEXT NOT NULL DEFAULT '',
-        created_at TEXT NOT NULL DEFAULT (datetime('now')),
-        updated_at TEXT NOT NULL DEFAULT (datetime('now')),
-        FOREIGN KEY (user_id) REFERENCES app_users(id) ON DELETE CASCADE,
-        FOREIGN KEY (server_id) REFERENCES servers(id) ON DELETE CASCADE,
-        UNIQUE (server_id, interface_name, peer_public_key)
-      );
-      INSERT INTO user_interface_bindings_new
-        (id, user_id, server_id, interface_name, interface_type, peer_public_key, peer_name, comment, created_at, updated_at)
-      SELECT id, user_id, server_id, interface_name, interface_type,
-        COALESCE(peer_public_key, ''), COALESCE(peer_name, ''), comment, created_at, updated_at
-      FROM user_interface_bindings;
-      DROP TABLE user_interface_bindings;
-      ALTER TABLE user_interface_bindings_new RENAME TO user_interface_bindings;
-      CREATE INDEX IF NOT EXISTS idx_user_iface_bind_user ON user_interface_bindings(user_id);
-    `)
-    sqlite.exec(`PRAGMA foreign_keys = ON`)
-  }
-}
-
-const recursiveCols = sqlite.prepare(`PRAGMA table_info('recursive_routes')`).all() as Array<{ name?: string }>
-const hasCountryColumn = recursiveCols.some((c) => c.name === "country")
-if (!hasCountryColumn) {
-  sqlite.exec(`ALTER TABLE recursive_routes ADD COLUMN country TEXT NOT NULL DEFAULT ''`)
-}
-
-const uptimeProbeCols = sqlite.prepare(`PRAGMA table_info('uptime_probes')`).all() as Array<{ name?: string }>
-const hasSrcInterfaceColumn = uptimeProbeCols.some((c) => c.name === "src_interface")
-if (!hasSrcInterfaceColumn) {
-  sqlite.exec(`ALTER TABLE uptime_probes ADD COLUMN src_interface TEXT NOT NULL DEFAULT ''`)
-}
-const hasShowOnDashboardColumn = uptimeProbeCols.some((c) => c.name === "show_on_dashboard")
-if (!hasShowOnDashboardColumn) {
-  sqlite.exec(`ALTER TABLE uptime_probes ADD COLUMN show_on_dashboard INTEGER NOT NULL DEFAULT 0`)
-}
-const hasProbeIntervalSecColumn = uptimeProbeCols.some((c) => c.name === "interval_sec")
-if (!hasProbeIntervalSecColumn) {
-  sqlite.exec(`ALTER TABLE uptime_probes ADD COLUMN interval_sec INTEGER NOT NULL DEFAULT 0`)
-}
-
-const uptimeSettingsCols = sqlite.prepare(`PRAGMA table_info('uptime_settings')`).all() as Array<{ name?: string }>
-const hasProbeIntervalColumn = uptimeSettingsCols.some((c) => c.name === "probe_interval_sec")
-if (!hasProbeIntervalColumn) {
-  sqlite.exec(`ALTER TABLE uptime_settings ADD COLUMN probe_interval_sec INTEGER NOT NULL DEFAULT 15`)
-}
-const hasSpeedIntervalColumn = uptimeSettingsCols.some((c) => c.name === "speed_interval_sec")
-if (!hasSpeedIntervalColumn) {
-  sqlite.exec(`ALTER TABLE uptime_settings ADD COLUMN speed_interval_sec INTEGER NOT NULL DEFAULT 60`)
-}
-
-const hasUptimeJobFlags = uptimeSettingsCols.some((c) => c.name === "resources_enabled")
-if (!hasUptimeJobFlags) {
-  sqlite.exec(`ALTER TABLE uptime_settings ADD COLUMN resources_enabled INTEGER NOT NULL DEFAULT 1`)
-  sqlite.exec(`ALTER TABLE uptime_settings ADD COLUMN ping_enabled INTEGER NOT NULL DEFAULT 1`)
-  sqlite.exec(`ALTER TABLE uptime_settings ADD COLUMN speed_enabled INTEGER NOT NULL DEFAULT 1`)
-  sqlite.exec(
-    `UPDATE uptime_settings SET resources_enabled = enabled, ping_enabled = enabled, speed_enabled = enabled WHERE id = 1`,
-  )
-}
-
-const uptimeSpeedProbeCols = sqlite.prepare(`PRAGMA table_info('uptime_speed_probes')`).all() as Array<{ name?: string }>
-const ensureSpeedProbeCol = (name: string, ddl: string) => {
-  if (!uptimeSpeedProbeCols.some((c) => c.name === name)) sqlite.exec(ddl)
-}
-ensureSpeedProbeCol("last_run_at", `ALTER TABLE uptime_speed_probes ADD COLUMN last_run_at TEXT`)
-ensureSpeedProbeCol("last_tx_avg_mbps", `ALTER TABLE uptime_speed_probes ADD COLUMN last_tx_avg_mbps REAL`)
-ensureSpeedProbeCol("last_rx_avg_mbps", `ALTER TABLE uptime_speed_probes ADD COLUMN last_rx_avg_mbps REAL`)
-ensureSpeedProbeCol("last_status", `ALTER TABLE uptime_speed_probes ADD COLUMN last_status TEXT`)
-ensureSpeedProbeCol("last_error", `ALTER TABLE uptime_speed_probes ADD COLUMN last_error TEXT`)
-ensureSpeedProbeCol("last_ping_rtt_ms", `ALTER TABLE uptime_speed_probes ADD COLUMN last_ping_rtt_ms INTEGER`)
-ensureSpeedProbeCol("last_ping_loss_pct", `ALTER TABLE uptime_speed_probes ADD COLUMN last_ping_loss_pct INTEGER`)
-ensureSpeedProbeCol("last_ping_at", `ALTER TABLE uptime_speed_probes ADD COLUMN last_ping_at TEXT`)
-ensureSpeedProbeCol("last_ping_error", `ALTER TABLE uptime_speed_probes ADD COLUMN last_ping_error TEXT`)
-
-const schedulerRunCols = sqlite.prepare(`PRAGMA table_info('scheduler_runs')`).all() as Array<{ name?: string }>
-if (!schedulerRunCols.some((c) => c.name === "result_json")) {
-  sqlite.exec(`ALTER TABLE scheduler_runs ADD COLUMN result_json TEXT`)
-}
-
-const serverCols = sqlite.prepare(`PRAGMA table_info('servers')`).all() as Array<{ name?: string }>
-if (!serverCols.some((c) => c.name === "lan_subnet")) {
-  sqlite.exec(`ALTER TABLE servers ADD COLUMN lan_subnet TEXT NOT NULL DEFAULT ''`)
-}
-if (!serverCols.some((c) => c.name === "wan_uplinks")) {
-  sqlite.exec(`ALTER TABLE servers ADD COLUMN wan_uplinks TEXT NOT NULL DEFAULT '[]'`)
-}
-if (!serverCols.some((c) => c.name === "mgmt_tunnel_ip")) {
-  sqlite.exec(`ALTER TABLE servers ADD COLUMN mgmt_tunnel_ip TEXT NOT NULL DEFAULT ''`)
-}
-
-const alertTgCols = sqlite.prepare(`PRAGMA table_info('alert_telegram_settings')`).all() as Array<{ name?: string }>
-if (!alertTgCols.some((c) => c.name === "message_thread_id")) {
-  sqlite.exec(`ALTER TABLE alert_telegram_settings ADD COLUMN message_thread_id INTEGER`)
-}
-
-const alertRulesCols = sqlite.prepare(`PRAGMA table_info('alert_rules')`).all() as Array<{ name?: string }>
-if (!alertRulesCols.some((c) => c.name === "group_id")) {
-  sqlite.exec(`ALTER TABLE alert_rules ADD COLUMN group_id TEXT`)
-}
-if (!alertRulesCols.some((c) => c.name === "confirm_stability_sec")) {
-  sqlite.exec(`ALTER TABLE alert_rules ADD COLUMN confirm_stability_sec INTEGER`)
-}
-if (!alertRulesCols.some((c) => c.name === "recovery_mode")) {
-  sqlite.exec(`ALTER TABLE alert_rules ADD COLUMN recovery_mode TEXT NOT NULL DEFAULT 'always'`)
-}
-if (!alertRulesCols.some((c) => c.name === "recovery_stability_sec")) {
-  sqlite.exec(`ALTER TABLE alert_rules ADD COLUMN recovery_stability_sec INTEGER`)
-}
-
-const alertHistoryCols = sqlite.prepare(`PRAGMA table_info('alert_history')`).all() as Array<{ name?: string }>
-if (!alertHistoryCols.some((c) => c.name === "group_id")) {
-  sqlite.exec(`ALTER TABLE alert_history ADD COLUMN group_id TEXT`)
-}
-
-/** Одна строка target на правило из legacy-колонки `alert_rules.target` */
-sqlite.exec(`
-INSERT OR IGNORE INTO alert_rule_targets (id, rule_id, target, sort_index)
-SELECT 'rt-' || id || '-0', id, target, 0 FROM alert_rules
-WHERE id NOT IN (SELECT rule_id FROM alert_rule_targets)
-`)
-
-/** Одна строка условия из legacy `alert_rules.condition` */
-sqlite.exec(`
-INSERT OR IGNORE INTO alert_rule_conditions (id, rule_id, condition_line, sort_index)
-SELECT 'rc-' || id || '-0', id, condition, 0 FROM alert_rules
-WHERE id NOT IN (SELECT rule_id FROM alert_rule_conditions)
-`)
-
-sqlite.exec(`
-INSERT INTO traffic_settings (id, enabled, interval_sec, retention_days)
-SELECT 1, 1, 30, 14
-WHERE NOT EXISTS (SELECT 1 FROM traffic_settings WHERE id = 1);
-`)
-
-sqlite.exec(`
-INSERT INTO traffic_flow_settings (id, enabled, collector_ip, flow_listen_port, wg_listen_port, prefix)
-SELECT 1, 0, '10.255.254.1', 4739, 51821, '10.255.254.0/24'
-WHERE NOT EXISTS (SELECT 1 FROM traffic_flow_settings WHERE id = 1);
-`)
-
-{
-  const flowSettingsCols = sqlite.prepare(`PRAGMA table_info('traffic_flow_settings')`).all() as Array<{ name?: string }>
-  if (!flowSettingsCols.some((c) => c.name === "map_service_min_share_pct")) {
-    sqlite.exec(`ALTER TABLE traffic_flow_settings ADD COLUMN map_service_min_share_pct REAL NOT NULL DEFAULT 5`)
-  }
-}
-
-sqlite.exec(`
-INSERT INTO uptime_settings (id, enabled, interval_sec, retention_days)
-SELECT 1, 1, 15, 14
-WHERE NOT EXISTS (SELECT 1 FROM uptime_settings WHERE id = 1);
-`)
-
-sqlite.exec(`
-INSERT INTO evobgp_settings (id, base_url, api_key, enabled)
-SELECT 1, '', '', 0
-WHERE NOT EXISTS (SELECT 1 FROM evobgp_settings WHERE id = 1);
-`)
-
-sqlite.exec(`
-INSERT INTO servers_api_ping_settings (id, enabled, interval_sec)
-SELECT 1, 0, 120
-WHERE NOT EXISTS (SELECT 1 FROM servers_api_ping_settings WHERE id = 1);
-`)
-
-sqlite.exec(`
-INSERT INTO internet_path_settings (id, enabled, interval_sec, retention_days)
-SELECT 1, 1, 300, 14
-WHERE NOT EXISTS (SELECT 1 FROM internet_path_settings WHERE id = 1);
-`)
-
-sqlite.exec(`
-INSERT INTO alert_telegram_settings (id, bot_token, chat_id)
-SELECT 1, '', ''
-WHERE NOT EXISTS (SELECT 1 FROM alert_telegram_settings WHERE id = 1);
-`)
-
-sqlite.exec(`
-INSERT INTO acme_settings (id, directory_url, cloudflare_api_token, default_zone_id, account_private_key)
-SELECT 1, 'https://acme-v02.api.letsencrypt.org/directory', '', '', ''
-WHERE NOT EXISTS (SELECT 1 FROM acme_settings WHERE id = 1);
-`)
-
-{
-  const flowIndexes = sqlite.prepare(`PRAGMA index_list('flow_buckets')`).all() as Array<{
-    name?: string
-    unique?: number
-  }>
-  let hasIfaceUnique = false
-  for (const idx of flowIndexes) {
-    if (!idx.name || !idx.unique) continue
-    const info = sqlite.prepare(`PRAGMA index_info(${JSON.stringify(idx.name)})`).all() as Array<{ name?: string }>
-    const names = info.map((c) => c.name)
-    if (names.includes("in_iface") && names.includes("src") && names.includes("dst")) {
-      hasIfaceUnique = true
-    }
-  }
-  if (!hasIfaceUnique) {
-    sqlite.exec(`DROP INDEX IF EXISTS idx_flow_buckets_unique`)
-    sqlite.exec(`
-      CREATE UNIQUE INDEX IF NOT EXISTS idx_flow_buckets_unique
-        ON flow_buckets(server_id, bucket_at, src, dst, proto, src_port, dst_port, in_iface)
-    `)
-  }
-}
-
-{
-  const flowCols = sqlite.prepare(`PRAGMA table_info('flow_buckets')`).all() as Array<{ name?: string }>
-  const names = new Set(flowCols.map((c) => c.name))
-  if (!names.has("out_iface")) sqlite.exec(`ALTER TABLE flow_buckets ADD COLUMN out_iface TEXT NOT NULL DEFAULT ''`)
-  if (!names.has("next_hop")) sqlite.exec(`ALTER TABLE flow_buckets ADD COLUMN next_hop TEXT NOT NULL DEFAULT ''`)
-  if (!names.has("flow_start_ms")) sqlite.exec(`ALTER TABLE flow_buckets ADD COLUMN flow_start_ms INTEGER NOT NULL DEFAULT 0`)
-  if (!names.has("flow_end_ms")) sqlite.exec(`ALTER TABLE flow_buckets ADD COLUMN flow_end_ms INTEGER NOT NULL DEFAULT 0`)
-}
-
-const certIssueJobCols = sqlite.prepare(`PRAGMA table_info('certificate_issue_jobs')`).all() as Array<{ name?: string }>
-if (!certIssueJobCols.some((c) => c.name === "source")) {
-  sqlite.exec(`ALTER TABLE certificate_issue_jobs ADD COLUMN source TEXT NOT NULL DEFAULT 'manual'`)
-}
-
-sqlite.exec(`
-INSERT INTO certificate_renew_settings (id, enabled, interval_sec, renew_before_days)
-SELECT 1, 1, 21600, 30
-WHERE NOT EXISTS (SELECT 1 FROM certificate_renew_settings WHERE id = 1);
-`)
-
-sqlite.exec(`
-INSERT INTO backup_schedule_settings (id, enabled, frequency, hour, minute, week_day, month_day, keep_count, format, server_ids_json)
-SELECT 1, 1, 'daily', 3, 0, 0, 1, 7, 'rsc', '[]'
-WHERE NOT EXISTS (SELECT 1 FROM backup_schedule_settings WHERE id = 1);
-`)
-
-sqlite.exec(`
-INSERT INTO alert_engine_cursor (id, last_source_finished_at)
-SELECT 1, NULL
-WHERE NOT EXISTS (SELECT 1 FROM alert_engine_cursor WHERE id = 1);
-`)
-
-const backupEntryCount = sqlite.prepare(`SELECT COUNT(*) AS c FROM backup_entries`).get() as { c: number }
-if (backupEntryCount.c === 0) {
-  const legacyIndexPath = path.resolve(process.cwd(), "storage", "backups", "index.json")
-  if (existsSync(legacyIndexPath)) {
     try {
-      const parsed = JSON.parse(readFileSync(legacyIndexPath, "utf8")) as unknown
-      if (Array.isArray(parsed)) {
-        const insert = sqlite.prepare(`
-          INSERT OR IGNORE INTO backup_entries (id, server_id, server_name, filename, size_bytes, kind, notes, created_at)
-          VALUES (@id, @serverId, @serverName, @filename, @sizeBytes, @kind, @notes, @createdAt)
-        `)
-        for (const row of parsed) {
-          if (!row || typeof row !== "object") continue
-          const item = row as Record<string, unknown>
-          const id = String(item.id ?? "").trim()
-          const filename = String(item.filename ?? "").trim()
-          if (!id || !filename) continue
-          insert.run({
-            id,
-            serverId: String(item.serverId ?? ""),
-            serverName: String(item.serverName ?? ""),
-            filename,
-            sizeBytes: Number(item.sizeBytes ?? 0) || 0,
-            kind: item.kind === "auto" ? "auto" : "manual",
-            notes: item.notes == null ? null : String(item.notes),
-            createdAt: String(item.createdAt ?? new Date().toISOString()),
-          })
-        }
-      }
+      await client.query("SELECT pg_advisory_unlock($1)", [key])
     } catch {
-      /* legacy index.json не читается — пропускаем */
+      /* ignore */
     }
+    client.release()
   }
 }
 
-export let db = drizzle(sqlite, { schema })
-
-/** Прямой доступ к better-sqlite3 для сложных read-only запросов (напр. /api/alerts). */
-export let sqliteDatabase: SqliteHandle = sqlite
-
-let sqliteExclusiveOp = false
-
-export function beginSqliteExclusiveOp(): void {
-  if (sqliteExclusiveOp) {
-    throw new Error("Операция с базой данных уже выполняется")
-  }
-  sqliteExclusiveOp = true
-}
-
-export function endSqliteExclusiveOp(): void {
-  sqliteExclusiveOp = false
-}
-
-export function reopenSqlite(): void {
-  try {
-    sqlite.close()
-  } catch {
-    /* already closed */
-  }
-  sqlite = openSqlite()
-  sqliteDatabase = sqlite
-  db = drizzle(sqlite, { schema })
+export async function closePool(): Promise<void> {
+  await pool.end()
 }
diff --git a/backend/src/db/json.ts b/backend/src/db/json.ts
new file mode 100644
index 0000000..65098ac
--- /dev/null
+++ b/backend/src/db/json.ts
@@ -0,0 +1,43 @@
+/** JSONB from node-pg may already be an object; SQLite leftovers may be strings. */
+
+export function parseJsonObject(value: unknown): Record<string, unknown> {
+  if (value && typeof value === "object" && !Array.isArray(value)) {
+    return value as Record<string, unknown>
+  }
+  if (typeof value === "string" && value.trim()) {
+    try {
+      const parsed = JSON.parse(value) as unknown
+      if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+        return parsed as Record<string, unknown>
+      }
+    } catch {
+      /* ignore */
+    }
+  }
+  return {}
+}
+
+export function parseJsonArray(value: unknown): unknown[] {
+  if (Array.isArray(value)) return value
+  if (typeof value === "string" && value.trim()) {
+    try {
+      const parsed = JSON.parse(value) as unknown
+      if (Array.isArray(parsed)) return parsed
+    } catch {
+      /* ignore */
+    }
+  }
+  return []
+}
+
+export function toJsonb(value: unknown): unknown {
+  if (value == null) return null
+  if (typeof value === "string") {
+    try {
+      return JSON.parse(value) as unknown
+    } catch {
+      return value
+    }
+  }
+  return value
+}
diff --git a/backend/src/db/migrate.ts b/backend/src/db/migrate.ts
new file mode 100644
index 0000000..de3e165
--- /dev/null
+++ b/backend/src/db/migrate.ts
@@ -0,0 +1,43 @@
+import { readFileSync } from "node:fs"
+import { dirname, join } from "node:path"
+import { fileURLToPath } from "node:url"
+import type { Pool } from "pg"
+
+const MIGRATION_ID = "0000_postgresql"
+
+function migrationsDir(): string {
+  const here = dirname(fileURLToPath(import.meta.url))
+  const candidates = [
+    join(here, "..", "..", "drizzle"),
+    join(process.cwd(), "drizzle"),
+    join(process.cwd(), "backend", "drizzle"),
+  ]
+  for (const dir of candidates) {
+    try {
+      readFileSync(join(dir, `${MIGRATION_ID}.sql`), "utf8")
+      return dir
+    } catch {
+      /* try next */
+    }
+  }
+  throw new Error("Не найден backend/drizzle/0000_postgresql.sql")
+}
+
+export async function applySqlMigrations(pool: Pool): Promise<void> {
+  await pool.query(`
+    CREATE TABLE IF NOT EXISTS schema_migrations (
+      id TEXT PRIMARY KEY,
+      applied_at TIMESTAMPTZ NOT NULL DEFAULT now()
+    )
+  `)
+  const { rows } = await pool.query<{ id: string }>(
+    `SELECT id FROM schema_migrations WHERE id = $1`,
+    [MIGRATION_ID],
+  )
+  if (rows.length > 0) return
+  const sql = readFileSync(join(migrationsDir(), `${MIGRATION_ID}.sql`), "utf8")
+  await pool.query(sql)
+  await pool.query(`INSERT INTO schema_migrations (id) VALUES ($1) ON CONFLICT (id) DO NOTHING`, [
+    MIGRATION_ID,
+  ])
+}
diff --git a/backend/src/db/partitions.ts b/backend/src/db/partitions.ts
new file mode 100644
index 0000000..0fe7490
--- /dev/null
+++ b/backend/src/db/partitions.ts
@@ -0,0 +1,129 @@
+import type { Pool } from "pg"
+
+export type PartitionKind = "day" | "week" | "month"
+
+export interface PartitionSpec {
+  parent: string
+  kind: PartitionKind
+  keepDays: number
+}
+
+export const PARTITION_SPECS: PartitionSpec[] = [
+  { parent: "flow_buckets", kind: "day", keepDays: 4 },
+  { parent: "flow_minute_stats", kind: "day", keepDays: 4 },
+  { parent: "flow_minute_dims", kind: "day", keepDays: 4 },
+  { parent: "flow_daily_dims", kind: "month", keepDays: 420 },
+  { parent: "traffic_samples", kind: "week", keepDays: 21 },
+  { parent: "servers_rest_ping_samples", kind: "week", keepDays: 35 },
+  { parent: "uptime_probe_samples", kind: "week", keepDays: 21 },
+  { parent: "uptime_resource_samples", kind: "week", keepDays: 21 },
+  { parent: "server_snapshots", kind: "week", keepDays: 21 },
+  { parent: "internet_path_snapshots", kind: "week", keepDays: 21 },
+]
+
+function utcDate(d: Date): Date {
+  return new Date(Date.UTC(d.getUTCFullYear(), d.getUTCMonth(), d.getUTCDate()))
+}
+
+function addUtcDays(d: Date, n: number): Date {
+  const x = utcDate(d)
+  x.setUTCDate(x.getUTCDate() + n)
+  return x
+}
+
+function startOfWeekUtc(d: Date): Date {
+  const x = utcDate(d)
+  const day = x.getUTCDay() || 7
+  x.setUTCDate(x.getUTCDate() - (day - 1))
+  return x
+}
+
+function startOfMonthUtc(d: Date): Date {
+  return new Date(Date.UTC(d.getUTCFullYear(), d.getUTCMonth(), 1))
+}
+
+function fmtDay(d: Date): string {
+  return d.toISOString().slice(0, 10)
+}
+
+function partName(parent: string, kind: PartitionKind, start: Date): string {
+  if (kind === "day") return `${parent}_d_${fmtDay(start).replaceAll("-", "")}`
+  if (kind === "week") return `${parent}_w_${fmtDay(start).replaceAll("-", "")}`
+  return `${parent}_m_${start.getUTCFullYear()}${String(start.getUTCMonth() + 1).padStart(2, "0")}`
+}
+
+function rangeFor(kind: PartitionKind, ts: Date): { start: Date; end: Date } {
+  if (kind === "day") {
+    const start = utcDate(ts)
+    return { start, end: addUtcDays(start, 1) }
+  }
+  if (kind === "week") {
+    const start = startOfWeekUtc(ts)
+    return { start, end: addUtcDays(start, 7) }
+  }
+  const start = startOfMonthUtc(ts)
+  const end = new Date(Date.UTC(start.getUTCFullYear(), start.getUTCMonth() + 1, 1))
+  return { start, end }
+}
+
+export async function ensurePartitionFor(
+  pool: Pool,
+  parent: string,
+  kind: PartitionKind,
+  ts: Date,
+): Promise<string> {
+  const { start, end } = rangeFor(kind, ts)
+  const name = partName(parent, kind, start)
+  const from = fmtDay(start)
+  const to = fmtDay(end)
+  await pool.query(
+    `CREATE TABLE IF NOT EXISTS ${name} PARTITION OF ${parent} FOR VALUES FROM ('${from}') TO ('${to}')`,
+  )
+  return name
+}
+
+export async function ensurePartitionsAround(pool: Pool, around = new Date()): Promise<void> {
+  for (const spec of PARTITION_SPECS) {
+    const daysAhead = spec.kind === "month" ? 40 : spec.kind === "week" ? 21 : 8
+    const start = addUtcDays(around, -spec.keepDays)
+    const end = addUtcDays(around, daysAhead)
+    for (let t = new Date(start.getTime()); t < end; ) {
+      await ensurePartitionFor(pool, spec.parent, spec.kind, t)
+      if (spec.kind === "day") t = addUtcDays(t, 1)
+      else if (spec.kind === "week") t = addUtcDays(t, 7)
+      else t = new Date(Date.UTC(t.getUTCFullYear(), t.getUTCMonth() + 1, 1))
+    }
+  }
+}
+
+export async function dropExpiredPartitions(pool: Pool, around = new Date()): Promise<void> {
+  for (const spec of PARTITION_SPECS) {
+    const cutoff = addUtcDays(around, -spec.keepDays)
+    const { rows } = await pool.query<{ relname: string }>(
+      `SELECT c.relname
+       FROM pg_inherits i
+       JOIN pg_class c ON c.oid = i.inhrelid
+       JOIN pg_class p ON p.oid = i.inhparent
+       WHERE p.relname = $1`,
+      [spec.parent],
+    )
+    for (const row of rows) {
+      const m = row.relname.match(/_([dwm])_(\d{8}|\d{6})$/)
+      if (!m) continue
+      const stamp = m[2]
+      let start: Date
+      if (stamp.length === 6) {
+        start = new Date(Date.UTC(Number(stamp.slice(0, 4)), Number(stamp.slice(4, 6)) - 1, 1))
+      } else {
+        start = new Date(`${stamp.slice(0, 4)}-${stamp.slice(4, 6)}-${stamp.slice(6, 8)}T00:00:00Z`)
+      }
+      if (start < cutoff) {
+        await pool.query(`DROP TABLE IF EXISTS ${row.relname}`)
+      }
+    }
+  }
+}
+
+export function specForParent(parent: string): PartitionSpec | undefined {
+  return PARTITION_SPECS.find((s) => s.parent === parent)
+}
diff --git a/backend/src/db/pg-schema.test.ts b/backend/src/db/pg-schema.test.ts
new file mode 100644
index 0000000..7cd0074
--- /dev/null
+++ b/backend/src/db/pg-schema.test.ts
@@ -0,0 +1,56 @@
+import assert from "node:assert/strict"
+import { withPgOrSkip } from "../test/pg.js"
+import { dbQuery, pool } from "./index.js"
+import { ensurePartitionFor } from "./partitions.js"
+
+if (!(await withPgOrSkip())) {
+  console.log("pg-schema.test.ts: skip")
+  process.exit(0)
+}
+
+{
+  const { rows } = await dbQuery<{ n: string }>(`SELECT COUNT(*)::text AS n FROM servers`)
+  assert.ok(rows[0])
+}
+
+{
+  await dbQuery(`
+    INSERT INTO servers (name, host) VALUES ('pg-schema-test', '127.0.0.1')
+  `)
+  const { rows } = await dbQuery<{ id: number }>(`SELECT id FROM servers WHERE name = 'pg-schema-test' LIMIT 1`)
+  const id = rows[0]?.id
+  assert.ok(id)
+
+  await ensurePartitionFor(pool, "flow_buckets", "day", new Date())
+  const bucketAt = new Date().toISOString()
+  await dbQuery(`
+    INSERT INTO flow_buckets (
+      server_id, bucket_at, src, dst, proto, src_port, dst_port, bytes, packets, in_iface
+    ) VALUES ($1, $2, '10.0.0.1', '8.8.8.8', 6, 1, 443, 10, 1, 'wg-flow')
+    ON CONFLICT DO NOTHING
+  `, [id, bucketAt])
+
+  await dbQuery(`DELETE FROM flow_buckets WHERE server_id = $1`, [id])
+  await dbQuery(`DELETE FROM servers WHERE id = $1`, [id])
+}
+
+{
+  await dbQuery(`
+    INSERT INTO alert_outbox (id, dedupe_key, payload_json, next_attempt_at)
+    VALUES ('pg-test-1', 'pg-dedupe-key', '{}'::jsonb, now())
+    ON CONFLICT (dedupe_key) DO NOTHING
+  `)
+  let threw = false
+  try {
+    await dbQuery(`
+      INSERT INTO alert_outbox (id, dedupe_key, payload_json, next_attempt_at)
+      VALUES ('pg-test-2', 'pg-dedupe-key', '{}'::jsonb, now())
+    `)
+  } catch {
+    threw = true
+  }
+  assert.equal(threw, true, "alert_outbox.dedupe_key UNIQUE")
+  await dbQuery(`DELETE FROM alert_outbox WHERE dedupe_key = 'pg-dedupe-key'`)
+}
+
+console.log("pg-schema.test.ts: ok")
diff --git a/backend/src/db/schema.ts b/backend/src/db/schema.ts
index 6f7c7ac..fc3c208 100644
--- a/backend/src/db/schema.ts
+++ b/backend/src/db/schema.ts
@@ -1,76 +1,83 @@
 import { sql } from "drizzle-orm"
 import {
+  bigint,
+  boolean,
+  date,
+  doublePrecision,
+  index,
   integer,
-  real,
-  sqliteTable,
+  jsonb,
+  pgTable,
+  primaryKey,
   text,
+  timestamp,
   uniqueIndex,
-} from "drizzle-orm/sqlite-core"
+} from "drizzle-orm/pg-core"
+
+function ts(name: string) {
+  return timestamp(name, { withTimezone: true, mode: "string" as const })
+}
+
+function idIdentity() {
+  return bigint("id", { mode: "number" }).generatedByDefaultAsIdentity()
+}
+
+function idSingleton() {
+  return bigint("id", { mode: "number" }).primaryKey()
+}
+
+function intPkRef() {
+  return bigint("server_id", { mode: "number" }).notNull()
+}
 
 // ── servers ────────────────────────────────────────────────────────────────────
 
-export const servers = sqliteTable("servers", {
-  id:        integer("id").primaryKey({ autoIncrement: true }),
+export const servers = pgTable("servers", {
+  id:        idIdentity().primaryKey(),
   name:      text("name").notNull().default(""),
   host:      text("host").notNull(),
   port:      integer("port").notNull().default(443),
   username:  text("username").notNull().default("admin"),
   password:  text("password").notNull().default(""),
-  useSsl:    integer("use_ssl", { mode: "boolean" }).notNull().default(true),
-  verifySsl: integer("verify_ssl", { mode: "boolean" }).notNull().default(false),
-
-  // metadata set manually by user
+  useSsl:    boolean("use_ssl").notNull().default(true),
+  verifySsl: boolean("verify_ssl").notNull().default(false),
   type:      text("type", { enum: ["jump-host", "exit-node", "home-router"] })
                .notNull().default("home-router"),
   site:      text("site").notNull().default(""),
   country:   text("country").notNull().default(""),
   asn:       text("asn").notNull().default(""),
   comment:   text("comment").notNull().default(""),
-  enabled:   integer("enabled", { mode: "boolean" }).notNull().default(true),
-
-  /** Подсеть LAN (home-router), текст из формы */
+  enabled:   boolean("enabled").notNull().default(true),
   lanSubnet: text("lan_subnet").notNull().default(""),
-  /** JSON-массив WAN-аплинков [{ id, name, isp, iface, ip, maxDl, maxUl }, …] */
-  wanUplinks: text("wan_uplinks").notNull().default("[]"),
-  /** Адрес в оверлее wg-flow (экспортёр IPFIX), например 10.255.254.5 */
+  wanUplinks: jsonb("wan_uplinks").notNull().default(sql`'[]'::jsonb`),
   mgmtTunnelIp: text("mgmt_tunnel_ip").notNull().default(""),
-
-  createdAt: text("created_at").notNull().default(sql`(datetime('now'))`),
-  updatedAt: text("updated_at").notNull().default(sql`(datetime('now'))`),
+  createdAt: ts("created_at").notNull().defaultNow(),
+  updatedAt: ts("updated_at").notNull().defaultNow(),
 })
 
-// ── server_snapshots ───────────────────────────────────────────────────────────
-
-export const serverSnapshots = sqliteTable("server_snapshots", {
-  id:             integer("id").primaryKey({ autoIncrement: true }),
-  serverId:       integer("server_id")
-                    .notNull()
-                    .references(() => servers.id, { onDelete: "cascade" }),
-  polledAt:       text("polled_at").notNull(),
+export const serverSnapshots = pgTable("server_snapshots", {
+  id:             idIdentity(),
+  serverId:       intPkRef().references(() => servers.id, { onDelete: "cascade" }),
+  polledAt:       ts("polled_at").notNull(),
   status:         text("status", { enum: ["online", "offline"] }).notNull(),
-  latencyMs:      real("latency_ms"),
-
-  // data from RouterOS
+  latencyMs:      doublePrecision("latency_ms"),
   rosVersion:     text("ros_version"),
   boardName:      text("board_name"),
   uptime:         text("uptime"),
   cpuLoad:        integer("cpu_load"),
-  freeMemory:     integer("free_memory"),
-  totalMemory:    integer("total_memory"),
+  freeMemory:     bigint("free_memory", { mode: "number" }),
+  totalMemory:    bigint("total_memory", { mode: "number" }),
   identityName:   text("identity_name"),
+  rawInterfaces:  jsonb("raw_interfaces"),
+  rawIpAddresses: jsonb("raw_ip_addresses"),
+}, (t) => [
+  primaryKey({ columns: [t.id, t.polledAt] }),
+  index("idx_server_snapshots_server_time").on(t.serverId, t.polledAt),
+])
 
-  // raw JSON payloads for future use
-  rawInterfaces:  text("raw_interfaces"),
-  rawIpAddresses: text("raw_ip_addresses"),
-})
-
-// ── filter_rules ───────────────────────────────────────────────────────────────
-
-export const filterRules = sqliteTable("filter_rules", {
-  id:              integer("id").primaryKey({ autoIncrement: true }),
-  serverId:        integer("server_id")
-                    .notNull()
-                    .references(() => servers.id, { onDelete: "cascade" }),
+export const filterRules = pgTable("filter_rules", {
+  id:              idIdentity().primaryKey(),
+  serverId:        intPkRef().references(() => servers.id, { onDelete: "cascade" }),
   sortOrder:       integer("sort_order").notNull().default(0),
   community:       text("community").notNull(),
   communityName:   text("community_name"),
@@ -78,17 +85,15 @@ export const filterRules = sqliteTable("filter_rules", {
   gateway:         text("gateway").notNull().default(""),
   gatewayTunnelId: text("gateway_tunnel_id").notNull().default(""),
   description:     text("description").notNull().default(""),
-  createdAt:       text("created_at").notNull().default(sql`(datetime('now'))`),
-  updatedAt:       text("updated_at").notNull().default(sql`(datetime('now'))`),
-})
+  createdAt:       ts("created_at").notNull().defaultNow(),
+  updatedAt:       ts("updated_at").notNull().defaultNow(),
+}, (t) => [
+  index("idx_filter_rules_server_sort").on(t.serverId, t.sortOrder),
+])
 
-// ── recursive_routes ───────────────────────────────────────────────────────────
-
-export const recursiveRoutes = sqliteTable("recursive_routes", {
-  id:            integer("id").primaryKey({ autoIncrement: true }),
-  serverId:      integer("server_id")
-                  .notNull()
-                  .references(() => servers.id, { onDelete: "cascade" }),
+export const recursiveRoutes = pgTable("recursive_routes", {
+  id:            idIdentity().primaryKey(),
+  serverId:      intPkRef().references(() => servers.id, { onDelete: "cascade" }),
   sortOrder:     integer("sort_order").notNull().default(0),
   dstAddress:    text("dst_address").notNull(),
   gateway:       text("gateway").notNull(),
@@ -99,70 +104,51 @@ export const recursiveRoutes = sqliteTable("recursive_routes", {
   checkGateway:  text("check_gateway").notNull().default(""),
   country:       text("country").notNull().default(""),
   comment:       text("comment").notNull().default(""),
-  disabled:      integer("disabled", { mode: "boolean" }).notNull().default(false),
-  createdAt:     text("created_at").notNull().default(sql`(datetime('now'))`),
-  updatedAt:     text("updated_at").notNull().default(sql`(datetime('now'))`),
-})
+  disabled:      boolean("disabled").notNull().default(false),
+  createdAt:     ts("created_at").notNull().defaultNow(),
+  updatedAt:     ts("updated_at").notNull().defaultNow(),
+}, (t) => [
+  index("idx_recursive_routes_server_sort").on(t.serverId, t.sortOrder),
+])
 
-// ── traffic collection settings ────────────────────────────────────────────────
-
-export const trafficSettings = sqliteTable("traffic_settings", {
-  id:             integer("id").primaryKey(),
-  enabled:        integer("enabled", { mode: "boolean" }).notNull().default(true),
+export const trafficSettings = pgTable("traffic_settings", {
+  id:             idSingleton(),
+  enabled:        boolean("enabled").notNull().default(true),
   intervalSec:    integer("interval_sec").notNull().default(30),
   retentionDays:  integer("retention_days").notNull().default(14),
-  lastCollectedAt: text("last_collected_at"),
+  lastCollectedAt: ts("last_collected_at"),
   lastDurationMs: integer("last_duration_ms"),
   lastError:      text("last_error"),
-  createdAt:      text("created_at").notNull().default(sql`(datetime('now'))`),
-  updatedAt:      text("updated_at").notNull().default(sql`(datetime('now'))`),
+  createdAt:      ts("created_at").notNull().defaultNow(),
+  updatedAt:      ts("updated_at").notNull().defaultNow(),
 })
 
-/** Настройки фоновой проверки доступности RouterOS REST API по серверам каталога. */
-export const serversApiPingSettings = sqliteTable("servers_api_ping_settings", {
-  id:             integer("id").primaryKey(),
-  enabled:        integer("enabled", { mode: "boolean" }).notNull().default(false),
+export const serversApiPingSettings = pgTable("servers_api_ping_settings", {
+  id:             idSingleton(),
+  enabled:        boolean("enabled").notNull().default(false),
   intervalSec:    integer("interval_sec").notNull().default(120),
-  lastCollectedAt: text("last_collected_at"),
+  lastCollectedAt: ts("last_collected_at"),
   lastDurationMs: integer("last_duration_ms"),
   lastError:      text("last_error"),
-  createdAt:      text("created_at").notNull().default(sql`(datetime('now'))`),
-  updatedAt:      text("updated_at").notNull().default(sql`(datetime('now'))`),
+  createdAt:      ts("created_at").notNull().defaultNow(),
+  updatedAt:      ts("updated_at").notNull().defaultNow(),
 })
 
-/** Сырые пробы REST `/system/identity` по серверам — для UI сбора и для `buildSignalSnapshot` (алерты). */
-export const serversRestPingSamples = sqliteTable("servers_rest_ping_samples", {
-  id:         integer("id").primaryKey({ autoIncrement: true }),
-  serverId:   integer("server_id")
-    .notNull()
-    .references(() => servers.id, { onDelete: "cascade" }),
-  sampledAt:  text("sampled_at").notNull(),
-  ok:         integer("ok", { mode: "boolean" }).notNull(),
+export const serversRestPingSamples = pgTable("servers_rest_ping_samples", {
+  id:         idIdentity(),
+  serverId:   intPkRef().references(() => servers.id, { onDelete: "cascade" }),
+  sampledAt:  ts("sampled_at").notNull(),
+  ok:         boolean("ok").notNull(),
   latencyMs:  integer("latency_ms"),
   error:      text("error"),
-})
+}, (t) => [
+  primaryKey({ columns: [t.id, t.sampledAt] }),
+  index("idx_servers_rest_ping_samples_server_id").on(t.serverId, t.sampledAt),
+])
 
-/** Сырые снимки GRE для алертов — пишет джоба `gre_bgp`. */
-export const alertGreTunnelSamples = sqliteTable("alert_gre_tunnel_samples", {
-  id:          integer("id").primaryKey({ autoIncrement: true }),
-  sampledAt:   text("sampled_at").notNull(),
-  targetLabel: text("target_label").notNull(),
-  status:      text("status").notNull(),
-})
-
-/** Сырые снимки BGP-сессий для алертов — пишет джоба `gre_bgp`. */
-export const alertBgpPeerSamples = sqliteTable("alert_bgp_peer_samples", {
-  id:        integer("id").primaryKey({ autoIncrement: true }),
-  sampledAt: text("sampled_at").notNull(),
-  peerKey:   text("peer_key").notNull(),
-  state:     text("state").notNull(),
-})
-
-// ── raw traffic samples (per server/interface/timepoint) ──────────────────────
-
-export const trafficFlowSettings = sqliteTable("traffic_flow_settings", {
-  id:              integer("id").primaryKey(),
-  enabled:         integer("enabled", { mode: "boolean" }).notNull().default(false),
+export const trafficFlowSettings = pgTable("traffic_flow_settings", {
+  id:              idSingleton(),
+  enabled:         boolean("enabled").notNull().default(false),
   collectorIp:     text("collector_ip").notNull().default("10.255.254.1"),
   flowListenPort:  integer("flow_listen_port").notNull().default(4739),
   wgListenPort:    integer("wg_listen_port").notNull().default(51821),
@@ -170,264 +156,265 @@ export const trafficFlowSettings = sqliteTable("traffic_flow_settings", {
   publicEndpoint:  text("public_endpoint").notNull().default(""),
   hostPublicKey:   text("host_public_key").notNull().default(""),
   hostPrivateKey:  text("host_private_key").notNull().default(""),
-  hubServerId:     integer("hub_server_id"),
+  hubServerId:     bigint("hub_server_id", { mode: "number" }),
   retentionHours:  integer("retention_hours").notNull().default(24),
   topN:            integer("top_n").notNull().default(200),
-  mapServiceMinSharePct: real("map_service_min_share_pct").notNull().default(5),
-  lastDatagramAt:  text("last_datagram_at"),
+  mapServiceMinSharePct: doublePrecision("map_service_min_share_pct").notNull().default(5),
+  lastDatagramAt:  ts("last_datagram_at"),
   lastExporterIp:  text("last_exporter_ip"),
   lastError:       text("last_error"),
-  packetsReceived: integer("packets_received").notNull().default(0),
-  peersJson:       text("peers_json").notNull().default("[]"),
-  createdAt:       text("created_at").notNull().default(sql`(datetime('now'))`),
-  updatedAt:       text("updated_at").notNull().default(sql`(datetime('now'))`),
+  packetsReceived: bigint("packets_received", { mode: "number" }).notNull().default(0),
+  peersJson:       jsonb("peers_json").notNull().default(sql`'[]'::jsonb`),
+  createdAt:       ts("created_at").notNull().defaultNow(),
+  updatedAt:       ts("updated_at").notNull().defaultNow(),
 })
 
-export const flowMinuteStats = sqliteTable("flow_minute_stats", {
-  serverId:      integer("server_id").notNull(),
-  bucketAt:      text("bucket_at").notNull(),
-  bytes:         integer("bytes").notNull().default(0),
-  packets:       integer("packets").notNull().default(0),
+export const flowMinuteStats = pgTable("flow_minute_stats", {
+  serverId:      bigint("server_id", { mode: "number" }).notNull()
+                   .references(() => servers.id, { onDelete: "cascade" }),
+  bucketAt:      ts("bucket_at").notNull(),
+  bytes:         bigint("bytes", { mode: "number" }).notNull().default(0),
+  packets:       bigint("packets", { mode: "number" }).notNull().default(0),
   uniqueSrc:     integer("unique_src").notNull().default(0),
   uniqueDst:     integer("unique_dst").notNull().default(0),
   conversations: integer("conversations").notNull().default(0),
 }, (t) => [
-  uniqueIndex("idx_flow_minute_stats_pk").on(t.serverId, t.bucketAt),
+  primaryKey({ columns: [t.serverId, t.bucketAt] }),
 ])
 
-export const flowMinuteDims = sqliteTable("flow_minute_dims", {
-  serverId: integer("server_id").notNull(),
-  bucketAt: text("bucket_at").notNull(),
+export const flowMinuteDims = pgTable("flow_minute_dims", {
+  serverId: bigint("server_id", { mode: "number" }).notNull()
+              .references(() => servers.id, { onDelete: "cascade" }),
+  bucketAt: ts("bucket_at").notNull(),
   dim:      text("dim").notNull(),
   key:      text("key").notNull(),
-  bytes:    integer("bytes").notNull().default(0),
-  packets:  integer("packets").notNull().default(0),
+  bytes:    bigint("bytes", { mode: "number" }).notNull().default(0),
+  packets:  bigint("packets", { mode: "number" }).notNull().default(0),
 }, (t) => [
-  uniqueIndex("idx_flow_minute_dims_pk").on(t.serverId, t.bucketAt, t.dim, t.key),
+  primaryKey({ columns: [t.serverId, t.bucketAt, t.dim, t.key] }),
+  index("idx_flow_minute_dims_time").on(t.bucketAt, t.dim),
 ])
 
-export const flowDailyDims = sqliteTable("flow_daily_dims", {
-  serverId: integer("server_id").notNull(),
-  day:      text("day").notNull(),
+export const flowDailyDims = pgTable("flow_daily_dims", {
+  serverId: bigint("server_id", { mode: "number" }).notNull()
+              .references(() => servers.id, { onDelete: "cascade" }),
+  day:      date("day", { mode: "string" }).notNull(),
   dim:      text("dim").notNull(),
   key:      text("key").notNull(),
-  bytes:    integer("bytes").notNull().default(0),
-  packets:  integer("packets").notNull().default(0),
+  bytes:    bigint("bytes", { mode: "number" }).notNull().default(0),
+  packets:  bigint("packets", { mode: "number" }).notNull().default(0),
 }, (t) => [
-  uniqueIndex("idx_flow_daily_dims_pk").on(t.serverId, t.day, t.dim, t.key),
+  primaryKey({ columns: [t.serverId, t.day, t.dim, t.key] }),
+  index("idx_flow_daily_dims_day").on(t.day, t.dim),
 ])
 
-export const flowBuckets = sqliteTable("flow_buckets", {
-  id:        integer("id").primaryKey({ autoIncrement: true }),
-  serverId:  integer("server_id")
-               .notNull()
-               .references(() => servers.id, { onDelete: "cascade" }),
-  bucketAt:  text("bucket_at").notNull(),
+export const flowBuckets = pgTable("flow_buckets", {
+  serverId:  intPkRef().references(() => servers.id, { onDelete: "cascade" }),
+  bucketAt:  ts("bucket_at").notNull(),
   src:       text("src").notNull(),
   dst:       text("dst").notNull(),
   proto:     integer("proto").notNull().default(0),
   srcPort:   integer("src_port").notNull().default(0),
   dstPort:   integer("dst_port").notNull().default(0),
-  bytes:     integer("bytes").notNull().default(0),
-  packets:   integer("packets").notNull().default(0),
+  bytes:     bigint("bytes", { mode: "number" }).notNull().default(0),
+  packets:   bigint("packets", { mode: "number" }).notNull().default(0),
   inIface:   text("in_iface").notNull().default(""),
   outIface:  text("out_iface").notNull().default(""),
   nextHop:   text("next_hop").notNull().default(""),
-  flowStartMs: integer("flow_start_ms").notNull().default(0),
-  flowEndMs:   integer("flow_end_ms").notNull().default(0),
+  flowStartMs: bigint("flow_start_ms", { mode: "number" }).notNull().default(0),
+  flowEndMs:   bigint("flow_end_ms", { mode: "number" }).notNull().default(0),
 }, (t) => [
-  uniqueIndex("idx_flow_buckets_unique").on(
-    t.serverId, t.bucketAt, t.src, t.dst, t.proto, t.srcPort, t.dstPort, t.inIface,
-  ),
+  primaryKey({
+    name: "flow_buckets_pkey",
+    columns: [t.serverId, t.bucketAt, t.src, t.dst, t.proto, t.srcPort, t.dstPort, t.inIface],
+  }),
+  index("idx_flow_buckets_server_time").on(t.serverId, t.bucketAt),
 ])
 
-export const flowIpMeta = sqliteTable("flow_ip_meta", {
+export const flowIpMeta = pgTable("flow_ip_meta", {
   prefix:    text("prefix").primaryKey(),
   asn:       integer("asn").notNull().default(0),
   country:   text("country").notNull().default(""),
-  lat:       real("lat"),
-  lng:       real("lng"),
+  lat:       doublePrecision("lat"),
+  lng:       doublePrecision("lng"),
   holder:    text("holder").notNull().default(""),
   ok:        integer("ok").notNull().default(1),
-  fetchedAt: text("fetched_at").notNull(),
+  fetchedAt: ts("fetched_at").notNull(),
 })
 
-export const flowAsnMeta = sqliteTable("flow_asn_meta", {
+export const flowAsnMeta = pgTable("flow_asn_meta", {
   asn:       integer("asn").primaryKey(),
   holder:    text("holder").notNull().default(""),
-  fetchedAt: text("fetched_at").notNull(),
+  fetchedAt: ts("fetched_at").notNull(),
 })
 
-export const trafficSamples = sqliteTable("traffic_samples", {
-  id:            integer("id").primaryKey({ autoIncrement: true }),
-  serverId:      integer("server_id")
-                  .notNull()
-                  .references(() => servers.id, { onDelete: "cascade" }),
+export const trafficSamples = pgTable("traffic_samples", {
+  id:            idIdentity(),
+  serverId:      intPkRef().references(() => servers.id, { onDelete: "cascade" }),
   interfaceName: text("interface_name").notNull(),
   peerPublicKey: text("peer_public_key").notNull().default(""),
-  sampledAt:     text("sampled_at").notNull(),
-  rxBytes:       integer("rx_bytes").notNull().default(0),
-  txBytes:       integer("tx_bytes").notNull().default(0),
-  rxBps:         integer("rx_bps").notNull().default(0),
-  txBps:         integer("tx_bps").notNull().default(0),
-  running:       integer("running", { mode: "boolean" }).notNull().default(false),
-  disabled:      integer("disabled", { mode: "boolean" }).notNull().default(false),
-})
+  sampledAt:     ts("sampled_at").notNull(),
+  rxBytes:       bigint("rx_bytes", { mode: "number" }).notNull().default(0),
+  txBytes:       bigint("tx_bytes", { mode: "number" }).notNull().default(0),
+  rxBps:         bigint("rx_bps", { mode: "number" }).notNull().default(0),
+  txBps:         bigint("tx_bps", { mode: "number" }).notNull().default(0),
+  running:       boolean("running").notNull().default(false),
+  disabled:      boolean("disabled").notNull().default(false),
+}, (t) => [
+  primaryKey({ columns: [t.id, t.sampledAt] }),
+  index("idx_traffic_samples_server_time").on(t.serverId, t.sampledAt),
+  index("idx_traffic_samples_server_iface_time").on(t.serverId, t.interfaceName, t.sampledAt),
+])
 
-// ── uptime monitor settings ────────────────────────────────────────────────────
-
-export const uptimeSettings = sqliteTable("uptime_settings", {
-  id:             integer("id").primaryKey(),
-  /** Устаревший агрегат: синхронизируется как resources ∨ ping ∨ speed (для совместимости). */
-  enabled:        integer("enabled", { mode: "boolean" }).notNull().default(true),
-  resourcesEnabled: integer("resources_enabled", { mode: "boolean" }).notNull().default(true),
-  pingEnabled:    integer("ping_enabled", { mode: "boolean" }).notNull().default(true),
-  speedEnabled:   integer("speed_enabled", { mode: "boolean" }).notNull().default(true),
+export const uptimeSettings = pgTable("uptime_settings", {
+  id:             idSingleton(),
+  enabled:        boolean("enabled").notNull().default(true),
+  resourcesEnabled: boolean("resources_enabled").notNull().default(true),
+  pingEnabled:    boolean("ping_enabled").notNull().default(true),
+  speedEnabled:   boolean("speed_enabled").notNull().default(true),
   intervalSec:    integer("interval_sec").notNull().default(15),
   probeIntervalSec: integer("probe_interval_sec").notNull().default(15),
   speedIntervalSec: integer("speed_interval_sec").notNull().default(60),
   retentionDays:  integer("retention_days").notNull().default(14),
-  lastCollectedAt: text("last_collected_at"),
+  lastCollectedAt: ts("last_collected_at"),
   lastDurationMs: integer("last_duration_ms"),
   lastError:      text("last_error"),
-  createdAt:      text("created_at").notNull().default(sql`(datetime('now'))`),
-  updatedAt:      text("updated_at").notNull().default(sql`(datetime('now'))`),
+  createdAt:      ts("created_at").notNull().defaultNow(),
+  updatedAt:      ts("updated_at").notNull().defaultNow(),
 })
 
-export const uptimeProbes = sqliteTable("uptime_probes", {
+export const uptimeProbes = pgTable("uptime_probes", {
   id:          text("id").primaryKey(),
-  srcServerId: integer("src_server_id")
-                .notNull()
+  srcServerId: bigint("src_server_id", { mode: "number" }).notNull()
                 .references(() => servers.id, { onDelete: "cascade" }),
   srcInterface: text("src_interface").notNull().default(""),
   name:        text("name").notNull(),
   target:      text("target").notNull(),
   probeFilter: text("probe_filter").notNull().default("—"),
-  enabled:     integer("enabled", { mode: "boolean" }).notNull().default(true),
-  /** 0 — брать глобальный probe_interval_sec из uptime_settings */
+  enabled:     boolean("enabled").notNull().default(true),
   intervalSec: integer("interval_sec").notNull().default(0),
-  /** Выводить пробу в блоке «Активные пробы» на дашборде */
-  showOnDashboard: integer("show_on_dashboard", { mode: "boolean" }).notNull().default(false),
+  showOnDashboard: boolean("show_on_dashboard").notNull().default(false),
   sortOrder:   integer("sort_order").notNull().default(0),
-  createdAt:   text("created_at").notNull().default(sql`(datetime('now'))`),
-  updatedAt:   text("updated_at").notNull().default(sql`(datetime('now'))`),
-})
+  createdAt:   ts("created_at").notNull().defaultNow(),
+  updatedAt:   ts("updated_at").notNull().defaultNow(),
+}, (t) => [
+  index("idx_uptime_probes_server_sort").on(t.srcServerId, t.sortOrder),
+])
 
-export const uptimeProbeSamples = sqliteTable("uptime_probe_samples", {
-  id:        integer("id").primaryKey({ autoIncrement: true }),
-  probeId:   text("probe_id")
-              .notNull()
-              .references(() => uptimeProbes.id, { onDelete: "cascade" }),
-  sampledAt: text("sampled_at").notNull(),
+export const uptimeProbeSamples = pgTable("uptime_probe_samples", {
+  id:        idIdentity(),
+  probeId:   text("probe_id").notNull().references(() => uptimeProbes.id, { onDelete: "cascade" }),
+  sampledAt: ts("sampled_at").notNull(),
   rttMs:     integer("rtt_ms"),
   lossPct:   integer("loss_pct").notNull().default(0),
   status:    text("status", { enum: ["up", "warn", "down"] }).notNull().default("down"),
-})
+}, (t) => [
+  primaryKey({ columns: [t.id, t.sampledAt] }),
+  index("idx_uptime_probe_samples_probe_time").on(t.probeId, t.sampledAt),
+])
 
-export const uptimeResourceSamples = sqliteTable("uptime_resource_samples", {
-  id:            integer("id").primaryKey({ autoIncrement: true }),
-  serverId:      integer("server_id")
-                  .notNull()
-                  .references(() => servers.id, { onDelete: "cascade" }),
-  sampledAt:     text("sampled_at").notNull(),
+export const uptimeResourceSamples = pgTable("uptime_resource_samples", {
+  id:            idIdentity(),
+  serverId:      intPkRef().references(() => servers.id, { onDelete: "cascade" }),
+  sampledAt:     ts("sampled_at").notNull(),
   status:        text("status", { enum: ["online", "offline"] }).notNull().default("offline"),
   cpuLoad:       integer("cpu_load").notNull().default(0),
-  freeMemory:    integer("free_memory").notNull().default(0),
-  totalMemory:   integer("total_memory").notNull().default(0),
-  freeHddSpace:  integer("free_hdd_space").notNull().default(0),
-  totalHddSpace: integer("total_hdd_space").notNull().default(0),
-  uptimeSeconds: integer("uptime_seconds").notNull().default(0),
+  freeMemory:    bigint("free_memory", { mode: "number" }).notNull().default(0),
+  totalMemory:   bigint("total_memory", { mode: "number" }).notNull().default(0),
+  freeHddSpace:  bigint("free_hdd_space", { mode: "number" }).notNull().default(0),
+  totalHddSpace: bigint("total_hdd_space", { mode: "number" }).notNull().default(0),
+  uptimeSeconds: bigint("uptime_seconds", { mode: "number" }).notNull().default(0),
   boardName:     text("board_name").notNull().default(""),
   rosVersion:    text("ros_version").notNull().default(""),
-})
+}, (t) => [
+  primaryKey({ columns: [t.id, t.sampledAt] }),
+  index("idx_uptime_resource_samples_server_time").on(t.serverId, t.sampledAt),
+])
 
-export const uptimeSpeedProbes = sqliteTable("uptime_speed_probes", {
+export const uptimeSpeedProbes = pgTable("uptime_speed_probes", {
   id:           text("id").primaryKey(),
-  srcServerId:  integer("src_server_id")
-                 .notNull()
+  srcServerId:  bigint("src_server_id", { mode: "number" }).notNull()
                  .references(() => servers.id, { onDelete: "cascade" }),
-  dstServerId:  integer("dst_server_id")
-                 .notNull()
+  dstServerId:  bigint("dst_server_id", { mode: "number" }).notNull()
                  .references(() => servers.id, { onDelete: "cascade" }),
   srcInterface: text("src_interface").notNull().default(""),
   dstInterface: text("dst_interface").notNull().default(""),
   protocol:     text("protocol", { enum: ["tcp", "udp"] }).notNull().default("tcp"),
   direction:    text("direction", { enum: ["transmit", "receive", "both"] }).notNull().default("both"),
   durationSec:  integer("duration_sec").notNull().default(10),
-  enabled:      integer("enabled", { mode: "boolean" }).notNull().default(true),
-  lastRunAt:    text("last_run_at"),
-  lastTxAvgMbps: real("last_tx_avg_mbps"),
-  lastRxAvgMbps: real("last_rx_avg_mbps"),
+  enabled:      boolean("enabled").notNull().default(true),
+  lastRunAt:    ts("last_run_at"),
+  lastTxAvgMbps: doublePrecision("last_tx_avg_mbps"),
+  lastRxAvgMbps: doublePrecision("last_rx_avg_mbps"),
   lastStatus:   text("last_status", { enum: ["done", "error"] }),
   lastError:    text("last_error"),
   lastPingRttMs:   integer("last_ping_rtt_ms"),
   lastPingLossPct: integer("last_ping_loss_pct"),
-  lastPingAt:      text("last_ping_at"),
+  lastPingAt:      ts("last_ping_at"),
   lastPingError:   text("last_ping_error"),
   sortOrder:    integer("sort_order").notNull().default(0),
-  createdAt:    text("created_at").notNull().default(sql`(datetime('now'))`),
-  updatedAt:    text("updated_at").notNull().default(sql`(datetime('now'))`),
-})
+  createdAt:    ts("created_at").notNull().defaultNow(),
+  updatedAt:    ts("updated_at").notNull().defaultNow(),
+}, (t) => [
+  index("idx_uptime_speed_probes_src_sort").on(t.srcServerId, t.sortOrder),
+])
 
-// ── EvoBGP integration (URL + API key на сервере) ─────────────────────────────
-
-export const evobgpSettings = sqliteTable("evobgp_settings", {
-  id:       integer("id").primaryKey(),
+export const evobgpSettings = pgTable("evobgp_settings", {
+  id:       idSingleton(),
   baseUrl:  text("base_url").notNull().default(""),
   apiKey:   text("api_key").notNull().default(""),
-  enabled:  integer("enabled", { mode: "boolean" }).notNull().default(false),
-  updatedAt: text("updated_at").notNull().default(sql`(datetime('now'))`),
+  enabled:  boolean("enabled").notNull().default(false),
+  updatedAt: ts("updated_at").notNull().defaultNow(),
 })
 
-/** Единственная строка id=1: токен и чат Telegram для оповещений. */
-export const alertTelegramSettings = sqliteTable("alert_telegram_settings", {
-  id:        integer("id").primaryKey(),
+export const alertTelegramSettings = pgTable("alert_telegram_settings", {
+  id:        idSingleton(),
   botToken:  text("bot_token").notNull().default(""),
   chatId:    text("chat_id").notNull().default(""),
-  /** Тема супергруппы (forum): `message_thread_id` в Bot API; NULL — общий чат */
   messageThreadId: integer("message_thread_id"),
-  updatedAt: text("updated_at").notNull().default(sql`(datetime('now'))`),
+  updatedAt: ts("updated_at").notNull().defaultNow(),
 })
 
-export const acmeSettings = sqliteTable("acme_settings", {
-  id:                 integer("id").primaryKey(),
+export const acmeSettings = pgTable("acme_settings", {
+  id:                 idSingleton(),
   directoryUrl:       text("directory_url").notNull().default("https://acme-v02.api.letsencrypt.org/directory"),
   cloudflareApiToken: text("cloudflare_api_token").notNull().default(""),
   defaultZoneId:      text("default_zone_id").notNull().default(""),
   accountPrivateKey:  text("account_private_key").notNull().default(""),
-  updatedAt:          text("updated_at").notNull().default(sql`(datetime('now'))`),
+  updatedAt:          ts("updated_at").notNull().defaultNow(),
 })
 
-export const certificateIssueJobs = sqliteTable("certificate_issue_jobs", {
+export const certificateIssueJobs = pgTable("certificate_issue_jobs", {
   id:          text("id").primaryKey(),
   status:      text("status", { enum: ["queued", "running", "done", "failed"] }).notNull().default("queued"),
   step:        text("step").notNull().default("queued"),
   source:      text("source", { enum: ["manual", "scheduler"] }).notNull().default("manual"),
-  serverId:    text("server_id").notNull(),
+  serverId:    bigint("server_id", { mode: "number" }).notNull()
+                 .references(() => servers.id, { onDelete: "cascade" }),
   certName:    text("cert_name").notNull(),
-  domainNames: text("domain_names").notNull(),
+  domainNames: jsonb("domain_names").notNull(),
   keyType:     text("key_type").notNull().default("rsa2048"),
   trustStore:  text("trust_store").notNull().default("www,api"),
-  requestedAt: text("requested_at").notNull().default(sql`(datetime('now'))`),
-  startedAt:   text("started_at"),
-  finishedAt:  text("finished_at"),
+  requestedAt: ts("requested_at").notNull().defaultNow(),
+  startedAt:   ts("started_at"),
+  finishedAt:  ts("finished_at"),
   error:       text("error"),
 })
 
-export const certificateRenewSettings = sqliteTable("certificate_renew_settings", {
-  id:              integer("id").primaryKey(),
-  enabled:         integer("enabled", { mode: "boolean" }).notNull().default(true),
+export const certificateRenewSettings = pgTable("certificate_renew_settings", {
+  id:              idSingleton(),
+  enabled:         boolean("enabled").notNull().default(true),
   intervalSec:     integer("interval_sec").notNull().default(21600),
   renewBeforeDays: integer("renew_before_days").notNull().default(30),
-  lastCollectedAt: text("last_collected_at"),
+  lastCollectedAt: ts("last_collected_at"),
   lastDurationMs:  integer("last_duration_ms"),
   lastError:       text("last_error"),
-  updatedAt:       text("updated_at").notNull().default(sql`(datetime('now'))`),
+  updatedAt:       ts("updated_at").notNull().defaultNow(),
 })
 
-export const backupScheduleSettings = sqliteTable("backup_schedule_settings", {
-  id:             integer("id").primaryKey(),
-  enabled:        integer("enabled", { mode: "boolean" }).notNull().default(true),
+export const backupScheduleSettings = pgTable("backup_schedule_settings", {
+  id:             idSingleton(),
+  enabled:        boolean("enabled").notNull().default(true),
   frequency:      text("frequency", { enum: ["daily", "weekly", "monthly"] }).notNull().default("daily"),
   hour:           integer("hour").notNull().default(3),
   minute:         integer("minute").notNull().default(0),
@@ -435,167 +422,153 @@ export const backupScheduleSettings = sqliteTable("backup_schedule_settings", {
   monthDay:       integer("month_day").notNull().default(1),
   keepCount:      integer("keep_count").notNull().default(7),
   format:         text("format", { enum: ["rsc", "backup"] }).notNull().default("rsc"),
-  serverIdsJson:  text("server_ids_json").notNull().default("[]"),
-  lastRunAt:      text("last_run_at"),
+  serverIdsJson:  jsonb("server_ids_json").notNull().default(sql`'[]'::jsonb`),
+  lastRunAt:      ts("last_run_at"),
   lastDurationMs: integer("last_duration_ms"),
   lastError:      text("last_error"),
-  updatedAt:      text("updated_at").notNull().default(sql`(datetime('now'))`),
+  updatedAt:      ts("updated_at").notNull().defaultNow(),
 })
 
-export const backupEntries = sqliteTable("backup_entries", {
+export const backupEntries = pgTable("backup_entries", {
   id:         text("id").primaryKey(),
-  serverId:   text("server_id").notNull(),
+  serverId:   bigint("server_id", { mode: "number" })
+                .references(() => servers.id, { onDelete: "set null" }),
   serverName: text("server_name").notNull(),
   filename:   text("filename").notNull(),
-  sizeBytes:  integer("size_bytes").notNull(),
+  sizeBytes:  bigint("size_bytes", { mode: "number" }).notNull(),
   kind:       text("kind", { enum: ["manual", "auto"] }).notNull().default("manual"),
   notes:      text("notes"),
-  createdAt:  text("created_at").notNull(),
-})
+  createdAt:  ts("created_at").notNull(),
+}, (t) => [
+  uniqueIndex("idx_backup_entries_filename").on(t.filename),
+  index("idx_backup_entries_server_created").on(t.serverId, t.createdAt),
+])
 
-/** Группы правил: ANY = хотя бы одно; ALL = все одновременно в окне тика. */
-export const alertGroups = sqliteTable("alert_groups", {
+export const alertGroups = pgTable("alert_groups", {
   id:                text("id").primaryKey(),
   name:              text("name").notNull(),
   combineMode:       text("combine_mode", { enum: ["any", "all"] }).notNull().default("any"),
-  enabled:           integer("enabled", { mode: "boolean" }).notNull().default(true),
-  /** Переопределение cooldown для агрегата группы; NULL — по умолчанию 5м */
+  enabled:           boolean("enabled").notNull().default(true),
   cooldownOverride:  text("cooldown_override", {
     enum: ["1м", "5м", "15м", "1ч", "4ч", "24ч"],
   }),
-  createdAt:         text("created_at").notNull().default(sql`(datetime('now'))`),
-  updatedAt:         text("updated_at").notNull().default(sql`(datetime('now'))`),
+  createdAt:         ts("created_at").notNull().defaultNow(),
+  updatedAt:         ts("updated_at").notNull().defaultNow(),
 })
 
-/** Правила оповещений (UI /alerts). */
-export const alertRules = sqliteTable("alert_rules", {
+export const alertRules = pgTable("alert_rules", {
   id:         text("id").primaryKey(),
   name:       text("name").notNull(),
   type:       text("type", {
     enum: ["gre-tunnel", "bgp-peer", "bgp-prefix", "gre-client", "server", "rtt", "loss", "traffic"],
   }).notNull(),
-  /** Сводная подпись (первый target или join); для совместимости и поиска */
   target:     text("target").notNull(),
   condition:  text("condition").notNull(),
   severity:   text("severity", { enum: ["critical", "warning", "info"] }).notNull(),
-  enabled:    integer("enabled", { mode: "boolean" }).notNull().default(true),
+  enabled:    boolean("enabled").notNull().default(true),
   cooldown:   text("cooldown", {
     enum: ["1м", "5м", "15м", "1ч", "4ч", "24ч"],
   }).notNull().default("5м"),
   chatId:     text("rule_chat_id").notNull().default(""),
-  /** NULL / 0 — выкл. Секунды: уведомление только если условие держится столько времени без «отмены» (восстановление сигнала). */
   confirmStabilitySec: integer("confirm_stability_sec"),
-  /** Политика recovery-уведомления для правила. */
   recoveryMode: text("recovery_mode", {
     enum: ["always", "never", "conditional"],
   }).notNull().default("always"),
-  /** Доп. задержка подтверждения для recovery при `conditional`; NULL — без доп. ожидания. */
   recoveryStabilitySec: integer("recovery_stability_sec"),
-  /** NULL — правило вне группы (отдельные отправки по cooldown правила) */
-  groupId:    text("group_id"),
-  createdAt:  text("created_at").notNull().default(sql`(datetime('now'))`),
-  updatedAt:  text("updated_at").notNull().default(sql`(datetime('now'))`),
+  groupId:    text("group_id").references(() => alertGroups.id, { onDelete: "set null" }),
+  createdAt:  ts("created_at").notNull().defaultNow(),
+  updatedAt:  ts("updated_at").notNull().defaultNow(),
 })
 
-/** Несколько объектов на правило; срабатывание по OR (хотя бы один). */
-export const alertRuleTargets = sqliteTable("alert_rule_targets", {
+export const alertRuleTargets = pgTable("alert_rule_targets", {
   id:        text("id").primaryKey(),
-  ruleId:    text("rule_id").notNull(),
+  ruleId:    text("rule_id").notNull().references(() => alertRules.id, { onDelete: "cascade" }),
   target:    text("target").notNull(),
   sortIndex: integer("sort_index").notNull().default(0),
-})
+}, (t) => [
+  index("idx_alert_rule_targets_rule").on(t.ruleId),
+])
 
-/** Несколько условий на правило; срабатывание по OR (любое из выбранных). */
-export const alertRuleConditions = sqliteTable("alert_rule_conditions", {
+export const alertRuleConditions = pgTable("alert_rule_conditions", {
   id:             text("id").primaryKey(),
-  ruleId:         text("rule_id").notNull(),
+  ruleId:         text("rule_id").notNull().references(() => alertRules.id, { onDelete: "cascade" }),
   conditionLine:  text("condition_line").notNull(),
   sortIndex:      integer("sort_index").notNull().default(0),
-})
+}, (t) => [
+  index("idx_alert_rule_conditions_rule").on(t.ruleId),
+])
 
-/** Состояние движка: cooldown / дедуп по ключу rule:id или group:id */
-export const alertEngineState = sqliteTable("alert_engine_state", {
+export const alertEngineState = pgTable("alert_engine_state", {
   scopeKey:        text("scope_key").primaryKey(),
   lastFiredAt:     text("last_fired_at").notNull().default(""),
   lastPayloadHash: text("last_payload_hash"),
 })
 
-/** Снимок прошлого тика для live-сигналов (GRE/BGP): переходы «offline» / «восстановился». */
-export const alertEnginePrevLive = sqliteTable("alert_engine_prev_live", {
+export const alertEnginePrevLive = pgTable("alert_engine_prev_live", {
   kind:         text("kind", { enum: ["gre", "bgp"] }).primaryKey(),
-  payloadJson:  text("payload_json").notNull().default("{}"),
-  updatedAt:    text("updated_at").notNull().default(sql`(datetime('now'))`),
+  payloadJson:  jsonb("payload_json").notNull().default(sql`'{}'::jsonb`),
+  updatedAt:    ts("updated_at").notNull().defaultNow(),
 })
 
-/** Ожидание стабильности срабатывания по правилу (антидребезг). */
-export const alertEngineConfirmPending = sqliteTable("alert_engine_confirm_pending", {
+export const alertEngineConfirmPending = pgTable("alert_engine_confirm_pending", {
   ruleId:      text("rule_id").primaryKey(),
   payloadHash: text("payload_hash").notNull(),
-  sinceAt:     text("since_at").notNull(),
+  sinceAt:     ts("since_at").notNull(),
 })
 
-/** Задел: несколько получателей Telegram (пока UI не подключён) */
-export const alertDestinations = sqliteTable("alert_destinations", {
-  id:               text("id").primaryKey(),
-  kind:             text("kind", { enum: ["telegram"] }).notNull().default("telegram"),
-  label:            text("label").notNull().default(""),
-  telegramChatId:   text("telegram_chat_id").notNull().default(""),
-  messageThreadId:  integer("message_thread_id"),
-  enabled:          integer("enabled", { mode: "boolean" }).notNull().default(true),
-  createdAt:        text("created_at").notNull().default(sql`(datetime('now'))`),
-})
-
-/** Журнал отправок / срабатываний (персист + при необходимости пополняется воркером). */
-export const alertHistory = sqliteTable("alert_history", {
+export const alertHistory = pgTable("alert_history", {
   id:        text("id").primaryKey(),
   ruleId:    text("rule_id"),
   groupId:   text("group_id"),
   ruleName:  text("rule_name").notNull(),
   severity:  text("severity", { enum: ["critical", "warning", "info"] }).notNull(),
   message:   text("message").notNull(),
-  sentOk:    integer("sent_ok", { mode: "boolean" }).notNull().default(true),
-  firedAt:   text("fired_at").notNull(),
-})
+  sentOk:    boolean("sent_ok").notNull().default(true),
+  firedAt:   ts("fired_at").notNull(),
+}, (t) => [
+  index("idx_alert_history_fired_at").on(t.firedAt),
+  index("idx_alert_history_rule_id").on(t.ruleId),
+])
 
-/** Outbox доставки уведомлений: ретраи и идемпотентность отправки каналов. */
-export const alertOutbox = sqliteTable("alert_outbox", {
+export const alertOutbox = pgTable("alert_outbox", {
   id:           text("id").primaryKey(),
   dedupeKey:    text("dedupe_key").notNull(),
   channel:      text("channel", { enum: ["telegram"] }).notNull().default("telegram"),
   status:       text("status", { enum: ["pending", "sent", "failed"] }).notNull().default("pending"),
   retryCount:   integer("retry_count").notNull().default(0),
   maxRetries:   integer("max_retries").notNull().default(3),
-  nextAttemptAt:text("next_attempt_at").notNull(),
-  payloadJson:  text("payload_json").notNull(),
-  createdAt:    text("created_at").notNull().default(sql`(datetime('now'))`),
-  sentAt:       text("sent_at"),
+  nextAttemptAt: ts("next_attempt_at").notNull(),
+  payloadJson:  jsonb("payload_json").notNull(),
+  createdAt:    ts("created_at").notNull().defaultNow(),
+  sentAt:       ts("sent_at"),
   lastError:    text("last_error"),
+}, (t) => [
+  uniqueIndex("idx_alert_outbox_dedupe").on(t.dedupeKey),
+  index("idx_alert_outbox_status_next_attempt").on(t.status, t.nextAttemptAt),
+])
+
+export const alertEngineCursor = pgTable("alert_engine_cursor", {
+  id:                idSingleton(),
+  lastSourceFinishedAt: ts("last_source_finished_at"),
+  updatedAt:         ts("updated_at").notNull().defaultNow(),
 })
 
-/** Cursor движка: watermark последней обработанной точки snapshot-источников. */
-export const alertEngineCursor = sqliteTable("alert_engine_cursor", {
-  id:                integer("id").primaryKey(),
-  lastSourceFinishedAt: text("last_source_finished_at"),
-  updatedAt:         text("updated_at").notNull().default(sql`(datetime('now'))`),
-})
-
-/** Журнал прогонов планировщика (аудит). */
-export const schedulerRuns = sqliteTable("scheduler_runs", {
+export const schedulerRuns = pgTable("scheduler_runs", {
   id:          text("id").primaryKey(),
   jobKey:      text("job_key").notNull(),
-  startedAt:   text("started_at").notNull(),
-  finishedAt:  text("finished_at").notNull(),
+  startedAt:   ts("started_at").notNull(),
+  finishedAt:  ts("finished_at").notNull(),
   status:      text("status", { enum: ["ok", "error"] }).notNull(),
   error:       text("error"),
   durationMs:  integer("duration_ms").notNull().default(0),
-  /** JSON: см. `SchedulerRunSnapshot` в types/scheduler-run-snapshot.ts */
-  resultJson:  text("result_json"),
-})
+  resultJson:  jsonb("result_json"),
+}, (t) => [
+  index("idx_scheduler_runs_job_time").on(t.jobKey, t.startedAt),
+])
 
-/** Централизованный append-only журнал событий системы. */
-export const events = sqliteTable("events", {
+export const events = pgTable("events", {
   id:           text("id").primaryKey(),
-  createdAt:    text("created_at").notNull(),
+  createdAt:    ts("created_at").notNull(),
   level:        text("level", { enum: ["critical", "warning", "info"] }).notNull(),
   eventType:    text("event_type").notNull(),
   sourceModule: text("source_module").notNull(),
@@ -603,14 +576,21 @@ export const events = sqliteTable("events", {
   message:      text("message").notNull(),
   entityType:   text("entity_type"),
   entityId:     text("entity_id"),
-  payloadJson:  text("payload_json"),
-})
+  payloadJson:  jsonb("payload_json"),
+}, (t) => [
+  index("idx_events_created_at").on(t.createdAt),
+  index("idx_events_level_created_at").on(t.level, t.createdAt),
+  index("idx_events_source_created_at").on(t.sourceModule, t.createdAt),
+  index("idx_events_event_type_created_at").on(t.eventType, t.createdAt),
+])
 
-export const uptimeSpeedTestRuns = sqliteTable("uptime_speed_test_runs", {
+export const uptimeSpeedTestRuns = pgTable("uptime_speed_test_runs", {
   id:                 text("id").primaryKey(),
   probeId:            text("probe_id"),
-  srcServerId:        integer("src_server_id").notNull().references(() => servers.id, { onDelete: "cascade" }),
-  dstServerId:        integer("dst_server_id").notNull().references(() => servers.id, { onDelete: "cascade" }),
+  srcServerId:        bigint("src_server_id", { mode: "number" }).notNull()
+                        .references(() => servers.id, { onDelete: "cascade" }),
+  dstServerId:        bigint("dst_server_id", { mode: "number" }).notNull()
+                        .references(() => servers.id, { onDelete: "cascade" }),
   srcInterface:       text("src_interface").notNull().default(""),
   dstInterface:       text("dst_interface").notNull().default(""),
   srcAddress:         text("src_address"),
@@ -620,73 +600,78 @@ export const uptimeSpeedTestRuns = sqliteTable("uptime_speed_test_runs", {
   protocol:           text("protocol", { enum: ["tcp", "udp"] }).notNull().default("tcp"),
   direction:          text("direction", { enum: ["transmit", "receive", "both"] }).notNull().default("both"),
   durationSec:        integer("duration_sec").notNull().default(10),
-  txAvgMbps:          real("tx_avg_mbps"),
-  rxAvgMbps:          real("rx_avg_mbps"),
+  txAvgMbps:          doublePrecision("tx_avg_mbps"),
+  rxAvgMbps:          doublePrecision("rx_avg_mbps"),
   pingRttMs:          integer("ping_rtt_ms"),
   pingLossPct:        integer("ping_loss_pct"),
   pingError:          text("ping_error"),
   status:             text("status", { enum: ["done", "error"] }).notNull().default("done"),
   error:              text("error"),
-  createdAt:          text("created_at").notNull().default(sql`(datetime('now'))`),
-})
+  createdAt:          ts("created_at").notNull().defaultNow(),
+}, (t) => [
+  index("idx_uptime_speed_test_runs_created_at").on(t.createdAt),
+])
 
-export const internetPathSettings = sqliteTable("internet_path_settings", {
-  id:             integer("id").primaryKey(),
-  enabled:        integer("enabled", { mode: "boolean" }).notNull().default(true),
+export const internetPathSettings = pgTable("internet_path_settings", {
+  id:             idSingleton(),
+  enabled:        boolean("enabled").notNull().default(true),
   intervalSec:    integer("interval_sec").notNull().default(300),
   retentionDays:  integer("retention_days").notNull().default(14),
-  lastCollectedAt: text("last_collected_at"),
+  lastCollectedAt: ts("last_collected_at"),
   lastDurationMs: integer("last_duration_ms"),
   lastError:      text("last_error"),
-  createdAt:      text("created_at").notNull().default(sql`(datetime('now'))`),
-  updatedAt:      text("updated_at").notNull().default(sql`(datetime('now'))`),
+  createdAt:      ts("created_at").notNull().defaultNow(),
+  updatedAt:      ts("updated_at").notNull().defaultNow(),
 })
 
-// ── app users (local catalog, not portal JWT) ────────────────────────────────
-
-export const appUsers = sqliteTable("app_users", {
+export const appUsers = pgTable("app_users", {
   id:          text("id").primaryKey(),
   name:        text("name").notNull().default(""),
   login:       text("login").notNull().unique(),
   email:       text("email").notNull().default(""),
   role:        text("role", { enum: ["admin", "operator", "viewer"] }).notNull().default("viewer"),
-  active:      integer("active", { mode: "boolean" }).notNull().default(true),
+  active:      boolean("active").notNull().default(true),
   avatar:      text("avatar").notNull().default(""),
-  lastSeen:    text("last_seen"),
-  sectionsJson: text("sections_json").notNull().default("[]"),
-  serversJson:  text("servers_json").notNull().default("[]"),
-  createdAt:   text("created_at").notNull().default(sql`(datetime('now'))`),
-  updatedAt:   text("updated_at").notNull().default(sql`(datetime('now'))`),
+  lastSeen:    ts("last_seen"),
+  sectionsJson: jsonb("sections_json").notNull().default(sql`'[]'::jsonb`),
+  serversJson:  jsonb("servers_json").notNull().default(sql`'[]'::jsonb`),
+  createdAt:   ts("created_at").notNull().defaultNow(),
+  updatedAt:   ts("updated_at").notNull().defaultNow(),
 })
 
-export const userInterfaceBindings = sqliteTable("user_interface_bindings", {
+export const userInterfaceBindings = pgTable("user_interface_bindings", {
   id:             text("id").primaryKey(),
-  userId:         text("user_id")
-                    .notNull()
-                    .references(() => appUsers.id, { onDelete: "cascade" }),
-  serverId:       integer("server_id")
-                    .notNull()
-                    .references(() => servers.id, { onDelete: "cascade" }),
+  userId:         text("user_id").notNull().references(() => appUsers.id, { onDelete: "cascade" }),
+  serverId:       intPkRef().references(() => servers.id, { onDelete: "cascade" }),
   interfaceName:  text("interface_name").notNull(),
   interfaceType:  text("interface_type", { enum: ["ether", "gre", "wg", "other"] })
-                    .notNull()
-                    .default("other"),
+                    .notNull().default("other"),
   peerPublicKey:  text("peer_public_key").notNull().default(""),
   peerName:       text("peer_name").notNull().default(""),
   comment:        text("comment").notNull().default(""),
-  createdAt:      text("created_at").notNull().default(sql`(datetime('now'))`),
-  updatedAt:      text("updated_at").notNull().default(sql`(datetime('now'))`),
+  createdAt:      ts("created_at").notNull().defaultNow(),
+  updatedAt:      ts("updated_at").notNull().defaultNow(),
 }, (t) => [
   uniqueIndex("idx_user_iface_bind_server_name_peer").on(t.serverId, t.interfaceName, t.peerPublicKey),
+  index("idx_user_iface_bind_user").on(t.userId),
 ])
 
-export const internetPathSnapshots = sqliteTable("internet_path_snapshots", {
-  id:          integer("id").primaryKey({ autoIncrement: true }),
-  sampledAt:   text("sampled_at").notNull(),
-  payloadJson: text("payload_json").notNull(),
-})
+export const internetPathSnapshots = pgTable("internet_path_snapshots", {
+  id:          idIdentity(),
+  sampledAt:   ts("sampled_at").notNull(),
+  payloadJson: jsonb("payload_json").notNull(),
+}, (t) => [
+  primaryKey({ columns: [t.id, t.sampledAt] }),
+  index("idx_internet_path_snapshots_sampled").on(t.sampledAt),
+])
 
-// ── inferred types ─────────────────────────────────────────────────────────────
+export const dataMigration = pgTable("data_migration", {
+  id:               integer("id").primaryKey(),
+  sqliteImportedAt: ts("sqlite_imported_at"),
+  sqlitePath:       text("sqlite_path"),
+  sqliteSha256:     text("sqlite_sha256"),
+  reportJson:       jsonb("report_json"),
+})
 
 export type Server         = typeof servers.$inferSelect
 export type ServerInsert   = typeof servers.$inferInsert
@@ -722,7 +707,6 @@ export type AlertGroupRow = typeof alertGroups.$inferSelect
 export type AlertRuleRow = typeof alertRules.$inferSelect
 export type AlertRuleTargetRow = typeof alertRuleTargets.$inferSelect
 export type AlertEngineStateRow = typeof alertEngineState.$inferSelect
-export type AlertDestinationRow = typeof alertDestinations.$inferSelect
 export type AlertHistoryRow = typeof alertHistory.$inferSelect
 export type AlertOutboxRow = typeof alertOutbox.$inferSelect
 export type AlertEngineCursorRow = typeof alertEngineCursor.$inferSelect
diff --git a/backend/src/db/sql-bind.test.ts b/backend/src/db/sql-bind.test.ts
new file mode 100644
index 0000000..48eee21
--- /dev/null
+++ b/backend/src/db/sql-bind.test.ts
@@ -0,0 +1,21 @@
+import assert from "node:assert/strict"
+import { bindSql } from "./sql-bind.js"
+
+{
+  const q = bindSql("SELECT 1")
+  assert.deepEqual(q, { text: "SELECT 1", values: [] })
+}
+
+{
+  const q = bindSql("SELECT * FROM t WHERE a = ? AND b = ?", [1, "x"])
+  assert.equal(q.text, "SELECT * FROM t WHERE a = $1 AND b = $2")
+  assert.deepEqual(q.values, [1, "x"])
+}
+
+{
+  const q = bindSql("INSERT INTO t (a, b) VALUES (@a, @b)", { a: 3, b: "y" })
+  assert.equal(q.text, "INSERT INTO t (a, b) VALUES ($1, $2)")
+  assert.deepEqual(q.values, [3, "y"])
+}
+
+console.log("sql-bind.test.ts: ok")
diff --git a/backend/src/db/sql-bind.ts b/backend/src/db/sql-bind.ts
new file mode 100644
index 0000000..2cfca79
--- /dev/null
+++ b/backend/src/db/sql-bind.ts
@@ -0,0 +1,22 @@
+/** Convert SQLite-style @name / ? placeholders to node-pg $n. */
+
+export function bindSql(
+  sql: string,
+  params?: unknown[] | Record<string, unknown>,
+): { text: string; values: unknown[] } {
+  if (params == null) return { text: sql, values: [] }
+  if (Array.isArray(params)) {
+    let i = 0
+    const text = sql.replace(/\?/g, () => {
+      i += 1
+      return `$${i}`
+    })
+    return { text, values: params }
+  }
+  const values: unknown[] = []
+  const text = sql.replace(/@([a-zA-Z_][a-zA-Z0-9_]*)/g, (_, name: string) => {
+    values.push(params[name])
+    return `$${values.length}`
+  })
+  return { text, values }
+}
diff --git a/backend/src/db/sqlite-import.ts b/backend/src/db/sqlite-import.ts
new file mode 100644
index 0000000..00dc0d6
--- /dev/null
+++ b/backend/src/db/sqlite-import.ts
@@ -0,0 +1,479 @@
+import { createHash } from "node:crypto"
+import { existsSync, readFileSync } from "node:fs"
+import Database from "better-sqlite3"
+import type { Pool } from "pg"
+import { env } from "../config.js"
+import { ensurePartitionFor, specForParent } from "./partitions.js"
+
+export interface ImportReport {
+  sqlitePath: string
+  sqliteSha256: string
+  tables: Record<string, { sqlite: number; copied: number; skipped: number }>
+  rejects: string[]
+  durationMs: number
+}
+
+const SNAPSHOT_RETENTION_DAYS = 14
+
+type ColKind = "ts" | "date" | "bool" | "json" | "json-null" | "bigint-id" | "int" | "text" | "num"
+
+interface TableCopy {
+  table: string
+  columns: Array<[string, ColKind]>
+  timeCol?: string
+  retentionDays?: number
+  identity?: boolean
+  upsert?: boolean
+}
+
+const TABLES: TableCopy[] = [
+  { table: "servers", identity: true, columns: [
+    ["id", "int"], ["name", "text"], ["host", "text"], ["port", "int"], ["username", "text"],
+    ["password", "text"], ["use_ssl", "bool"], ["verify_ssl", "bool"], ["type", "text"],
+    ["site", "text"], ["country", "text"], ["asn", "text"], ["comment", "text"], ["enabled", "bool"],
+    ["lan_subnet", "text"], ["wan_uplinks", "json"], ["mgmt_tunnel_ip", "text"],
+    ["created_at", "ts"], ["updated_at", "ts"],
+  ]},
+  { table: "traffic_settings", upsert: true, columns: [
+    ["id", "int"], ["enabled", "bool"], ["interval_sec", "int"], ["retention_days", "int"],
+    ["last_collected_at", "ts"], ["last_duration_ms", "int"], ["last_error", "text"],
+    ["created_at", "ts"], ["updated_at", "ts"],
+  ]},
+  { table: "servers_api_ping_settings", upsert: true, columns: [
+    ["id", "int"], ["enabled", "bool"], ["interval_sec", "int"],
+    ["last_collected_at", "ts"], ["last_duration_ms", "int"], ["last_error", "text"],
+    ["created_at", "ts"], ["updated_at", "ts"],
+  ]},
+  { table: "traffic_flow_settings", upsert: true, columns: [
+    ["id", "int"], ["enabled", "bool"], ["collector_ip", "text"], ["flow_listen_port", "int"],
+    ["wg_listen_port", "int"], ["prefix", "text"], ["public_endpoint", "text"],
+    ["host_public_key", "text"], ["host_private_key", "text"], ["hub_server_id", "int"],
+    ["retention_hours", "int"], ["top_n", "int"], ["map_service_min_share_pct", "num"],
+    ["last_datagram_at", "ts"], ["last_exporter_ip", "text"], ["last_error", "text"],
+    ["packets_received", "int"], ["peers_json", "json"], ["created_at", "ts"], ["updated_at", "ts"],
+  ]},
+  { table: "uptime_settings", upsert: true, columns: [
+    ["id", "int"], ["enabled", "bool"], ["resources_enabled", "bool"], ["ping_enabled", "bool"],
+    ["speed_enabled", "bool"], ["interval_sec", "int"], ["probe_interval_sec", "int"],
+    ["speed_interval_sec", "int"], ["retention_days", "int"], ["last_collected_at", "ts"],
+    ["last_duration_ms", "int"], ["last_error", "text"], ["created_at", "ts"], ["updated_at", "ts"],
+  ]},
+  { table: "evobgp_settings", upsert: true, columns: [
+    ["id", "int"], ["base_url", "text"], ["api_key", "text"], ["enabled", "bool"], ["updated_at", "ts"],
+  ]},
+  { table: "alert_telegram_settings", upsert: true, columns: [
+    ["id", "int"], ["bot_token", "text"], ["chat_id", "text"], ["message_thread_id", "int"], ["updated_at", "ts"],
+  ]},
+  { table: "acme_settings", upsert: true, columns: [
+    ["id", "int"], ["directory_url", "text"], ["cloudflare_api_token", "text"],
+    ["default_zone_id", "text"], ["account_private_key", "text"], ["updated_at", "ts"],
+  ]},
+  { table: "certificate_renew_settings", upsert: true, columns: [
+    ["id", "int"], ["enabled", "bool"], ["interval_sec", "int"], ["renew_before_days", "int"],
+    ["last_collected_at", "ts"], ["last_duration_ms", "int"], ["last_error", "text"], ["updated_at", "ts"],
+  ]},
+  { table: "backup_schedule_settings", upsert: true, columns: [
+    ["id", "int"], ["enabled", "bool"], ["frequency", "text"], ["hour", "int"], ["minute", "int"],
+    ["week_day", "int"], ["month_day", "int"], ["keep_count", "int"], ["format", "text"],
+    ["server_ids_json", "json"], ["last_run_at", "ts"], ["last_duration_ms", "int"],
+    ["last_error", "text"], ["updated_at", "ts"],
+  ]},
+  { table: "internet_path_settings", upsert: true, columns: [
+    ["id", "int"], ["enabled", "bool"], ["interval_sec", "int"], ["retention_days", "int"],
+    ["last_collected_at", "ts"], ["last_duration_ms", "int"], ["last_error", "text"],
+    ["created_at", "ts"], ["updated_at", "ts"],
+  ]},
+  { table: "alert_engine_cursor", upsert: true, columns: [
+    ["id", "int"], ["last_source_finished_at", "ts"], ["updated_at", "ts"],
+  ]},
+  { table: "filter_rules", identity: true, columns: [
+    ["id", "int"], ["server_id", "int"], ["sort_order", "int"], ["community", "text"],
+    ["community_name", "text"], ["action", "text"], ["gateway", "text"],
+    ["gateway_tunnel_id", "text"], ["description", "text"], ["created_at", "ts"], ["updated_at", "ts"],
+  ]},
+  { table: "recursive_routes", identity: true, columns: [
+    ["id", "int"], ["server_id", "int"], ["sort_order", "int"], ["dst_address", "text"],
+    ["gateway", "text"], ["distance", "int"], ["scope", "int"], ["target_scope", "int"],
+    ["routing_table", "text"], ["check_gateway", "text"], ["country", "text"], ["comment", "text"],
+    ["disabled", "bool"], ["created_at", "ts"], ["updated_at", "ts"],
+  ]},
+  { table: "server_snapshots", identity: true, timeCol: "polled_at", retentionDays: SNAPSHOT_RETENTION_DAYS, columns: [
+    ["id", "int"], ["server_id", "int"], ["polled_at", "ts"], ["status", "text"], ["latency_ms", "num"],
+    ["ros_version", "text"], ["board_name", "text"], ["uptime", "text"], ["cpu_load", "int"],
+    ["free_memory", "int"], ["total_memory", "int"], ["identity_name", "text"],
+    ["raw_interfaces", "json-null"], ["raw_ip_addresses", "json-null"],
+  ]},
+  { table: "traffic_samples", identity: true, timeCol: "sampled_at", retentionDays: 14, columns: [
+    ["id", "int"], ["server_id", "int"], ["interface_name", "text"], ["peer_public_key", "text"],
+    ["sampled_at", "ts"], ["rx_bytes", "int"], ["tx_bytes", "int"], ["rx_bps", "int"], ["tx_bps", "int"],
+    ["running", "bool"], ["disabled", "bool"],
+  ]},
+  { table: "servers_rest_ping_samples", identity: true, timeCol: "sampled_at", retentionDays: 30, columns: [
+    ["id", "int"], ["server_id", "int"], ["sampled_at", "ts"], ["ok", "bool"], ["latency_ms", "int"], ["error", "text"],
+  ]},
+  { table: "flow_buckets", timeCol: "bucket_at", retentionDays: 2, columns: [
+    ["server_id", "int"], ["bucket_at", "ts"], ["src", "text"], ["dst", "text"], ["proto", "int"],
+    ["src_port", "int"], ["dst_port", "int"], ["bytes", "int"], ["packets", "int"],
+    ["in_iface", "text"], ["out_iface", "text"], ["next_hop", "text"],
+    ["flow_start_ms", "int"], ["flow_end_ms", "int"],
+  ]},
+  { table: "flow_minute_stats", timeCol: "bucket_at", retentionDays: 3, columns: [
+    ["server_id", "int"], ["bucket_at", "ts"], ["bytes", "int"], ["packets", "int"],
+    ["unique_src", "int"], ["unique_dst", "int"], ["conversations", "int"],
+  ]},
+  { table: "flow_minute_dims", timeCol: "bucket_at", retentionDays: 3, columns: [
+    ["server_id", "int"], ["bucket_at", "ts"], ["dim", "text"], ["key", "text"], ["bytes", "int"], ["packets", "int"],
+  ]},
+  { table: "flow_daily_dims", timeCol: "day", retentionDays: 396, columns: [
+    ["server_id", "int"], ["day", "date"], ["dim", "text"], ["key", "text"], ["bytes", "int"], ["packets", "int"],
+  ]},
+  { table: "flow_ip_meta", columns: [
+    ["prefix", "text"], ["asn", "int"], ["country", "text"], ["lat", "num"], ["lng", "num"],
+    ["holder", "text"], ["ok", "int"], ["fetched_at", "ts"],
+  ]},
+  { table: "flow_asn_meta", columns: [
+    ["asn", "int"], ["holder", "text"], ["fetched_at", "ts"],
+  ]},
+  { table: "uptime_probes", columns: [
+    ["id", "text"], ["src_server_id", "int"], ["src_interface", "text"], ["name", "text"],
+    ["target", "text"], ["probe_filter", "text"], ["enabled", "bool"], ["interval_sec", "int"],
+    ["show_on_dashboard", "bool"], ["sort_order", "int"], ["created_at", "ts"], ["updated_at", "ts"],
+  ]},
+  { table: "uptime_probe_samples", identity: true, timeCol: "sampled_at", retentionDays: 14, columns: [
+    ["id", "int"], ["probe_id", "text"], ["sampled_at", "ts"], ["rtt_ms", "int"], ["loss_pct", "int"], ["status", "text"],
+  ]},
+  { table: "uptime_resource_samples", identity: true, timeCol: "sampled_at", retentionDays: 14, columns: [
+    ["id", "int"], ["server_id", "int"], ["sampled_at", "ts"], ["status", "text"], ["cpu_load", "int"],
+    ["free_memory", "int"], ["total_memory", "int"], ["free_hdd_space", "int"], ["total_hdd_space", "int"],
+    ["uptime_seconds", "int"], ["board_name", "text"], ["ros_version", "text"],
+  ]},
+  { table: "uptime_speed_probes", columns: [
+    ["id", "text"], ["src_server_id", "int"], ["dst_server_id", "int"], ["src_interface", "text"],
+    ["dst_interface", "text"], ["protocol", "text"], ["direction", "text"], ["duration_sec", "int"],
+    ["enabled", "bool"], ["last_run_at", "ts"], ["last_tx_avg_mbps", "num"], ["last_rx_avg_mbps", "num"],
+    ["last_status", "text"], ["last_error", "text"], ["last_ping_rtt_ms", "int"],
+    ["last_ping_loss_pct", "int"], ["last_ping_at", "ts"], ["last_ping_error", "text"],
+    ["sort_order", "int"], ["created_at", "ts"], ["updated_at", "ts"],
+  ]},
+  { table: "uptime_speed_test_runs", columns: [
+    ["id", "text"], ["probe_id", "text"], ["src_server_id", "int"], ["dst_server_id", "int"],
+    ["src_interface", "text"], ["dst_interface", "text"], ["src_address", "text"], ["dst_address", "text"],
+    ["src_interface_address", "text"], ["dst_interface_address", "text"], ["protocol", "text"],
+    ["direction", "text"], ["duration_sec", "int"], ["tx_avg_mbps", "num"], ["rx_avg_mbps", "num"],
+    ["ping_rtt_ms", "int"], ["ping_loss_pct", "int"], ["ping_error", "text"], ["status", "text"],
+    ["error", "text"], ["created_at", "ts"],
+  ]},
+  { table: "app_users", columns: [
+    ["id", "text"], ["name", "text"], ["login", "text"], ["email", "text"], ["role", "text"],
+    ["active", "bool"], ["avatar", "text"], ["last_seen", "ts"], ["sections_json", "json"],
+    ["servers_json", "json"], ["created_at", "ts"], ["updated_at", "ts"],
+  ]},
+  { table: "user_interface_bindings", columns: [
+    ["id", "text"], ["user_id", "text"], ["server_id", "int"], ["interface_name", "text"],
+    ["interface_type", "text"], ["peer_public_key", "text"], ["peer_name", "text"],
+    ["comment", "text"], ["created_at", "ts"], ["updated_at", "ts"],
+  ]},
+  { table: "alert_groups", columns: [
+    ["id", "text"], ["name", "text"], ["combine_mode", "text"], ["enabled", "bool"],
+    ["cooldown_override", "text"], ["created_at", "ts"], ["updated_at", "ts"],
+  ]},
+  { table: "alert_rules", columns: [
+    ["id", "text"], ["name", "text"], ["type", "text"], ["target", "text"], ["condition", "text"],
+    ["severity", "text"], ["enabled", "bool"], ["cooldown", "text"], ["rule_chat_id", "text"],
+    ["confirm_stability_sec", "int"], ["recovery_mode", "text"], ["recovery_stability_sec", "int"],
+    ["group_id", "text"], ["created_at", "ts"], ["updated_at", "ts"],
+  ]},
+  { table: "alert_rule_targets", columns: [
+    ["id", "text"], ["rule_id", "text"], ["target", "text"], ["sort_index", "int"],
+  ]},
+  { table: "alert_rule_conditions", columns: [
+    ["id", "text"], ["rule_id", "text"], ["condition_line", "text"], ["sort_index", "int"],
+  ]},
+  { table: "alert_engine_state", columns: [
+    ["scope_key", "text"], ["last_fired_at", "text"], ["last_payload_hash", "text"],
+  ]},
+  { table: "alert_engine_prev_live", columns: [
+    ["kind", "text"], ["payload_json", "json"], ["updated_at", "ts"],
+  ]},
+  { table: "alert_engine_confirm_pending", columns: [
+    ["rule_id", "text"], ["payload_hash", "text"], ["since_at", "ts"],
+  ]},
+  { table: "alert_history", columns: [
+    ["id", "text"], ["rule_id", "text"], ["group_id", "text"], ["rule_name", "text"],
+    ["severity", "text"], ["message", "text"], ["sent_ok", "bool"], ["fired_at", "ts"],
+  ]},
+  { table: "alert_outbox", columns: [
+    ["id", "text"], ["dedupe_key", "text"], ["channel", "text"], ["status", "text"],
+    ["retry_count", "int"], ["max_retries", "int"], ["next_attempt_at", "ts"],
+    ["payload_json", "json"], ["created_at", "ts"], ["sent_at", "ts"], ["last_error", "text"],
+  ]},
+  { table: "certificate_issue_jobs", columns: [
+    ["id", "text"], ["status", "text"], ["step", "text"], ["source", "text"],
+    ["server_id", "bigint-id"], ["cert_name", "text"], ["domain_names", "json"],
+    ["key_type", "text"], ["trust_store", "text"], ["requested_at", "ts"],
+    ["started_at", "ts"], ["finished_at", "ts"], ["error", "text"],
+  ]},
+  { table: "backup_entries", columns: [
+    ["id", "text"], ["server_id", "bigint-id"], ["server_name", "text"], ["filename", "text"],
+    ["size_bytes", "int"], ["kind", "text"], ["notes", "text"], ["created_at", "ts"],
+  ]},
+  { table: "scheduler_runs", timeCol: "started_at", retentionDays: 30, columns: [
+    ["id", "text"], ["job_key", "text"], ["started_at", "ts"], ["finished_at", "ts"],
+    ["status", "text"], ["error", "text"], ["duration_ms", "int"], ["result_json", "json-null"],
+  ]},
+  { table: "events", timeCol: "created_at", retentionDays: 30, columns: [
+    ["id", "text"], ["created_at", "ts"], ["level", "text"], ["event_type", "text"],
+    ["source_module", "text"], ["title", "text"], ["message", "text"],
+    ["entity_type", "text"], ["entity_id", "text"], ["payload_json", "json-null"],
+  ]},
+  { table: "internet_path_snapshots", identity: true, timeCol: "sampled_at", retentionDays: 14, columns: [
+    ["id", "int"], ["sampled_at", "ts"], ["payload_json", "json"],
+  ]},
+]
+
+function parseTs(value: unknown, strict: boolean, rejects: string[], ctx: string): string | null {
+  if (value == null || value === "") return null
+  const s = String(value)
+  try {
+    if (/^\d{4}-\d{2}-\d{2}T/.test(s)) return new Date(s).toISOString()
+    if (/^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}/.test(s)) {
+      return new Date(`${s.replace(" ", "T")}Z`).toISOString()
+    }
+    const d = new Date(s)
+    if (!Number.isNaN(d.getTime())) return d.toISOString()
+  } catch {
+    /* fallthrough */
+  }
+  const msg = `${ctx}: неразобранный timestamp ${s}`
+  if (strict) throw new Error(msg)
+  rejects.push(msg)
+  return null
+}
+
+function parseDate(value: unknown): string | null {
+  if (value == null || value === "") return null
+  return String(value).slice(0, 10)
+}
+
+function parseBool(value: unknown): boolean {
+  return value === true || value === 1 || value === "1" || value === "true"
+}
+
+function parseJson(value: unknown, fallback: unknown): unknown {
+  if (value == null || value === "") return fallback
+  if (typeof value !== "string") return value
+  try {
+    return JSON.parse(value) as unknown
+  } catch {
+    return fallback
+  }
+}
+
+function coerce(kind: ColKind, value: unknown, strict: boolean, rejects: string[], ctx: string): unknown {
+  switch (kind) {
+    case "ts":
+      return parseTs(value, strict, rejects, ctx)
+    case "date":
+      return parseDate(value)
+    case "bool":
+      return parseBool(value)
+    case "json":
+      return parseJson(value, [])
+    case "json-null":
+      return value == null || value === "" ? null : parseJson(value, null)
+    case "bigint-id": {
+      const t = String(value ?? "").trim()
+      if (!t) return null
+      const n = Number(t)
+      if (!Number.isFinite(n)) {
+        const msg = `${ctx}: server_id ${t}`
+        if (strict) throw new Error(msg)
+        rejects.push(msg)
+        return null
+      }
+      return n
+    }
+    case "int":
+      if (value == null || value === "") return null
+      return Number(value)
+    case "num":
+      if (value == null || value === "") return null
+      return Number(value)
+    case "text":
+      return value == null ? "" : String(value)
+    default:
+      return value == null ? null : String(value)
+  }
+}
+
+function sqliteTableExists(sqlite: Database.Database, name: string): boolean {
+  const row = sqlite.prepare(
+    `SELECT 1 AS ok FROM sqlite_master WHERE type = 'table' AND name = ?`,
+  ).get(name) as { ok?: number } | undefined
+  return Boolean(row)
+}
+
+async function setval(pool: Pool, table: string): Promise<void> {
+  await pool.query(
+    `SELECT setval(
+       pg_get_serial_sequence($1, 'id'),
+       GREATEST(COALESCE((SELECT MAX(id) FROM ${table}), 1), 1),
+       true
+     )`,
+    [table],
+  )
+}
+
+async function copyTable(
+  sqlite: Database.Database,
+  pool: Pool,
+  spec: TableCopy,
+  opts: { strict: boolean; fullHistory: boolean; rejects: string[] },
+): Promise<{ sqlite: number; copied: number; skipped: number }> {
+  if (!sqliteTableExists(sqlite, spec.table)) {
+    return { sqlite: 0, copied: 0, skipped: 0 }
+  }
+  let where = ""
+  if (spec.timeCol && spec.retentionDays && !opts.fullHistory) {
+    const cutoff = new Date(Date.now() - spec.retentionDays * 86400_000).toISOString()
+    where = ` WHERE ${spec.timeCol} >= '${cutoff.replace("T", " ").slice(0, 19)}' OR ${spec.timeCol} >= '${cutoff}'`
+  }
+  const total = (sqlite.prepare(`SELECT COUNT(*) AS c FROM ${spec.table}${where}`).get() as { c: number }).c
+  const part = specForParent(spec.table)
+  const cols = spec.columns.map(([c]) => c)
+  const placeholders = cols.map((_, i) => `$${i + 1}`).join(", ")
+  const conflictSql = spec.upsert
+    ? `ON CONFLICT (id) DO UPDATE SET ${cols.filter((c) => c !== "id").map((c) => `${c} = EXCLUDED.${c}`).join(", ")}`
+    : `ON CONFLICT DO NOTHING`
+  const insertSql = `INSERT INTO ${spec.table} (${cols.join(", ")}) VALUES (${placeholders}) ${conflictSql}`
+  let copied = 0
+  let skipped = 0
+  const stmt = sqlite.prepare(`SELECT * FROM ${spec.table}${where}`)
+  const batch: unknown[][] = []
+  const flush = async () => {
+    if (batch.length === 0) return
+    const client = await pool.connect()
+    try {
+      await client.query("BEGIN")
+      for (const values of batch) {
+        await client.query(insertSql, values)
+        copied += 1
+      }
+      await client.query("COMMIT")
+    } catch (err) {
+      await client.query("ROLLBACK")
+      throw err
+    } finally {
+      client.release()
+      batch.length = 0
+    }
+  }
+  for (const row of stmt.iterate() as Iterable<Record<string, unknown>>) {
+    try {
+      if (part && spec.timeCol) {
+        const raw = row[spec.timeCol]
+        const ts = spec.columns.find((c) => c[0] === spec.timeCol)?.[1] === "date"
+          ? `${String(raw).slice(0, 10)}T00:00:00Z`
+          : parseTs(raw, false, opts.rejects, spec.table)
+        if (ts) await ensurePartitionFor(pool, spec.table, part.kind, new Date(ts))
+      }
+      const values = spec.columns.map(([col, kind]) =>
+        coerce(kind, row[col], opts.strict, opts.rejects, `${spec.table}.${col}`),
+      )
+      if (spec.table === "certificate_issue_jobs" && values[4] == null) {
+        skipped += 1
+        continue
+      }
+      batch.push(values)
+      if (batch.length >= 200) await flush()
+    } catch (err) {
+      skipped += 1
+      const msg = `${spec.table}: ${err instanceof Error ? err.message : String(err)}`
+      opts.rejects.push(msg)
+      if (opts.strict) throw err
+    }
+  }
+  await flush()
+  if (spec.identity) {
+    try {
+      await setval(pool, spec.table)
+    } catch {
+      /* partitioned identity sequence name may differ */
+    }
+  }
+  return { sqlite: total, copied, skipped }
+}
+
+export function sqliteFileLooksPresent(path: string): boolean {
+  if (!existsSync(path) || path === ":memory:") return false
+  try {
+    const buf = readFileSync(path)
+    return buf.subarray(0, 16).toString("utf8").startsWith("SQLite format 3")
+  } catch {
+    return false
+  }
+}
+
+export async function shouldImportSqlite(pool: Pool, sqlitePath: string): Promise<boolean> {
+  if (!sqliteFileLooksPresent(sqlitePath)) return false
+  const marker = await pool.query<{ sqlite_imported_at: string | null }>(
+    `SELECT sqlite_imported_at FROM data_migration WHERE id = 1`,
+  )
+  if (marker.rows[0]?.sqlite_imported_at) return false
+  const servers = await pool.query<{ c: string }>(`SELECT COUNT(*)::text AS c FROM servers`)
+  if (Number(servers.rows[0]?.c ?? 0) > 0) return false
+  return true
+}
+
+export async function importSqliteToPostgres(
+  pool: Pool,
+  sqlitePath: string,
+  opts?: { dryRun?: boolean; strict?: boolean; fullHistory?: boolean },
+): Promise<ImportReport> {
+  const started = Date.now()
+  const rejects: string[] = []
+  const sqlite = new Database(sqlitePath, { readonly: true, fileMustExist: true })
+  try {
+    sqlite.pragma("journal_mode = WAL")
+  } catch {
+    /* readonly */
+  }
+  const sha = createHash("sha256").update(readFileSync(sqlitePath)).digest("hex")
+  const report: ImportReport = {
+    sqlitePath,
+    sqliteSha256: sha,
+    tables: {},
+    rejects,
+    durationMs: 0,
+  }
+  const fullHistory = opts?.fullHistory ?? env.sqliteImportFullHistory
+  const strict = opts?.strict ?? true
+  if (opts?.dryRun) {
+    for (const spec of TABLES) {
+      if (!sqliteTableExists(sqlite, spec.table)) {
+        report.tables[spec.table] = { sqlite: 0, copied: 0, skipped: 0 }
+        continue
+      }
+      const c = (sqlite.prepare(`SELECT COUNT(*) AS c FROM ${spec.table}`).get() as { c: number }).c
+      report.tables[spec.table] = { sqlite: c, copied: 0, skipped: 0 }
+    }
+    sqlite.close()
+    report.durationMs = Date.now() - started
+    return report
+  }
+  for (const spec of TABLES) {
+    report.tables[spec.table] = await copyTable(sqlite, pool, spec, { strict, fullHistory, rejects })
+  }
+  sqlite.close()
+  await pool.query(
+    `UPDATE data_migration
+     SET sqlite_imported_at = now(), sqlite_path = $1, sqlite_sha256 = $2, report_json = $3::jsonb
+     WHERE id = 1`,
+    [sqlitePath, sha, JSON.stringify(report.tables)],
+  )
+  report.durationMs = Date.now() - started
+  if (strict && rejects.length > 0) {
+    throw new Error(`SQLite import strict: ${rejects.length} rejects\n${rejects.slice(0, 20).join("\n")}`)
+  }
+  return report
+}
diff --git a/backend/src/index.ts b/backend/src/index.ts
index 5993684..e891e37 100644
--- a/backend/src/index.ts
+++ b/backend/src/index.ts
@@ -3,6 +3,8 @@ import cors from "@fastify/cors"
 import { serializerCompiler, validatorCompiler } from "@fastify/type-provider-zod"
 import { monitorEventLoopDelay } from "node:perf_hooks"
 import { env } from "./config.js"
+import { initDatabase } from "./db/bootstrap.js"
+import { closePool } from "./db/index.js"
 import authPlugin, { requireAuth } from "./plugins/auth.js"
 import serversRoutes from "./routes/servers.js"
 import bgpRoutes from "./routes/bgp.js"
@@ -132,8 +134,8 @@ export async function buildApp(opts?: {
   await app.register(usersRoutes, { prefix: "/api" })
 
   if (opts?.startScheduler !== false) {
-    refreshScheduler()
-    startTrafficFlowListener()
+    await refreshScheduler()
+    await startTrafficFlowListener()
     app.addHook("onClose", async () => {
       stopScheduler()
       stopTrafficFlowListener()
@@ -149,6 +151,7 @@ const isMain =
 
 if (isMain) {
   try {
+    await initDatabase()
     const app = await buildApp()
     let shuttingDown = false
     const shutdown = async (code: number) => {
@@ -157,6 +160,7 @@ if (isMain) {
       try {
         stopTrafficFlowListener()
         await app.close()
+        await closePool()
       } catch (err) {
         console.error(err)
       } finally {
diff --git a/backend/src/modules/events/repository/events-repository.ts b/backend/src/modules/events/repository/events-repository.ts
index cf95f06..3dbdc63 100644
--- a/backend/src/modules/events/repository/events-repository.ts
+++ b/backend/src/modules/events/repository/events-repository.ts
@@ -24,18 +24,7 @@ export type ListEventsParams = {
   to?: string
 }
 
-function parsePayload(payloadJson: string | null): Record<string, unknown> {
-  if (!payloadJson) return {}
-  try {
-    const parsed = JSON.parse(payloadJson) as unknown
-    if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
-      return parsed as Record<string, unknown>
-    }
-  } catch {
-    // keep backwards compatibility with malformed legacy payloads
-  }
-  return {}
-}
+import { parseJsonObject } from "../../../db/json.js"
 
 function mapEventRow(row: typeof events.$inferSelect): EventItem {
   return {
@@ -48,13 +37,13 @@ function mapEventRow(row: typeof events.$inferSelect): EventItem {
     message: row.message,
     entityType: row.entityType ?? null,
     entityId: row.entityId ?? null,
-    payload: parsePayload(row.payloadJson ?? null),
+    payload: parseJsonObject(row.payloadJson),
   }
 }
 
-export function insertEventsBatch(items: EventInsertInput[]) {
+export async function insertEventsBatch(items: EventInsertInput[]) {
   if (items.length === 0) return
-  db.insert(events)
+  await db.insert(events)
     .values(
       items.map((item) => ({
         id: item.id,
@@ -66,25 +55,23 @@ export function insertEventsBatch(items: EventInsertInput[]) {
         message: item.message,
         entityType: item.entityType ?? null,
         entityId: item.entityId ?? null,
-        payloadJson: item.payload ? JSON.stringify(item.payload) : null,
+        payloadJson: item.payload ?? null,
       })),
     )
-    .run()
 }
 
-export function listEvents(params: ListEventsParams): EventItem[] {
+export async function listEvents(params: ListEventsParams): Promise<EventItem[]> {
   const where = and(
     params.level ? eq(events.level, params.level) : undefined,
     params.sourceModule ? eq(events.sourceModule, params.sourceModule) : undefined,
     params.from ? gte(events.createdAt, params.from) : undefined,
     params.to ? lte(events.createdAt, params.to) : undefined,
   )
-  const rows = db
+  const rows = await db
     .select()
     .from(events)
     .where(where)
     .orderBy(desc(events.createdAt))
     .limit(params.limit)
-    .all()
   return rows.map(mapEventRow)
 }
diff --git a/backend/src/modules/events/service/events-service.ts b/backend/src/modules/events/service/events-service.ts
index 9e93af2..dd02044 100644
--- a/backend/src/modules/events/service/events-service.ts
+++ b/backend/src/modules/events/service/events-service.ts
@@ -23,17 +23,17 @@ function normalizeEventInput(input: AppendEventBody): EventInsertInput {
   }
 }
 
-export function appendEvent(input: AppendEventBody) {
+export async function appendEvent(input: AppendEventBody) {
   const parsed = appendEventSchema.parse(input)
-  insertEventsBatch([normalizeEventInput(parsed)])
+  await insertEventsBatch([normalizeEventInput(parsed)])
 }
 
-export function appendEvents(inputs: AppendEventBody[]) {
+export async function appendEvents(inputs: AppendEventBody[]) {
   const rows = inputs.map((entry) => normalizeEventInput(appendEventSchema.parse(entry)))
-  insertEventsBatch(rows)
+  await insertEventsBatch(rows)
 }
 
-export function readEvents(query: Partial<ListEventsQuery>): EventItem[] {
+export async function readEvents(query: Partial<ListEventsQuery>): Promise<EventItem[]> {
   const parsed = listEventsQuerySchema.parse(query)
-  return listEvents(parsed)
+  return await listEvents(parsed)
 }
diff --git a/backend/src/modules/servers/mapper/servers-mapper.ts b/backend/src/modules/servers/mapper/servers-mapper.ts
index 4cc84d5..935bbca 100644
--- a/backend/src/modules/servers/mapper/servers-mapper.ts
+++ b/backend/src/modules/servers/mapper/servers-mapper.ts
@@ -1,29 +1,24 @@
+import { parseJsonArray } from "../../../db/json.js"
 import type { ServerRead, WanUplinkRead } from "../../../types/server.js"
 import type { ServerRow, SnapshotRow } from "../repository/servers-repository.js"
 
-function parseWanUplinksJson(raw: string | null | undefined): WanUplinkRead[] {
-  if (raw == null || raw === "") return []
-  try {
-    const data = JSON.parse(raw) as unknown
-    if (!Array.isArray(data)) return []
-    const out: WanUplinkRead[] = []
-    for (const row of data) {
-      if (typeof row !== "object" || row === null) continue
-      const r = row as Record<string, unknown>
-      out.push({
-        id: typeof r.id === "string" ? r.id : "",
-        name: typeof r.name === "string" ? r.name : "",
-        isp: typeof r.isp === "string" ? r.isp : "",
-        iface: typeof r.iface === "string" ? r.iface : "",
-        ip: typeof r.ip === "string" ? r.ip : "",
-        maxDl: typeof r.maxDl === "number" && Number.isFinite(r.maxDl) ? r.maxDl : 0,
-        maxUl: typeof r.maxUl === "number" && Number.isFinite(r.maxUl) ? r.maxUl : 0,
-      })
-    }
-    return out
-  } catch {
-    return []
+function parseWanUplinksJson(raw: unknown): WanUplinkRead[] {
+  const data = parseJsonArray(raw)
+  const out: WanUplinkRead[] = []
+  for (const row of data) {
+    if (typeof row !== "object" || row === null) continue
+    const r = row as Record<string, unknown>
+    out.push({
+      id: typeof r.id === "string" ? r.id : "",
+      name: typeof r.name === "string" ? r.name : "",
+      isp: typeof r.isp === "string" ? r.isp : "",
+      iface: typeof r.iface === "string" ? r.iface : "",
+      ip: typeof r.ip === "string" ? r.ip : "",
+      maxDl: typeof r.maxDl === "number" && Number.isFinite(r.maxDl) ? r.maxDl : 0,
+      maxUl: typeof r.maxUl === "number" && Number.isFinite(r.maxUl) ? r.maxUl : 0,
+    })
   }
+  return out
 }
 
 export function toServerRead(server: ServerRow, snap: SnapshotRow | undefined): ServerRead {
diff --git a/backend/src/modules/servers/repository/servers-repository.ts b/backend/src/modules/servers/repository/servers-repository.ts
index 2318c8d..ab5db23 100644
--- a/backend/src/modules/servers/repository/servers-repository.ts
+++ b/backend/src/modules/servers/repository/servers-repository.ts
@@ -6,52 +6,52 @@ import { invalidateFlowCatalogCache } from "../../../services/traffic-flow-topol
 export type ServerRow = typeof servers.$inferSelect
 export type SnapshotRow = typeof serverSnapshots.$inferSelect
 
-export function listServerRows(): ServerRow[] {
-  return db.select().from(servers).all()
+export async function listServerRows(): Promise<ServerRow[]> {
+  return await db.select().from(servers)
 }
 
-export function getServerRowById(id: number): ServerRow | undefined {
-  return db.select().from(servers).where(eq(servers.id, id)).limit(1).all()[0]
+export async function getServerRowById(id: number): Promise<ServerRow | undefined> {
+  const rows = await db.select().from(servers).where(eq(servers.id, id)).limit(1)
+  return rows[0]
 }
 
-export function createServerRow(
+export async function createServerRow(
   values: Omit<typeof servers.$inferInsert, "id">,
-): ServerRow {
-  const [inserted] = db.insert(servers).values(values).returning().all()
+): Promise<ServerRow> {
+  const [inserted] = await db.insert(servers).values(values).returning()
   invalidateFlowCatalogCache()
   return inserted
 }
 
-export function updateServerRowById(
+export async function updateServerRowById(
   id: number,
   values: Partial<ServerRow>,
-): ServerRow {
-  const [updated] = db.update(servers).set(values).where(eq(servers.id, id)).returning().all()
+): Promise<ServerRow> {
+  const [updated] = await db.update(servers).set(values).where(eq(servers.id, id)).returning()
   invalidateFlowCatalogCache()
   return updated
 }
 
-export function deleteServerRowById(id: number): void {
-  db.delete(servers).where(eq(servers.id, id)).run()
+export async function deleteServerRowById(id: number): Promise<void> {
+  await db.delete(servers).where(eq(servers.id, id))
   invalidateFlowCatalogCache()
 }
 
-export function listSnapshotsByServerId(serverId: number, limit: number): SnapshotRow[] {
+export async function listSnapshotsByServerId(serverId: number, limit: number): Promise<SnapshotRow[]> {
   return db
     .select()
     .from(serverSnapshots)
     .where(eq(serverSnapshots.serverId, serverId))
     .orderBy(desc(serverSnapshots.polledAt))
     .limit(limit)
-    .all()
 }
 
-export function getLatestSnapshot(serverId: number): SnapshotRow | undefined {
-  return db
+export async function getLatestSnapshot(serverId: number): Promise<SnapshotRow | undefined> {
+  const rows = await db
     .select()
     .from(serverSnapshots)
     .where(eq(serverSnapshots.serverId, serverId))
     .orderBy(desc(serverSnapshots.polledAt))
     .limit(1)
-    .all()[0]
+  return rows[0]
 }
diff --git a/backend/src/modules/servers/service/servers-service.ts b/backend/src/modules/servers/service/servers-service.ts
index e78bea3..d9ecb4c 100644
--- a/backend/src/modules/servers/service/servers-service.ts
+++ b/backend/src/modules/servers/service/servers-service.ts
@@ -11,45 +11,46 @@ import {
 import { toServerRead } from "../mapper/servers-mapper.js"
 import type { ServerCreate, ServerRead, ServerUpdate, SnapshotRead } from "../../../types/server.js"
 
-export function listServersRead(): ServerRead[] {
-  return listServerRows().map((server) => toServerRead(server, getLatestSnapshot(server.id)))
+export async function listServersRead(): Promise<ServerRead[]> {
+  const rows = await listServerRows()
+  return Promise.all(rows.map(async (server) => toServerRead(server, await getLatestSnapshot(server.id))))
 }
 
-export function getServerReadById(id: number): ServerRead | undefined {
-  const row = getServerRowById(id)
+export async function getServerReadById(id: number): Promise<ServerRead | undefined> {
+  const row = await getServerRowById(id)
   if (!row) return undefined
-  return toServerRead(row, getLatestSnapshot(row.id))
+  return toServerRead(row, await getLatestSnapshot(row.id))
 }
 
-export function createServer(input: ServerCreate): ServerRead {
+export async function createServer(input: ServerCreate): Promise<ServerRead> {
   const now = new Date().toISOString()
   const { wanUplinks, ...rest } = input
-  const inserted = createServerRow({
+  const inserted = await createServerRow({
     ...rest,
-    wanUplinks: JSON.stringify(wanUplinks ?? []),
+    wanUplinks: wanUplinks ?? [],
     createdAt: now,
     updatedAt: now,
   })
   return toServerRead(inserted, undefined)
 }
 
-export function updateServer(id: number, input: ServerUpdate): ServerRead {
+export async function updateServer(id: number, input: ServerUpdate): Promise<ServerRead> {
   const { wanUplinks, ...rest } = input
   const setPayload: Record<string, unknown> = { updatedAt: new Date().toISOString() }
   for (const [k, v] of Object.entries(rest)) {
     if (v !== undefined) setPayload[k] = v
   }
   if (wanUplinks !== undefined) {
-    setPayload.wanUplinks = JSON.stringify(wanUplinks)
+    setPayload.wanUplinks = wanUplinks
   }
-  const updated = updateServerRowById(id, setPayload as never)
-  return toServerRead(updated, getLatestSnapshot(updated.id))
+  const updated = await updateServerRowById(id, setPayload as never)
+  return toServerRead(updated, await getLatestSnapshot(updated.id))
 }
 
-export function deleteServer(id: number): void {
-  deleteServerRowById(id)
+export async function deleteServer(id: number): Promise<void> {
+  await deleteServerRowById(id)
 }
 
-export function listServerSnapshots(id: number, limit: number): SnapshotRead[] {
-  return listSnapshotsByServerId(id, limit).map(toSnapshotRead)
+export async function listServerSnapshots(id: number, limit: number): Promise<SnapshotRead[]> {
+  return (await listSnapshotsByServerId(id, limit)).map(toSnapshotRead)
 }
diff --git a/backend/src/modules/users/bindings.test.ts b/backend/src/modules/users/bindings.test.ts
index 9a5b2d6..96c0591 100644
--- a/backend/src/modules/users/bindings.test.ts
+++ b/backend/src/modules/users/bindings.test.ts
@@ -1,79 +1,7 @@
 import assert from "node:assert/strict"
-import Database from "better-sqlite3"
 import { normalizeBindingPeer, PeerBindError } from "./peer-bind.js"
-
-const sqlite = new Database(":memory:")
-sqlite.pragma("foreign_keys = ON")
-sqlite.exec(`
-CREATE TABLE servers (
-  id INTEGER PRIMARY KEY,
-  name TEXT NOT NULL DEFAULT '',
-  host TEXT NOT NULL DEFAULT '127.0.0.1'
-);
-CREATE TABLE app_users (
-  id TEXT PRIMARY KEY,
-  name TEXT NOT NULL DEFAULT '',
-  login TEXT NOT NULL UNIQUE,
-  email TEXT NOT NULL DEFAULT '',
-  role TEXT NOT NULL DEFAULT 'viewer',
-  active INTEGER NOT NULL DEFAULT 1,
-  avatar TEXT NOT NULL DEFAULT '',
-  last_seen TEXT,
-  sections_json TEXT NOT NULL DEFAULT '[]',
-  servers_json TEXT NOT NULL DEFAULT '[]',
-  created_at TEXT NOT NULL DEFAULT (datetime('now')),
-  updated_at TEXT NOT NULL DEFAULT (datetime('now'))
-);
-CREATE TABLE user_interface_bindings (
-  id TEXT PRIMARY KEY,
-  user_id TEXT NOT NULL,
-  server_id INTEGER NOT NULL,
-  interface_name TEXT NOT NULL,
-  interface_type TEXT NOT NULL DEFAULT 'other',
-  peer_public_key TEXT NOT NULL DEFAULT '',
-  peer_name TEXT NOT NULL DEFAULT '',
-  comment TEXT NOT NULL DEFAULT '',
-  created_at TEXT NOT NULL DEFAULT (datetime('now')),
-  updated_at TEXT NOT NULL DEFAULT (datetime('now')),
-  FOREIGN KEY (user_id) REFERENCES app_users(id) ON DELETE CASCADE,
-  FOREIGN KEY (server_id) REFERENCES servers(id) ON DELETE CASCADE,
-  UNIQUE (server_id, interface_name, peer_public_key)
-);
-`)
-
-sqlite.prepare("INSERT INTO servers (id, name, host) VALUES (1, 'jh', '10.0.0.1')").run()
-sqlite.prepare("INSERT INTO app_users (id, name, login) VALUES ('u1', 'A', 'a.user')").run()
-sqlite.prepare("INSERT INTO app_users (id, name, login) VALUES ('u2', 'B', 'b.user')").run()
-sqlite.prepare(`
-  INSERT INTO user_interface_bindings (id, user_id, server_id, interface_name, interface_type)
-  VALUES ('b1', 'u1', 1, 'gre-office', 'gre')
-`).run()
-
-assert.throws(
-  () => sqlite.prepare(`
-    INSERT INTO user_interface_bindings (id, user_id, server_id, interface_name, interface_type)
-    VALUES ('b2', 'u2', 1, 'gre-office', 'gre')
-  `).run(),
-  /UNIQUE/i,
-  "один интерфейс на сервере — один пользователь",
-)
-
-sqlite.prepare(`
-  INSERT INTO user_interface_bindings (id, user_id, server_id, interface_name, interface_type, peer_public_key, peer_name)
-  VALUES ('wg1', 'u1', 1, 'wg-server', 'wg', 'peer-key-aaa', 'phone')
-`).run()
-sqlite.prepare(`
-  INSERT INTO user_interface_bindings (id, user_id, server_id, interface_name, interface_type, peer_public_key, peer_name)
-  VALUES ('wg2', 'u2', 1, 'wg-server', 'wg', 'peer-key-bbb', 'laptop')
-`).run()
-assert.throws(
-  () => sqlite.prepare(`
-    INSERT INTO user_interface_bindings (id, user_id, server_id, interface_name, interface_type, peer_public_key)
-    VALUES ('wg3', 'u2', 1, 'wg-server', 'wg', 'peer-key-aaa')
-  `).run(),
-  /UNIQUE/i,
-  "один пир — один пользователь",
-)
+import { withPgOrSkip } from "../../test/pg.js"
+import { dbQuery } from "../../db/index.js"
 
 assert.throws(
   () => normalizeBindingPeer("wg", ""),
@@ -83,8 +11,64 @@ assert.throws(
 assert.equal(normalizeBindingPeer("ether", "ignored"), "")
 assert.equal(normalizeBindingPeer("wg", " abc "), "abc")
 
-sqlite.prepare("DELETE FROM app_users WHERE id = 'u1'").run()
-const leftover = sqlite.prepare("SELECT COUNT(*) AS n FROM user_interface_bindings").get() as { n: number }
-assert.equal(leftover.n, 1, "каскад: привязки u1 удаляются, пир u2 остаётся")
+if (!(await withPgOrSkip())) {
+  console.log("users bindings unique+cascade tests skip")
+  process.exit(0)
+}
+
+await dbQuery(`
+  INSERT INTO servers (id, name, host) VALUES (91001, 'jh-bind-test', '10.0.0.1')
+  ON CONFLICT (id) DO NOTHING
+`)
+await dbQuery(`
+  INSERT INTO app_users (id, name, login)
+  VALUES ('u-bind-1', 'A', 'a.bind.test'), ('u-bind-2', 'B', 'b.bind.test')
+  ON CONFLICT (id) DO NOTHING
+`)
+await dbQuery(`DELETE FROM user_interface_bindings WHERE server_id = 91001`)
+await dbQuery(`
+  INSERT INTO user_interface_bindings (id, user_id, server_id, interface_name, interface_type)
+  VALUES ('b-bind-1', 'u-bind-1', 91001, 'gre-office', 'gre')
+`)
+
+let uniqueIface = false
+try {
+  await dbQuery(`
+    INSERT INTO user_interface_bindings (id, user_id, server_id, interface_name, interface_type)
+    VALUES ('b-bind-2', 'u-bind-2', 91001, 'gre-office', 'gre')
+  `)
+} catch {
+  uniqueIface = true
+}
+assert.equal(uniqueIface, true, "один интерфейс на сервере — один пользователь")
+
+await dbQuery(`
+  INSERT INTO user_interface_bindings (id, user_id, server_id, interface_name, interface_type, peer_public_key, peer_name)
+  VALUES ('wg-bind-1', 'u-bind-1', 91001, 'wg-server', 'wg', 'peer-key-aaa', 'phone')
+`)
+await dbQuery(`
+  INSERT INTO user_interface_bindings (id, user_id, server_id, interface_name, interface_type, peer_public_key, peer_name)
+  VALUES ('wg-bind-2', 'u-bind-2', 91001, 'wg-server', 'wg', 'peer-key-bbb', 'laptop')
+`)
+
+let uniquePeer = false
+try {
+  await dbQuery(`
+    INSERT INTO user_interface_bindings (id, user_id, server_id, interface_name, interface_type, peer_public_key)
+    VALUES ('wg-bind-3', 'u-bind-2', 91001, 'wg-server', 'wg', 'peer-key-aaa')
+  `)
+} catch {
+  uniquePeer = true
+}
+assert.equal(uniquePeer, true, "один пир — один пользователь")
+
+await dbQuery(`DELETE FROM app_users WHERE id = 'u-bind-1'`)
+const leftover = await dbQuery<{ n: number }>(
+  `SELECT COUNT(*)::int AS n FROM user_interface_bindings WHERE server_id = 91001`,
+)
+assert.equal(leftover.rows[0]?.n, 1, "каскад: привязки u1 удаляются, пир u2 остаётся")
+
+await dbQuery(`DELETE FROM app_users WHERE id IN ('u-bind-1', 'u-bind-2')`)
+await dbQuery(`DELETE FROM servers WHERE id = 91001`)
 
 console.log("users bindings unique+cascade tests ok")
diff --git a/backend/src/modules/users/iface-type.ts b/backend/src/modules/users/iface-type.ts
index b920857..0c70921 100644
--- a/backend/src/modules/users/iface-type.ts
+++ b/backend/src/modules/users/iface-type.ts
@@ -27,10 +27,10 @@ function asBool(raw: unknown): boolean {
   return s === "true" || s === "yes" || s === "1"
 }
 
-export function parseRawInterfaces(json: string | null | undefined): ParsedRosIface[] {
-  if (!json) return []
+export function parseRawInterfaces(json: unknown): ParsedRosIface[] {
+  if (json == null || json === "") return []
   try {
-    const parsed = JSON.parse(json) as unknown
+    const parsed = typeof json === "string" ? JSON.parse(json) as unknown : json
     const arr = Array.isArray(parsed) ? parsed : []
     const out: ParsedRosIface[] = []
     for (const item of arr) {
@@ -56,5 +56,5 @@ export function isUniqueConstraintError(err: unknown): boolean {
   const rec = err as { code?: unknown; message?: unknown }
   const code = String(rec.code ?? "")
   const msg = String(rec.message ?? "")
-  return code.includes("SQLITE_CONSTRAINT") || /unique constraint/i.test(msg)
+  return code === "23505" || code.includes("SQLITE_CONSTRAINT") || /unique constraint/i.test(msg)
 }
diff --git a/backend/src/modules/users/repository/users-repository.ts b/backend/src/modules/users/repository/users-repository.ts
index b7da578..2ea4c4c 100644
--- a/backend/src/modules/users/repository/users-repository.ts
+++ b/backend/src/modules/users/repository/users-repository.ts
@@ -6,56 +6,59 @@ import { invalidateFlowCatalogCache } from "../../../services/traffic-flow-topol
 export type AppUserRow = typeof appUsers.$inferSelect
 export type BindingRow = typeof userInterfaceBindings.$inferSelect
 
-export function listUserRows(): AppUserRow[] {
-  return db.select().from(appUsers).all()
+export async function listUserRows(): Promise<AppUserRow[]> {
+  return await db.select().from(appUsers)
 }
 
-export function getUserRowById(id: string): AppUserRow | undefined {
-  return db.select().from(appUsers).where(eq(appUsers.id, id)).limit(1).all()[0]
+export async function getUserRowById(id: string): Promise<AppUserRow | undefined> {
+  const rows = await db.select().from(appUsers).where(eq(appUsers.id, id)).limit(1)
+  return rows[0]
 }
 
-export function getUserRowByLogin(login: string): AppUserRow | undefined {
-  return db.select().from(appUsers).where(eq(appUsers.login, login)).limit(1).all()[0]
+export async function getUserRowByLogin(login: string): Promise<AppUserRow | undefined> {
+  const rows = await db.select().from(appUsers).where(eq(appUsers.login, login)).limit(1)
+  return rows[0]
 }
 
-export function createUserRow(values: typeof appUsers.$inferInsert): AppUserRow {
-  const [inserted] = db.insert(appUsers).values(values).returning().all()
+export async function createUserRow(values: typeof appUsers.$inferInsert): Promise<AppUserRow> {
+  const [inserted] = await db.insert(appUsers).values(values).returning()
   invalidateFlowCatalogCache()
   return inserted
 }
 
-export function updateUserRowById(
+export async function updateUserRowById(
   id: string,
   values: Partial<AppUserRow>,
-): AppUserRow {
-  const [updated] = db.update(appUsers).set(values).where(eq(appUsers.id, id)).returning().all()
+): Promise<AppUserRow> {
+  const [updated] = await db.update(appUsers).set(values).where(eq(appUsers.id, id)).returning()
   invalidateFlowCatalogCache()
   return updated
 }
 
-export function deleteUserRowById(id: string): void {
-  db.delete(appUsers).where(eq(appUsers.id, id)).run()
+export async function deleteUserRowById(id: string): Promise<void> {
+  await db.delete(appUsers).where(eq(appUsers.id, id))
   invalidateFlowCatalogCache()
 }
 
-export function listBindingRows(): BindingRow[] {
-  return db.select().from(userInterfaceBindings).all()
+export async function listBindingRows(): Promise<BindingRow[]> {
+  return await db.select().from(userInterfaceBindings)
 }
 
-export function listBindingRowsByUser(userId: string): BindingRow[] {
-  return db.select().from(userInterfaceBindings).where(eq(userInterfaceBindings.userId, userId)).all()
+export async function listBindingRowsByUser(userId: string): Promise<BindingRow[]> {
+  return await db.select().from(userInterfaceBindings).where(eq(userInterfaceBindings.userId, userId))
 }
 
-export function getBindingRowById(id: string): BindingRow | undefined {
-  return db.select().from(userInterfaceBindings).where(eq(userInterfaceBindings.id, id)).limit(1).all()[0]
+export async function getBindingRowById(id: string): Promise<BindingRow | undefined> {
+  const rows = await db.select().from(userInterfaceBindings).where(eq(userInterfaceBindings.id, id)).limit(1)
+  return rows[0]
 }
 
-export function getBindingByServerIfacePeer(
+export async function getBindingByServerIfacePeer(
   serverId: number,
   interfaceName: string,
   peerPublicKey = "",
-): BindingRow | undefined {
-  return db
+): Promise<BindingRow | undefined> {
+  const rows = await db
     .select()
     .from(userInterfaceBindings)
     .where(and(
@@ -64,20 +67,21 @@ export function getBindingByServerIfacePeer(
       eq(userInterfaceBindings.peerPublicKey, peerPublicKey),
     ))
     .limit(1)
-    .all()[0]
+  return rows[0]
 }
 
-export function createBindingRow(values: typeof userInterfaceBindings.$inferInsert): BindingRow {
-  const [inserted] = db.insert(userInterfaceBindings).values(values).returning().all()
+export async function createBindingRow(values: typeof userInterfaceBindings.$inferInsert): Promise<BindingRow> {
+  const [inserted] = await db.insert(userInterfaceBindings).values(values).returning()
   invalidateFlowCatalogCache()
   return inserted
 }
 
-export function deleteBindingRowById(id: string): void {
-  db.delete(userInterfaceBindings).where(eq(userInterfaceBindings.id, id)).run()
+export async function deleteBindingRowById(id: string): Promise<void> {
+  await db.delete(userInterfaceBindings).where(eq(userInterfaceBindings.id, id))
   invalidateFlowCatalogCache()
 }
 
-export function countUserRows(): number {
-  return db.select({ n: count() }).from(appUsers).all()[0]?.n ?? 0
+export async function countUserRows(): Promise<number> {
+  const rows = await db.select({ n: count() }).from(appUsers)
+  return rows[0]?.n ?? 0
 }
diff --git a/backend/src/modules/users/service/users-service.ts b/backend/src/modules/users/service/users-service.ts
index 3701609..999adcf 100644
--- a/backend/src/modules/users/service/users-service.ts
+++ b/backend/src/modules/users/service/users-service.ts
@@ -12,6 +12,7 @@ import type {
   UserBindingCreate,
 } from "@mmapp/contracts/users"
 import { db } from "../../../db/index.js"
+import { parseJsonArray } from "../../../db/json.js"
 import { servers, trafficSamples } from "../../../db/schema.js"
 import {
   createBindingRow,
@@ -52,13 +53,9 @@ export class UsersServiceError extends Error {
   }
 }
 
-function parseJsonArray<T>(raw: string, fallback: T[]): T[] {
-  try {
-    const parsed = JSON.parse(raw) as unknown
-    return Array.isArray(parsed) ? (parsed as T[]) : fallback
-  } catch {
-    return fallback
-  }
+function asPermArray<T>(raw: unknown, fallback: T[]): T[] {
+  const arr = parseJsonArray(raw)
+  return arr.length ? arr as T[] : fallback
 }
 
 function initials(name: string): string {
@@ -66,8 +63,9 @@ function initials(name: string): string {
   return parts.map((p) => p[0] ?? "").slice(0, 2).join("").toUpperCase() || "??"
 }
 
-function serverMeta(serverId: number): { name: string; site: string; country: string } {
-  const row = db.select().from(servers).where(eq(servers.id, serverId)).limit(1).all()[0]
+async function serverMeta(serverId: number): Promise<{ name: string; site: string; country: string }> {
+  const rows = await db.select().from(servers).where(eq(servers.id, serverId)).limit(1)
+  const row = rows[0]
   return {
     name: row?.name || row?.host || String(serverId),
     site: row?.site || "—",
@@ -75,8 +73,8 @@ function serverMeta(serverId: number): { name: string; site: string; country: st
   }
 }
 
-function toBindingDto(row: BindingRow): UserBinding {
-  const meta = serverMeta(row.serverId)
+async function toBindingDto(row: BindingRow): Promise<UserBinding> {
+  const meta = await serverMeta(row.serverId)
   return {
     id: row.id,
     userId: row.userId,
@@ -94,7 +92,7 @@ function toBindingDto(row: BindingRow): UserBinding {
   }
 }
 
-function toUserDto(row: AppUserRow, bindings: BindingRow[]): AppUserRead {
+async function toUserDto(row: AppUserRow, bindings: BindingRow[]): Promise<AppUserRead> {
   return {
     id: row.id,
     name: row.name,
@@ -104,39 +102,39 @@ function toUserDto(row: AppUserRow, bindings: BindingRow[]): AppUserRead {
     active: Boolean(row.active),
     avatar: row.avatar,
     lastSeen: row.lastSeen ?? null,
-    sections: parseJsonArray<SectionPerm>(row.sectionsJson, []),
-    servers: parseJsonArray<ServerPerm>(row.serversJson, []),
-    bindings: bindings.map(toBindingDto),
+    sections: asPermArray<SectionPerm>(row.sectionsJson, []),
+    servers: asPermArray<ServerPerm>(row.serversJson, []),
+    bindings: await Promise.all(bindings.map((b) => toBindingDto(b))),
     createdAt: row.createdAt,
     updatedAt: row.updatedAt,
   }
 }
 
-export function listUsers(): AppUserRead[] {
-  const users = listUserRows()
-  const allBindings = listBindingRows()
+export async function listUsers(): Promise<AppUserRead[]> {
+  const users = await listUserRows()
+  const allBindings = await listBindingRows()
   const byUser = new Map<string, BindingRow[]>()
   for (const b of allBindings) {
     const arr = byUser.get(b.userId) ?? []
     arr.push(b)
     byUser.set(b.userId, arr)
   }
-  return users.map((u) => toUserDto(u, byUser.get(u.id) ?? []))
+  return Promise.all(users.map((u) => toUserDto(u, byUser.get(u.id) ?? [])))
 }
 
-export function getUserById(id: string): AppUserRead | undefined {
-  const row = getUserRowById(id)
+export async function getUserById(id: string): Promise<AppUserRead | undefined> {
+  const row = await getUserRowById(id)
   if (!row) return undefined
-  return toUserDto(row, listBindingRowsByUser(id))
+  return await toUserDto(row, await listBindingRowsByUser(id))
 }
 
-export function createUser(input: AppUserCreate): AppUserRead {
+export async function createUser(input: AppUserCreate): Promise<AppUserRead> {
   const login = input.login.trim()
-  if (getUserRowByLogin(login)) {
+  if (await getUserRowByLogin(login)) {
     throw new UsersServiceError("Логин уже занят", 409)
   }
   const now = new Date().toISOString()
-  const row = createUserRow({
+  const row = await createUserRow({
     id: randomUUID(),
     name: input.name.trim(),
     login,
@@ -145,19 +143,19 @@ export function createUser(input: AppUserCreate): AppUserRead {
     active: input.active ?? true,
     avatar: (input.avatar ?? "").trim() || initials(input.name),
     lastSeen: input.lastSeen ?? null,
-    sectionsJson: JSON.stringify(input.sections ?? []),
-    serversJson: JSON.stringify(input.servers ?? []),
+    sectionsJson: input.sections ?? [],
+    serversJson: input.servers ?? [],
     createdAt: now,
     updatedAt: now,
   })
-  return toUserDto(row, [])
+  return await toUserDto(row, [])
 }
 
-export function updateUser(id: string, input: AppUserUpdate): AppUserRead {
-  const existing = getUserRowById(id)
+export async function updateUser(id: string, input: AppUserUpdate): Promise<AppUserRead> {
+  const existing = await getUserRowById(id)
   if (!existing) throw new UsersServiceError("Пользователь не найден", 404)
   if (input.login != null) {
-    const other = getUserRowByLogin(input.login.trim())
+    const other = await getUserRowByLogin(input.login.trim())
     if (other && other.id !== id) throw new UsersServiceError("Логин уже занят", 409)
   }
   const patch: Partial<AppUserRow> = { updatedAt: new Date().toISOString() }
@@ -168,26 +166,26 @@ export function updateUser(id: string, input: AppUserUpdate): AppUserRead {
   if (input.active != null) patch.active = input.active
   if (input.avatar != null) patch.avatar = input.avatar.trim() || existing.avatar
   if (input.lastSeen !== undefined) patch.lastSeen = input.lastSeen
-  if (input.sections != null) patch.sectionsJson = JSON.stringify(input.sections)
-  if (input.servers != null) patch.serversJson = JSON.stringify(input.servers)
-  const updated = updateUserRowById(id, patch)
-  return toUserDto(updated, listBindingRowsByUser(id))
+  if (input.sections != null) patch.sectionsJson = input.sections
+  if (input.servers != null) patch.serversJson = input.servers
+  const updated = await updateUserRowById(id, patch)
+  return await toUserDto(updated, await listBindingRowsByUser(id))
 }
 
-export function deleteUser(id: string): void {
-  const existing = getUserRowById(id)
+export async function deleteUser(id: string): Promise<void> {
+  const existing = await getUserRowById(id)
   if (!existing) throw new UsersServiceError("Пользователь не найден", 404)
-  deleteUserRowById(id)
+  await deleteUserRowById(id)
 }
 
-export function addBinding(userId: string, input: UserBindingCreate): UserBinding {
-  const user = getUserRowById(userId)
+export async function addBinding(userId: string, input: UserBindingCreate): Promise<UserBinding> {
+  const user = await getUserRowById(userId)
   if (!user) throw new UsersServiceError("Пользователь не найден", 404)
-  const server = db.select().from(servers).where(eq(servers.id, input.serverId)).limit(1).all()[0]
-  if (!server) throw new UsersServiceError("Сервер не найден", 404)
+  const serverRows = await db.select().from(servers).where(eq(servers.id, input.serverId)).limit(1)
+  if (!serverRows[0]) throw new UsersServiceError("Сервер не найден", 404)
   const ifaceName = input.interfaceName.trim()
   if (!ifaceName) throw new UsersServiceError("Имя интерфейса обязательно", 400)
-  const type: InterfaceType = input.interfaceType ?? inferIfaceType(input.serverId, ifaceName)
+  const type: InterfaceType = input.interfaceType ?? await inferIfaceType(input.serverId, ifaceName)
   let peerPublicKey = ""
   try {
     peerPublicKey = normalizeBindingPeer(type, input.peerPublicKey)
@@ -201,7 +199,7 @@ export function addBinding(userId: string, input: UserBindingCreate): UserBindin
       name: input.peerName,
     })
     : ""
-  const taken = getBindingByServerIfacePeer(input.serverId, ifaceName, peerPublicKey)
+  const taken = await getBindingByServerIfacePeer(input.serverId, ifaceName, peerPublicKey)
   if (taken) {
     throw new UsersServiceError(
       type === "wg"
@@ -212,7 +210,7 @@ export function addBinding(userId: string, input: UserBindingCreate): UserBindin
   }
   const now = new Date().toISOString()
   try {
-    const row = createBindingRow({
+    const row = await createBindingRow({
       id: randomUUID(),
       userId,
       serverId: input.serverId,
@@ -224,7 +222,7 @@ export function addBinding(userId: string, input: UserBindingCreate): UserBindin
       createdAt: now,
       updatedAt: now,
     })
-    return toBindingDto(row)
+    return await toBindingDto(row)
   } catch (err) {
     if (isUniqueConstraintError(err)) {
       throw new UsersServiceError(
@@ -238,37 +236,37 @@ export function addBinding(userId: string, input: UserBindingCreate): UserBindin
   }
 }
 
-export function removeBinding(userId: string, bindingId: string): void {
-  const row = getBindingRowById(bindingId)
+export async function removeBinding(userId: string, bindingId: string): Promise<void> {
+  const row = await getBindingRowById(bindingId)
   if (!row || row.userId !== userId) {
     throw new UsersServiceError("Привязка не найдена", 404)
   }
-  deleteBindingRowById(bindingId)
+  await deleteBindingRowById(bindingId)
 }
 
-function inferIfaceType(serverId: number, ifaceName: string): InterfaceType {
-  const snap = getLatestSnapshot(serverId)
+async function inferIfaceType(serverId: number, ifaceName: string): Promise<InterfaceType> {
+  const snap = await getLatestSnapshot(serverId)
   const parsed = parseRawInterfaces(snap?.rawInterfaces)
   const found = parsed.find((i) => i.name === ifaceName)
   return found?.type ?? "other"
 }
 
 export async function listInterfaceCatalog(serverId: number): Promise<CatalogInterface[]> {
-  const server = db.select().from(servers).where(eq(servers.id, serverId)).limit(1).all()[0]
-  if (!server) throw new UsersServiceError("Сервер не найден", 404)
+  const serverRows = await db.select().from(servers).where(eq(servers.id, serverId)).limit(1)
+  if (!serverRows[0]) throw new UsersServiceError("Сервер не найден", 404)
 
-  const snap = getLatestSnapshot(serverId)
+  const snap = await getLatestSnapshot(serverId)
   let ifaces = parseRawInterfaces(snap?.rawInterfaces)
   if (ifaces.length === 0) {
-    const last = db
+    const lastRows = await db
       .select({ sampledAt: trafficSamples.sampledAt })
       .from(trafficSamples)
       .where(eq(trafficSamples.serverId, serverId))
       .orderBy(desc(trafficSamples.sampledAt))
       .limit(1)
-      .all()[0]
+    const last = lastRows[0]
     if (last) {
-      const rows = db
+      const rows = (await db
         .select({
           interfaceName: trafficSamples.interfaceName,
           peerPublicKey: trafficSamples.peerPublicKey,
@@ -276,8 +274,7 @@ export async function listInterfaceCatalog(serverId: number): Promise<CatalogInt
           disabled: trafficSamples.disabled,
         })
         .from(trafficSamples)
-        .where(eq(trafficSamples.serverId, serverId))
-        .all()
+        .where(eq(trafficSamples.serverId, serverId)))
         .filter((r) => r.interfaceName && !/^(lo|loopback)/i.test(r.interfaceName) && !(r.peerPublicKey ?? ""))
       const seen = new Set<string>()
       ifaces = []
@@ -294,8 +291,8 @@ export async function listInterfaceCatalog(serverId: number): Promise<CatalogInt
     }
   }
 
-  const bindings = listBindingRows().filter((b) => b.serverId === serverId)
-  const usersById = new Map(listUserRows().map((u) => [u.id, u]))
+  const bindings = (await listBindingRows()).filter((b) => b.serverId === serverId)
+  const usersById = new Map((await listUserRows()).map((u) => [u.id, u]))
   const hasWg = ifaces.some((i) => i.type === "wg")
   const wgLive = hasWg
     ? await listWireGuardPeersForCatalog(serverId)
diff --git a/backend/src/plugins/auth.smoke.test.ts b/backend/src/plugins/auth.smoke.test.ts
index b73d208..97268ba 100644
--- a/backend/src/plugins/auth.smoke.test.ts
+++ b/backend/src/plugins/auth.smoke.test.ts
@@ -10,7 +10,6 @@ process.env.AUTH_JWT_SECRET = "test-secret-at-least-8"
 process.env.AUTH_ISSUER = "https://auth.test.local"
 process.env.AUTH_PORTAL_URL = "http://localhost:5175"
 process.env.CORS_ORIGIN = "http://localhost:3000"
-process.env.DATABASE_PATH = ":memory:"
 process.env.NODE_ENV = "test"
 
 // Dynamic import after env is set
diff --git a/backend/src/routes/alerts.ts b/backend/src/routes/alerts.ts
index 0bf2816..f11aefd 100644
--- a/backend/src/routes/alerts.ts
+++ b/backend/src/routes/alerts.ts
@@ -20,14 +20,14 @@ import {
 
 const alertsRoutes: FastifyPluginAsyncZod = async (app) => {
   app.get("/alerts", async (_req, reply) => {
-    const tg = getTelegramPublic()
+    const tg = await getTelegramPublic()
     const connected = tg.tokenConfigured && Boolean(tg.chatId?.trim())
     return reply.send({
       telegram: { ...tg, connected },
-      groups: listAlertGroups(),
-      rules: listAlertRules(),
-      history: listMergedHistory(),
-      meta: getAlertsMeta(),
+      groups: await listAlertGroups(),
+      rules: await listAlertRules(),
+      history: await listMergedHistory(),
+      meta: await getAlertsMeta(),
     })
   })
 
@@ -38,7 +38,7 @@ const alertsRoutes: FastifyPluginAsyncZod = async (app) => {
     }
     const groups =
       parsed.data.groups ??
-      listAlertGroups().map((g) => ({
+      (await listAlertGroups()).map((g) => ({
         id: g.id,
         name: g.name,
         combineMode: g.combineMode,
@@ -67,8 +67,8 @@ const alertsRoutes: FastifyPluginAsyncZod = async (app) => {
       recoveryStabilitySec: r.recoveryStabilitySec ?? null,
       chatId: r.chatId,
     }))
-    replaceAlertsConfig({ groups, rules })
-    return reply.send({ ok: true, groups: listAlertGroups(), rules: listAlertRules() })
+    await replaceAlertsConfig({ groups, rules })
+    return reply.send({ ok: true, groups: await listAlertGroups(), rules: await listAlertRules() })
   })
 
   app.put("/alerts/telegram", async (req, reply) => {
@@ -76,7 +76,7 @@ const alertsRoutes: FastifyPluginAsyncZod = async (app) => {
     if (!parsed.success) {
       return reply.status(400).send({ error: "Некорректное тело запроса", details: parsed.error.flatten() })
     }
-    const next = updateTelegramSettings({
+    const next = await updateTelegramSettings({
       token: parsed.data.token,
       chatId: parsed.data.chatId,
       messageThreadId: parsed.data.messageThreadId,
@@ -90,9 +90,9 @@ const alertsRoutes: FastifyPluginAsyncZod = async (app) => {
     if (!parsed.success) {
       return reply.status(400).send({ error: "Некорректное тело запроса", details: parsed.error.flatten() })
     }
-    const fromDb = getTelegramBotToken()
+    const fromDb = await getTelegramBotToken()
     const token = (parsed.data.token?.trim() || fromDb).trim()
-    const pub = getTelegramPublic()
+    const pub = await getTelegramPublic()
     const chatId = (parsed.data.chatId?.trim() || pub.chatId || "").trim()
     if (!token) {
       return reply.status(400).send({ error: "Не задан Bot Token (сохраните в БД или передайте в запросе)" })
@@ -103,7 +103,7 @@ const alertsRoutes: FastifyPluginAsyncZod = async (app) => {
     const threadId =
       parsed.data.messageThreadId != null && parsed.data.messageThreadId >= 1
         ? parsed.data.messageThreadId
-        : getTelegramMessageThreadIdForApi()
+        : await getTelegramMessageThreadIdForApi()
     const text = parsed.data.rulePreview
       ? formatAlertRuleTestTelegramText(parsed.data.rulePreview)
       : "MikroTik Manager — тест оповещений (Telegram)."
diff --git a/backend/src/routes/backups.ts b/backend/src/routes/backups.ts
index 342b472..786930b 100644
--- a/backend/src/routes/backups.ts
+++ b/backend/src/routes/backups.ts
@@ -61,7 +61,7 @@ async function processBackupJob(job: BackupJob, ids: string[], notes?: string) {
   }
   job.status = "done"
   job.finishedAt = new Date().toISOString()
-  appendEvent({
+  await appendEvent({
     level: job.failures.length > 0 ? "warning" : "info",
     eventType: "backups.job.done",
     sourceModule: "backups",
@@ -80,11 +80,11 @@ async function processBackupJob(job: BackupJob, ids: string[], notes?: string) {
 
 const backupsRoutes: FastifyPluginAsyncZod = async (app) => {
   app.get("/backups", async (_req, reply) => {
-    return reply.send(listBackups())
+    return reply.send(await listBackups())
   })
 
   app.get("/backups/schedule", async (_req, reply) => {
-    return reply.send(getBackupScheduleSettings())
+    return reply.send(await getBackupScheduleSettings())
   })
 
   app.put("/backups/schedule", async (req, reply) => {
@@ -92,15 +92,15 @@ const backupsRoutes: FastifyPluginAsyncZod = async (app) => {
     if (!parsed.success) {
       return reply.status(400).send({ error: "Некорректное тело запроса", details: parsed.error.flatten() })
     }
-    const result = updateBackupScheduleSettings(parsed.data)
-    refreshScheduler()
+    const result = await updateBackupScheduleSettings(parsed.data)
+    await refreshScheduler()
     return reply.send(result)
   })
 
   app.post("/backups/create", { schema: { body: CreateBackupBodySchema } }, async (req, reply) => {
     const inputIds = req.body.serverIds.map((x) => String(x))
     const notes = req.body.notes?.trim() || undefined
-    const existingServers = new Set(listServersRead().map((s) => String(s.id)))
+    const existingServers = new Set((await listServersRead()).map((s) => String(s.id)))
     const ids = [...new Set(inputIds)].filter((id) => existingServers.has(id))
     if (ids.length === 0) return reply.status(400).send({ error: "Не выбраны валидные серверы" })
 
@@ -115,7 +115,7 @@ const backupsRoutes: FastifyPluginAsyncZod = async (app) => {
       failures: [],
     }
     backupJobs.set(jobId, job)
-    appendEvent({
+    await appendEvent({
       level: "info",
       eventType: "backups.job.started",
       sourceModule: "backups",
@@ -128,8 +128,8 @@ const backupsRoutes: FastifyPluginAsyncZod = async (app) => {
         notes: notes ?? null,
       },
     })
-    queueMicrotask(() => {
-      void processBackupJob(job, ids, notes).catch((err) => {
+    queueMicrotask(async () => {
+      void processBackupJob(job, ids, notes).catch(async (err) => {
         job.status = "failed"
         job.finishedAt = new Date().toISOString()
         const failure = {
@@ -137,7 +137,7 @@ const backupsRoutes: FastifyPluginAsyncZod = async (app) => {
           error: err instanceof Error ? err.message : String(err),
         }
         job.failures.push(failure)
-        appendEvent({
+        await appendEvent({
           level: "critical",
           eventType: "backups.job.failed",
           sourceModule: "backups",
@@ -167,7 +167,7 @@ const backupsRoutes: FastifyPluginAsyncZod = async (app) => {
   })
 
   app.get("/backups/:id/download", { schema: { params: BackupIdParamSchema } }, async (req, reply) => {
-    const hit = getBackupById(req.params.id)
+    const hit = await getBackupById(req.params.id)
     if (!hit) return reply.status(404).send({ error: "Бэкап не найден" })
     const filePath = path.join(getBackupsDir(), hit.filename)
     const content = await readFile(filePath, "utf8").catch(() => null)
diff --git a/backend/src/routes/bgp.ts b/backend/src/routes/bgp.ts
index b4b3d28..340b9f5 100644
--- a/backend/src/routes/bgp.ts
+++ b/backend/src/routes/bgp.ts
@@ -12,7 +12,7 @@ const bgpRoutes: FastifyPluginAsyncZod = async (app) => {
   // GET /api/bgp/sessions/raw/:id — raw RouterOS response for a single server (debug)
   app.get("/bgp/sessions/raw/:id", { schema: { params: ServerIdParamSchema } }, async (req, reply) => {
     const params = req.params as ServerIdParams
-    const server = db.select().from(servers).where(eq(servers.id, params.id)).limit(1).all()[0]
+    const server = (await db.select().from(servers).where(eq(servers.id, params.id)).limit(1))[0]
     if (!server) return reply.status(404).send({ error: "Server not found" })
     try {
       const client = MikrotikClient.fromServer(server)
@@ -26,7 +26,7 @@ const bgpRoutes: FastifyPluginAsyncZod = async (app) => {
 
   // GET /api/bgp/sessions — aggregate from ALL enabled servers
   app.get("/bgp/sessions", async (_req, reply) => {
-    const allServers = db.select().from(servers).where(eq(servers.enabled, true)).all()
+    const allServers = await db.select().from(servers).where(eq(servers.enabled, true))
 
     const results: BgpSessionRead[][] = await Promise.all(
       allServers.map(async (server) => {
@@ -46,10 +46,10 @@ const bgpRoutes: FastifyPluginAsyncZod = async (app) => {
   // GET /api/servers/:id/bgp/sessions — single server
   app.get("/servers/:id/bgp/sessions", { schema: { params: ServerIdParamSchema } }, async (req, reply) => {
     const params = req.params as ServerIdParams
-    const server = db
+    const server = (await db
       .select().from(servers)
       .where(eq(servers.id, params.id))
-      .limit(1).all()[0]
+      .limit(1))[0]
 
     if (!server) return reply.status(404).send({ error: "Server not found" })
 
diff --git a/backend/src/routes/certificates.ts b/backend/src/routes/certificates.ts
index d2baaf1..97137da 100644
--- a/backend/src/routes/certificates.ts
+++ b/backend/src/routes/certificates.ts
@@ -32,7 +32,7 @@ const certificatesRoutes: FastifyPluginAsyncZod = async (app) => {
   })
 
   app.get("/certificates/acme-settings", async (_req, reply) => {
-    return reply.send(getAcmeSettingsPublic())
+    return reply.send(await getAcmeSettingsPublic())
   })
 
   app.put("/certificates/acme-settings", async (req, reply) => {
@@ -40,11 +40,11 @@ const certificatesRoutes: FastifyPluginAsyncZod = async (app) => {
     if (!parsed.success) {
       return reply.status(400).send({ error: "Некорректное тело запроса", details: parsed.error.flatten() })
     }
-    return reply.send(updateAcmeSettings(parsed.data))
+    return reply.send(await updateAcmeSettings(parsed.data))
   })
 
   app.get("/certificates/renew-settings", async (_req, reply) => {
-    return reply.send(getCertificateRenewSettings())
+    return reply.send(await getCertificateRenewSettings())
   })
 
   app.put("/certificates/renew-settings", async (req, reply) => {
@@ -52,8 +52,8 @@ const certificatesRoutes: FastifyPluginAsyncZod = async (app) => {
     if (!parsed.success) {
       return reply.status(400).send({ error: "Некорректное тело запроса", details: parsed.error.flatten() })
     }
-    const result = updateCertificateRenewSettings(parsed.data)
-    refreshScheduler()
+    const result = await updateCertificateRenewSettings(parsed.data)
+    await refreshScheduler()
     return reply.send(result)
   })
 
@@ -62,7 +62,7 @@ const certificatesRoutes: FastifyPluginAsyncZod = async (app) => {
     if (!parsed.success) {
       return reply.status(400).send({ error: "Некорректное тело запроса", details: parsed.error.flatten() })
     }
-    const effective = parsed.data.cloudflareApiToken?.trim() || getAcmeCloudflareToken()
+    const effective = parsed.data.cloudflareApiToken?.trim() || await getAcmeCloudflareToken()
     if (!effective) {
       return reply.status(400).send({ error: "Не задан Cloudflare API token" })
     }
@@ -83,12 +83,12 @@ const certificatesRoutes: FastifyPluginAsyncZod = async (app) => {
       return reply.status(400).send({ error: "Некорректное тело запроса", details: parsed.error.flatten() })
     }
     const serverId = String(parsed.data.serverId)
-    const server = getServerRowByIdString(serverId)
+    const server = await getServerRowByIdString(serverId)
     if (!server) return reply.status(404).send({ error: "Сервер не найден" })
 
     const jobId = randomUUID()
     const trustStore = (parsed.data.trustStore ?? ["www", "api"]).join(",")
-    createIssueJobRecord({
+    await createIssueJobRecord({
       id: jobId,
       serverId,
       certName: parsed.data.certName.trim(),
@@ -103,9 +103,9 @@ const certificatesRoutes: FastifyPluginAsyncZod = async (app) => {
 
   app.get("/certificates/issue/:jobId", async (req, reply) => {
     const jobId = String((req.params as { jobId: string }).jobId)
-    const row = getIssueJobRecord(jobId)
+    const row = await getIssueJobRecord(jobId)
     if (!row) return reply.status(404).send({ error: "Задача не найдена" })
-    return reply.send(toIssueJobDto(row))
+    return reply.send(await toIssueJobDto(row))
   })
 }
 
diff --git a/backend/src/routes/events.ts b/backend/src/routes/events.ts
index 220733d..a562eee 100644
--- a/backend/src/routes/events.ts
+++ b/backend/src/routes/events.ts
@@ -8,7 +8,7 @@ const eventsRoutes: FastifyPluginAsyncZod = async (app) => {
     if (!parsed.success) {
       return reply.status(400).send({ error: "Некорректные параметры запроса", details: parsed.error.flatten() })
     }
-    return reply.send({ events: readEvents(parsed.data) })
+    return reply.send({ events: await readEvents(parsed.data) })
   })
 
   app.post("/events/batch", async (req, reply) => {
@@ -16,7 +16,7 @@ const eventsRoutes: FastifyPluginAsyncZod = async (app) => {
     if (!parsed.success) {
       return reply.status(400).send({ error: "Некорректное тело запроса", details: parsed.error.flatten() })
     }
-    appendEvents(parsed.data.events)
+    await appendEvents(parsed.data.events)
     return reply.status(201).send({ ok: true, inserted: parsed.data.events.length })
   })
 }
diff --git a/backend/src/routes/evobgp.ts b/backend/src/routes/evobgp.ts
index b869c46..63f5486 100644
--- a/backend/src/routes/evobgp.ts
+++ b/backend/src/routes/evobgp.ts
@@ -17,11 +17,11 @@ const TestEvobgpSchema = z.object({
   apiKey: z.string().optional(),
 })
 
-function ensureEvobgpRow() {
-  let row = db.select().from(evobgpSettings).where(eq(evobgpSettings.id, 1)).limit(1).all()[0]
+async function ensureEvobgpRow() {
+  let row = (await db.select().from(evobgpSettings).where(eq(evobgpSettings.id, 1)).limit(1))[0]
   if (!row) {
-    db.insert(evobgpSettings).values({ id: 1 }).run()
-    row = db.select().from(evobgpSettings).where(eq(evobgpSettings.id, 1)).limit(1).all()[0]
+    await db.insert(evobgpSettings).values({ id: 1 })
+    row = (await db.select().from(evobgpSettings).where(eq(evobgpSettings.id, 1)).limit(1))[0]
   }
   return row!
 }
@@ -108,11 +108,10 @@ function aggregateCommunityRouteCounts(catalog: EvoCatalogRaw): Map<string, numb
  * Уникальные серверы из локальной БД, у которых в BGP-фильтре указан community (строка AS:NNN).
  * Ключ — значение `filter_rules.community` после trim (как в EvoBGP `community`).
  */
-function distinctServersByFilterCommunityValue(): Map<string, number> {
-  const rows = db
+async function distinctServersByFilterCommunityValue(): Promise<Map<string, number>> {
+  const rows = await db
     .select({ serverId: filterRules.serverId, community: filterRules.community })
     .from(filterRules)
-    .all()
   const byVal = new Map<string, Set<number>>()
   for (const r of rows) {
     const v = (r.community ?? "").trim()
@@ -161,8 +160,8 @@ async function fetchEvoJson<T>(root: string, path: string, token: string): Promi
   }
 }
 
-function credentialsFromDb(): { root: string; apiKey: string } | null {
-  const row = ensureEvobgpRow()
+async function credentialsFromDb(): Promise<{ root: string; apiKey: string } | null> {
+  const row = await ensureEvobgpRow()
   const root = normalizeBaseUrl(row.baseUrl)
   const apiKey = normalizeApiKey(row.apiKey)
   if (!root || !apiKey) return null
@@ -171,7 +170,7 @@ function credentialsFromDb(): { root: string; apiKey: string } | null {
 
 const evobgpRoutes: FastifyPluginAsyncZod = async (app) => {
   app.get("/evobgp/settings", async (_req, reply) => {
-    const row = ensureEvobgpRow()
+    const row = await ensureEvobgpRow()
     return reply.send({
       baseUrl: row.baseUrl ?? "",
       enabled: Boolean(row.enabled),
@@ -184,7 +183,7 @@ const evobgpRoutes: FastifyPluginAsyncZod = async (app) => {
     if (!parsed.success) {
       return reply.status(400).send({ error: "Некорректное тело запроса", details: parsed.error.flatten() })
     }
-    const cur = ensureEvobgpRow()
+    const cur = await ensureEvobgpRow()
     let nextBase = cur.baseUrl
     let nextEnabled = cur.enabled
     let nextKey = cur.apiKey
@@ -200,17 +199,16 @@ const evobgpRoutes: FastifyPluginAsyncZod = async (app) => {
           : normalizeApiKey(parsed.data.apiKey)
     }
 
-    db.update(evobgpSettings)
+    await db.update(evobgpSettings)
       .set({
         baseUrl: nextBase,
         enabled: nextEnabled,
         apiKey: nextKey,
-        updatedAt: sql`(datetime('now'))`,
+        updatedAt: sql`now()`,
       })
       .where(eq(evobgpSettings.id, 1))
-      .run()
 
-    const row = ensureEvobgpRow()
+    const row = await ensureEvobgpRow()
     return reply.send({
       baseUrl: row.baseUrl ?? "",
       enabled: Boolean(row.enabled),
@@ -228,7 +226,7 @@ const evobgpRoutes: FastifyPluginAsyncZod = async (app) => {
     if (!parsed.success) {
       return reply.status(400).send({ error: "Некорректное тело запроса", details: parsed.error.flatten() })
     }
-    const row = ensureEvobgpRow()
+    const row = await ensureEvobgpRow()
     const d = parsed.data
     const urlRaw = d.baseUrl !== undefined ? d.baseUrl : row.baseUrl
     const keyRaw =
@@ -253,11 +251,11 @@ const evobgpRoutes: FastifyPluginAsyncZod = async (app) => {
    * Прокси к GET /v1/router-lists/catalog — учётные данные только из БД.
    */
   app.post("/evobgp/catalog", async (_req, reply) => {
-    const row = ensureEvobgpRow()
+    const row = await ensureEvobgpRow()
     if (!row.enabled) {
       return reply.status(400).send({ error: "Интеграция EvoBGP выключена в настройках" })
     }
-    const cred = credentialsFromDb()
+    const cred = await credentialsFromDb()
     if (!cred) {
       return reply.status(400).send({ error: "Не заданы базовый URL или API-ключ в БД" })
     }
@@ -333,7 +331,7 @@ const evobgpRoutes: FastifyPluginAsyncZod = async (app) => {
       })
 
       const routeCountsByCommUuid = aggregateCommunityRouteCounts(catalog)
-      const serversByCommunityStr = distinctServersByFilterCommunityValue()
+      const serversByCommunityStr = await distinctServersByFilterCommunityValue()
 
       const communities = commItems.map((c) => {
         const valueStr = (c.community ?? "").trim()
diff --git a/backend/src/routes/exec.ts b/backend/src/routes/exec.ts
index acfbd3f..a82933e 100644
--- a/backend/src/routes/exec.ts
+++ b/backend/src/routes/exec.ts
@@ -314,10 +314,10 @@ const execRoutes: FastifyPluginAsyncZod = async (app) => {
     { schema: { params: ServerIdParamSchema, body: ExecBodySchema } },
     async (req, reply) => {
       const params = req.params as ServerIdParams
-      const server = db
+      const server = (await db
         .select().from(servers)
         .where(eq(servers.id, params.id))
-        .limit(1).all()[0]
+        .limit(1))[0]
 
       if (!server) return reply.status(404).send({ error: "Server not found" })
 
diff --git a/backend/src/routes/filters.ts b/backend/src/routes/filters.ts
index 86444a0..1327443 100644
--- a/backend/src/routes/filters.ts
+++ b/backend/src/routes/filters.ts
@@ -186,12 +186,11 @@ function gatewayFromRecursiveDst(dstAddress: string): string {
  * Импорт с роутера даёт только `set gateway` без `set out-interface` — в таком виде не отличить от «поломанного» GRE.
  * Сопоставляем hop с локальной таблицей recursive_routes и восстанавливаем gatewayTunnelId = rec:<id>.
  */
-function enrichRulesWithRecursiveGateway(serverId: number, rules: ApiFilterRule[]): ApiFilterRule[] {
-  const rows = db
+async function enrichRulesWithRecursiveGateway(serverId: number, rules: ApiFilterRule[]): Promise<ApiFilterRule[]> {
+  const rows = await db
     .select()
     .from(recursiveRoutes)
     .where(and(eq(recursiveRoutes.serverId, serverId), eq(recursiveRoutes.disabled, false)))
-    .all()
 
   return rules.map(rule => {
     if (rule.action === "blackhole") return rule
@@ -249,7 +248,7 @@ async function fetchServerFilters(server: ServerRow) {
     .filter(r => (r.chain ?? "").trim().toLowerCase() === "bgp-in")
     .flatMap(parseFilterRule)
 
-  const rules = enrichRulesWithRecursiveGateway(server.id, rulesRaw)
+  const rules = await enrichRulesWithRecursiveGateway(server.id, rulesRaw)
 
   return {
     serverId: String(server.id),
@@ -258,8 +257,8 @@ async function fetchServerFilters(server: ServerRow) {
   }
 }
 
-function toApiRulesets(serverRows: ServerRow[]) {
-  const dbRules = db.select().from(filterRules).orderBy(asc(filterRules.serverId), asc(filterRules.sortOrder)).all()
+async function toApiRulesets(serverRows: ServerRow[]) {
+  const dbRules = await db.select().from(filterRules).orderBy(asc(filterRules.serverId), asc(filterRules.sortOrder))
   return serverRows.map(s => ({
     serverId: String(s.id),
     rules: dbRules
@@ -277,7 +276,7 @@ function toApiRulesets(serverRows: ServerRow[]) {
 }
 
 /** GRE: gatewayTunnelId = имя интерфейса; рекурсивный: rec:<id строки recursive_routes */
-function resolveRouteTargets(serverId: number, rule: ApiFilterRule): { gateway: string; outIface: string } {
+async function resolveRouteTargets(serverId: number, rule: ApiFilterRule): Promise<{ gateway: string; outIface: string }> {
   if (rule.action === "blackhole") return { gateway: "", outIface: "" }
   const tid = (rule.gatewayTunnelId ?? "").trim()
   if (tid.startsWith("rec:")) {
@@ -285,12 +284,11 @@ function resolveRouteTargets(serverId: number, rule: ApiFilterRule): { gateway:
     if (!Number.isFinite(rid)) {
       return { gateway: rule.gateway, outIface: "" }
     }
-    const row = db
+    const row = (await db
       .select()
       .from(recursiveRoutes)
       .where(and(eq(recursiveRoutes.serverId, serverId), eq(recursiveRoutes.id, rid)))
-      .limit(1)
-      .all()[0]
+      .limit(1))[0]
     if (!row) return { gateway: rule.gateway, outIface: "" }
     const gw = gatewayFromRecursiveDst(row.dstAddress)
     return { gateway: gw || rule.gateway, outIface: "" }
@@ -303,30 +301,30 @@ function normalizeCommunity(c: string): string {
 }
 
 /** Одинаковый эффект на роутере при одинаковой community (blackhole vs gateway + out-interface) */
-function ruleEffectSignature(serverId: number, r: ApiFilterRule): string {
+async function ruleEffectSignature(serverId: number, r: ApiFilterRule): Promise<string> {
   if (r.action === "blackhole") return `bh:${normalizeCommunity(r.community)}`
-  const { gateway, outIface } = resolveRouteTargets(serverId, r)
+  const { gateway, outIface } = await resolveRouteTargets(serverId, r)
   return `rt:${normalizeCommunity(r.community)}:${gateway}:${outIface}`
 }
 
 export type FilterRouterCompareStatus = "synced" | "drift" | "missing"
 
-function compareDbRulesWithRouter(
+async function compareDbRulesWithRouter(
   serverId: number,
   dbRules: ApiFilterRule[],
   remoteRules: ApiFilterRule[],
-): Record<string, FilterRouterCompareStatus> {
+): Promise<Record<string, FilterRouterCompareStatus>> {
   const remoteSigByComm = new Map<string, string>()
   for (const rr of remoteRules) {
     const c = normalizeCommunity(rr.community)
     if (!remoteSigByComm.has(c)) {
-      remoteSigByComm.set(c, ruleEffectSignature(serverId, rr))
+      remoteSigByComm.set(c, await ruleEffectSignature(serverId, rr))
     }
   }
   const out: Record<string, FilterRouterCompareStatus> = {}
   for (const dr of dbRules) {
     const c = normalizeCommunity(dr.community)
-    const sigD = ruleEffectSignature(serverId, dr)
+    const sigD = await ruleEffectSignature(serverId, dr)
     const sigR = remoteSigByComm.get(c)
     if (sigR === undefined) {
       out[c] = "missing"
@@ -339,7 +337,7 @@ function compareDbRulesWithRouter(
   return out
 }
 
-function toRouterRuleBody(serverId: number, rules: ApiFilterRule[]): string {
+async function toRouterRuleBody(serverId: number, rules: ApiFilterRule[]): Promise<string> {
   if (rules.length === 0) return ""
   // Группируем по эффекту (action + gateway + out-interface). Communities с одним и тем же
   // `set gw` объединяются через `||` в один if-блок — компактнее и ближе к привычному
@@ -361,7 +359,7 @@ function toRouterRuleBody(serverId: number, rules: ApiFilterRule[]): string {
     const isBlackhole = rule.action === "blackhole"
     const { gateway, outIface } = isBlackhole
       ? { gateway: "", outIface: "" }
-      : resolveRouteTargets(serverId, rule)
+      : await resolveRouteTargets(serverId, rule)
     const key = isBlackhole ? "bh" : `rt:${gateway}:${outIface}`
     let idx = indexByKey.get(key)
     if (idx === undefined) {
@@ -404,10 +402,10 @@ function toRouterRuleBody(serverId: number, rules: ApiFilterRule[]): string {
 }
 
 async function replaceDbRules(serverId: number, rules: ApiFilterRule[]) {
-  db.delete(filterRules).where(eq(filterRules.serverId, serverId)).run()
+  await db.delete(filterRules).where(eq(filterRules.serverId, serverId))
   if (rules.length === 0) return
   const now = new Date().toISOString()
-  db.insert(filterRules).values(
+  await db.insert(filterRules).values(
     rules.map((r, i) => ({
       serverId,
       sortOrder: i,
@@ -420,7 +418,7 @@ async function replaceDbRules(serverId: number, rules: ApiFilterRule[]) {
       createdAt: now,
       updatedAt: now,
     })),
-  ).run()
+  )
 }
 
 const filtersRoutes: FastifyPluginAsyncZod = async (app) => {
@@ -432,17 +430,16 @@ const filtersRoutes: FastifyPluginAsyncZod = async (app) => {
       return reply.status(400).send({ error: "serverId is required" })
     }
 
-    const server = db.select().from(servers).where(eq(servers.id, serverId)).limit(1).all()[0]
+    const server = (await db.select().from(servers).where(eq(servers.id, serverId)).limit(1))[0]
     if (!server) return reply.status(404).send({ error: "Server not found" })
 
     try {
       const remote = await fetchServerFilters(server)
-      const rows = db
+      const rows = await db
         .select()
         .from(filterRules)
         .where(eq(filterRules.serverId, serverId))
         .orderBy(asc(filterRules.sortOrder))
-        .all()
 
       const dbRules: ApiFilterRule[] = rows.map(r => ({
         id: String(r.id),
@@ -454,7 +451,7 @@ const filtersRoutes: FastifyPluginAsyncZod = async (app) => {
         description: r.description,
       }))
 
-      const byCommunity = compareDbRulesWithRouter(serverId, dbRules, remote.rules)
+      const byCommunity = await compareDbRulesWithRouter(serverId, dbRules, remote.rules)
       return reply.send({ byCommunity })
     } catch (err) {
       app.log.error({ serverId, err: String(err) }, "filters router-compare failed")
@@ -466,7 +463,7 @@ const filtersRoutes: FastifyPluginAsyncZod = async (app) => {
   app.get("/filters/gre-tunnels", async (req, reply) => {
     const q = req.query as { serverId?: string | number }
     const sid = parseDbServerId(q.serverId)
-    const enabledServers = db.select().from(servers).where(eq(servers.enabled, true)).all()
+    const enabledServers = await db.select().from(servers).where(eq(servers.enabled, true))
 
     if (sid !== null) {
       const server = enabledServers.find(s => s.id === sid)
@@ -492,8 +489,8 @@ const filtersRoutes: FastifyPluginAsyncZod = async (app) => {
 
   /** Только правила фильтров из БД (без опроса MikroTik за GRE) */
   app.get("/filters/rules", async (_req, reply) => {
-    const allServers = db.select().from(servers).where(eq(servers.enabled, true)).all()
-    const dbRulesets = toApiRulesets(allServers)
+    const allServers = await db.select().from(servers).where(eq(servers.enabled, true))
+    const dbRulesets = await toApiRulesets(allServers)
 
     return reply.send({
       rulesets: dbRulesets,
@@ -506,7 +503,7 @@ const filtersRoutes: FastifyPluginAsyncZod = async (app) => {
     const payload = body.rulesets ?? []
     const serverIds = payload.map(r => Number.parseInt(r.serverId, 10)).filter(Number.isFinite)
     if (serverIds.length > 0) {
-      db.delete(filterRules).where(inArray(filterRules.serverId, serverIds)).run()
+      await db.delete(filterRules).where(inArray(filterRules.serverId, serverIds))
     }
     for (const rs of payload) {
       const sid = Number.parseInt(rs.serverId, 10)
@@ -524,12 +521,12 @@ const filtersRoutes: FastifyPluginAsyncZod = async (app) => {
       return reply.status(400).send({ error: "serverId is required" })
     }
 
-    const server = db.select().from(servers).where(eq(servers.id, serverId)).limit(1).all()[0]
+    const server = (await db.select().from(servers).where(eq(servers.id, serverId)).limit(1))[0]
     if (!server) return reply.status(404).send({ error: "Server not found" })
 
     try {
       app.log.info({ serverId, host: server.host }, "Filters sync from router started")
-      appendEvent({
+      await appendEvent({
         level: "info",
         eventType: "filters.sync.from_router.started",
         sourceModule: "filters",
@@ -541,7 +538,7 @@ const filtersRoutes: FastifyPluginAsyncZod = async (app) => {
       const remote = await fetchServerFilters(server)
       await replaceDbRules(server.id, remote.rules)
       app.log.info({ serverId, totalRules: remote.rules.length }, "Filters sync from router completed")
-      appendEvent({
+      await appendEvent({
         level: "info",
         eventType: "filters.sync.from_router.done",
         sourceModule: "filters",
@@ -553,7 +550,7 @@ const filtersRoutes: FastifyPluginAsyncZod = async (app) => {
       return reply.send({ ok: true, updatedServers: 1, totalRules: remote.rules.length, serverId })
     } catch (err) {
       app.log.error({ serverId, err: String(err) }, "Filters sync from router failed")
-      appendEvent({
+      await appendEvent({
         level: "critical",
         eventType: "filters.sync.from_router.failed",
         sourceModule: "filters",
@@ -570,7 +567,7 @@ const filtersRoutes: FastifyPluginAsyncZod = async (app) => {
     const body = req.body as { serverId?: string | number } | undefined
     const requestedServerId = parseDbServerId(body?.serverId)
 
-    const allServers = db.select().from(servers).where(eq(servers.enabled, true)).all()
+    const allServers = await db.select().from(servers).where(eq(servers.enabled, true))
     const targetServers = requestedServerId !== null
       ? allServers.filter(s => s.id === requestedServerId)
       : allServers
@@ -582,7 +579,7 @@ const filtersRoutes: FastifyPluginAsyncZod = async (app) => {
     let updatedServers = 0
     let pushedRules = 0
     const errors: Array<{ serverId: number; error: string }> = []
-    appendEvent({
+    await appendEvent({
       level: "info",
       eventType: "filters.sync.to_router.started",
       sourceModule: "filters",
@@ -618,10 +615,9 @@ const filtersRoutes: FastifyPluginAsyncZod = async (app) => {
           .map(r => r[".id"])
           .filter((id): id is string => Boolean(id))
 
-        const rows = db.select().from(filterRules)
+        const rows = await db.select().from(filterRules)
           .where(and(eq(filterRules.serverId, server.id)))
           .orderBy(asc(filterRules.sortOrder))
-          .all()
 
         const rules: ApiFilterRule[] = rows.map(r => ({
           id: String(r.id),
@@ -639,7 +635,7 @@ const filtersRoutes: FastifyPluginAsyncZod = async (app) => {
         // трактует как «вызов команды» и отдаёт 400 «no such command».
         // См. https://help.mikrotik.com/docs/spaces/ROS/pages/47579162/REST+API
         if (rules.length > 0) {
-          const ruleBody = toRouterRuleBody(server.id, rules)
+          const ruleBody = await toRouterRuleBody(server.id, rules)
           if (managedRule && managedRule[".id"]) {
             await client.patch(
               `/routing/filter/rule/${encodeURIComponent(managedRule[".id"])}`,
@@ -688,7 +684,7 @@ const filtersRoutes: FastifyPluginAsyncZod = async (app) => {
       }
     }
 
-    appendEvent({
+    await appendEvent({
       level: errors.length === 0 ? "info" : "warning",
       eventType: errors.length === 0 ? "filters.sync.to_router.done" : "filters.sync.to_router.partial",
       sourceModule: "filters",
diff --git a/backend/src/routes/firewall.ts b/backend/src/routes/firewall.ts
index 7a49ba7..7e9fa57 100644
--- a/backend/src/routes/firewall.ts
+++ b/backend/src/routes/firewall.ts
@@ -116,8 +116,8 @@ function rosErr(e: unknown): string {
   return String(e)
 }
 
-function requireServer(serverId: string) {
-  return getEnabledServerById(serverId)
+async function requireServer(serverId: string) {
+  return await getEnabledServerById(serverId)
 }
 
 const firewallRoutes: FastifyPluginAsyncZod = async (app) => {
@@ -132,7 +132,7 @@ const firewallRoutes: FastifyPluginAsyncZod = async (app) => {
       return reply.status(400).send({ error: "Некорректное тело запроса", details: parsed.error.flatten() })
     }
     const body = parsed.data
-    const server = requireServer(body.serverId)
+    const server = await requireServer(body.serverId)
     if (!server) return reply.status(404).send({ error: "Сервер не найден" })
     const client = MikrotikClient.fromServer(server)
     const path = firewallRestPath(body.family as FirewallFamily, body.table as FirewallTable)
@@ -150,7 +150,7 @@ const firewallRoutes: FastifyPluginAsyncZod = async (app) => {
       return reply.status(400).send({ error: "Некорректное тело запроса", details: parsed.error.flatten() })
     }
     const body = parsed.data
-    const server = requireServer(body.serverId)
+    const server = await requireServer(body.serverId)
     if (!server) return reply.status(404).send({ error: "Сервер не найден" })
     const client = MikrotikClient.fromServer(server)
     const path = `${firewallRestPath(body.family as FirewallFamily, body.table as FirewallTable)}/${encodeRosId(body.rosId)}`
@@ -168,7 +168,7 @@ const firewallRoutes: FastifyPluginAsyncZod = async (app) => {
       return reply.status(400).send({ error: "Некорректное тело запроса", details: parsed.error.flatten() })
     }
     const body = parsed.data
-    const server = requireServer(body.serverId)
+    const server = await requireServer(body.serverId)
     if (!server) return reply.status(404).send({ error: "Сервер не найден" })
     const client = MikrotikClient.fromServer(server)
     const path = `${firewallRestPath(body.family, body.table)}/${encodeRosId(body.rosId)}`
@@ -186,7 +186,7 @@ const firewallRoutes: FastifyPluginAsyncZod = async (app) => {
       return reply.status(400).send({ error: "Некорректное тело запроса", details: parsed.error.flatten() })
     }
     const body = parsed.data
-    const server = requireServer(body.serverId)
+    const server = await requireServer(body.serverId)
     if (!server) return reply.status(404).send({ error: "Сервер не найден" })
     const client = MikrotikClient.fromServer(server)
     const path = `${firewallRestPath(body.family, body.table)}/${encodeRosId(body.rosId)}`
@@ -204,7 +204,7 @@ const firewallRoutes: FastifyPluginAsyncZod = async (app) => {
       return reply.status(400).send({ error: "Некорректное тело запроса", details: parsed.error.flatten() })
     }
     const body = parsed.data
-    const server = requireServer(body.serverId)
+    const server = await requireServer(body.serverId)
     if (!server) return reply.status(404).send({ error: "Сервер не найден" })
     const client = MikrotikClient.fromServer(server)
     const path = `${firewallRestPath(body.family, body.table)}/move`
@@ -225,7 +225,7 @@ const firewallRoutes: FastifyPluginAsyncZod = async (app) => {
       return reply.status(400).send({ error: "Некорректное тело запроса", details: parsed.error.flatten() })
     }
     const body = parsed.data
-    const server = requireServer(body.serverId)
+    const server = await requireServer(body.serverId)
     if (!server) return reply.status(404).send({ error: "Сервер не найден" })
     const client = MikrotikClient.fromServer(server)
     try {
@@ -242,7 +242,7 @@ const firewallRoutes: FastifyPluginAsyncZod = async (app) => {
       return reply.status(400).send({ error: "Некорректное тело запроса", details: parsed.error.flatten() })
     }
     const body = parsed.data
-    const server = requireServer(body.serverId)
+    const server = await requireServer(body.serverId)
     if (!server) return reply.status(404).send({ error: "Сервер не найден" })
     const client = MikrotikClient.fromServer(server)
     const path = `${firewallRestPath(body.family, "address-list")}/${encodeRosId(body.rosId)}`
@@ -260,7 +260,7 @@ const firewallRoutes: FastifyPluginAsyncZod = async (app) => {
       return reply.status(400).send({ error: "Некорректное тело запроса", details: parsed.error.flatten() })
     }
     const body = parsed.data
-    const server = requireServer(body.serverId)
+    const server = await requireServer(body.serverId)
     if (!server) return reply.status(404).send({ error: "Сервер не найден" })
     const client = MikrotikClient.fromServer(server)
     const path = `${firewallRestPath(body.family, "address-list")}/${encodeRosId(body.rosId)}`
@@ -278,7 +278,7 @@ const firewallRoutes: FastifyPluginAsyncZod = async (app) => {
       return reply.status(400).send({ error: "Некорректное тело запроса", details: parsed.error.flatten() })
     }
     const body = parsed.data
-    const server = requireServer(body.serverId)
+    const server = await requireServer(body.serverId)
     if (!server) return reply.status(404).send({ error: "Сервер не найден" })
     const client = MikrotikClient.fromServer(server)
     const path = `${firewallRestPath(body.family, "address-list")}/${encodeRosId(body.rosId)}`
diff --git a/backend/src/routes/internet-path.ts b/backend/src/routes/internet-path.ts
index 4b36164..d472f94 100644
--- a/backend/src/routes/internet-path.ts
+++ b/backend/src/routes/internet-path.ts
@@ -8,7 +8,7 @@ import {
 
 const internetPathRoutes: FastifyPluginAsyncZod = async (app) => {
   app.get("/internet-path/settings", async (_req, reply) => {
-    const s = getInternetPathSettings()
+    const s = await getInternetPathSettings()
     return reply.send({
       enabled: s.enabled,
       intervalSec: s.intervalSec,
@@ -25,12 +25,12 @@ const internetPathRoutes: FastifyPluginAsyncZod = async (app) => {
       intervalSec?: number | string
       retentionDays?: number | string
     }
-    const updated = updateInternetPathSettings({
+    const updated = await updateInternetPathSettings({
       enabled: body.enabled,
       intervalSec: body.intervalSec == null ? undefined : Math.max(30, Number.parseInt(String(body.intervalSec), 10) || 300),
       retentionDays: body.retentionDays == null ? undefined : Math.max(1, Number.parseInt(String(body.retentionDays), 10) || 14),
     })
-    refreshScheduler()
+    await refreshScheduler()
     return reply.send({
       ok: true,
       settings: {
@@ -45,13 +45,15 @@ const internetPathRoutes: FastifyPluginAsyncZod = async (app) => {
   })
 
   app.get("/internet-path/latest", async (_req, reply) => {
-    const row = getLatestInternetPathSnapshot()
+    const row = await getLatestInternetPathSnapshot()
     if (!row) return reply.send({ snapshot: null })
-    let payload: unknown = null
-    try {
-      payload = JSON.parse(row.payloadJson)
-    } catch {
-      payload = null
+    let payload: unknown = row.payloadJson
+    if (typeof row.payloadJson === "string") {
+      try {
+        payload = JSON.parse(row.payloadJson)
+      } catch {
+        payload = null
+      }
     }
     return reply.send({
       snapshot: payload,
diff --git a/backend/src/routes/ospf.ts b/backend/src/routes/ospf.ts
index c923c7a..b985a5b 100644
--- a/backend/src/routes/ospf.ts
+++ b/backend/src/routes/ospf.ts
@@ -207,23 +207,21 @@ function calcRouteScore(pingMs: number, dlMbps: number, ulMbps: number, pingWeig
   return Math.round(w * pingScore + (1 - w) * speedScore)
 }
 
-function getLatestSnapshotLatencyMs(serverId: number): number {
-  const latest = db
+async function getLatestSnapshotLatencyMs(serverId: number): Promise<number> {
+  const latest = await db
     .select()
     .from(serverSnapshots)
     .where(eq(serverSnapshots.serverId, serverId))
     .orderBy(desc(serverSnapshots.polledAt))
     .limit(1)
-    .all()
   return latest.length > 0 ? Math.max(1, Math.round(latest[0].latencyMs ?? 100)) : 100
 }
 
-function latestTrafficByInterface(serverId: number): Map<string, TrafficSampleRow> {
-  const rows = db
+async function latestTrafficByInterface(serverId: number): Promise<Map<string, { id: number; serverId: number; disabled: boolean; sampledAt: string; interfaceName: string; peerPublicKey: string; rxBytes: number; txBytes: number; rxBps: number; txBps: number; running: boolean; }>> {
+  const rows = await db
     .select()
     .from(trafficSamples)
     .where(eq(trafficSamples.serverId, serverId))
-    .all()
   const map = new Map<string, TrafficSampleRow>()
   for (const row of rows) {
     const prev = map.get(row.interfaceName)
@@ -302,14 +300,14 @@ async function buildOspfOptimizationPlan(server: ServerRow, pingWeight: number):
   const areaMap = buildAreaMap(areas)
   const parsed = parseInterfaces(server, ifaceTemplates, areas, instances, areaMap)
   const editable = parsed.filter((i) => !i.disabled && !isRefInterfaceName(i.interface))
-  const localLatencyMs = getLatestSnapshotLatencyMs(server.id)
-  const latestTraffic = latestTrafficByInterface(server.id)
+  const localLatencyMs = await getLatestSnapshotLatencyMs(server.id)
+  const latestTraffic = await latestTrafficByInterface(server.id)
 
   // 1) Сопоставляем remote OSPF router-id -> сервер из каталога (чтобы взять унифицированный ping как в карте /route-optimizer).
   const neededRouterIds = new Set(neighbors.map((n) => String(n["router-id"] ?? "")).filter((x) => x.length > 0))
 
   async function buildRouterIdToServerMap(needed: Set<string>): Promise<Map<string, ServerRow["id"]>> {
-    const enabledServers = db.select().from(servers).where(eq(servers.enabled, true)).all()
+    const enabledServers = await db.select().from(servers).where(eq(servers.enabled, true))
     const out = new Map<string, ServerRow["id"]>()
     const neededLeft = new Set(needed)
 
@@ -356,11 +354,10 @@ async function buildOspfOptimizationPlan(server: ServerRow, pingWeight: number):
   }
 
   // 3) Предгружаем uptimeSpeedProbes: оттуда берём и ping, и скорость (единый источник как у карты).
-  const allSourceProbes = db
+  const allSourceProbes = (await db
     .select()
     .from(uptimeSpeedProbes)
-    .where(eq(uptimeSpeedProbes.srcServerId, server.id))
-    .all()
+    .where(eq(uptimeSpeedProbes.srcServerId, server.id)))
     .filter((r: SpeedProbeRow) => r.enabled !== false)
   const speedProbesByDest = new Map<number, SpeedProbeRow[]>()
   for (const p of allSourceProbes) {
@@ -482,8 +479,7 @@ async function buildOspfOptimizationPlan(server: ServerRow, pingWeight: number):
     for (const [iface, probe] of assigned.entries()) assignedProbeByIface.set(iface, probe)
   }
 
-  return editable
-    .map((iface) => {
+  return (await Promise.all(editable.map(async (iface) => {
       const t = latestTraffic.get(iface.interface)
       const speed = normalizeSpeedMbps(t)
 
@@ -494,7 +490,7 @@ async function buildOspfOptimizationPlan(server: ServerRow, pingWeight: number):
         bestProbe?.lastPingRttMs != null
           ? Math.max(1, Math.round(bestProbe.lastPingRttMs))
           : dstServerId != null
-            ? Math.min(995, Math.round(localLatencyMs + getLatestSnapshotLatencyMs(dstServerId)))
+            ? Math.min(995, Math.round(localLatencyMs + await getLatestSnapshotLatencyMs(dstServerId)))
             : localLatencyMs
 
       const dlMbps =
@@ -517,8 +513,7 @@ async function buildOspfOptimizationPlan(server: ServerRow, pingWeight: number):
         score: calcRouteScore(pingMs, dlMbps, ulMbps, pingWeight),
         optimalCost: 0,
       }
-    })
-    .sort((a, b) => b.score - a.score || a.interface.localeCompare(b.interface))
+    }))).sort((a, b) => b.score - a.score || a.interface.localeCompare(b.interface))
     .map((row, idx) => ({ ...row, optimalCost: (idx + 1) * 10 }))
 }
 
@@ -528,7 +523,7 @@ const ospfRoutes: FastifyPluginAsyncZod = async (app) => {
 
   // GET /api/ospf/neighbors — aggregate OSPF neighbors from ALL enabled servers
   app.get("/ospf/neighbors", async (_req, reply) => {
-    const allServers = db.select().from(servers).where(eq(servers.enabled, true)).all()
+    const allServers = await db.select().from(servers).where(eq(servers.enabled, true))
 
     const results = await Promise.all(
       allServers.map(async (server) => {
@@ -547,7 +542,7 @@ const ospfRoutes: FastifyPluginAsyncZod = async (app) => {
 
   // GET /api/ospf/interfaces — aggregate OSPF interface templates from ALL enabled servers
   app.get("/ospf/interfaces", async (_req, reply) => {
-    const allServers = db.select().from(servers).where(eq(servers.enabled, true)).all()
+    const allServers = await db.select().from(servers).where(eq(servers.enabled, true))
 
     const results = await Promise.all(
       allServers.map(async (server) => {
@@ -566,7 +561,7 @@ const ospfRoutes: FastifyPluginAsyncZod = async (app) => {
 
   // GET /api/ospf/instances — aggregate OSPF instances from ALL enabled servers
   app.get("/ospf/instances", async (_req, reply) => {
-    const allServers = db.select().from(servers).where(eq(servers.enabled, true)).all()
+    const allServers = await db.select().from(servers).where(eq(servers.enabled, true))
 
     const results = await Promise.all(
       allServers.map(async (server) => {
@@ -584,7 +579,7 @@ const ospfRoutes: FastifyPluginAsyncZod = async (app) => {
 
   // GET /api/ospf/all — single round-trip: neighbors + interfaces + instances + BFD
   app.get("/ospf/all", async (_req, reply) => {
-    const allServers = db.select().from(servers).where(eq(servers.enabled, true)).all()
+    const allServers = await db.select().from(servers).where(eq(servers.enabled, true))
 
     const perServer = await Promise.all(
       allServers.map(async (server) => {
@@ -613,7 +608,7 @@ const ospfRoutes: FastifyPluginAsyncZod = async (app) => {
 
   // GET /api/bfd/sessions — BFD sessions only (for direct access)
   app.get("/bfd/sessions", async (_req, reply) => {
-    const allServers = db.select().from(servers).where(eq(servers.enabled, true)).all()
+    const allServers = await db.select().from(servers).where(eq(servers.enabled, true))
     const results = await Promise.all(
       allServers.map(async (server) => {
         try {
@@ -631,10 +626,10 @@ const ospfRoutes: FastifyPluginAsyncZod = async (app) => {
   // GET /api/servers/:id/ospf — single server OSPF + BFD data
   app.get("/servers/:id/ospf", { schema: { params: ServerIdParamSchema } }, async (req, reply) => {
     const params = req.params as ServerIdParams
-    const server = db
+    const server = (await db
       .select().from(servers)
       .where(eq(servers.id, params.id))
-      .limit(1).all()[0]
+      .limit(1))[0]
 
     if (!server) return reply.status(404).send({ error: "Server not found" })
 
@@ -659,10 +654,10 @@ const ospfRoutes: FastifyPluginAsyncZod = async (app) => {
     { schema: { params: ServerIdParamSchema, body: OspfOptimizeBodySchema } },
     async (req, reply) => {
       const params = req.params as ServerIdParams
-      const server = db
+      const server = (await db
         .select().from(servers)
         .where(eq(servers.id, params.id))
-        .limit(1).all()[0]
+        .limit(1))[0]
 
       if (!server) return reply.status(404).send({ error: "Server not found" })
 
@@ -691,10 +686,10 @@ const ospfRoutes: FastifyPluginAsyncZod = async (app) => {
     { schema: { params: ServerIdParamSchema, body: OspfOptimizeBodySchema } },
     async (req, reply) => {
       const params = req.params as ServerIdParams
-      const server = db
+      const server = (await db
         .select().from(servers)
         .where(eq(servers.id, params.id))
-        .limit(1).all()[0]
+        .limit(1))[0]
 
       if (!server) return reply.status(404).send({ error: "Server not found" })
 
diff --git a/backend/src/routes/probes.ts b/backend/src/routes/probes.ts
index ad358fc..bd1c5c8 100644
--- a/backend/src/routes/probes.ts
+++ b/backend/src/routes/probes.ts
@@ -256,14 +256,14 @@ async function mtuDiscover(client: MikrotikClient, address: string, srcIpv4: str
   return lines.join("\n")
 }
 
-function resolveBtestPeer(remoteHost: string, explicitDstId?: number) {
+async function resolveBtestPeer(remoteHost: string, explicitDstId?: number) {
   if (explicitDstId != null && Number.isFinite(explicitDstId)) {
-    const s = db.select().from(servers).where(eq(servers.id, explicitDstId)).limit(1).all()[0]
+    const s = (await db.select().from(servers).where(eq(servers.id, explicitDstId)).limit(1))[0]
     if (s) return s
   }
   const norm = remoteHost.trim().toLowerCase()
-  return db.select().from(servers).where(eq(servers.enabled, true)).all()
-    .find((x) => x.host.trim().toLowerCase() === norm)
+  const enabled = await db.select().from(servers).where(eq(servers.enabled, true))
+  return enabled.find((x) => x.host.trim().toLowerCase() === norm)
 }
 
 const probesRoutes: FastifyPluginAsyncZod = async (app) => {
@@ -271,7 +271,7 @@ const probesRoutes: FastifyPluginAsyncZod = async (app) => {
     const sid = parseServerId(String((req.params as { id?: string }).id ?? ""))
     if (sid === null) return reply.status(400).send({ error: "Invalid server id" })
 
-    const server = db.select().from(servers).where(eq(servers.id, sid)).limit(1).all()[0]
+    const server = (await db.select().from(servers).where(eq(servers.id, sid)).limit(1))[0]
     if (!server) return reply.status(404).send({ error: "Server not found" })
 
     const body = req.body as {
@@ -369,7 +369,7 @@ const probesRoutes: FastifyPluginAsyncZod = async (app) => {
         case "bandwidth": {
           const remote = String(body.bwRemoteAddress ?? "").trim()
           if (!remote) return reply.status(400).send({ error: "bwRemoteAddress required" })
-          const dst = resolveBtestPeer(remote, body.dstServerId)
+          const dst = await resolveBtestPeer(remote, body.dstServerId)
           if (!dst) {
             return reply.status(400).send({
               error: "Не найден сервер назначения для bandwidth-test: добавьте узел с host = GRE remote или укажите dstServerId",
diff --git a/backend/src/routes/recursive-routes.ts b/backend/src/routes/recursive-routes.ts
index dbc0f3a..a586198 100644
--- a/backend/src/routes/recursive-routes.ts
+++ b/backend/src/routes/recursive-routes.ts
@@ -80,13 +80,12 @@ function splitGateway(raw: string): { ip: string; name: string } | null {
   return { ip, name: name || ip }
 }
 
-function mapDbRoutes(serverId: number): RecursiveRouteDto[] {
-  const rows = db
+async function mapDbRoutes(serverId: number): Promise<RecursiveRouteDto[]> {
+  const rows = await db
     .select()
     .from(recursiveRoutes)
     .where(eq(recursiveRoutes.serverId, serverId))
     .orderBy(asc(recursiveRoutes.sortOrder))
-    .all()
 
   return rows.map((r) => ({
     id: String(r.id),
@@ -118,10 +117,10 @@ function toRouterPayload(route: RecursiveRouteDto): Record<string, string> {
 }
 
 async function replaceDbRoutes(serverId: number, routes: RecursiveRouteDto[]) {
-  db.delete(recursiveRoutes).where(eq(recursiveRoutes.serverId, serverId)).run()
+  await db.delete(recursiveRoutes).where(eq(recursiveRoutes.serverId, serverId))
   if (routes.length === 0) return
   const now = new Date().toISOString()
-  db.insert(recursiveRoutes).values(
+  await db.insert(recursiveRoutes).values(
     routes.map((r, i) => ({
       serverId,
       sortOrder: i,
@@ -138,7 +137,7 @@ async function replaceDbRoutes(serverId: number, routes: RecursiveRouteDto[]) {
       createdAt: now,
       updatedAt: now,
     })),
-  ).run()
+  )
 }
 
 const recursiveRoutesPlugin: FastifyPluginAsyncZod = async (app) => {
@@ -146,7 +145,7 @@ const recursiveRoutesPlugin: FastifyPluginAsyncZod = async (app) => {
     const q = req.query as { serverId?: string | number }
     const serverId = parseDbServerId(q.serverId)
     if (serverId === null) return reply.status(400).send({ error: "serverId is required" })
-    const server = db.select().from(servers).where(eq(servers.id, serverId)).limit(1).all()[0]
+    const server = (await db.select().from(servers).where(eq(servers.id, serverId)).limit(1))[0]
     if (!server) return reply.status(404).send({ error: "Server not found" })
 
     try {
@@ -176,16 +175,16 @@ const recursiveRoutesPlugin: FastifyPluginAsyncZod = async (app) => {
     const q = req.query as { serverId?: string | number }
     const serverId = parseDbServerId(q.serverId)
     if (serverId === null) return reply.status(400).send({ error: "serverId is required" })
-    const server = db.select().from(servers).where(eq(servers.id, serverId)).limit(1).all()[0]
+    const server = (await db.select().from(servers).where(eq(servers.id, serverId)).limit(1))[0]
     if (!server) return reply.status(404).send({ error: "Server not found" })
-    return reply.send({ routes: mapDbRoutes(serverId) })
+    return reply.send({ routes: await mapDbRoutes(serverId) })
   })
 
   app.put("/recursive-routes", async (req, reply) => {
     const body = req.body as { serverId?: string | number; routes?: RecursiveRouteDto[] }
     const serverId = parseDbServerId(body.serverId)
     if (serverId === null) return reply.status(400).send({ error: "serverId is required" })
-    const server = db.select().from(servers).where(eq(servers.id, serverId)).limit(1).all()[0]
+    const server = (await db.select().from(servers).where(eq(servers.id, serverId)).limit(1))[0]
     if (!server) return reply.status(404).send({ error: "Server not found" })
     await replaceDbRoutes(serverId, body.routes ?? [])
     return reply.send({ ok: true })
@@ -195,10 +194,10 @@ const recursiveRoutesPlugin: FastifyPluginAsyncZod = async (app) => {
     const body = req.body as { serverId?: string | number } | undefined
     const serverId = parseDbServerId(body?.serverId)
     if (serverId === null) return reply.status(400).send({ error: "serverId is required" })
-    const server: ServerRow | undefined = db
+    const server: ServerRow | undefined = (await db
       .select().from(servers)
       .where(eq(servers.id, serverId))
-      .limit(1).all()[0]
+      .limit(1))[0]
     if (!server) return reply.status(404).send({ error: "Server not found" })
 
     try {
@@ -231,7 +230,7 @@ const recursiveRoutesPlugin: FastifyPluginAsyncZod = async (app) => {
     const body = req.body as { serverId?: string | number } | undefined
     const serverId = parseDbServerId(body?.serverId)
     if (serverId === null) return reply.status(400).send({ error: "serverId is required" })
-    const server = db.select().from(servers).where(eq(servers.id, serverId)).limit(1).all()[0]
+    const server = (await db.select().from(servers).where(eq(servers.id, serverId)).limit(1))[0]
     if (!server) return reply.status(404).send({ error: "Server not found" })
 
     try {
@@ -243,7 +242,7 @@ const recursiveRoutesPlugin: FastifyPluginAsyncZod = async (app) => {
         await client.delete(`/ip/route/${encodeURIComponent(r[".id"])}`)
       }
 
-      const dbRows = mapDbRoutes(serverId)
+      const dbRows = await mapDbRoutes(serverId)
       for (const route of dbRows) {
         await client.post("/ip/route", toRouterPayload(route))
       }
diff --git a/backend/src/routes/scheduler.ts b/backend/src/routes/scheduler.ts
index 42762d3..c718174 100644
--- a/backend/src/routes/scheduler.ts
+++ b/backend/src/routes/scheduler.ts
@@ -14,7 +14,7 @@ function parseJobKey(raw: string | undefined): typeof JOB_KEYS[number] | null {
 
 const schedulerRoutes: FastifyPluginAsyncZod = async (app) => {
   app.get("/scheduler/status", async (_req, reply) => {
-    return reply.send(getSchedulerStatus())
+    return reply.send(await getSchedulerStatus())
   })
 
   app.get("/scheduler/runs", async (req, reply) => {
@@ -25,12 +25,12 @@ const schedulerRoutes: FastifyPluginAsyncZod = async (app) => {
     }
     const limit = Math.min(200, Math.max(1, Number.parseInt(String(q.limit ?? "50"), 10) || 50))
     const offset = Math.max(0, Number.parseInt(String(q.offset ?? "0"), 10) || 0)
-    return reply.send(listSchedulerRuns({ jobKey: jobKey ?? undefined, limit, offset }))
+    return reply.send(await listSchedulerRuns({ jobKey: jobKey ?? undefined, limit, offset }))
   })
 
   app.post("/scheduler/refresh", async (_req, reply) => {
-    refreshScheduler()
-    return reply.send({ ok: true, status: getSchedulerStatus() })
+    await refreshScheduler()
+    return reply.send({ ok: true, status: await getSchedulerStatus() })
   })
 
   app.post("/scheduler/jobs/:jobKey/run-now", async (req, reply) => {
@@ -38,7 +38,7 @@ const schedulerRoutes: FastifyPluginAsyncZod = async (app) => {
     if (!jobKey) return reply.status(400).send({ error: "Некорректный jobKey" })
     try {
       await runSchedulerJobNow(jobKey)
-      return reply.send({ ok: true, status: getSchedulerStatus() })
+      return reply.send({ ok: true, status: await getSchedulerStatus() })
     } catch (e) {
       const statusCode = (e as Error & { statusCode?: number }).statusCode
       if (statusCode === 409) {
diff --git a/backend/src/routes/servers-api-ping.ts b/backend/src/routes/servers-api-ping.ts
index 05b9c68..9a5f88c 100644
--- a/backend/src/routes/servers-api-ping.ts
+++ b/backend/src/routes/servers-api-ping.ts
@@ -10,7 +10,7 @@ import {
 
 const serversApiPingRoutes: FastifyPluginAsyncZod = async (app) => {
   app.get("/servers-api-ping/settings", async (_req, reply) => {
-    const settings = getServersApiPingSettings()
+    const settings = await getServersApiPingSettings()
     const state = getServersRestPingCollectorState()
     return reply.send({
       enabled: settings.enabled,
@@ -29,11 +29,11 @@ const serversApiPingRoutes: FastifyPluginAsyncZod = async (app) => {
     }
     const intervalSec =
       body.intervalSec == null ? undefined : Math.max(10, Number.parseInt(String(body.intervalSec), 10) || 120)
-    const updated = updateServersApiPingSettings({
+    const updated = await updateServersApiPingSettings({
       enabled: body.enabled,
       intervalSec,
     })
-    refreshScheduler()
+    await refreshScheduler()
     return reply.send({
       ok: true,
       settings: {
@@ -49,7 +49,7 @@ const serversApiPingRoutes: FastifyPluginAsyncZod = async (app) => {
   app.post("/servers-api-ping/collect-now", async (_req, reply) => {
     await collectServersRestPingOnce()
     scheduleAlertEngineAfterDataCollectors()
-    const row = getServersApiPingSettings()
+    const row = await getServersApiPingSettings()
     return reply.send({
       ok: true,
       lastCollectedAt: row.lastCollectedAt ?? null,
diff --git a/backend/src/routes/servers.ts b/backend/src/routes/servers.ts
index e879f40..8205425 100644
--- a/backend/src/routes/servers.ts
+++ b/backend/src/routes/servers.ts
@@ -77,13 +77,13 @@ const serversRoutes: FastifyPluginAsyncZod = async (app) => {
 
   // GET /api/servers
   app.get("/", async (_req, reply) => {
-    return reply.send(listServersRead())
+    return reply.send(await listServersRead())
   })
 
   // GET /api/servers/:id/ros-src-address — IPv4 для src-address в RouterOS (не FQDN)
   app.get("/:id/ros-src-address", { schema: { params: ServerIdParamSchema } }, async (req, reply) => {
     const params = req.params as ServerIdParams
-    const server = getServerRowById(params.id)
+    const server = await getServerRowById(params.id)
 
     if (!server) return reply.status(404).send({ error: "Server not found" })
     const ipv4 = await resolveRosSrcIpv4(server.host)
@@ -93,7 +93,7 @@ const serversRoutes: FastifyPluginAsyncZod = async (app) => {
   // GET /api/servers/:id/wan-runtime — DHCP lease + active default route for HomeRouter WAN uplinks
   app.get("/:id/wan-runtime", { schema: { params: ServerIdParamSchema } }, async (req, reply) => {
     const params = req.params as ServerIdParams
-    const server = getServerReadById(params.id)
+    const server = await getServerReadById(params.id)
     if (!server) return reply.status(404).send({ error: "Server not found" })
 
     const toIp = (raw: string | null | undefined): string | null => {
@@ -141,7 +141,9 @@ const serversRoutes: FastifyPluginAsyncZod = async (app) => {
     }
 
     try {
-      const client = MikrotikClient.fromServer(getServerRowById(params.id)!)
+      const row = await getServerRowById(params.id)
+      if (!row) return reply.status(404).send({ error: "Server not found" })
+      const client = MikrotikClient.fromServer(row)
       const isTrue = (v: unknown) => {
         const s = String(v ?? "").trim().toLowerCase()
         return s === "true" || s === "yes"
@@ -228,13 +230,13 @@ const serversRoutes: FastifyPluginAsyncZod = async (app) => {
 
   // POST /api/servers
   app.post("/", { schema: { body: ServerCreateSchema } }, async (req, reply) => {
-    return reply.status(201).send(createServer(req.body as ServerCreateRequest))
+    return reply.status(201).send(await createServer(req.body as ServerCreateRequest))
   })
 
   // GET /api/servers/:id
   app.get("/:id", { schema: { params: ServerIdParamSchema } }, async (req, reply) => {
     const params = req.params as ServerIdParams
-    const server = getServerReadById(params.id)
+    const server = await getServerReadById(params.id)
     if (!server) return reply.status(404).send({ error: "Server not found" })
     return reply.send(server)
   })
@@ -245,25 +247,25 @@ const serversRoutes: FastifyPluginAsyncZod = async (app) => {
     { schema: { params: ServerIdParamSchema, body: ServerUpdateSchema } },
     async (req, reply) => {
       const params = req.params as ServerIdParams
-      const existing = getServerReadById(params.id)
+      const existing = await getServerReadById(params.id)
       if (!existing) return reply.status(404).send({ error: "Server not found" })
-      return reply.send(updateServer(params.id, req.body as ServerUpdateRequest))
+      return reply.send(await updateServer(params.id, req.body as ServerUpdateRequest))
     },
   )
 
   // DELETE /api/servers/:id
   app.delete("/:id", { schema: { params: ServerIdParamSchema } }, async (req, reply) => {
     const params = req.params as ServerIdParams
-    const existing = getServerReadById(params.id)
+    const existing = await getServerReadById(params.id)
     if (!existing) return reply.status(404).send({ error: "Server not found" })
-    deleteServer(params.id)
+    await deleteServer(params.id)
     return reply.status(204).send()
   })
 
   // POST /api/servers/:id/poll
   app.post("/:id/poll", { schema: { params: ServerIdParamSchema } }, async (req, reply) => {
     const params = req.params as ServerIdParams
-    const existing = getServerReadById(params.id)
+    const existing = await getServerReadById(params.id)
     if (!existing) return reply.status(404).send({ error: "Server not found" })
 
     try {
@@ -281,9 +283,9 @@ const serversRoutes: FastifyPluginAsyncZod = async (app) => {
     async (req, reply) => {
       const params = req.params as ServerIdParams
       const query = req.query as SnapshotsQuery
-      const existing = getServerReadById(params.id)
+      const existing = await getServerReadById(params.id)
       if (!existing) return reply.status(404).send({ error: "Server not found" })
-      return reply.send(listServerSnapshots(params.id, query.limit))
+      return reply.send(await listServerSnapshots(params.id, query.limit))
     },
   )
 }
diff --git a/backend/src/routes/sidebar-counts.ts b/backend/src/routes/sidebar-counts.ts
index 0816b5b..dd8194e 100644
--- a/backend/src/routes/sidebar-counts.ts
+++ b/backend/src/routes/sidebar-counts.ts
@@ -12,22 +12,24 @@ import {
 } from "../db/schema.js"
 import { listUsers } from "../modules/users/service/users-service.js"
 
-function tableCount(table: typeof servers | typeof filterRules | typeof uptimeProbes | typeof uptimeSpeedProbes | typeof recursiveRoutes): number {
-  return db.select({ n: count() }).from(table).all()[0]?.n ?? 0
+async function tableCount(table: typeof servers | typeof filterRules | typeof uptimeProbes | typeof uptimeSpeedProbes | typeof recursiveRoutes): Promise<number> {
+  const rows = await db.select({ n: count() }).from(table)
+  return rows[0]?.n ?? 0
 }
 
 const sidebarCountsRoutes: FastifyPluginAsyncZod = async (app) => {
   app.get("/sidebar-counts", async (_req, reply) => {
-    const serversTotal = tableCount(servers)
-    const filterRulesTotal = tableCount(filterRules)
-    const uptimeProbesTotal = tableCount(uptimeProbes)
-    const uptimeSpeedProbesTotal = tableCount(uptimeSpeedProbes)
-    const recursiveRoutesTotal = tableCount(recursiveRoutes)
-    const [certificatesTotal, wireguardTotal] = await Promise.all([
-      listCertificatesFromServers().then((res) => res.certificates.length),
+    const serversTotal = await tableCount(servers)
+    const filterRulesTotal = await tableCount(filterRules)
+    const uptimeProbesTotal = await tableCount(uptimeProbes)
+    const uptimeSpeedProbesTotal = await tableCount(uptimeSpeedProbes)
+    const recursiveRoutesTotal = await tableCount(recursiveRoutes)
+    const [certRes, wireguardTotal] = await Promise.all([
+      listCertificatesFromServers(),
       countWireGuardInterfaces().catch(() => 0),
     ])
-    const usersTotal = listUsers().length
+    const certificatesTotal = certRes.certificates.length
+    const usersTotal = (await listUsers()).length
 
     return reply.send({
       servers: serversTotal,
diff --git a/backend/src/routes/system-database.ts b/backend/src/routes/system-database.ts
index c846ba6..44dae31 100644
--- a/backend/src/routes/system-database.ts
+++ b/backend/src/routes/system-database.ts
@@ -18,7 +18,7 @@ const systemDatabaseRoutes: FastifyPluginAsync = async (app) => {
   app.get("/system/database/backup", async (_req, reply) => {
     try {
       const { filename, buffer } = await exportSystemDatabaseBackup()
-      appendEvent({
+      await appendEvent({
         level: "info",
         eventType: "system.database.backup",
         sourceModule: "system",
@@ -44,16 +44,16 @@ const systemDatabaseRoutes: FastifyPluginAsync = async (app) => {
   app.post("/system/database/restore", async (req, reply) => {
     const body = req.body
     if (!Buffer.isBuffer(body) || body.length === 0) {
-      return reply.status(400).send({ error: "Ожидается тело запроса с файлом SQLite" })
+      return reply.status(400).send({ error: "Ожидается тело запроса с файлом pg_dump (custom, PGDMP)" })
     }
     try {
       await restoreSystemDatabaseBackup(body)
-      appendEvent({
+      await appendEvent({
         level: "warning",
         eventType: "system.database.restore",
         sourceModule: "system",
         title: "Восстановлена база приложения",
-        message: "Данные SQLite заменены из загруженного файла",
+        message: "Данные PostgreSQL заменены из загруженного дампа",
         entityType: "system_database",
         entityId: "restore",
         payload: {
diff --git a/backend/src/routes/traffic-flow.ts b/backend/src/routes/traffic-flow.ts
index ac3e3af..2836e44 100644
--- a/backend/src/routes/traffic-flow.ts
+++ b/backend/src/routes/traffic-flow.ts
@@ -94,7 +94,7 @@ function analyticsQuery(req: FastifyRequest) {
 
 async function sendFlowTalkers(req: FastifyRequest, reply: FastifyReply) {
   const q = req.query as { range?: string }
-  return reply.send(listFlowTalkers(rangeToMinutes(q.range)))
+  return reply.send(await listFlowTalkers(rangeToMinutes(q.range)))
 }
 
 function requestPublicHost(req: FastifyRequest): string {
@@ -145,7 +145,7 @@ function sleep(ms: number, signal: AbortSignal): Promise<void> {
 
 const trafficFlowRoutes: FastifyPluginAsyncZod = async (app) => {
   app.get("/traffic/flow/settings", async (_req, reply) => {
-    return reply.send(toTrafficFlowSettingsDto(getFlowListenerState()))
+    return reply.send(await toTrafficFlowSettingsDto(getFlowListenerState()))
   })
 
   app.put("/traffic/flow/settings", async (req, reply) => {
@@ -153,31 +153,31 @@ const trafficFlowRoutes: FastifyPluginAsyncZod = async (app) => {
     if (!parsed.success) {
       return reply.status(400).send({ error: "Некорректное тело запроса", details: parsed.error.flatten() })
     }
-    updateTrafficFlowSettings(parsed.data)
-    startTrafficFlowListener()
-    return reply.send({ ok: true, settings: toTrafficFlowSettingsDto(getFlowListenerState()) })
+    await updateTrafficFlowSettings(parsed.data)
+    await startTrafficFlowListener()
+    return reply.send({ ok: true, settings: await toTrafficFlowSettingsDto(getFlowListenerState()) })
   })
 
   app.post("/traffic/flow/settings/generate-keys", async (_req, reply) => {
-    const result = ensureHostKeys()
+    const result = await ensureHostKeys()
     return reply.send({
       ok: true,
       created: result.created,
       publicKey: result.publicKey,
-      settings: toTrafficFlowSettingsDto(getFlowListenerState()),
+      settings: await toTrafficFlowSettingsDto(getFlowListenerState()),
     })
   })
 
   app.get("/traffic/flow/host-files", async (_req, reply) => {
-    const row = getTrafficFlowSettingsRow()
-    if (!row.hostPrivateKey) ensureHostKeys()
-    return reply.send({ files: listTrafficFlowHostFiles() })
+    const row = await getTrafficFlowSettingsRow()
+    if (!row.hostPrivateKey) await ensureHostKeys()
+    return reply.send({ files: await listTrafficFlowHostFiles() })
   })
 
   app.post("/traffic/flow/purge", async (_req, reply) => {
     try {
       const result = await purgeTrafficFlowStore()
-      appendEvent({
+      await appendEvent({
         level: "warning",
         eventType: "traffic.flow.purge",
         sourceModule: "traffic",
@@ -211,20 +211,20 @@ const trafficFlowRoutes: FastifyPluginAsyncZod = async (app) => {
 
   app.get("/traffic/flow/exporters", async (req, reply) => {
     const q = req.query as { range?: string }
-    return reply.send(listFlowExporters(rangeToMinutes(q.range)))
+    return reply.send(await listFlowExporters(rangeToMinutes(q.range)))
   })
 
   app.get("/traffic/flow/clients", async (req, reply) => {
     const q = req.query as { range?: string }
-    return reply.send(listFlowClients(rangeToMinutes(q.range)))
+    return reply.send(await listFlowClients(rangeToMinutes(q.range)))
   })
 
   app.get("/traffic/flow/analytics", async (req, reply) => {
-    return reply.send(buildFlowAnalytics(analyticsQuery(req)))
+    return reply.send(await buildFlowAnalytics(analyticsQuery(req)))
   })
 
   app.get("/traffic/flow/map-hops", async (req, reply) => {
-    return reply.send(buildFlowMapHops(analyticsQuery(req)))
+    return reply.send(await buildFlowMapHops(analyticsQuery(req)))
   })
 
   app.get("/traffic/flow/monthly", async (req, reply) => {
@@ -233,7 +233,7 @@ const trafficFlowRoutes: FastifyPluginAsyncZod = async (app) => {
     const month = /^\d{4}-\d{2}$/.test(q.month ?? "")
       ? (q.month as string)
       : `${now.getUTCFullYear()}-${String(now.getUTCMonth() + 1).padStart(2, "0")}`
-    return reply.send(getFlowMonthly(month, parseId(q.serverId)))
+    return reply.send(await getFlowMonthly(month, parseId(q.serverId)))
   })
 
   app.get("/traffic/flow/live", async (req, reply) => {
diff --git a/backend/src/routes/traffic.ts b/backend/src/routes/traffic.ts
index b8279d6..312f3e4 100644
--- a/backend/src/routes/traffic.ts
+++ b/backend/src/routes/traffic.ts
@@ -57,14 +57,13 @@ interface TrafficInterfaceDto {
 const LIVE_TICK_MS = 1500
 const LIVE_ROS_TIMEOUT_MS = 4000
 
-function latestSnapshot(serverId: number): SnapshotRow | undefined {
-  return db
+async function latestSnapshot(serverId: number) {
+  return (await db
     .select()
     .from(serverSnapshots)
     .where(eq(serverSnapshots.serverId, serverId))
     .orderBy(desc(serverSnapshots.polledAt))
-    .limit(1)
-    .all()[0]
+    .limit(1))[0]
 }
 
 function rangeToMinutes(range: string | undefined): number {
@@ -114,8 +113,8 @@ function buildServerTraffic(
   }
 }
 
-function snapshotStatus(serverId: number): TrafficServerDto["status"] {
-  const snap = latestSnapshot(serverId)
+async function snapshotStatus(serverId: number): Promise<TrafficServerDto["status"]> {
+  const snap = await latestSnapshot(serverId)
   return snap?.status === "offline" ? "offline" : (snap?.status === "online" ? "online" : "degraded")
 }
 
@@ -222,8 +221,8 @@ async function monitorTrafficOnce(
 
 const trafficRoutes: FastifyPluginAsyncZod = async (app) => {
   app.get("/traffic/settings", async (_req, reply) => {
-    const settings = getTrafficSettings()
-    const state = getTrafficCollectorState()
+    const settings = await getTrafficSettings()
+    const state = await getTrafficCollectorState()
     return reply.send({
       enabled: settings.enabled,
       intervalSec: settings.intervalSec,
@@ -243,12 +242,12 @@ const trafficRoutes: FastifyPluginAsyncZod = async (app) => {
     }
     const intervalSec = body.intervalSec == null ? undefined : Math.max(5, Number.parseInt(String(body.intervalSec), 10) || 30)
     const retentionDays = body.retentionDays == null ? undefined : Math.max(1, Number.parseInt(String(body.retentionDays), 10) || 14)
-    const updated = updateTrafficSettings({
+    const updated = await updateTrafficSettings({
       enabled: body.enabled,
       intervalSec,
       retentionDays,
     })
-    refreshScheduler()
+    await refreshScheduler()
     return reply.send({
       ok: true,
       settings: {
@@ -266,8 +265,8 @@ const trafficRoutes: FastifyPluginAsyncZod = async (app) => {
     try {
       await collectTrafficOnce()
       scheduleAlertEngineAfterDataCollectors()
-      const updated = getTrafficSettings()
-      appendEvent({
+      const updated = await getTrafficSettings()
+      await appendEvent({
         level: "info",
         eventType: "traffic.collect.manual.ok",
         sourceModule: "traffic",
@@ -285,7 +284,7 @@ const trafficRoutes: FastifyPluginAsyncZod = async (app) => {
       })
     } catch (error) {
       const msg = error instanceof Error ? error.message : String(error)
-      appendEvent({
+      await appendEvent({
         level: "critical",
         eventType: "traffic.collect.manual.failed",
         sourceModule: "traffic",
@@ -302,11 +301,11 @@ const trafficRoutes: FastifyPluginAsyncZod = async (app) => {
     const rangeEndMs = Date.now()
     const rangeStartMs = rangeEndMs - minutes * 60_000
     const sinceIso = new Date(rangeStartMs).toISOString()
-    const allServers = db.select().from(servers).where(eq(servers.enabled, true)).all()
-    const data = allServers.map((s): TrafficServerDto => {
-      const rows = readServerSamplesInRange(s.id, sinceIso)
-      return buildServerTraffic(s, snapshotStatus(s.id), rows, rangeStartMs, rangeEndMs)
-    })
+    const allServers = await db.select().from(servers).where(eq(servers.enabled, true))
+    const data = await Promise.all(allServers.map(async (s): Promise<TrafficServerDto> => {
+      const rows = await readServerSamplesInRange(s.id, sinceIso)
+      return buildServerTraffic(s, await snapshotStatus(s.id), rows, rangeStartMs, rangeEndMs)
+    }))
 
     return reply.send({ servers: data })
   })
@@ -314,7 +313,7 @@ const trafficRoutes: FastifyPluginAsyncZod = async (app) => {
   app.get("/traffic/servers/:id/live", async (req, reply) => {
     const p = req.params as { id?: string | number }
     const q = req.query as { iface?: string }
-    const server = getEnabledServerById(p.id ?? "")
+    const server = await getEnabledServerById(p.id ?? "")
     if (!server || !server.enabled) return reply.status(404).send({ error: "Server not found" })
 
     const onlyInterface = q.iface && q.iface !== "__all__" ? q.iface : undefined
@@ -375,12 +374,12 @@ const trafficRoutes: FastifyPluginAsyncZod = async (app) => {
     const serverId = Number.parseInt(String(p.id ?? ""), 10)
     if (!Number.isFinite(serverId)) return reply.status(400).send({ error: "id is required" })
 
-    const allRows = db.select().from(servers).where(eq(servers.id, serverId)).limit(1).all()
+    const allRows = await db.select().from(servers).where(eq(servers.id, serverId)).limit(1)
     const server = allRows[0]
     if (!server) return reply.status(404).send({ error: "Server not found" })
 
     const sinceIso = new Date(Date.now() - 24 * 60 * 60 * 1000).toISOString()
-    const rows = readServerSamplesInRange(serverId, sinceIso)
+    const rows = await readServerSamplesInRange(serverId, sinceIso)
     const byIface = new Map<string, typeof rows>()
     for (const r of rows) {
       if (isLoopbackName(r.interfaceName)) continue
@@ -413,17 +412,17 @@ const trafficRoutes: FastifyPluginAsyncZod = async (app) => {
     const q = req.query as { range?: string; iface?: string }
     const serverId = Number.parseInt(String(p.id ?? ""), 10)
     if (!Number.isFinite(serverId)) return reply.status(400).send({ error: "id is required" })
-    const server = db.select().from(servers).where(eq(servers.id, serverId)).limit(1).all()[0]
+    const server = (await db.select().from(servers).where(eq(servers.id, serverId)).limit(1))[0]
     if (!server) return reply.status(404).send({ error: "Server not found" })
 
     const minutes = rangeToMinutes(q.range)
     const rangeEndMs = Date.now()
     const rangeStartMs = rangeEndMs - minutes * 60_000
     const sinceIso = new Date(rangeStartMs).toISOString()
-    const rows = readServerSamplesInRange(server.id, sinceIso)
+    const rows = await readServerSamplesInRange(server.id, sinceIso)
     const data = buildServerTraffic(
       server,
-      snapshotStatus(server.id),
+      await snapshotStatus(server.id),
       rows,
       rangeStartMs,
       rangeEndMs,
@@ -437,7 +436,7 @@ const trafficRoutes: FastifyPluginAsyncZod = async (app) => {
     const minutes = rangeToMinutes(q.range)
     const rangeEndMs = Date.now()
     const rangeStartMs = rangeEndMs - minutes * 60_000
-    return reply.send({ users: buildUserTrafficList(rangeStartMs, rangeEndMs) })
+    return reply.send({ users: await buildUserTrafficList(rangeStartMs, rangeEndMs) })
   })
 
   app.get("/traffic/users/:id", async (req, reply) => {
@@ -448,7 +447,7 @@ const trafficRoutes: FastifyPluginAsyncZod = async (app) => {
     const minutes = rangeToMinutes(q.range)
     const rangeEndMs = Date.now()
     const rangeStartMs = rangeEndMs - minutes * 60_000
-    const users = buildUserTrafficList(rangeStartMs, rangeEndMs)
+    const users = await buildUserTrafficList(rangeStartMs, rangeEndMs)
     const user = users.find((u) => u.id === id)
     if (!user) return reply.status(404).send({ error: "Пользователь не найден" })
     return reply.send({ user })
@@ -459,7 +458,7 @@ const trafficRoutes: FastifyPluginAsyncZod = async (app) => {
     const minutes = rangeToMinutes(q.range)
     const rangeEndMs = Date.now()
     const rangeStartMs = rangeEndMs - minutes * 60_000
-    return reply.send({ interfaces: buildBoundInterfaceTraffic(rangeStartMs, rangeEndMs) })
+    return reply.send({ interfaces: await buildBoundInterfaceTraffic(rangeStartMs, rangeEndMs) })
   })
 }
 
diff --git a/backend/src/routes/uptime.ts b/backend/src/routes/uptime.ts
index b078092..30f1cea 100644
--- a/backend/src/routes/uptime.ts
+++ b/backend/src/routes/uptime.ts
@@ -36,8 +36,8 @@ function toSeries(values: number[], target = 40): number[] {
   return [...Array(target - values.length).fill(values[0] ?? 0), ...values]
 }
 
-/** Сэмпл ресурсов из SQLite (readResourceSamplesSince). */
-type ResourceSampleRow = ReturnType<typeof readResourceSamplesSince>[number]
+/** Сэмпл ресурсов из PostgreSQL (readResourceSamplesSince). */
+type ResourceSampleRow = Awaited<ReturnType<typeof readResourceSamplesSince>>[number]
 
 /**
  * Последний сэмпл по времени может быть offline после сбоя опроса — тогда UI «пустой».
@@ -67,7 +67,7 @@ function pickResourceDisplayRow(rows: ResourceSampleRow[], maxGapMs: number): {
 
 const uptimeRoutes: FastifyPluginAsyncZod = async (app) => {
   app.get("/uptime/settings", async (_req, reply) => {
-    const s = readUptimeSettings()
+    const s = await readUptimeSettings()
     return reply.send({
       enabled: s.enabled,
       resourcesEnabled: s.resourcesEnabled ?? s.enabled,
@@ -82,7 +82,7 @@ const uptimeRoutes: FastifyPluginAsyncZod = async (app) => {
       lastCollectedAt: s.lastCollectedAt ?? null,
       lastDurationMs: s.lastDurationMs ?? null,
       lastError: s.lastError || null,
-      scheduler: getSchedulerStatus(),
+      scheduler: await getSchedulerStatus(),
     })
   })
 
@@ -97,7 +97,7 @@ const uptimeRoutes: FastifyPluginAsyncZod = async (app) => {
       speedIntervalSec?: number | string
       retentionDays?: number | string
     }
-    const updated = updateUptimeSettings({
+    const updated = await updateUptimeSettings({
       enabled: body.enabled,
       resourcesEnabled: body.resourcesEnabled,
       pingEnabled: body.pingEnabled,
@@ -107,7 +107,7 @@ const uptimeRoutes: FastifyPluginAsyncZod = async (app) => {
       speedIntervalSec: body.speedIntervalSec == null ? undefined : Math.max(10, Number.parseInt(String(body.speedIntervalSec), 10) || 60),
       retentionDays: body.retentionDays == null ? undefined : Math.max(1, Number.parseInt(String(body.retentionDays), 10) || 14),
     })
-    refreshScheduler()
+    await refreshScheduler()
     return reply.send({
       ok: true,
       settings: {
@@ -122,7 +122,7 @@ const uptimeRoutes: FastifyPluginAsyncZod = async (app) => {
         lastCollectedAt: updated.lastCollectedAt ?? null,
         lastDurationMs: updated.lastDurationMs ?? null,
         lastError: updated.lastError || null,
-        scheduler: getSchedulerStatus(),
+        scheduler: await getSchedulerStatus(),
       },
     })
   })
@@ -130,7 +130,7 @@ const uptimeRoutes: FastifyPluginAsyncZod = async (app) => {
   app.post("/uptime/collect-now", async (_req, reply) => {
     await collectUptimeOnce()
     scheduleAlertEngineAfterDataCollectors()
-    const s = readUptimeSettings()
+    const s = await readUptimeSettings()
     return reply.send({
       ok: true,
       lastCollectedAt: s.lastCollectedAt ?? null,
@@ -158,7 +158,7 @@ const uptimeRoutes: FastifyPluginAsyncZod = async (app) => {
   })
 
   app.get("/uptime/probes", async (_req, reply) => {
-    const rows = readProbeRows()
+    const rows = await readProbeRows()
     return reply.send({
       probes: rows.map((p) => ({
         id: p.id,
@@ -178,7 +178,7 @@ const uptimeRoutes: FastifyPluginAsyncZod = async (app) => {
   })
 
   app.get("/uptime/speed-probes", async (_req, reply) => {
-    const rows = db.select().from(uptimeSpeedProbes).orderBy(asc(uptimeSpeedProbes.sortOrder)).all()
+    const rows = await db.select().from(uptimeSpeedProbes).orderBy(asc(uptimeSpeedProbes.sortOrder))
     return reply.send({
       probes: rows.map((r) => ({
         id: r.id,
@@ -204,7 +204,7 @@ const uptimeRoutes: FastifyPluginAsyncZod = async (app) => {
   })
 
   app.get("/uptime/speed-test/runs", async (_req, reply) => {
-    const rows = db.select().from(uptimeSpeedTestRuns).orderBy(desc(uptimeSpeedTestRuns.createdAt)).limit(200).all()
+    const rows = await db.select().from(uptimeSpeedTestRuns).orderBy(desc(uptimeSpeedTestRuns.createdAt)).limit(200)
     return reply.send({
       runs: rows.map((r) => ({
         id: r.id,
@@ -263,12 +263,12 @@ const uptimeRoutes: FastifyPluginAsyncZod = async (app) => {
       .filter((p) => Number.isFinite(p.srcServerId) && Number.isFinite(p.dstServerId) && p.srcServerId !== p.dstServerId)
 
     const now = new Date().toISOString()
-    const existing = db.select({ id: uptimeSpeedProbes.id }).from(uptimeSpeedProbes).all()
+    const existing = await db.select({ id: uptimeSpeedProbes.id }).from(uptimeSpeedProbes)
     const nextIds = new Set(normalized.map((p) => p.id))
 
     for (const row of existing) {
       if (nextIds.has(row.id)) continue
-      db.delete(uptimeSpeedProbes).where(eq(uptimeSpeedProbes.id, row.id)).run()
+      await db.delete(uptimeSpeedProbes).where(eq(uptimeSpeedProbes.id, row.id))
     }
 
     for (let i = 0; i < normalized.length; i += 1) {
@@ -285,15 +285,15 @@ const uptimeRoutes: FastifyPluginAsyncZod = async (app) => {
         sortOrder: i,
         updatedAt: now,
       }
-      const updated = db.update(uptimeSpeedProbes).set(patch).where(eq(uptimeSpeedProbes.id, p.id)).run()
-      if ((updated.changes ?? 0) > 0) continue
-      db.insert(uptimeSpeedProbes).values({
+      const updated = await db.update(uptimeSpeedProbes).set(patch).where(eq(uptimeSpeedProbes.id, p.id)).returning({ id: uptimeSpeedProbes.id })
+      if (updated.length > 0) continue
+      await db.insert(uptimeSpeedProbes).values({
         id: p.id,
         ...patch,
         createdAt: now,
-      }).run()
+      })
     }
-    refreshScheduler()
+    await refreshScheduler()
     return reply.send({ ok: true })
   })
 
@@ -326,8 +326,8 @@ const uptimeRoutes: FastifyPluginAsyncZod = async (app) => {
           : Number.parseInt(String(p.intervalSec), 10),
       }))
       .filter((p) => Number.isFinite(p.srcServerId) && p.name && p.target)
-    replaceProbes(normalized)
-    refreshScheduler()
+    await replaceProbes(normalized)
+    await refreshScheduler()
     return reply.send({ ok: true })
   })
 
@@ -339,7 +339,7 @@ const uptimeRoutes: FastifyPluginAsyncZod = async (app) => {
     if (typeof body.showOnDashboard !== "boolean") {
       return reply.status(400).send({ error: "showOnDashboard boolean required" })
     }
-    const ok = updateProbeShowOnDashboard(probeId, body.showOnDashboard)
+    const ok = await updateProbeShowOnDashboard(probeId, body.showOnDashboard)
     if (!ok) return reply.status(404).send({ error: "Probe not found" })
     return reply.send({ ok: true })
   })
@@ -348,7 +348,7 @@ const uptimeRoutes: FastifyPluginAsyncZod = async (app) => {
     const params = req.params as { id?: string | number }
     const serverId = Number.parseInt(String(params.id ?? ""), 10)
     if (!Number.isFinite(serverId)) return reply.status(400).send({ error: "Invalid server id" })
-    const srv = db.select().from(servers).where(eq(servers.id, serverId)).limit(1).all()[0]
+    const srv = (await db.select().from(servers).where(eq(servers.id, serverId)).limit(1))[0]
     if (!srv) return reply.status(404).send({ error: "Server not found" })
     try {
       const rows = await MikrotikClient.fromServer(srv).getInterfaces()
@@ -386,8 +386,8 @@ const uptimeRoutes: FastifyPluginAsyncZod = async (app) => {
       return reply.status(400).send({ error: "Invalid src/dst server id" })
     }
     if (srcId === dstId) return reply.status(400).send({ error: "Source and destination must be different" })
-    const src = db.select().from(servers).where(eq(servers.id, srcId)).limit(1).all()[0]
-    const dst = db.select().from(servers).where(eq(servers.id, dstId)).limit(1).all()[0]
+    const src = (await db.select().from(servers).where(eq(servers.id, srcId)).limit(1))[0]
+    const dst = (await db.select().from(servers).where(eq(servers.id, dstId)).limit(1))[0]
     if (!src || !dst) return reply.status(404).send({ error: "Server not found" })
     try {
       const result = await runBandwidthSpeedTest({
@@ -404,7 +404,7 @@ const uptimeRoutes: FastifyPluginAsyncZod = async (app) => {
       return reply.send({ ok: true, result })
     } catch (e) {
       const raw = e instanceof Error ? e.message : "Bandwidth test failed"
-      recordSpeedTestFailure({
+      await recordSpeedTestFailure({
         probeId: String(body.probeId ?? "").trim() || undefined,
         runId: String(body.runId ?? "").trim() || undefined,
         srcServerId: srcId,
@@ -430,7 +430,7 @@ const uptimeRoutes: FastifyPluginAsyncZod = async (app) => {
     const params = req.params as { id?: string | number }
     const serverId = Number.parseInt(String(params.id ?? ""), 10)
     if (!Number.isFinite(serverId)) return reply.status(400).send({ error: "Invalid server id" })
-    const srv = db.select().from(servers).where(eq(servers.id, serverId)).limit(1).all()[0]
+    const srv = (await db.select().from(servers).where(eq(servers.id, serverId)).limit(1))[0]
     if (!srv) return reply.status(404).send({ error: "Server not found" })
     try {
       const client = MikrotikClient.fromServer(srv)
@@ -473,10 +473,10 @@ const uptimeRoutes: FastifyPluginAsyncZod = async (app) => {
     const minutes = rangeToMinutes(q.range)
     const sinceIso = new Date(Date.now() - minutes * 60_000).toISOString()
 
-    const allServers = db.select().from(servers).all()
-    const probeRows = readProbeRows()
-    const probeSamples = readProbeSamplesSince(sinceIso)
-    const uptimeCfg = readUptimeSettings()
+    const allServers = await db.select().from(servers)
+    const probeRows = await readProbeRows()
+    const probeSamples = await readProbeSamplesSince(sinceIso)
+    const uptimeCfg = await readUptimeSettings()
     const intervalSec = Math.max(15, uptimeCfg.intervalSec ?? 300)
     /** Допустимый разрыв между последней попыткой и последним «хорошим» сэмплом (не показывать данные часовой давности). */
     const resourceFallbackMaxGapMs = Math.min(2 * 3600 * 1000, Math.max(10 * 60 * 1000, intervalSec * 6 * 1000))
@@ -501,8 +501,8 @@ const uptimeRoutes: FastifyPluginAsyncZod = async (app) => {
       }
     })
 
-    const resources = allServers.map((s) => {
-      const rows = readResourceSamplesSince(sinceIso, s.id)
+    const resources = await Promise.all(allServers.map(async (s) => {
+      const rows = await readResourceSamplesSince(sinceIso, s.id)
       const { row: pick, hasData } = pickResourceDisplayRow(rows, resourceFallbackMaxGapMs)
       const cpuHistory = toSeries(rows.map((r) => r.cpuLoad), 40)
       return {
@@ -518,7 +518,7 @@ const uptimeRoutes: FastifyPluginAsyncZod = async (app) => {
         boardName: pick?.boardName || "RouterBOARD",
         temp: undefined as number | undefined,
       }
-    })
+    }))
 
     return reply.send({ probes, resources })
   })
diff --git a/backend/src/routes/users.ts b/backend/src/routes/users.ts
index bb1dafc..b083a31 100644
--- a/backend/src/routes/users.ts
+++ b/backend/src/routes/users.ts
@@ -31,7 +31,7 @@ function sendServiceError(reply: { status: (c: number) => { send: (b: unknown) =
 
 const usersRoutes: FastifyPluginAsyncZod = async (app) => {
   app.get("/users", async (_req, reply) => {
-    return reply.send({ users: listUsers() })
+    return reply.send({ users: await listUsers() })
   })
 
   app.get("/users/interface-catalog", {
@@ -49,7 +49,7 @@ const usersRoutes: FastifyPluginAsyncZod = async (app) => {
     schema: { params: appUserIdParamSchema },
   }, async (req, reply) => {
     const { id } = req.params as { id: string }
-    const user = getUserById(id)
+    const user = await getUserById(id)
     if (!user) return reply.status(404).send({ error: "Пользователь не найден" })
     return reply.send({ user })
   })
@@ -58,7 +58,7 @@ const usersRoutes: FastifyPluginAsyncZod = async (app) => {
     schema: { body: appUserCreateSchema },
   }, async (req, reply) => {
     try {
-      const user = createUser(req.body as AppUserCreate)
+      const user = await createUser(req.body as AppUserCreate)
       return reply.status(201).send({ user })
     } catch (err) {
       return sendServiceError(reply, err)
@@ -70,7 +70,7 @@ const usersRoutes: FastifyPluginAsyncZod = async (app) => {
   }, async (req, reply) => {
     const { id } = req.params as { id: string }
     try {
-      const user = updateUser(id, req.body as AppUserUpdate)
+      const user = await updateUser(id, req.body as AppUserUpdate)
       return reply.send({ user })
     } catch (err) {
       return sendServiceError(reply, err)
@@ -82,7 +82,7 @@ const usersRoutes: FastifyPluginAsyncZod = async (app) => {
   }, async (req, reply) => {
     const { id } = req.params as { id: string }
     try {
-      deleteUser(id)
+      await deleteUser(id)
       return reply.status(204).send()
     } catch (err) {
       return sendServiceError(reply, err)
@@ -94,7 +94,7 @@ const usersRoutes: FastifyPluginAsyncZod = async (app) => {
   }, async (req, reply) => {
     const { id } = req.params as { id: string }
     try {
-      const binding = addBinding(id, req.body as UserBindingCreate)
+      const binding = await addBinding(id, req.body as UserBindingCreate)
       return reply.status(201).send({ binding })
     } catch (err) {
       return sendServiceError(reply, err)
@@ -106,7 +106,7 @@ const usersRoutes: FastifyPluginAsyncZod = async (app) => {
   }, async (req, reply) => {
     const { id, bindingId } = req.params as { id: string; bindingId: string }
     try {
-      removeBinding(id, bindingId)
+      await removeBinding(id, bindingId)
       return reply.status(204).send()
     } catch (err) {
       return sendServiceError(reply, err)
diff --git a/backend/src/routes/wireguard.ts b/backend/src/routes/wireguard.ts
index e8d6697..88b8cb9 100644
--- a/backend/src/routes/wireguard.ts
+++ b/backend/src/routes/wireguard.ts
@@ -154,7 +154,7 @@ const wireguardRoutes: FastifyPluginAsyncZod = async (app) => {
       return reply.status(400).send({ error: "Некорректное тело запроса", details: parsed.error.flatten() })
     }
     const body = parsed.data
-    const server = getEnabledServerById(body.serverId)
+    const server = await getEnabledServerById(body.serverId)
     if (!server) return reply.status(404).send({ error: "Сервер не найден" })
 
     const client = MikrotikClient.fromServer(server)
@@ -194,7 +194,7 @@ const wireguardRoutes: FastifyPluginAsyncZod = async (app) => {
     if (!parsed.success) {
       return reply.status(400).send({ error: "Некорректное тело запроса", details: parsed.error.flatten() })
     }
-    const server = getEnabledServerById(serverIdParam(serverId))
+    const server = await getEnabledServerById(serverIdParam(serverId))
     if (!server) return reply.status(404).send({ error: "Сервер не найден" })
     const client = MikrotikClient.fromServer(server)
     const d = parsed.data
@@ -219,7 +219,7 @@ const wireguardRoutes: FastifyPluginAsyncZod = async (app) => {
 
   app.delete("/wireguard/interfaces/:serverId/:rosId", async (req, reply) => {
     const { serverId, rosId } = req.params as { serverId: string; rosId: string }
-    const server = getEnabledServerById(serverIdParam(serverId))
+    const server = await getEnabledServerById(serverIdParam(serverId))
     if (!server) return reply.status(404).send({ error: "Сервер не найден" })
     const client = MikrotikClient.fromServer(server)
     try {
@@ -237,7 +237,7 @@ const wireguardRoutes: FastifyPluginAsyncZod = async (app) => {
       return reply.status(400).send({ error: "Некорректное тело запроса", details: parsed.error.flatten() })
     }
     const body = parsed.data
-    const server = getEnabledServerById(body.serverId)
+    const server = await getEnabledServerById(body.serverId)
     if (!server) return reply.status(404).send({ error: "Сервер не найден" })
     const client = MikrotikClient.fromServer(server)
     try {
@@ -255,7 +255,7 @@ const wireguardRoutes: FastifyPluginAsyncZod = async (app) => {
     if (!parsed.success) {
       return reply.status(400).send({ error: "Некорректное тело запроса", details: parsed.error.flatten() })
     }
-    const server = getEnabledServerById(serverIdParam(serverId))
+    const server = await getEnabledServerById(serverIdParam(serverId))
     if (!server) return reply.status(404).send({ error: "Сервер не найден" })
     const d = parsed.data
     const client = MikrotikClient.fromServer(server)
@@ -286,7 +286,7 @@ const wireguardRoutes: FastifyPluginAsyncZod = async (app) => {
 
   app.delete("/wireguard/peers/:serverId/:rosId", async (req, reply) => {
     const { serverId, rosId } = req.params as { serverId: string; rosId: string }
-    const server = getEnabledServerById(serverIdParam(serverId))
+    const server = await getEnabledServerById(serverIdParam(serverId))
     if (!server) return reply.status(404).send({ error: "Сервер не найден" })
     const client = MikrotikClient.fromServer(server)
     try {
@@ -315,7 +315,7 @@ const wireguardRoutes: FastifyPluginAsyncZod = async (app) => {
       return reply.send({ dryRun: true, preview })
     }
 
-    const server = getEnabledServerById(body.serverId)
+    const server = await getEnabledServerById(body.serverId)
     if (!server) return reply.status(404).send({ error: "Сервер не найден" })
     const client = MikrotikClient.fromServer(server)
     try {
@@ -333,14 +333,14 @@ const wireguardRoutes: FastifyPluginAsyncZod = async (app) => {
       return reply.status(400).send({ error: "Некорректное тело запроса", details: parsed.error.flatten() })
     }
     const body = parsed.data
-    const server = getEnabledServerById(body.serverId)
+    const server = await getEnabledServerById(body.serverId)
     if (!server) return reply.status(404).send({ error: "Сервер не найден" })
 
     const list = await listWireGuardInterfaces({
       serverId: String(server.id),
       includePrivateKey: body.includePrivateKey === true,
     })
-    const iface = findIface(list.interfaces, String(server.id), body.interfaceName)
+    const iface = await findIface(list.interfaces, String(server.id), body.interfaceName)
     if (!iface) return reply.status(404).send({ error: "Интерфейс не найден" })
 
     if (body.format === "rsc") {
diff --git a/backend/src/scripts/migrate-sqlite-to-pg.ts b/backend/src/scripts/migrate-sqlite-to-pg.ts
new file mode 100644
index 0000000..ade8c3e
--- /dev/null
+++ b/backend/src/scripts/migrate-sqlite-to-pg.ts
@@ -0,0 +1,20 @@
+import { env } from "../config.js"
+import { closePool, pool } from "../db/index.js"
+import { applySqlMigrations } from "../db/migrate.js"
+import { ensurePartitionsAround } from "../db/partitions.js"
+import { importSqliteToPostgres } from "../db/sqlite-import.js"
+
+const sqlitePath = process.argv.find((a) => a.startsWith("--sqlite="))?.slice(9) ?? env.DATABASE_PATH
+const dryRun = process.argv.includes("--dry-run")
+const fullHistory = process.argv.includes("--full-history")
+const strict = process.argv.includes("--strict") || !dryRun
+
+await applySqlMigrations(pool)
+await ensurePartitionsAround(pool)
+const report = await importSqliteToPostgres(pool, sqlitePath, { dryRun, strict, fullHistory })
+console.log(JSON.stringify(report, null, 2))
+if (!dryRun && report.rejects.length > 0 && strict) {
+  await closePool()
+  process.exit(1)
+}
+await closePool()
diff --git a/backend/src/services/acme-cloudflare.ts b/backend/src/services/acme-cloudflare.ts
index f79e764..82f56db 100644
--- a/backend/src/services/acme-cloudflare.ts
+++ b/backend/src/services/acme-cloudflare.ts
@@ -85,15 +85,11 @@ async function deleteTxtRecord(token: string, zoneId: string, recordId: string):
   await cloudflareRequest(token, `/zones/${zoneId}/dns_records/${recordId}`, { method: "DELETE" })
 }
 
-function parseWanUplinks(raw: string | null | undefined): WanUplinkRow[] {
-  if (!raw?.trim()) return []
-  try {
-    const data = JSON.parse(raw) as unknown
-    if (!Array.isArray(data)) return []
-    return data.filter((row): row is WanUplinkRow => row != null && typeof row === "object")
-  } catch {
-    return []
-  }
+function parseWanUplinks(raw: unknown): WanUplinkRow[] {
+  const data = Array.isArray(raw) ? raw : typeof raw === "string" && raw.trim()
+    ? (() => { try { const p = JSON.parse(raw) as unknown; return Array.isArray(p) ? p : [] } catch { return [] } })()
+    : []
+  return data.filter((row): row is WanUplinkRow => row != null && typeof row === "object")
 }
 
 function normalizeIpv4(raw: string | undefined): string | null {
@@ -217,10 +213,10 @@ async function sleep(ms: number) {
 }
 
 async function getOrCreateAccountKey(): Promise<Buffer> {
-  const existing = getAcmeAccountPrivateKey()
+  const existing = await getAcmeAccountPrivateKey()
   if (existing) return Buffer.from(existing)
   const key = await acme.crypto.createPrivateKey()
-  saveAcmeAccountPrivateKey(key.toString("utf8"))
+  await saveAcmeAccountPrivateKey(key.toString("utf8"))
   return key
 }
 
@@ -247,8 +243,8 @@ export async function issueCertificateWithCloudflareDns(params: {
   trustStore: string[]
   onStep?: (step: string) => void
 }): Promise<void> {
-  const settings = getAcmeSettingsPublic()
-  const token = getAcmeCloudflareToken()
+  const settings = await getAcmeSettingsPublic()
+  const token = await getAcmeCloudflareToken()
   if (!token) throw new Error("Не настроен Cloudflare API token")
 
   const domains = [...new Set(params.domainNames.map((d) => d.trim().toLowerCase()).filter(Boolean))]
diff --git a/backend/src/services/alert-collector-hooks.ts b/backend/src/services/alert-collector-hooks.ts
index 051b018..381fa45 100644
--- a/backend/src/services/alert-collector-hooks.ts
+++ b/backend/src/services/alert-collector-hooks.ts
@@ -1,5 +1,5 @@
 /**
- * Внутренние хуки: после записи сигналов в SQLite (коллекторы) — отложенный прогон `alert_engine`.
+ * Внутренние хуки: после записи сигналов в PostgreSQL (коллекторы) — отложенный прогон `alert_engine`.
  * Не импортирует `scheduler.ts` (избегаем цикла); runner задаётся через `wireAlertEngineRunner`.
  *
  * Любой код, пишущий таблицы для `buildSignalSnapshot`, после успешного коммита должен вызывать
@@ -15,7 +15,7 @@ let alertAfterCollectChain: Promise<void> = Promise.resolve()
 
 let alertEngineRunner: (() => Promise<void>) | null = null
 
-/** Задать runner один раз при старте приложения (обычно `() => executeSchedulerJob("alert_engine")`). */
+/** Задать runner один раз при старте приложения (обычно `() => await executeSchedulerJob("alert_engine")`). */
 export function wireAlertEngineRunner(run: () => Promise<void>): void {
   alertEngineRunner = run
 }
@@ -39,7 +39,7 @@ async function runAlertEngineWhenIdle(): Promise<void> {
 /** После успешной записи сигналов в БД коллекторами (не из `alert_engine`). */
 export function scheduleAlertEngineAfterDataCollectors(): void {
   if (alertAfterCollectTimer != null) clearTimeout(alertAfterCollectTimer)
-  alertAfterCollectTimer = setTimeout(() => {
+  alertAfterCollectTimer = setTimeout(async () => {
     alertAfterCollectTimer = null
     alertAfterCollectChain = alertAfterCollectChain
       .then(() => runAlertEngineWhenIdle())
diff --git a/backend/src/services/alert-engine/confirm-stability.test.ts b/backend/src/services/alert-engine/confirm-stability.test.ts
index 17ff75a..221e701 100644
--- a/backend/src/services/alert-engine/confirm-stability.test.ts
+++ b/backend/src/services/alert-engine/confirm-stability.test.ts
@@ -4,11 +4,10 @@ import { db } from "../../db/index.js"
 import { alertEngineConfirmPending } from "../../db/schema.js"
 import type { ApiAlertRule } from "../alerts-service.js"
 import { computeStabilityReadyMap, deleteConfirmPending } from "./confirm-stability.js"
+import { withPgOrSkip } from "../../test/pg.js"
 
 const ruleId = "test-confirm-stability-recovery-bypass"
 
-deleteConfirmPending(ruleId)
-
 const baseRule: ApiAlertRule = {
   id: ruleId,
   name: "Server transition",
@@ -46,25 +45,31 @@ const recoveryHit = {
   payloadHash: "recovery-1",
 }
 
+if (!(await withPgOrSkip())) {
+  console.log("alert-engine confirm-stability tests skip")
+  process.exit(0)
+}
+
+await deleteConfirmPending(ruleId)
+
 {
-  const m = computeStabilityReadyMap([baseRule], new Map([[ruleId, problemHit]]))
+  const m = await computeStabilityReadyMap([baseRule], new Map([[ruleId, problemHit]]))
   assert.equal(m.get(ruleId), false, "проблемный переход должен ждать confirmStabilitySec")
 }
 
 {
-  const m = computeStabilityReadyMap([baseRule], new Map([[ruleId, recoveryHit]]))
+  const m = await computeStabilityReadyMap([baseRule], new Map([[ruleId, recoveryHit]]))
   assert.equal(m.get(ruleId), true, "восстановление должно отправляться без задержки")
 }
 
 {
-  const m = computeStabilityReadyMap([baseRule], new Map([[ruleId, null]]))
+  const m = await computeStabilityReadyMap([baseRule], new Map([[ruleId, null]]))
   assert.equal(m.get(ruleId), false, "без hit отправка не готова")
-  const left = db
+  const left = (await db
     .select()
     .from(alertEngineConfirmPending)
     .where(eq(alertEngineConfirmPending.ruleId, ruleId))
-    .limit(1)
-    .all()[0]
+    .limit(1))[0]
   assert.equal(left, undefined, "pending должен очищаться после отсутствия hit")
 }
 
diff --git a/backend/src/services/alert-engine/confirm-stability.ts b/backend/src/services/alert-engine/confirm-stability.ts
index a0ba6a7..f6ab69a 100644
--- a/backend/src/services/alert-engine/confirm-stability.ts
+++ b/backend/src/services/alert-engine/confirm-stability.ts
@@ -4,46 +4,44 @@ import { alertEngineConfirmPending } from "../../db/schema.js"
 import type { ApiAlertRule } from "../alerts-service.js"
 import type { RuleEvalHit } from "./types.js"
 
-export function deleteConfirmPending(ruleId: string) {
-  db.delete(alertEngineConfirmPending).where(eq(alertEngineConfirmPending.ruleId, ruleId)).run()
+export async function deleteConfirmPending(ruleId: string) {
+  await db.delete(alertEngineConfirmPending).where(eq(alertEngineConfirmPending.ruleId, ruleId))
 }
 
 /**
  * Обновляет состояние ожидания стабильности и возвращает, можно ли отправлять уведомление в этом тике.
  * При отсутствии срабатывания (`hit == null`) ожидание сбрасывается.
  */
-export function stabilityReadyForSend(
+export async function stabilityReadyForSend(
   ruleId: string,
   hit: RuleEvalHit | null,
   delaySec: number | null | undefined,
-): boolean {
+): Promise<boolean> {
   if (!hit) {
-    deleteConfirmPending(ruleId)
+    await deleteConfirmPending(ruleId)
     return false
   }
   const sec = delaySec != null && delaySec > 0 ? Math.floor(delaySec) : 0
   if (sec <= 0) {
-    deleteConfirmPending(ruleId)
+    await deleteConfirmPending(ruleId)
     return true
   }
 
   const now = Date.now()
   const nowIso = new Date().toISOString()
-  const existing = db
+  const existing = (await db
     .select()
     .from(alertEngineConfirmPending)
     .where(eq(alertEngineConfirmPending.ruleId, ruleId))
-    .limit(1)
-    .all()[0]
+    .limit(1))[0]
 
   if (!existing || existing.payloadHash !== hit.payloadHash) {
     if (existing) {
-      db.update(alertEngineConfirmPending)
+      await db.update(alertEngineConfirmPending)
         .set({ payloadHash: hit.payloadHash, sinceAt: nowIso })
         .where(eq(alertEngineConfirmPending.ruleId, ruleId))
-        .run()
     } else {
-      db.insert(alertEngineConfirmPending).values({ ruleId, payloadHash: hit.payloadHash, sinceAt: nowIso }).run()
+      await db.insert(alertEngineConfirmPending).values({ ruleId, payloadHash: hit.payloadHash, sinceAt: nowIso })
     }
     return false
   }
@@ -54,18 +52,18 @@ export function stabilityReadyForSend(
 }
 
 /** После успешной отправки — сбросить таймер стабильности для следующего цикла. */
-export function clearConfirmPendingAfterSend(ruleIds: string[]) {
-  for (const id of ruleIds) deleteConfirmPending(id)
+export async function clearConfirmPendingAfterSend(ruleIds: string[]) {
+  for (const id of ruleIds) await deleteConfirmPending(id)
 }
 
-export function computeStabilityReadyMap(
+export async function computeStabilityReadyMap(
   rules: ApiAlertRule[],
   hitByRule: Map<string, RuleEvalHit | null>,
-): Map<string, boolean> {
+): Promise<Map<string, boolean>> {
   const m = new Map<string, boolean>()
   for (const rule of rules) {
     if (!rule.enabled) {
-      deleteConfirmPending(rule.id)
+      await deleteConfirmPending(rule.id)
       m.set(rule.id, false)
       continue
     }
@@ -76,7 +74,7 @@ export function computeStabilityReadyMap(
           ? rule.recoveryStabilitySec
           : 0
         : rule.confirmStabilitySec
-    m.set(rule.id, stabilityReadyForSend(rule.id, hit, delaySec))
+    m.set(rule.id, await stabilityReadyForSend(rule.id, hit, delaySec))
   }
   return m
 }
diff --git a/backend/src/services/alert-engine/decision-engine.ts b/backend/src/services/alert-engine/decision-engine.ts
index 3c7b3dc..b43dbd3 100644
--- a/backend/src/services/alert-engine/decision-engine.ts
+++ b/backend/src/services/alert-engine/decision-engine.ts
@@ -73,20 +73,20 @@ export function buildRuleDiagnostics(
   return out
 }
 
-export function computeDecisions(args: {
+export async function computeDecisions(args: {
   rules: ApiAlertRule[]
   groups: ApiAlertGroup[]
   hitByRule: Map<string, RuleEvalHit | null>
   state: EngineStateMap
   canSend: boolean
-}): {
+}): Promise<{
   stabilityReady: Map<string, boolean>
   standalone: StandaloneDecision[]
   grouped: GroupDecision[]
   ruleDiag: AlertEngineRuleDiag[]
-} {
+}> {
   const { rules, groups, hitByRule, state, canSend } = args
-  const stabilityReady = computeStabilityReadyMap(rules, hitByRule)
+  const stabilityReady = await computeStabilityReadyMap(rules, hitByRule)
   const ruleDiag = buildRuleDiagnostics(rules, hitByRule, stabilityReady, state, canSend)
   const standalone: StandaloneDecision[] = []
   const grouped: GroupDecision[] = []
diff --git a/backend/src/services/alert-engine/outbox.ts b/backend/src/services/alert-engine/outbox.ts
index c7439d6..0712971 100644
--- a/backend/src/services/alert-engine/outbox.ts
+++ b/backend/src/services/alert-engine/outbox.ts
@@ -17,7 +17,9 @@ export type AlertOutboxPayload = {
   }
 }
 
-function safeParsePayload(raw: string): AlertOutboxPayload | null {
+function safeParsePayload(raw: unknown): AlertOutboxPayload | null {
+  if (raw && typeof raw === "object") return raw as AlertOutboxPayload
+  if (typeof raw !== "string") return null
   try {
     return JSON.parse(raw) as AlertOutboxPayload
   } catch {
@@ -25,21 +27,20 @@ function safeParsePayload(raw: string): AlertOutboxPayload | null {
   }
 }
 
-export function enqueueTelegramOutbox(input: {
+export async function enqueueTelegramOutbox(input: {
   id: string
   dedupeKey: string
   payload: AlertOutboxPayload
   maxRetries?: number
-}): boolean {
-  const existing = db
+}): Promise<boolean> {
+  const existing = (await db
     .select()
     .from(alertOutbox)
     .where(eq(alertOutbox.dedupeKey, input.dedupeKey))
-    .limit(1)
-    .all()[0]
+    .limit(1))[0]
   if (existing && (existing.status === "pending" || existing.status === "sent")) return false
   const nowIso = new Date().toISOString()
-  db.insert(alertOutbox)
+  await db.insert(alertOutbox)
     .values({
       id: input.id,
       dedupeKey: input.dedupeKey,
@@ -48,22 +49,20 @@ export function enqueueTelegramOutbox(input: {
       retryCount: 0,
       maxRetries: Math.max(1, Math.floor(input.maxRetries ?? 3)),
       nextAttemptAt: nowIso,
-      payloadJson: JSON.stringify(input.payload),
+      payloadJson: input.payload,
     })
-    .run()
   return true
 }
 
 export function dispatchPendingOutbox(limit = 25): Promise<{ sent: number; failed: number; errors: string[] }> {
   return (async () => {
     const nowIso = new Date().toISOString()
-    const rows = db
+    const rows = await db
       .select()
       .from(alertOutbox)
       .where(and(eq(alertOutbox.status, "pending"), lte(alertOutbox.nextAttemptAt, nowIso)))
       .orderBy(asc(alertOutbox.createdAt))
       .limit(Math.max(1, limit))
-      .all()
 
     let sent = 0
     let failed = 0
@@ -72,27 +71,25 @@ export function dispatchPendingOutbox(limit = 25): Promise<{ sent: number; faile
     for (const row of rows) {
       const payload = safeParsePayload(row.payloadJson)
       if (!payload) {
-        db.update(alertOutbox)
+        await db.update(alertOutbox)
           .set({
             status: "failed",
             lastError: "invalid payload_json",
           })
           .where(eq(alertOutbox.id, row.id))
-          .run()
         failed += 1
         continue
       }
       const send = await sendTelegramAlertMessage({ text: payload.text, chatId: payload.chatId })
       if (send.ok) {
-        db.update(alertOutbox)
+        await db.update(alertOutbox)
           .set({
             status: "sent",
             sentAt: new Date().toISOString(),
             lastError: null,
           })
           .where(eq(alertOutbox.id, row.id))
-          .run()
-        appendAlertHistory({
+        await appendAlertHistory({
           id: payload.history.id,
           ruleId: payload.history.ruleId ?? null,
           groupId: payload.history.groupId ?? null,
@@ -107,7 +104,7 @@ export function dispatchPendingOutbox(limit = 25): Promise<{ sent: number; faile
       }
       const nextRetry = row.retryCount + 1
       const exhausted = nextRetry >= row.maxRetries
-      db.update(alertOutbox)
+      await db.update(alertOutbox)
         .set({
           retryCount: nextRetry,
           status: exhausted ? "failed" : "pending",
@@ -115,9 +112,8 @@ export function dispatchPendingOutbox(limit = 25): Promise<{ sent: number; faile
           lastError: send.error,
         })
         .where(eq(alertOutbox.id, row.id))
-        .run()
       if (exhausted) {
-        appendAlertHistory({
+        await appendAlertHistory({
           id: payload.history.id,
           ruleId: payload.history.ruleId ?? null,
           groupId: payload.history.groupId ?? null,
diff --git a/backend/src/services/alert-engine/prev-live-store.ts b/backend/src/services/alert-engine/prev-live-store.ts
index a149cc3..0517582 100644
--- a/backend/src/services/alert-engine/prev-live-store.ts
+++ b/backend/src/services/alert-engine/prev-live-store.ts
@@ -1,5 +1,6 @@
 import { eq } from "drizzle-orm"
 import { db } from "../../db/index.js"
+import { parseJsonObject } from "../../db/json.js"
 import { alertEnginePrevLive } from "../../db/schema.js"
 
 export type PrevLiveKind = "gre" | "bgp"
@@ -7,42 +8,32 @@ export type PrevLiveKind = "gre" | "bgp"
 /** Предыдущие строковые состояния (GRE: up|down|degraded; BGP: state как с роутера). */
 export type PrevLiveStringMap = Record<string, string>
 
-function safeParseMap(json: string | null | undefined): PrevLiveStringMap {
-  if (!json || json.trim() === "") return {}
-  try {
-    const v = JSON.parse(json) as unknown
-    if (v == null || typeof v !== "object" || Array.isArray(v)) return {}
-    return v as PrevLiveStringMap
-  } catch {
-    return {}
-  }
+function safeParseMap(json: unknown): PrevLiveStringMap {
+  return parseJsonObject(json) as PrevLiveStringMap
 }
 
-export function loadPrevLiveMap(kind: PrevLiveKind): PrevLiveStringMap {
-  const row = db
+export async function loadPrevLiveMap(kind: PrevLiveKind): Promise<PrevLiveStringMap> {
+  const row = (await db
     .select()
     .from(alertEnginePrevLive)
     .where(eq(alertEnginePrevLive.kind, kind))
-    .limit(1)
-    .all()[0]
+    .limit(1))[0]
   return safeParseMap(row?.payloadJson)
 }
 
-export function savePrevLiveMap(kind: PrevLiveKind, map: PrevLiveStringMap) {
-  const payloadJson = JSON.stringify(map)
-  const existing = db
+export async function savePrevLiveMap(kind: PrevLiveKind, map: PrevLiveStringMap) {
+  const payloadJson = map
+  const existing = (await db
     .select()
     .from(alertEnginePrevLive)
     .where(eq(alertEnginePrevLive.kind, kind))
-    .limit(1)
-    .all()[0]
+    .limit(1))[0]
   if (existing) {
     if (existing.payloadJson === payloadJson) return
-    db.update(alertEnginePrevLive)
+    await db.update(alertEnginePrevLive)
       .set({ payloadJson, updatedAt: new Date().toISOString() })
       .where(eq(alertEnginePrevLive.kind, kind))
-      .run()
     return
   }
-  db.insert(alertEnginePrevLive).values({ kind, payloadJson, updatedAt: new Date().toISOString() }).run()
+  await db.insert(alertEnginePrevLive).values({ kind, payloadJson, updatedAt: new Date().toISOString() })
 }
diff --git a/backend/src/services/alert-engine/run-once.ts b/backend/src/services/alert-engine/run-once.ts
index 61f2ba3..6536a63 100644
--- a/backend/src/services/alert-engine/run-once.ts
+++ b/backend/src/services/alert-engine/run-once.ts
@@ -26,7 +26,7 @@ const SNAPSHOT_SOURCE_WAIT_MS = 30_000
 const SNAPSHOT_SOURCE_POLL_MS = 20
 
 /**
- * Не строить снимок, пока коллекторы пишут в SQLite — иначе гонка с `alert_engine` по таймеру
+ * Не строить снимок, пока коллекторы пишут в PostgreSQL — иначе гонка с `alert_engine` по таймеру
  * (в т.ч. слот планировщика занят до первого `await` в коллекторе, когда внутренний `collecting` ещё false).
  */
 async function awaitSnapshotSourcesIdle(): Promise<void> {
@@ -52,8 +52,8 @@ function newOutboxId(): string {
   return `ao-${Date.now()}-${Math.random().toString(36).slice(2, 10)}`
 }
 
-function loadEngineStateMap(): Map<string, { lastFiredAt: string; lastPayloadHash: string | null }> {
-  const rows = db.select().from(alertEngineState).all()
+async function loadEngineStateMap(): Promise<Map<string, { lastFiredAt: string; lastPayloadHash: string | null }>> {
+  const rows = await db.select().from(alertEngineState)
   const m = new Map<string, { lastFiredAt: string; lastPayloadHash: string | null }>()
   for (const r of rows) {
     m.set(r.scopeKey, { lastFiredAt: r.lastFiredAt, lastPayloadHash: r.lastPayloadHash ?? null })
@@ -61,15 +61,14 @@ function loadEngineStateMap(): Map<string, { lastFiredAt: string; lastPayloadHas
   return m
 }
 
-function upsertEngineState(scopeKey: string, lastFiredAt: string, lastPayloadHash: string | null) {
-  const existing = db.select().from(alertEngineState).where(eq(alertEngineState.scopeKey, scopeKey)).limit(1).all()[0]
+async function upsertEngineState(scopeKey: string, lastFiredAt: string, lastPayloadHash: string | null) {
+  const existing = (await db.select().from(alertEngineState).where(eq(alertEngineState.scopeKey, scopeKey)).limit(1))[0]
   if (existing) {
-    db.update(alertEngineState)
+    await db.update(alertEngineState)
       .set({ lastFiredAt, lastPayloadHash })
       .where(eq(alertEngineState.scopeKey, scopeKey))
-      .run()
   } else {
-    db.insert(alertEngineState).values({ scopeKey, lastFiredAt, lastPayloadHash }).run()
+    await db.insert(alertEngineState).values({ scopeKey, lastFiredAt, lastPayloadHash })
   }
 }
 
@@ -90,16 +89,16 @@ function ruleScopeKey(ruleId: string, transition?: RuleEvalHit["transition"]): s
 export async function runAlertEngineOnce(): Promise<AlertEngineRunResult> {
   const errors: string[] = []
   const sampledAt = new Date().toISOString()
-  const latestSourceFinishedAt = getLatestSourceFinishedAt()
-  const prevSourceFinishedAt = getSourceWatermark()
+  const latestSourceFinishedAt = await getLatestSourceFinishedAt()
+  const prevSourceFinishedAt = await getSourceWatermark()
   const hasNewSources =
     latestSourceFinishedAt != null &&
     (prevSourceFinishedAt == null || latestSourceFinishedAt > prevSourceFinishedAt)
 
-  const rules = listAlertRules()
-  const groups = listAlertGroups()
-  const state = loadEngineStateMap()
-  const pub = getTelegramPublic()
+  const rules = await listAlertRules()
+  const groups = await listAlertGroups()
+  const state = await loadEngineStateMap()
+  const pub = await getTelegramPublic()
   const canSend = pub.tokenConfigured && Boolean(pub.chatId?.trim())
   let standaloneFires = 0
   let groupFires = 0
@@ -107,10 +106,10 @@ export async function runAlertEngineOnce(): Promise<AlertEngineRunResult> {
   let ruleDiag: AlertEngineRunResult["ruleDiag"] = []
   if (hasNewSources) {
     await awaitSnapshotSourcesIdle()
-    const snap = ingestAlertSignals()
+    const snap = await ingestAlertSignals()
     const matched = matchRules(rules, snap)
     errors.push(...matched.errors)
-    const { standalone, grouped, ruleDiag: diag } = computeDecisions({
+    const { standalone, grouped, ruleDiag: diag } = await computeDecisions({
       rules,
       groups,
       hitByRule: matched.hitByRule,
@@ -123,7 +122,7 @@ export async function runAlertEngineOnce(): Promise<AlertEngineRunResult> {
       if (!canSend) break
       const firedAt = new Date().toISOString()
       const key = ruleScopeKey(d.rule.id, d.hit.transition)
-      const queued = enqueueTelegramOutbox({
+      const queued = await enqueueTelegramOutbox({
         id: newOutboxId(),
         dedupeKey: `${key}:${d.hit.payloadHash}`,
         payload: {
@@ -142,8 +141,8 @@ export async function runAlertEngineOnce(): Promise<AlertEngineRunResult> {
       })
       if (!queued) continue
       standaloneFires += 1
-      clearConfirmPendingAfterSend([d.rule.id])
-      upsertEngineState(key, firedAt, d.hit.payloadHash)
+      await clearConfirmPendingAfterSend([d.rule.id])
+      await upsertEngineState(key, firedAt, d.hit.payloadHash)
       state.set(key, { lastFiredAt: firedAt, lastPayloadHash: d.hit.payloadHash })
     }
 
@@ -155,7 +154,7 @@ export async function runAlertEngineOnce(): Promise<AlertEngineRunResult> {
       const body = `Группа «${d.group.name}» (${d.group.combineMode === "any" ? "ANY" : "ALL"})\n\n${lines.join("\n")}`
       const hash = d.hits.map((h) => h.payloadHash).sort().join("|")
       const key = `group:${d.group.id}`
-      const queued = enqueueTelegramOutbox({
+      const queued = await enqueueTelegramOutbox({
         id: newOutboxId(),
         dedupeKey: `${key}:${hash}`,
         payload: {
@@ -173,18 +172,18 @@ export async function runAlertEngineOnce(): Promise<AlertEngineRunResult> {
       })
       if (!queued) continue
       groupFires += 1
-      upsertEngineState(key, firedAt, hash)
+      await upsertEngineState(key, firedAt, hash)
       state.set(key, { lastFiredAt: firedAt, lastPayloadHash: hash })
-      clearConfirmPendingAfterSend(d.members.map((r) => r.id))
+      await clearConfirmPendingAfterSend(d.members.map((r) => r.id))
     }
-    updateSourceWatermark(latestSourceFinishedAt)
+    await updateSourceWatermark(latestSourceFinishedAt)
   }
 
   const outbox = await dispatchPendingOutbox()
   errors.push(...outbox.errors)
 
   if (standaloneFires > 0 || groupFires > 0) {
-    appendEvent({
+    await appendEvent({
       level: "info",
       eventType: "alerts.engine.fired",
       sourceModule: "alerts",
@@ -197,7 +196,7 @@ export async function runAlertEngineOnce(): Promise<AlertEngineRunResult> {
     })
   }
   if (errors.length > 0) {
-    appendEvent({
+    await appendEvent({
       level: "warning",
       eventType: "alerts.engine.errors",
       sourceModule: "alerts",
diff --git a/backend/src/services/alert-engine/signal-ingestor.ts b/backend/src/services/alert-engine/signal-ingestor.ts
index 310e0c4..f651a89 100644
--- a/backend/src/services/alert-engine/signal-ingestor.ts
+++ b/backend/src/services/alert-engine/signal-ingestor.ts
@@ -1,6 +1,6 @@
 import { buildSignalSnapshotFromCollectors } from "./signals-from-collectors.js"
 
 /** Единая точка входа для подготовки сигналов к rule matching. */
-export function ingestAlertSignals() {
-  return buildSignalSnapshotFromCollectors()
+export async function ingestAlertSignals() {
+  return await buildSignalSnapshotFromCollectors()
 }
diff --git a/backend/src/services/alert-engine/signals-from-collectors.ts b/backend/src/services/alert-engine/signals-from-collectors.ts
index b8500b7..ab52d48 100644
--- a/backend/src/services/alert-engine/signals-from-collectors.ts
+++ b/backend/src/services/alert-engine/signals-from-collectors.ts
@@ -1,4 +1,4 @@
-import { sqliteDatabase } from "../../db/index.js"
+import { dbAll } from "../../db/index.js"
 import type {
   GreBgpSnapshotRunSnapshot,
   PingRunSnapshot,
@@ -20,25 +20,23 @@ function normalizeNameKey(v: string): string {
   return v.trim().toLowerCase()
 }
 
-function safeParseRunSnapshot(raw: string | null): SchedulerRunSnapshot | null {
-  if (!raw) return null
-  try {
-    return JSON.parse(raw) as SchedulerRunSnapshot
-  } catch {
-    return null
-  }
+function safeParseRunSnapshot(raw: unknown): SchedulerRunSnapshot | null {
+  const obj = typeof raw === "string" ? (() => {
+    try { return JSON.parse(raw) as unknown } catch { return null }
+  })() : raw
+  if (!obj || typeof obj !== "object") return null
+  return obj as SchedulerRunSnapshot
 }
 
-function readLatestOkRunSnapshots(jobKey: string, limit = 32): SchedulerRunSnapshot[] {
-  const rows = sqliteDatabase
-    .prepare(
-      `SELECT result_json AS resultJson
-       FROM scheduler_runs
-       WHERE job_key = ? AND status = 'ok' AND result_json IS NOT NULL
-       ORDER BY finished_at DESC
-       LIMIT ?`,
-    )
-    .all(jobKey, limit) as { resultJson: string | null }[]
+async function readLatestOkRunSnapshots(jobKey: string, limit = 32): Promise<SchedulerRunSnapshot[]> {
+  const rows = await dbAll<{ resultJson: unknown }>(
+    `SELECT result_json AS "resultJson"
+     FROM scheduler_runs
+     WHERE job_key = ? AND status = 'ok' AND result_json IS NOT NULL
+     ORDER BY finished_at DESC
+     LIMIT ?`,
+    [jobKey, limit],
+  )
   const out: SchedulerRunSnapshot[] = []
   for (const row of rows) {
     const parsed = safeParseRunSnapshot(row.resultJson)
@@ -227,13 +225,13 @@ function collectBgpSignalsFromRuns(runs: GreBgpSnapshotRunSnapshot[]): BgpPeerSi
 }
 
 /** Собирает сигналы alert_engine напрямую из результатов collector jobs (`scheduler_runs.result_json`). */
-export function buildSignalSnapshotFromCollectors(): SignalSnapshot {
+export async function buildSignalSnapshotFromCollectors(): Promise<SignalSnapshot> {
   const sampledAt = new Date().toISOString()
-  const resourceRuns = readLatestOkRunSnapshots("uptime_resources", 16) as ResourcesRunSnapshot[]
-  const restRuns = readLatestOkRunSnapshots("servers_rest_ping", 16) as ServersRestPingRunSnapshot[]
-  const pingRuns = readLatestOkRunSnapshots("uptime_ping", 24) as PingRunSnapshot[]
-  const trafficRuns = readLatestOkRunSnapshots("traffic", 8) as TrafficRunSnapshot[]
-  const greBgpRuns = readLatestOkRunSnapshots("gre_bgp", 8) as GreBgpSnapshotRunSnapshot[]
+  const resourceRuns = await readLatestOkRunSnapshots("uptime_resources", 16) as ResourcesRunSnapshot[]
+  const restRuns = await readLatestOkRunSnapshots("servers_rest_ping", 16) as ServersRestPingRunSnapshot[]
+  const pingRuns = await readLatestOkRunSnapshots("uptime_ping", 24) as PingRunSnapshot[]
+  const trafficRuns = await readLatestOkRunSnapshots("traffic", 8) as TrafficRunSnapshot[]
+  const greBgpRuns = await readLatestOkRunSnapshots("gre_bgp", 8) as GreBgpSnapshotRunSnapshot[]
 
   const resourceByKey = collectServerSignalsFromResourceRuns(resourceRuns)
   const restByKey = collectServerSignalsFromRestRuns(restRuns)
diff --git a/backend/src/services/alert-engine/snapshot.ts b/backend/src/services/alert-engine/snapshot.ts
index f6fcff6..948cd50 100644
--- a/backend/src/services/alert-engine/snapshot.ts
+++ b/backend/src/services/alert-engine/snapshot.ts
@@ -2,6 +2,6 @@ import { buildSignalSnapshotFromCollectors } from "./signals-from-collectors.js"
 import type { SignalSnapshot } from "./types.js"
 
 /** Legacy-совместимость: единый источник сигналов — collector snapshots из scheduler_runs. */
-export function buildSignalSnapshot(): SignalSnapshot {
-  return buildSignalSnapshotFromCollectors()
+export async function buildSignalSnapshot(): Promise<SignalSnapshot> {
+  return await buildSignalSnapshotFromCollectors()
 }
diff --git a/backend/src/services/alert-engine/source-watermark.ts b/backend/src/services/alert-engine/source-watermark.ts
index b56528c..0ff9a64 100644
--- a/backend/src/services/alert-engine/source-watermark.ts
+++ b/backend/src/services/alert-engine/source-watermark.ts
@@ -11,44 +11,40 @@ const SOURCE_JOBS = [
   "gre_bgp",
 ] as const
 
-export function getLatestSourceFinishedAt(): string | null {
-  const row = db
+export async function getLatestSourceFinishedAt(): Promise<string | null> {
+  const row = (await db
     .select({ finishedAt: schedulerRuns.finishedAt })
     .from(schedulerRuns)
     .where(inArray(schedulerRuns.jobKey, [...SOURCE_JOBS]))
     .orderBy(desc(schedulerRuns.finishedAt))
-    .limit(1)
-    .all()[0]
+    .limit(1))[0]
   return row?.finishedAt ?? null
 }
 
-export function getSourceWatermark(): string | null {
-  const row = db.select().from(alertEngineCursor).where(eq(alertEngineCursor.id, 1)).limit(1).all()[0]
+export async function getSourceWatermark(): Promise<string | null> {
+  const row = (await db.select().from(alertEngineCursor).where(eq(alertEngineCursor.id, 1)).limit(1))[0]
   return row?.lastSourceFinishedAt ?? null
 }
 
-export function updateSourceWatermark(lastSourceFinishedAt: string | null): void {
-  const existing = db
+export async function updateSourceWatermark(lastSourceFinishedAt: string | null): Promise<void> {
+  const existing = (await db
     .select()
     .from(alertEngineCursor)
     .where(eq(alertEngineCursor.id, 1))
-    .limit(1)
-    .all()[0]
+    .limit(1))[0]
   if (existing) {
-    db.update(alertEngineCursor)
+    await db.update(alertEngineCursor)
       .set({
         lastSourceFinishedAt,
         updatedAt: new Date().toISOString(),
       })
       .where(eq(alertEngineCursor.id, 1))
-      .run()
     return
   }
-  db.insert(alertEngineCursor)
+  await db.insert(alertEngineCursor)
     .values({
       id: 1,
       lastSourceFinishedAt,
       updatedAt: new Date().toISOString(),
     })
-    .run()
 }
diff --git a/backend/src/services/alerts-service.ts b/backend/src/services/alerts-service.ts
index 41556ce..e147e8b 100644
--- a/backend/src/services/alerts-service.ts
+++ b/backend/src/services/alerts-service.ts
@@ -1,5 +1,5 @@
 import { asc, desc, eq, sql } from "drizzle-orm"
-import { db, sqliteDatabase } from "../db/index.js"
+import { db, dbAll } from "../db/index.js"
 import {
   alertGroups,
   alertHistory,
@@ -55,24 +55,22 @@ export type ApiAlertHistoryEntry = {
   source: "db" | "live"
 }
 
-function ensureTelegramRow() {
-  let row = db.select().from(alertTelegramSettings).where(eq(alertTelegramSettings.id, 1)).limit(1).all()[0]
+async function ensureTelegramRow() {
+  let row = (await db.select().from(alertTelegramSettings).where(eq(alertTelegramSettings.id, 1)).limit(1))[0]
   if (!row) {
-    db.insert(alertTelegramSettings).values({ id: 1 }).run()
-    row = db.select().from(alertTelegramSettings).where(eq(alertTelegramSettings.id, 1)).limit(1).all()[0]
+    await db.insert(alertTelegramSettings).values({ id: 1 })
+    row = (await db.select().from(alertTelegramSettings).where(eq(alertTelegramSettings.id, 1)).limit(1))[0]
   }
   return row!
 }
 
-function lastFiredByRuleId(): Map<string, string> {
-  const rows = sqliteDatabase
-    .prepare(
-      `SELECT rule_id AS ruleId, MAX(fired_at) AS mx
-       FROM alert_history
-       WHERE rule_id IS NOT NULL AND rule_id != ''
-       GROUP BY rule_id`,
-    )
-    .all() as { ruleId: string; mx: string }[]
+async function lastFiredByRuleId(): Promise<Map<string, string>> {
+  const rows = await dbAll<{ ruleId: string; mx: string }>(
+    `SELECT rule_id AS "ruleId", MAX(fired_at) AS mx
+     FROM alert_history
+     WHERE rule_id IS NOT NULL AND rule_id != ''
+     GROUP BY rule_id`,
+  )
   const m = new Map<string, string>()
   for (const r of rows) {
     if (r.ruleId && r.mx) m.set(r.ruleId, r.mx)
@@ -80,12 +78,11 @@ function lastFiredByRuleId(): Map<string, string> {
   return m
 }
 
-function targetsByRuleId(): Map<string, string[]> {
-  const rows = db
+async function targetsByRuleId(): Promise<Map<string, string[]>> {
+  const rows = await db
     .select()
     .from(alertRuleTargets)
     .orderBy(asc(alertRuleTargets.sortIndex), asc(alertRuleTargets.id))
-    .all()
   const m = new Map<string, string[]>()
   for (const t of rows) {
     const rid = t.ruleId
@@ -96,12 +93,11 @@ function targetsByRuleId(): Map<string, string[]> {
   return m
 }
 
-function conditionsByRuleId(): Map<string, string[]> {
-  const rows = db
+async function conditionsByRuleId(): Promise<Map<string, string[]>> {
+  const rows = await db
     .select()
     .from(alertRuleConditions)
     .orderBy(asc(alertRuleConditions.sortIndex), asc(alertRuleConditions.id))
-    .all()
   const m = new Map<string, string[]>()
   for (const t of rows) {
     const rid = t.ruleId
@@ -112,26 +108,25 @@ function conditionsByRuleId(): Map<string, string[]> {
   return m
 }
 
-export function listAlertGroups(): ApiAlertGroup[] {
-  return db
+export async function listAlertGroups(): Promise<ApiAlertGroup[]> {
+  const rows = await db
     .select()
     .from(alertGroups)
     .orderBy(asc(alertGroups.name))
-    .all()
-    .map((g) => ({
-      id: g.id,
-      name: g.name,
-      combineMode: g.combineMode,
-      enabled: g.enabled,
-      cooldownOverride: g.cooldownOverride ?? null,
-    }))
+  return rows.map((g) => ({
+    id: g.id,
+    name: g.name,
+    combineMode: g.combineMode,
+    enabled: g.enabled,
+    cooldownOverride: g.cooldownOverride ?? null,
+  }))
 }
 
-export function listAlertRules(): ApiAlertRule[] {
-  const lf = lastFiredByRuleId()
-  const tgtMap = targetsByRuleId()
-  const condMap = conditionsByRuleId()
-  const rows = db.select().from(alertRules).all()
+export async function listAlertRules(): Promise<ApiAlertRule[]> {
+  const lf = await lastFiredByRuleId()
+  const tgtMap = await targetsByRuleId()
+  const condMap = await conditionsByRuleId()
+  const rows = await db.select().from(alertRules)
   return rows.map((r) => {
     const targets = tgtMap.get(r.id)
     const ts = targets?.length ? targets : [r.target]
@@ -207,23 +202,23 @@ export type ReplaceAlertGroupInput = {
 }
 
 /** Атомарно заменяет группы, правила и строки targets. */
-export function replaceAlertsConfig(payload: { groups: ReplaceAlertGroupInput[]; rules: ReplaceAlertRuleInput[] }) {
-  const now = sql`(datetime('now'))`
+export async function replaceAlertsConfig(payload: { groups: ReplaceAlertGroupInput[]; rules: ReplaceAlertRuleInput[] }) {
+  const now = sql`now()`
   const { groups, rules } = payload
-  db.transaction((tx) => {
-    tx.delete(alertRuleConditions).run()
-    tx.delete(alertRuleTargets).run()
-    tx.delete(alertRules).run()
-    tx.delete(alertGroups).run()
+  await db.transaction(async (tx) => {
+    await tx.delete(alertRuleConditions)
+    await tx.delete(alertRuleTargets)
+    await tx.delete(alertRules)
+    await tx.delete(alertGroups)
     for (const g of groups) {
-      tx.insert(alertGroups).values({
+      await tx.insert(alertGroups).values({
         id: g.id,
         name: g.name.trim() || g.id,
         combineMode: g.combineMode,
         enabled: g.enabled,
         cooldownOverride: g.cooldownOverride ?? null,
         updatedAt: now,
-      }).run()
+      })
     }
     for (const r of rules) {
       const rawTargets =
@@ -250,7 +245,7 @@ export function replaceAlertsConfig(payload: { groups: ReplaceAlertGroupInput[];
         r.recoveryStabilitySec > 0
           ? Math.min(86400, Math.max(1, Math.floor(r.recoveryStabilitySec)))
           : null
-      tx.insert(alertRules).values({
+      await tx.insert(alertRules).values({
         id: r.id,
         name: r.name,
         type: r.type,
@@ -265,39 +260,39 @@ export function replaceAlertsConfig(payload: { groups: ReplaceAlertGroupInput[];
         chatId: r.chatId ?? "",
         groupId: r.groupId && r.groupId.trim() ? r.groupId.trim() : null,
         updatedAt: now,
-      }).run()
-      rawTargets.forEach((t, i) => {
-        tx.insert(alertRuleTargets).values({
+      })
+      for (const [i, t] of rawTargets.entries()) {
+        await tx.insert(alertRuleTargets).values({
           id: `rt-${r.id}-${i}`,
           ruleId: r.id,
           target: t,
           sortIndex: i,
-        }).run()
-      })
-      rawConds.forEach((c, i) => {
-        tx.insert(alertRuleConditions).values({
+        })
+      }
+      for (const [i, c] of rawConds.entries()) {
+        await tx.insert(alertRuleConditions).values({
           id: `rc-${r.id}-${i}`,
           ruleId: r.id,
           conditionLine: c,
           sortIndex: i,
-        }).run()
-      })
+        })
+      }
     }
   })
 }
 
 /** Совместимость: только правила, группы не трогаем. */
-export function replaceAlertRules(rules: ReplaceAlertRuleInput[]) {
-  const curGroups = listAlertGroups()
-  replaceAlertsConfig({ groups: curGroups.map((g) => ({ ...g })), rules })
+export async function replaceAlertRules(rules: ReplaceAlertRuleInput[]) {
+  const curGroups = await listAlertGroups()
+  await replaceAlertsConfig({ groups: curGroups.map((g) => ({ ...g })), rules })
 }
 
-export function getTelegramSettingsRow() {
-  return ensureTelegramRow()
+export async function getTelegramSettingsRow() {
+  return await ensureTelegramRow()
 }
 
-export function getTelegramPublic() {
-  const row = ensureTelegramRow()
+export async function getTelegramPublic() {
+  const row = await ensureTelegramRow()
   const tid = row.messageThreadId
   const messageThreadId =
     typeof tid === "number" && Number.isFinite(tid) && Math.floor(tid) >= 1 ? Math.floor(tid) : null
@@ -308,13 +303,13 @@ export function getTelegramPublic() {
   }
 }
 
-export function updateTelegramSettings(patch: {
+export async function updateTelegramSettings(patch: {
   token?: string | null
   chatId?: string | undefined
   /** undefined — не менять; null — сбросить тему */
   messageThreadId?: number | null
 }) {
-  const cur = ensureTelegramRow()
+  const cur = await ensureTelegramRow()
   let nextToken = cur.botToken
   let nextChat = cur.chatId ?? ""
   let nextThread: number | null | undefined = undefined
@@ -335,27 +330,26 @@ export function updateTelegramSettings(patch: {
   const base = {
     botToken: nextToken,
     chatId: nextChat,
-    updatedAt: sql`(datetime('now'))`,
+    updatedAt: sql`now()`,
   }
   if (nextThread !== undefined) {
-    db.update(alertTelegramSettings)
+    await db.update(alertTelegramSettings)
       .set({ ...base, messageThreadId: nextThread })
       .where(eq(alertTelegramSettings.id, 1))
-      .run()
   } else {
-    db.update(alertTelegramSettings).set(base).where(eq(alertTelegramSettings.id, 1)).run()
+    await db.update(alertTelegramSettings).set(base).where(eq(alertTelegramSettings.id, 1))
   }
-  return getTelegramPublic()
+  return await getTelegramPublic()
 }
 
 /** Токен только для внутреннего вызова Telegram API (не отдаётся клиенту). */
-export function getTelegramBotToken(): string {
-  return ensureTelegramRow().botToken?.trim() ?? ""
+export async function getTelegramBotToken(): Promise<string> {
+  return (await ensureTelegramRow()).botToken?.trim() ?? ""
 }
 
 /** Для `sendMessage`: только если в БД задана валидная тема. */
-export function getTelegramMessageThreadIdForApi(): number | undefined {
-  const { messageThreadId } = getTelegramPublic()
+export async function getTelegramMessageThreadIdForApi(): Promise<number | undefined> {
+  const { messageThreadId } = await getTelegramPublic()
   return messageThreadId ?? undefined
 }
 
@@ -390,9 +384,9 @@ export async function sendTelegramAlertMessage(opts: {
   /** Переопределение темы; undefined — как в настройках */
   messageThreadId?: number | null
 }): Promise<{ ok: true } | { ok: false; error: string }> {
-  const token = (opts.token?.trim() || getTelegramBotToken()).trim()
+  const token = (opts.token?.trim() || await getTelegramBotToken()).trim()
   if (!token) return { ok: false, error: "Не задан Bot Token" }
-  const pub = getTelegramPublic()
+  const pub = await getTelegramPublic()
   const chatId = (opts.chatId?.trim() || pub.chatId || "").trim()
   if (!chatId) return { ok: false, error: "Не задан Chat ID" }
   const threadId =
@@ -400,7 +394,7 @@ export async function sendTelegramAlertMessage(opts: {
       ? opts.messageThreadId >= 1
         ? Math.floor(opts.messageThreadId)
         : undefined
-      : getTelegramMessageThreadIdForApi()
+      : await getTelegramMessageThreadIdForApi()
   const url = `https://api.telegram.org/bot${encodeURIComponent(token)}/sendMessage`
   try {
     const payload: { chat_id: string; text: string; message_thread_id?: number } = {
@@ -423,7 +417,7 @@ export async function sendTelegramAlertMessage(opts: {
   }
 }
 
-export function appendAlertHistory(entry: {
+export async function appendAlertHistory(entry: {
   id: string
   ruleId?: string | null
   groupId?: string | null
@@ -434,7 +428,7 @@ export function appendAlertHistory(entry: {
   firedAt?: string
 }) {
   const firedAt = entry.firedAt ?? new Date().toISOString()
-  db.insert(alertHistory)
+  await db.insert(alertHistory)
     .values({
       id: entry.id,
       ruleId: entry.ruleId ?? null,
@@ -445,7 +439,6 @@ export function appendAlertHistory(entry: {
       sentOk: entry.sentOk,
       firedAt,
     })
-    .run()
 }
 
 interface LiveResRow {
@@ -462,38 +455,38 @@ interface LiveProbeRow {
   lossPct: number | null
 }
 
-function loadLiveResourceIssues(): LiveResRow[] {
-  return sqliteDatabase
-    .prepare(
-      `SELECT s.name AS serverName, urs.sampled_at AS sampledAt
-       FROM uptime_resource_samples urs
-       INNER JOIN (
-         SELECT server_id, MAX(id) AS mid FROM uptime_resource_samples GROUP BY server_id
-       ) latest ON latest.mid = urs.id
-       INNER JOIN servers s ON s.id = urs.server_id
-       WHERE urs.status = 'offline'`,
-    )
-    .all() as LiveResRow[]
+async function loadLiveResourceIssues(): Promise<LiveResRow[]> {
+  return dbAll<LiveResRow>(
+    `SELECT s.name AS "serverName", urs.sampled_at AS "sampledAt"
+     FROM uptime_resource_samples urs
+     INNER JOIN (
+       SELECT DISTINCT ON (server_id) server_id, sampled_at, status
+       FROM uptime_resource_samples
+       ORDER BY server_id, sampled_at DESC
+     ) latest ON latest.server_id = urs.server_id AND latest.sampled_at = urs.sampled_at
+     INNER JOIN servers s ON s.id = urs.server_id
+     WHERE urs.status = 'offline'`,
+  )
 }
 
-function loadLiveProbeIssues(): LiveProbeRow[] {
-  return sqliteDatabase
-    .prepare(
-      `SELECT p.name AS probeName, p.target AS target, ups.sampled_at AS sampledAt,
-              ups.status AS status, ups.rtt_ms AS rttMs, ups.loss_pct AS lossPct
-       FROM uptime_probe_samples ups
-       INNER JOIN (
-         SELECT probe_id, MAX(id) AS mid FROM uptime_probe_samples GROUP BY probe_id
-       ) latest ON latest.mid = ups.id
-       INNER JOIN uptime_probes p ON p.id = ups.probe_id
-       WHERE ups.status IN ('down', 'warn')`,
-    )
-    .all() as LiveProbeRow[]
+async function loadLiveProbeIssues(): Promise<LiveProbeRow[]> {
+  return dbAll<LiveProbeRow>(
+    `SELECT p.name AS "probeName", p.target AS target, ups.sampled_at AS "sampledAt",
+            ups.status AS status, ups.rtt_ms AS "rttMs", ups.loss_pct AS "lossPct"
+     FROM uptime_probe_samples ups
+     INNER JOIN (
+       SELECT DISTINCT ON (probe_id) probe_id, sampled_at, status, rtt_ms, loss_pct
+       FROM uptime_probe_samples
+       ORDER BY probe_id, sampled_at DESC
+     ) latest ON latest.probe_id = ups.probe_id AND latest.sampled_at = ups.sampled_at
+     INNER JOIN uptime_probes p ON p.id = ups.probe_id
+     WHERE ups.status IN ('down', 'warn')`,
+  )
 }
 
-function toLiveHistoryEntries(): ApiAlertHistoryEntry[] {
+async function toLiveHistoryEntries(): Promise<ApiAlertHistoryEntry[]> {
   const out: ApiAlertHistoryEntry[] = []
-  for (const r of loadLiveResourceIssues()) {
+  for (const r of await loadLiveResourceIssues()) {
     const safeId = `live-res-${r.serverName}-${r.sampledAt}`.replace(/[^a-zA-Z0-9._-]+/g, "_")
     out.push({
       id: safeId,
@@ -505,7 +498,7 @@ function toLiveHistoryEntries(): ApiAlertHistoryEntry[] {
       source: "live",
     })
   }
-  for (const p of loadLiveProbeIssues()) {
+  for (const p of await loadLiveProbeIssues()) {
     const sev = p.status === "down" ? "critical" : "warning"
     const loss = p.lossPct != null ? `${p.lossPct}%` : "—"
     const rtt = p.rttMs != null ? `${p.rttMs} мс` : "—"
@@ -523,13 +516,12 @@ function toLiveHistoryEntries(): ApiAlertHistoryEntry[] {
   return out
 }
 
-export function listPersistedHistory(limit: number): ApiAlertHistoryEntry[] {
-  const rows = db
+export async function listPersistedHistory(limit: number): Promise<ApiAlertHistoryEntry[]> {
+  const rows = await db
     .select()
     .from(alertHistory)
     .orderBy(desc(alertHistory.firedAt))
     .limit(limit)
-    .all()
   return rows.map((h) => ({
     id: h.id,
     ruleName: h.ruleName,
@@ -541,9 +533,9 @@ export function listPersistedHistory(limit: number): ApiAlertHistoryEntry[] {
   }))
 }
 
-export function listMergedHistory(persistLimit = 40, liveCap = 25): ApiAlertHistoryEntry[] {
-  const persisted = listPersistedHistory(persistLimit)
-  const live = toLiveHistoryEntries().slice(0, liveCap)
+export async function listMergedHistory(persistLimit = 40, liveCap = 25): Promise<ApiAlertHistoryEntry[]> {
+  const persisted = await listPersistedHistory(persistLimit)
+  const live = (await toLiveHistoryEntries()).slice(0, liveCap)
   const merged = [...persisted, ...live].sort((a, b) => (a.firedAt < b.firedAt ? 1 : a.firedAt > b.firedAt ? -1 : 0))
   const seen = new Set<string>()
   const dedup: ApiAlertHistoryEntry[] = []
@@ -556,8 +548,8 @@ export function listMergedHistory(persistLimit = 40, liveCap = 25): ApiAlertHist
   return dedup
 }
 
-export function getAlertsMeta() {
-  const srvRows = db
+export async function getAlertsMeta() {
+  const srvRows = await db
     .select({
       name: servers.name,
       host: servers.host,
@@ -566,7 +558,6 @@ export function getAlertsMeta() {
       type: servers.type,
     })
     .from(servers)
-    .all()
   const labels = srvRows.map((s) => (s.name?.trim() ? s.name.trim() : s.host))
   const serversDetail = srvRows.map((r) => ({
     name: r.name?.trim() || "",
@@ -575,7 +566,7 @@ export function getAlertsMeta() {
     country: r.country?.trim() || "",
     type: (r.type ?? "home-router") as string,
   }))
-  const probes = db.select({ name: uptimeProbes.name, target: uptimeProbes.target }).from(uptimeProbes).all()
+  const probes = await db.select({ name: uptimeProbes.name, target: uptimeProbes.target }).from(uptimeProbes)
   const probeTargets = probes.map((p) => `${p.name} → ${p.target}`)
   const defaults = ["8.8.8.8", "1.1.1.1"]
   const rttLossTargets: string[] = []
diff --git a/backend/src/services/backup-scheduler-collector.ts b/backend/src/services/backup-scheduler-collector.ts
index 941144c..d8af2f7 100644
--- a/backend/src/services/backup-scheduler-collector.ts
+++ b/backend/src/services/backup-scheduler-collector.ts
@@ -18,7 +18,7 @@ export function getBackupSchedulerCollectorState(): { running: boolean } {
 
 export async function collectScheduledBackupsOnce(): Promise<BackupsRunSnapshot> {
   const sampledAt = new Date().toISOString()
-  const settings = getBackupScheduleSettings()
+  const settings = await getBackupScheduleSettings()
   const snapshot: BackupsRunSnapshot = {
     v: SCHEDULER_RUN_SNAPSHOT_VERSION,
     job: "backups",
@@ -49,7 +49,7 @@ export async function collectScheduledBackupsOnce(): Promise<BackupsRunSnapshot>
   if (settings.format !== "rsc") {
     snapshot.skipped = true
     snapshot.errors = ["Формат backup пока не поддерживается, используйте rsc"]
-    touchBackupScheduleRunMeta({
+    await touchBackupScheduleRunMeta({
       lastRunAt: sampledAt,
       lastDurationMs: 0,
       lastError: snapshot.errors[0],
@@ -59,9 +59,9 @@ export async function collectScheduledBackupsOnce(): Promise<BackupsRunSnapshot>
 
   collecting = true
   const started = Date.now()
-  const serverIds = resolveBackupServerIds(settings)
+  const serverIds = await resolveBackupServerIds(settings)
 
-  appendEvent({
+  await appendEvent({
     level: "info",
     eventType: "backups.job.started",
     sourceModule: "backups",
@@ -88,13 +88,13 @@ export async function collectScheduledBackupsOnce(): Promise<BackupsRunSnapshot>
       snapshot.pruned += await pruneBackupsForServer(id, settings.keepCount)
     }
 
-    touchBackupScheduleRunMeta({
+    await touchBackupScheduleRunMeta({
       lastRunAt: sampledAt,
       lastDurationMs: Date.now() - started,
       lastError: snapshot.errors?.length ? snapshot.errors.join("; ") : null,
     })
 
-    appendEvent({
+    await appendEvent({
       level: snapshot.failures > 0 ? "warning" : "info",
       eventType: "backups.job.done",
       sourceModule: "backups",
@@ -115,12 +115,12 @@ export async function collectScheduledBackupsOnce(): Promise<BackupsRunSnapshot>
     const message = e instanceof Error ? e.message : String(e)
     snapshot.fatalError = message
     snapshot.errors?.push(message)
-    touchBackupScheduleRunMeta({
+    await touchBackupScheduleRunMeta({
       lastRunAt: sampledAt,
       lastDurationMs: Date.now() - started,
       lastError: message,
     })
-    appendEvent({
+    await appendEvent({
       level: "critical",
       eventType: "backups.job.failed",
       sourceModule: "backups",
diff --git a/backend/src/services/backup-service.ts b/backend/src/services/backup-service.ts
index df89ed8..59f1350 100644
--- a/backend/src/services/backup-service.ts
+++ b/backend/src/services/backup-service.ts
@@ -4,6 +4,7 @@ import path from "node:path"
 import { desc, eq } from "drizzle-orm"
 import type { BackupScheduleSettingsDto } from "@mmapp/contracts/backups"
 import { db } from "../db/index.js"
+import { parseJsonArray } from "../db/json.js"
 import { backupEntries, backupScheduleSettings } from "../db/schema.js"
 import { getServerRowById } from "../modules/servers/repository/servers-repository.js"
 import { listServersRead } from "../modules/servers/service/servers-service.js"
@@ -14,7 +15,7 @@ const BACKUPS_DIR = path.resolve(process.cwd(), "storage", "backups")
 
 export type BackupMeta = {
   id: string
-  serverId: string
+  serverId: number | null
   serverName: string
   filename: string
   sizeBytes: number
@@ -40,17 +41,18 @@ export async function ensureBackupStorage(): Promise<void> {
   await mkdir(BACKUPS_DIR, { recursive: true })
 }
 
-export function listBackups(): BackupMeta[] {
-  return db.select().from(backupEntries).orderBy(desc(backupEntries.createdAt)).all().map(rowToMeta)
+export async function listBackups(): Promise<BackupMeta[]> {
+  const rows = await db.select().from(backupEntries).orderBy(desc(backupEntries.createdAt))
+  return rows.map(rowToMeta)
 }
 
-export function getBackupById(id: string): BackupMeta | null {
-  const row = db.select().from(backupEntries).where(eq(backupEntries.id, id)).limit(1).all()[0]
+export async function getBackupById(id: string): Promise<BackupMeta | null> {
+  const row = (await db.select().from(backupEntries).where(eq(backupEntries.id, id)).limit(1))[0]
   return row ? rowToMeta(row) : null
 }
 
-export function insertBackup(meta: BackupMeta): void {
-  db.insert(backupEntries).values({
+export async function insertBackup(meta: BackupMeta): Promise<void> {
+  await db.insert(backupEntries).values({
     id: meta.id,
     serverId: meta.serverId,
     serverName: meta.serverName,
@@ -59,13 +61,13 @@ export function insertBackup(meta: BackupMeta): void {
     kind: meta.kind,
     notes: meta.notes ?? null,
     createdAt: meta.createdAt,
-  }).run()
+  })
 }
 
 export async function deleteBackupRecord(id: string): Promise<BackupMeta | null> {
-  const hit = getBackupById(id)
+  const hit = await getBackupById(id)
   if (!hit) return null
-  db.delete(backupEntries).where(eq(backupEntries.id, id)).run()
+  await db.delete(backupEntries).where(eq(backupEntries.id, id))
   await rm(path.join(BACKUPS_DIR, hit.filename), { force: true })
   return hit
 }
@@ -75,18 +77,12 @@ function fmtTs(d = new Date()): string {
   return `${d.getFullYear()}-${p(d.getMonth() + 1)}-${p(d.getDate())}_${p(d.getHours())}-${p(d.getMinutes())}-${p(d.getSeconds())}`
 }
 
-function parseServerIds(raw: string): string[] {
-  try {
-    const parsed = JSON.parse(raw) as unknown
-    if (!Array.isArray(parsed)) return []
-    return parsed.map(String).filter(Boolean)
-  } catch {
-    return []
-  }
+function parseServerIds(raw: unknown): string[] {
+  return parseJsonArray(raw).map(String).filter(Boolean)
 }
 
-function getBackupScheduleSettingsRow() {
-  return db.select().from(backupScheduleSettings).where(eq(backupScheduleSettings.id, SETTINGS_ID)).limit(1).all()[0]
+async function getBackupScheduleSettingsRow() {
+  return (await db.select().from(backupScheduleSettings).where(eq(backupScheduleSettings.id, SETTINGS_ID)).limit(1))[0]
     ?? {
       id: SETTINGS_ID,
       enabled: true,
@@ -97,7 +93,7 @@ function getBackupScheduleSettingsRow() {
       monthDay: 1,
       keepCount: 7,
       format: "rsc" as const,
-      serverIdsJson: "[]",
+      serverIdsJson: [],
       lastRunAt: null,
       lastDurationMs: null,
       lastError: null,
@@ -105,8 +101,8 @@ function getBackupScheduleSettingsRow() {
     }
 }
 
-export function getBackupScheduleSettings(): BackupScheduleSettingsDto {
-  const row = getBackupScheduleSettingsRow()
+export async function getBackupScheduleSettings(): Promise<BackupScheduleSettingsDto> {
+  const row = await getBackupScheduleSettingsRow()
   return {
     enabled: row.enabled,
     frequency: row.frequency,
@@ -124,7 +120,7 @@ export function getBackupScheduleSettings(): BackupScheduleSettingsDto {
   }
 }
 
-export function updateBackupScheduleSettings(patch: Partial<{
+export async function updateBackupScheduleSettings(patch: Partial<{
   enabled: boolean
   frequency: "daily" | "weekly" | "monthly"
   hour: number
@@ -135,7 +131,7 @@ export function updateBackupScheduleSettings(patch: Partial<{
   format: "rsc" | "backup"
   serverIds: string[]
 }>) {
-  const prev = getBackupScheduleSettingsRow()
+  const prev = await getBackupScheduleSettingsRow()
   const now = new Date().toISOString()
   const next = {
     enabled: patch.enabled ?? prev.enabled,
@@ -146,33 +142,33 @@ export function updateBackupScheduleSettings(patch: Partial<{
     monthDay: patch.monthDay ?? prev.monthDay,
     keepCount: patch.keepCount ?? prev.keepCount,
     format: patch.format ?? prev.format,
-    serverIdsJson: patch.serverIds ? JSON.stringify(patch.serverIds) : prev.serverIdsJson,
+    serverIdsJson: patch.serverIds ?? prev.serverIdsJson,
     updatedAt: now,
   }
-  if (db.select().from(backupScheduleSettings).where(eq(backupScheduleSettings.id, SETTINGS_ID)).limit(1).all()[0]) {
-    db.update(backupScheduleSettings).set(next).where(eq(backupScheduleSettings.id, SETTINGS_ID)).run()
+  if ((await db.select().from(backupScheduleSettings).where(eq(backupScheduleSettings.id, SETTINGS_ID)).limit(1))[0]) {
+    await db.update(backupScheduleSettings).set(next).where(eq(backupScheduleSettings.id, SETTINGS_ID))
   } else {
-    db.insert(backupScheduleSettings).values({ id: SETTINGS_ID, ...next }).run()
+    await db.insert(backupScheduleSettings).values({ id: SETTINGS_ID, ...next })
   }
-  return getBackupScheduleSettings()
+  return await getBackupScheduleSettings()
 }
 
-export function touchBackupScheduleRunMeta(patch: {
+export async function touchBackupScheduleRunMeta(patch: {
   lastRunAt?: string
   lastDurationMs?: number
   lastError?: string | null
 }) {
-  const prev = getBackupScheduleSettingsRow()
-  db.update(backupScheduleSettings).set({
+  const prev = await getBackupScheduleSettingsRow()
+  await db.update(backupScheduleSettings).set({
     lastRunAt: patch.lastRunAt ?? prev.lastRunAt,
     lastDurationMs: patch.lastDurationMs ?? prev.lastDurationMs,
     lastError: patch.lastError === undefined ? prev.lastError : patch.lastError,
     updatedAt: new Date().toISOString(),
-  }).where(eq(backupScheduleSettings.id, SETTINGS_ID)).run()
+  }).where(eq(backupScheduleSettings.id, SETTINGS_ID))
 }
 
-export function resolveBackupServerIds(settings: BackupScheduleSettingsDto): string[] {
-  const enabled = new Set(listServersRead().map((s) => String(s.id)))
+export async function resolveBackupServerIds(settings: BackupScheduleSettingsDto): Promise<string[]> {
+  const enabled = new Set((await listServersRead()).map((s) => String(s.id)))
   const requested = settings.serverIds.length > 0 ? settings.serverIds : [...enabled]
   return [...new Set(requested)].filter((id) => enabled.has(id))
 }
@@ -227,7 +223,7 @@ export async function runBackupForServer(
   if (!Number.isFinite(serverIdNum)) {
     throw new Error("Невалидный id сервера")
   }
-  const row = getServerRowById(serverIdNum)
+  const row = await getServerRowById(serverIdNum)
   if (!row) {
     throw new Error("Сервер не найден")
   }
@@ -242,7 +238,7 @@ export async function runBackupForServer(
   const st = await stat(filePath)
   const meta: BackupMeta = {
     id: randomUUID(),
-    serverId: String(row.id),
+    serverId: row.id,
     serverName: row.name,
     filename,
     sizeBytes: st.size,
@@ -250,19 +246,18 @@ export async function runBackupForServer(
     kind,
     notes,
   }
-  insertBackup(meta)
+  await insertBackup(meta)
   return meta
 }
 
 export async function pruneBackupsForServer(serverId: string, keepCount: number): Promise<number> {
-  const rows = db.select().from(backupEntries)
-    .where(eq(backupEntries.serverId, serverId))
+  const rows = await db.select().from(backupEntries)
+    .where(eq(backupEntries.serverId, Number(serverId)))
     .orderBy(desc(backupEntries.createdAt))
-    .all()
   if (rows.length <= keepCount) return 0
   const toDelete = rows.slice(keepCount)
   for (const hit of toDelete) {
-    db.delete(backupEntries).where(eq(backupEntries.id, hit.id)).run()
+    await db.delete(backupEntries).where(eq(backupEntries.id, hit.id))
     await rm(path.join(BACKUPS_DIR, hit.filename), { force: true })
   }
   return toDelete.length
diff --git a/backend/src/services/bgp-peers-live.ts b/backend/src/services/bgp-peers-live.ts
index 651101b..baea31c 100644
--- a/backend/src/services/bgp-peers-live.ts
+++ b/backend/src/services/bgp-peers-live.ts
@@ -14,7 +14,7 @@ export function bgpPeerAlertKey(s: BgpSessionRead): string {
 
 /** Агрегат BGP-сессий с включённых серверов — как `/api/bgp/sessions`. */
 export async function fetchBgpSessionsForAlerts(): Promise<BgpSessionRead[]> {
-  const allServers = db.select().from(servers).where(eq(servers.enabled, true)).all()
+  const allServers = await db.select().from(servers).where(eq(servers.enabled, true))
   const results = await Promise.all(
     allServers.map(async (server) => {
       try {
diff --git a/backend/src/services/certificate-issue-runner.ts b/backend/src/services/certificate-issue-runner.ts
index 86e6959..698b0d7 100644
--- a/backend/src/services/certificate-issue-runner.ts
+++ b/backend/src/services/certificate-issue-runner.ts
@@ -1,3 +1,4 @@
+import { parseJsonArray } from "../db/json.js"
 import { appendEvent } from "../modules/events/service/events-service.js"
 import { issueCertificateWithCloudflareDns } from "./acme-cloudflare.js"
 import {
@@ -11,15 +12,15 @@ const runningJobs = new Set<string>()
 export async function runCertificateIssueJob(jobId: string): Promise<void> {
   if (runningJobs.has(jobId)) return
   runningJobs.add(jobId)
-  const row = getIssueJobRecord(jobId)
+  const row = await getIssueJobRecord(jobId)
   if (!row) {
     runningJobs.delete(jobId)
     return
   }
 
-  const server = getServerRowByIdString(row.serverId)
+  const server = await getServerRowByIdString(row.serverId)
   if (!server) {
-    updateIssueJobRecord(jobId, {
+    await updateIssueJobRecord(jobId, {
       status: "failed",
       step: "failed",
       finishedAt: new Date().toISOString(),
@@ -29,20 +30,15 @@ export async function runCertificateIssueJob(jobId: string): Promise<void> {
     return
   }
 
-  let domainNames: string[] = []
-  try {
-    domainNames = JSON.parse(row.domainNames) as string[]
-  } catch {
-    domainNames = []
-  }
+  const domainNames = parseJsonArray(row.domainNames).map(String)
 
   const trustStore = row.trustStore.split(",").map((s) => s.trim()).filter(Boolean)
   const startedAt = new Date().toISOString()
   const isScheduler = row.source === "scheduler"
-  updateIssueJobRecord(jobId, { status: "running", step: "acme_order", startedAt, error: null })
+  await updateIssueJobRecord(jobId, { status: "running", step: "acme_order", startedAt, error: null })
 
   if (isScheduler) {
-    appendEvent({
+    await appendEvent({
       level: "info",
       eventType: "certificates.renew.started",
       sourceModule: "certificates",
@@ -60,15 +56,15 @@ export async function runCertificateIssueJob(jobId: string): Promise<void> {
       domainNames,
       keyType: row.keyType === "ec256" ? "ec256" : "rsa2048",
       trustStore: trustStore.length > 0 ? trustStore : ["www", "api"],
-      onStep: (step) => updateIssueJobRecord(jobId, { step }),
+      onStep: (step) => { void updateIssueJobRecord(jobId, { step }) },
     })
-    updateIssueJobRecord(jobId, {
+    await updateIssueJobRecord(jobId, {
       status: "done",
       step: "done",
       finishedAt: new Date().toISOString(),
       error: null,
     })
-    appendEvent({
+    await appendEvent({
       level: "info",
       eventType: isScheduler ? "certificates.renew.done" : "certificates.issue.done",
       sourceModule: "certificates",
@@ -79,13 +75,13 @@ export async function runCertificateIssueJob(jobId: string): Promise<void> {
     })
   } catch (e) {
     const message = e instanceof Error ? e.message : String(e)
-    updateIssueJobRecord(jobId, {
+    await updateIssueJobRecord(jobId, {
       status: "failed",
       step: "failed",
       finishedAt: new Date().toISOString(),
       error: message,
     })
-    appendEvent({
+    await appendEvent({
       level: "warning",
       eventType: isScheduler ? "certificates.renew.failed" : "certificates.issue.failed",
       sourceModule: "certificates",
diff --git a/backend/src/services/certificate-renew-collector.ts b/backend/src/services/certificate-renew-collector.ts
index 1036512..1c8f2c5 100644
--- a/backend/src/services/certificate-renew-collector.ts
+++ b/backend/src/services/certificate-renew-collector.ts
@@ -22,7 +22,7 @@ export function getCertificateRenewCollectorState(): { running: boolean } {
 
 export async function collectCertificatesRenewOnce(): Promise<CertificatesRenewRunSnapshot> {
   const sampledAt = new Date().toISOString()
-  const settings = getCertificateRenewSettings()
+  const settings = await getCertificateRenewSettings()
   if (collecting) {
     return {
       v: SCHEDULER_RUN_SNAPSHOT_VERSION,
@@ -55,7 +55,7 @@ export async function collectCertificatesRenewOnce(): Promise<CertificatesRenewR
       return snapshot
     }
 
-    const targets = listManagedCertificateTargets()
+    const targets = await listManagedCertificateTargets()
     for (const target of targets) {
       snapshot.checked += 1
       const item = {
@@ -66,12 +66,12 @@ export async function collectCertificatesRenewOnce(): Promise<CertificatesRenewR
         message: "",
       }
 
-      if (hasActiveIssueJob(target.serverId, target.certName)) {
+      if (await hasActiveIssueJob(target.serverId, target.certName)) {
         item.action = "skipped"
         item.message = "Уже выполняется выпуск"
         snapshot.skippedTargets += 1
         snapshot.targets?.push(item)
-        appendEvent({
+        await appendEvent({
           level: "info",
           eventType: "certificates.renew.skipped",
           sourceModule: "certificates",
@@ -83,7 +83,7 @@ export async function collectCertificatesRenewOnce(): Promise<CertificatesRenewR
         continue
       }
 
-      const server = getServerRowByIdString(target.serverId)
+      const server = await getServerRowByIdString(target.serverId)
       if (!server) {
         item.action = "error"
         item.message = "Сервер не найден"
@@ -114,7 +114,7 @@ export async function collectCertificatesRenewOnce(): Promise<CertificatesRenewR
         }
 
         const jobId = randomUUID()
-        createIssueJobRecord({
+        await createIssueJobRecord({
           id: jobId,
           serverId: target.serverId,
           certName: target.certName,
@@ -137,7 +137,7 @@ export async function collectCertificatesRenewOnce(): Promise<CertificatesRenewR
       }
     }
 
-    touchCertificateRenewRunMeta({
+    await touchCertificateRenewRunMeta({
       lastCollectedAt: sampledAt,
       lastDurationMs: Date.now() - started,
       lastError: snapshot.errors.length > 0 ? snapshot.errors.join("; ") : null,
@@ -146,7 +146,7 @@ export async function collectCertificatesRenewOnce(): Promise<CertificatesRenewR
   } catch (e) {
     const message = e instanceof Error ? e.message : String(e)
     snapshot.fatalError = message
-    touchCertificateRenewRunMeta({
+    await touchCertificateRenewRunMeta({
       lastCollectedAt: sampledAt,
       lastDurationMs: Date.now() - started,
       lastError: message,
diff --git a/backend/src/services/certificates-service.ts b/backend/src/services/certificates-service.ts
index 936f529..183a989 100644
--- a/backend/src/services/certificates-service.ts
+++ b/backend/src/services/certificates-service.ts
@@ -1,6 +1,7 @@
 import { desc, eq, inArray } from "drizzle-orm"
 import type { CertificateDto, CertificateRenewSettingsDto } from "@mmapp/contracts/certificates"
 import { db } from "../db/index.js"
+import { parseJsonArray } from "../db/json.js"
 import {
   acmeSettings,
   certificateIssueJobs,
@@ -25,7 +26,7 @@ export async function listCertificatesFromServers(): Promise<{
   certificates: CertificateDto[]
   failures: Array<{ serverId: string; serverName?: string; error: string }>
 }> {
-  const allServers = db.select().from(servers).where(eq(servers.enabled, true)).all()
+  const allServers = await db.select().from(servers).where(eq(servers.enabled, true))
   const certificates: CertificateDto[] = []
   const failures: Array<{ serverId: string; serverName?: string; error: string }> = []
 
@@ -53,8 +54,8 @@ export async function listCertificatesFromServers(): Promise<{
   return { certificates, failures }
 }
 
-export function getAcmeSettingsPublic() {
-  const row = db.select().from(acmeSettings).where(eq(acmeSettings.id, SETTINGS_ID)).limit(1).all()[0]
+export async function getAcmeSettingsPublic() {
+  const row = (await db.select().from(acmeSettings).where(eq(acmeSettings.id, SETTINGS_ID)).limit(1))[0]
   if (!row) {
     return {
       directoryUrl: "https://acme-v02.api.letsencrypt.org/directory",
@@ -71,30 +72,29 @@ export function getAcmeSettingsPublic() {
   }
 }
 
-export function getAcmeCloudflareToken(): string {
-  const row = db.select().from(acmeSettings).where(eq(acmeSettings.id, SETTINGS_ID)).limit(1).all()[0]
+export async function getAcmeCloudflareToken(): Promise<string> {
+  const row = (await db.select().from(acmeSettings).where(eq(acmeSettings.id, SETTINGS_ID)).limit(1))[0]
   return row?.cloudflareApiToken?.trim() ?? ""
 }
 
-export function getAcmeAccountPrivateKey(): string {
-  const row = db.select().from(acmeSettings).where(eq(acmeSettings.id, SETTINGS_ID)).limit(1).all()[0]
+export async function getAcmeAccountPrivateKey(): Promise<string> {
+  const row = (await db.select().from(acmeSettings).where(eq(acmeSettings.id, SETTINGS_ID)).limit(1))[0]
   return row?.accountPrivateKey?.trim() ?? ""
 }
 
-export function saveAcmeAccountPrivateKey(pem: string) {
+export async function saveAcmeAccountPrivateKey(pem: string) {
   const now = new Date().toISOString()
-  db.update(acmeSettings)
+  await db.update(acmeSettings)
     .set({ accountPrivateKey: pem, updatedAt: now })
     .where(eq(acmeSettings.id, SETTINGS_ID))
-    .run()
 }
 
-export function updateAcmeSettings(input: {
+export async function updateAcmeSettings(input: {
   directoryUrl?: string
   defaultZoneId?: string | null
   cloudflareApiToken?: string | null
 }) {
-  const row = db.select().from(acmeSettings).where(eq(acmeSettings.id, SETTINGS_ID)).limit(1).all()[0]
+  const row = (await db.select().from(acmeSettings).where(eq(acmeSettings.id, SETTINGS_ID)).limit(1))[0]
   const now = new Date().toISOString()
   const next = {
     directoryUrl: input.directoryUrl?.trim() || row?.directoryUrl || "https://acme-v02.api.letsencrypt.org/directory",
@@ -109,14 +109,14 @@ export function updateAcmeSettings(input: {
     updatedAt: now,
   }
   if (row) {
-    db.update(acmeSettings).set(next).where(eq(acmeSettings.id, SETTINGS_ID)).run()
+    await db.update(acmeSettings).set(next).where(eq(acmeSettings.id, SETTINGS_ID))
   } else {
-    db.insert(acmeSettings).values({ id: SETTINGS_ID, accountPrivateKey: "", ...next }).run()
+    await db.insert(acmeSettings).values({ id: SETTINGS_ID, accountPrivateKey: "", ...next })
   }
-  return getAcmeSettingsPublic()
+  return await getAcmeSettingsPublic()
 }
 
-export function createIssueJobRecord(input: {
+export async function createIssueJobRecord(input: {
   id: string
   serverId: string
   certName: string
@@ -126,21 +126,21 @@ export function createIssueJobRecord(input: {
   source?: "manual" | "scheduler"
 }) {
   const now = new Date().toISOString()
-  db.insert(certificateIssueJobs).values({
+  await db.insert(certificateIssueJobs).values({
     id: input.id,
     status: "queued",
     step: "queued",
     source: input.source ?? "manual",
-    serverId: input.serverId,
+    serverId: Number(input.serverId),
     certName: input.certName,
-    domainNames: JSON.stringify(input.domainNames),
+    domainNames: input.domainNames,
     keyType: input.keyType,
     trustStore: input.trustStore,
     requestedAt: now,
-  }).run()
+  })
 }
 
-export function updateIssueJobRecord(
+export async function updateIssueJobRecord(
   id: string,
   patch: Partial<{
     status: "queued" | "running" | "done" | "failed"
@@ -150,21 +150,15 @@ export function updateIssueJobRecord(
     error: string | null
   }>,
 ) {
-  db.update(certificateIssueJobs).set(patch).where(eq(certificateIssueJobs.id, id)).run()
+  await db.update(certificateIssueJobs).set(patch).where(eq(certificateIssueJobs.id, id))
 }
 
-export function getIssueJobRecord(id: string) {
-  return db.select().from(certificateIssueJobs).where(eq(certificateIssueJobs.id, id)).limit(1).all()[0] ?? null
+export async function getIssueJobRecord(id: string) {
+  return (await db.select().from(certificateIssueJobs).where(eq(certificateIssueJobs.id, id)).limit(1))[0] ?? null
 }
 
-export function toIssueJobDto(row: NonNullable<ReturnType<typeof getIssueJobRecord>>) {
-  let domainNames: string[] = []
-  try {
-    const parsed = JSON.parse(row.domainNames) as unknown
-    if (Array.isArray(parsed)) domainNames = parsed.map(String)
-  } catch {
-    domainNames = []
-  }
+export function toIssueJobDto(row: NonNullable<Awaited<ReturnType<typeof getIssueJobRecord>>>) {
+  const domainNames = parseJsonArray(row.domainNames).map(String)
   return {
     id: row.id,
     status: row.status,
@@ -179,14 +173,14 @@ export function toIssueJobDto(row: NonNullable<ReturnType<typeof getIssueJobReco
   }
 }
 
-export function getServerRowByIdString(serverId: string) {
-  const id = Number.parseInt(serverId, 10)
+export async function getServerRowByIdString(serverId: string | number) {
+  const id = typeof serverId === "number" ? serverId : Number.parseInt(serverId, 10)
   if (!Number.isFinite(id)) return null
-  return db.select().from(servers).where(eq(servers.id, id)).limit(1).all()[0] ?? null
+  return (await db.select().from(servers).where(eq(servers.id, id)).limit(1))[0] ?? null
 }
 
-function getCertificateRenewSettingsRow() {
-  return db.select().from(certificateRenewSettings).where(eq(certificateRenewSettings.id, SETTINGS_ID)).limit(1).all()[0]
+async function getCertificateRenewSettingsRow() {
+  return (await db.select().from(certificateRenewSettings).where(eq(certificateRenewSettings.id, SETTINGS_ID)).limit(1))[0]
     ?? {
       id: SETTINGS_ID,
       enabled: true,
@@ -199,8 +193,8 @@ function getCertificateRenewSettingsRow() {
     }
 }
 
-export function getCertificateRenewSettings(): CertificateRenewSettingsDto {
-  const row = getCertificateRenewSettingsRow()
+export async function getCertificateRenewSettings(): Promise<CertificateRenewSettingsDto> {
+  const row = await getCertificateRenewSettingsRow()
   return {
     enabled: row.enabled,
     intervalSec: row.intervalSec,
@@ -212,12 +206,12 @@ export function getCertificateRenewSettings(): CertificateRenewSettingsDto {
   }
 }
 
-export function updateCertificateRenewSettings(patch: {
+export async function updateCertificateRenewSettings(patch: {
   enabled?: boolean
   intervalSec?: number
   renewBeforeDays?: number
 }) {
-  const prev = getCertificateRenewSettingsRow()
+  const prev = await getCertificateRenewSettingsRow()
   const now = new Date().toISOString()
   const next = {
     enabled: patch.enabled ?? prev.enabled,
@@ -225,47 +219,40 @@ export function updateCertificateRenewSettings(patch: {
     renewBeforeDays: patch.renewBeforeDays ?? prev.renewBeforeDays,
     updatedAt: now,
   }
-  if (db.select().from(certificateRenewSettings).where(eq(certificateRenewSettings.id, SETTINGS_ID)).limit(1).all()[0]) {
-    db.update(certificateRenewSettings).set(next).where(eq(certificateRenewSettings.id, SETTINGS_ID)).run()
+  if ((await db.select().from(certificateRenewSettings).where(eq(certificateRenewSettings.id, SETTINGS_ID)).limit(1))[0]) {
+    await db.update(certificateRenewSettings).set(next).where(eq(certificateRenewSettings.id, SETTINGS_ID))
   } else {
-    db.insert(certificateRenewSettings).values({ id: SETTINGS_ID, ...next }).run()
+    await db.insert(certificateRenewSettings).values({ id: SETTINGS_ID, ...next })
   }
-  return getCertificateRenewSettings()
+  return await getCertificateRenewSettings()
 }
 
-export function touchCertificateRenewRunMeta(patch: {
+export async function touchCertificateRenewRunMeta(patch: {
   lastCollectedAt?: string
   lastDurationMs?: number
   lastError?: string | null
 }) {
-  const prev = getCertificateRenewSettingsRow()
-  db.update(certificateRenewSettings).set({
+  const prev = await getCertificateRenewSettingsRow()
+  await db.update(certificateRenewSettings).set({
     lastCollectedAt: patch.lastCollectedAt ?? prev.lastCollectedAt,
     lastDurationMs: patch.lastDurationMs ?? prev.lastDurationMs,
     lastError: patch.lastError === undefined ? prev.lastError : patch.lastError,
     updatedAt: new Date().toISOString(),
-  }).where(eq(certificateRenewSettings.id, SETTINGS_ID)).run()
+  }).where(eq(certificateRenewSettings.id, SETTINGS_ID))
 }
 
-export function listManagedCertificateTargets(): ManagedCertificateTarget[] {
-  const rows = db.select().from(certificateIssueJobs)
+export async function listManagedCertificateTargets(): Promise<ManagedCertificateTarget[]> {
+  const rows = await db.select().from(certificateIssueJobs)
     .where(eq(certificateIssueJobs.status, "done"))
     .orderBy(desc(certificateIssueJobs.finishedAt), desc(certificateIssueJobs.requestedAt))
-    .all()
 
   const byKey = new Map<string, ManagedCertificateTarget>()
   for (const row of rows) {
     const key = `${row.serverId}::${row.certName}`
     if (byKey.has(key)) continue
-    let domainNames: string[] = []
-    try {
-      const parsed = JSON.parse(row.domainNames) as unknown
-      if (Array.isArray(parsed)) domainNames = parsed.map(String)
-    } catch {
-      domainNames = []
-    }
+    const domainNames = parseJsonArray(row.domainNames).map(String)
     byKey.set(key, {
-      serverId: row.serverId,
+      serverId: row.serverId == null ? "" : String(row.serverId),
       certName: row.certName,
       domainNames,
       keyType: row.keyType,
@@ -276,11 +263,10 @@ export function listManagedCertificateTargets(): ManagedCertificateTarget[] {
   return [...byKey.values()]
 }
 
-export function hasActiveIssueJob(serverId: string, certName: string): boolean {
-  const row = db.select().from(certificateIssueJobs)
+export async function hasActiveIssueJob(serverId: string, certName: string): Promise<boolean> {
+  const rows = await db.select().from(certificateIssueJobs)
     .where(inArray(certificateIssueJobs.status, ["queued", "running"]))
     .orderBy(desc(certificateIssueJobs.requestedAt))
-    .all()
-    .find((r) => r.serverId === serverId && r.certName === certName)
-  return Boolean(row)
+  const sid = Number(serverId)
+  return rows.some((r) => r.serverId === sid && r.certName === certName)
 }
diff --git a/backend/src/services/firewall-live.ts b/backend/src/services/firewall-live.ts
index 55c0da4..6b2d402 100644
--- a/backend/src/services/firewall-live.ts
+++ b/backend/src/services/firewall-live.ts
@@ -179,7 +179,7 @@ export async function listFirewallAll(): Promise<{
   rules: FirewallRuleDto[]
   addressLists: FirewallAddressListDto[]
 }> {
-  const allServers = db.select().from(servers).where(eq(servers.enabled, true)).all()
+  const allServers = await db.select().from(servers).where(eq(servers.enabled, true))
   const perServer = await Promise.all(
     allServers.map(async (server) => {
       try {
diff --git a/backend/src/services/gre-bgp-snapshot-collector.ts b/backend/src/services/gre-bgp-snapshot-collector.ts
index e82b38a..16ccb61 100644
--- a/backend/src/services/gre-bgp-snapshot-collector.ts
+++ b/backend/src/services/gre-bgp-snapshot-collector.ts
@@ -41,8 +41,8 @@ export async function collectGreBgpSnapshotOnce(): Promise<GreBgpSnapshotRunSnap
 
   try {
     const [greSettled, bgpSettled] = await Promise.allSettled([
-      fetchGreTunnelLiveRows(),
-      fetchBgpSessionsForAlerts(),
+      await fetchGreTunnelLiveRows(),
+      await fetchBgpSessionsForAlerts(),
     ])
 
     if (greSettled.status === "rejected") {
diff --git a/backend/src/services/gre-tunnels-live.ts b/backend/src/services/gre-tunnels-live.ts
index 9691704..7103668 100644
--- a/backend/src/services/gre-tunnels-live.ts
+++ b/backend/src/services/gre-tunnels-live.ts
@@ -46,7 +46,7 @@ async function fetchGreForServer(server: ServerRow): Promise<GreTunnelLiveRow[]>
 
 /** GRE с включённых серверов — тот же смысл, что `/api/filters/gre-tunnels` (без правил фильтров). */
 export async function fetchGreTunnelLiveRows(): Promise<GreTunnelLiveRow[]> {
-  const enabledServers = db.select().from(servers).where(eq(servers.enabled, true)).all()
+  const enabledServers = await db.select().from(servers).where(eq(servers.enabled, true))
   const results = await Promise.all(
     enabledServers.map(async (server) => {
       try {
diff --git a/backend/src/services/internet-path-collector.ts b/backend/src/services/internet-path-collector.ts
index fa27737..2ab568e 100644
--- a/backend/src/services/internet-path-collector.ts
+++ b/backend/src/services/internet-path-collector.ts
@@ -1,4 +1,4 @@
-import { and, asc, eq, lt } from "drizzle-orm"
+import { and, asc, desc, eq, lt } from "drizzle-orm"
 import { db } from "../db/index.js"
 import {
   filterRules,
@@ -30,29 +30,29 @@ function norm(v: string | null | undefined): string {
   return String(v ?? "").trim().toLowerCase()
 }
 
-function getSettingsRow() {
-  const row = db.select().from(internetPathSettings).where(eq(internetPathSettings.id, 1)).limit(1).all()[0]
+async function getSettingsRow() {
+  const row = (await db.select().from(internetPathSettings).where(eq(internetPathSettings.id, 1)).limit(1))[0]
   if (row) return row
   const now = new Date().toISOString()
-  db.insert(internetPathSettings).values({
+  await db.insert(internetPathSettings).values({
     id: 1,
     enabled: true,
     intervalSec: 300,
     retentionDays: 14,
     createdAt: now,
     updatedAt: now,
-  }).run()
-  return db.select().from(internetPathSettings).where(eq(internetPathSettings.id, 1)).limit(1).all()[0]
+  })
+  return (await db.select().from(internetPathSettings).where(eq(internetPathSettings.id, 1)).limit(1))[0]
 }
 
-function cleanupSnapshots(retentionDays: number) {
+async function cleanupSnapshots(retentionDays: number) {
   const cutoff = new Date(Date.now() - retentionDays * 24 * 60 * 60 * 1000).toISOString()
-  db.delete(internetPathSnapshots).where(lt(internetPathSnapshots.sampledAt, cutoff)).run()
+  await db.delete(internetPathSnapshots).where(lt(internetPathSnapshots.sampledAt, cutoff))
 }
 
-function buildRulesets() {
-  const enabled = db.select().from(servers).where(eq(servers.enabled, true)).all()
-  const rules = db.select().from(filterRules).orderBy(asc(filterRules.serverId), asc(filterRules.sortOrder)).all()
+async function buildRulesets() {
+  const enabled = await db.select().from(servers).where(eq(servers.enabled, true))
+  const rules = await db.select().from(filterRules).orderBy(asc(filterRules.serverId), asc(filterRules.sortOrder))
   return enabled.map((s) => ({
     serverId: String(s.id),
     rules: rules
@@ -70,7 +70,7 @@ function buildRulesets() {
 }
 
 async function readRouteLookup(serverId: number): Promise<{ gateway: string | null; routingMark: string | null }> {
-  const row = db.select().from(servers).where(eq(servers.id, serverId)).limit(1).all()[0]
+  const row = (await db.select().from(servers).where(eq(servers.id, serverId)).limit(1))[0]
   if (!row) return { gateway: null, routingMark: null }
   const client = MikrotikClient.fromServer(row)
   const routes = await client.get<Array<Record<string, string>>>("/ip/route").catch(() => [])
@@ -91,8 +91,8 @@ async function readRouteLookup(serverId: number): Promise<{ gateway: string | nu
 }
 
 async function readWanRuntime(serverId: number) {
-  const server = listServersRead().find((s) => Number(s.id) === serverId)
-  const row = db.select().from(servers).where(eq(servers.id, serverId)).limit(1).all()[0]
+  const server = (await listServersRead()).find((s) => Number(s.id) === serverId)
+  const row = (await db.select().from(servers).where(eq(servers.id, serverId)).limit(1))[0]
   if (!server || !row) return null
   const client = MikrotikClient.fromServer(row)
   const [dhcpRaw, ipAddrs, routes] = await Promise.all([
@@ -144,8 +144,8 @@ async function readWanRuntime(serverId: number) {
   }
 }
 
-function mapSpeedProbes() {
-  const rows = db.select().from(uptimeSpeedProbes).orderBy(asc(uptimeSpeedProbes.sortOrder)).all()
+async function mapSpeedProbes() {
+  const rows = await db.select().from(uptimeSpeedProbes).orderBy(asc(uptimeSpeedProbes.sortOrder))
   return rows.map((r) => ({
     id: r.id,
     srcServerId: String(r.srcServerId),
@@ -175,7 +175,7 @@ function parseInnerIps(comment: string): { localInnerIp: string; remoteInnerIp:
 }
 
 async function collectGreTunnels() {
-  const enabled = db.select().from(servers).where(eq(servers.enabled, true)).all()
+  const enabled = await db.select().from(servers).where(eq(servers.enabled, true))
   const all = await Promise.all(enabled.map(async (srv) => {
     try {
       const client = MikrotikClient.fromServer(srv)
@@ -214,23 +214,24 @@ async function collectGreTunnels() {
   return all.flat()
 }
 
-export function getInternetPathSettings() {
-  return getSettingsRow()
+export async function getInternetPathSettings() {
+  return await getSettingsRow()
 }
 
-export function updateInternetPathSettings(patch: { enabled?: boolean; intervalSec?: number; retentionDays?: number }) {
-  const prev = getSettingsRow()
-  db.update(internetPathSettings).set({
+export async function updateInternetPathSettings(patch: { enabled?: boolean; intervalSec?: number; retentionDays?: number }) {
+  const prev = await getSettingsRow()
+  await db.update(internetPathSettings).set({
     enabled: patch.enabled ?? prev.enabled,
     intervalSec: patch.intervalSec ?? prev.intervalSec,
     retentionDays: patch.retentionDays ?? prev.retentionDays,
     updatedAt: new Date().toISOString(),
-  }).where(eq(internetPathSettings.id, 1)).run()
-  return getSettingsRow()
+  }).where(eq(internetPathSettings.id, 1))
+  return await getSettingsRow()
 }
 
-export function getLatestInternetPathSnapshot() {
-  return db.select().from(internetPathSnapshots).orderBy(asc(internetPathSnapshots.id)).all().at(-1) ?? null
+export async function getLatestInternetPathSnapshot() {
+  const rows = await db.select().from(internetPathSnapshots).orderBy(desc(internetPathSnapshots.id)).limit(1)
+  return rows[0] ?? null
 }
 
 export async function collectInternetPathSnapshotOnce(): Promise<InternetPathRunSnapshot> {
@@ -246,12 +247,12 @@ export async function collectInternetPathSnapshotOnce(): Promise<InternetPathRun
   }
   collecting = true
   const started = Date.now()
-  const settings = getSettingsRow()
+  const settings = await getSettingsRow()
   try {
-    const serversRead = listServersRead()
+    const serversRead = await listServersRead()
     const homes = serversRead.filter((s) => s.type === "home-router")
-    const [greTunnels, rulesets] = await Promise.all([collectGreTunnels(), Promise.resolve(buildRulesets())])
-    const speedProbes = mapSpeedProbes()
+    const [greTunnels, rulesets] = await Promise.all([await collectGreTunnels(), Promise.resolve(await buildRulesets())])
+    const speedProbes = await mapSpeedProbes()
     const routeLookupByServerId: Record<string, { gateway: string | null; routingMark: string | null }> = {}
     const wanRuntimeByHomeId: Record<string, unknown> = {}
     for (const h of homes) {
@@ -268,17 +269,17 @@ export async function collectInternetPathSnapshotOnce(): Promise<InternetPathRun
       routeLookupByServerId,
       wanRuntimeByHomeId,
     }
-    db.insert(internetPathSnapshots).values({
+    await db.insert(internetPathSnapshots).values({
       sampledAt,
-      payloadJson: JSON.stringify(payload),
-    }).run()
-    cleanupSnapshots(Math.max(1, settings.retentionDays))
-    db.update(internetPathSettings).set({
+      payloadJson: payload,
+    })
+    await cleanupSnapshots(Math.max(1, settings.retentionDays))
+    await db.update(internetPathSettings).set({
       lastCollectedAt: sampledAt,
       lastDurationMs: Date.now() - started,
       lastError: "",
       updatedAt: sampledAt,
-    }).where(eq(internetPathSettings.id, 1)).run()
+    }).where(eq(internetPathSettings.id, 1))
     return {
       v: SCHEDULER_RUN_SNAPSHOT_VERSION,
       job: "internet_path",
@@ -288,12 +289,12 @@ export async function collectInternetPathSnapshotOnce(): Promise<InternetPathRun
     }
   } catch (e) {
     const msg = e instanceof Error ? e.message : String(e)
-    db.update(internetPathSettings).set({
+    await db.update(internetPathSettings).set({
       lastCollectedAt: sampledAt,
       lastDurationMs: Date.now() - started,
       lastError: msg,
       updatedAt: sampledAt,
-    }).where(eq(internetPathSettings.id, 1)).run()
+    }).where(eq(internetPathSettings.id, 1))
     return {
       v: SCHEDULER_RUN_SNAPSHOT_VERSION,
       job: "internet_path",
diff --git a/backend/src/services/poller.ts b/backend/src/services/poller.ts
index b3abf31..5c9290b 100644
--- a/backend/src/services/poller.ts
+++ b/backend/src/services/poller.ts
@@ -1,5 +1,6 @@
-import { eq } from "drizzle-orm"
-import { db } from "../db/index.js"
+import { eq, lt } from "drizzle-orm"
+import { db, pool } from "../db/index.js"
+import { dropExpiredPartitions, ensurePartitionsAround } from "../db/partitions.js"
 import { servers, serverSnapshots } from "../db/schema.js"
 import type { SnapshotInsert } from "../db/schema.js"
 import type { SnapshotRead } from "../types/server.js"
@@ -14,12 +15,11 @@ import { invalidateFlowCatalogCache } from "./traffic-flow-topology.js"
  * and sync the server's display name from system/identity.
  */
 export async function pollServer(serverId: number): Promise<SnapshotRead> {
-  const server = db
+  const server = (await db
     .select()
     .from(servers)
     .where(eq(servers.id, serverId))
-    .limit(1)
-    .all()[0]
+    .limit(1))[0]
 
   if (!server) {
     throw new Error(`Server with id=${serverId} not found`)
@@ -61,15 +61,14 @@ export async function pollServer(serverId: number): Promise<SnapshotRead> {
       cpuLoad,
       freeMemory:     freeMem,
       totalMemory:    totalMem,
-      rawInterfaces:  JSON.stringify(ifaces),
-      rawIpAddresses: JSON.stringify(addresses),
+      rawInterfaces:  ifaces,
+      rawIpAddresses: addresses,
     } satisfies Partial<SnapshotInsert>)
 
     if ((identity.name || "") !== (server.name || "")) {
-      db.update(servers)
+      await db.update(servers)
         .set({ name: identity.name, updatedAt: now })
         .where(eq(servers.id, serverId))
-        .run()
       invalidateFlowCatalogCache()
     }
 
@@ -78,11 +77,14 @@ export async function pollServer(serverId: number): Promise<SnapshotRead> {
     console.warn(`[poller] server id=${serverId} unreachable:`, (err as Error).message)
   }
 
-  const [inserted] = db
+  const [inserted] = await db
     .insert(serverSnapshots)
     .values(partialSnap as SnapshotInsert)
     .returning()
-    .all()
+
+  const cutoffIso = new Date(Date.now() - 14 * 24 * 3600_000).toISOString()
+  await db.delete(serverSnapshots).where(lt(serverSnapshots.polledAt, cutoffIso))
+  void dropExpiredPartitions(pool).then(() => ensurePartitionsAround(pool))
 
   return toSnapshotRead(inserted)
 }
diff --git a/backend/src/services/scheduler.ts b/backend/src/services/scheduler.ts
index 68b0d79..3ac3108 100644
--- a/backend/src/services/scheduler.ts
+++ b/backend/src/services/scheduler.ts
@@ -6,7 +6,7 @@
  * 2. `traffic`, `uptime_resources`, `servers_rest_ping` — средний (REST `/system/identity` по каталогу).
  * 3. `uptime_speed` — ниже (BW-test, тяжёлый); локи узлов — `withBtestNodeLocks` в speed-сервисе.
  *
- * **Оповещения (`alert_engine`):** читают SQLite после джоб сбора (см. `buildSignalSnapshot`), в т.ч.
+ * **Оповещения (`alert_engine`):** читают PostgreSQL после джоб сбора (см. `buildSignalSnapshot`), в т.ч.
  * `gre_bgp` → snapshot в `scheduler_runs.result_json` (`greTunnels` / `bgpPeers`). После успешного завершения джоб
  * `traffic`, `uptime_*`, `servers_rest_ping`, `gre_bgp` планируется **дополнительный** прогон движка
  * (debounce), см. [`alert-collector-hooks.ts`](./alert-collector-hooks.ts); любой другой писатель сэмплов
@@ -89,7 +89,7 @@ function newRunId(): string {
   return `sch-${Date.now()}-${Math.random().toString(36).slice(2, 10)}`
 }
 
-function appendSchedulerRun(row: {
+async function appendSchedulerRun(row: {
   jobKey: string
   startedAt: string
   finishedAt: string
@@ -99,8 +99,8 @@ function appendSchedulerRun(row: {
   result?: SchedulerRunSnapshot | null
 }) {
   const cutoff = new Date(Date.now() - RUN_LOG_RETENTION_MS).toISOString()
-  db.transaction((tx) => {
-    tx.insert(schedulerRuns).values({
+  await db.transaction(async (tx) => {
+    await tx.insert(schedulerRuns).values({
       id: newRunId(),
       jobKey: row.jobKey,
       startedAt: row.startedAt,
@@ -108,10 +108,10 @@ function appendSchedulerRun(row: {
       status: row.status,
       error: row.error,
       durationMs: row.durationMs,
-      resultJson: row.result ? JSON.stringify(row.result) : null,
-    }).run()
-    tx.delete(schedulerRuns).where(lt(schedulerRuns.finishedAt, cutoff)).run()
-    tx.delete(events).where(lt(events.createdAt, cutoff)).run()
+      resultJson: row.result ?? null,
+    })
+    await tx.delete(schedulerRuns).where(lt(schedulerRuns.finishedAt, cutoff))
+    await tx.delete(events).where(lt(events.createdAt, cutoff))
   })
 }
 
@@ -167,7 +167,7 @@ async function runSchedulerJobBody(jobKey: SchedulerJobKey): Promise<void> {
         throw new Error(`Unknown job: ${jobKey}`)
     }
     const finishedIso = new Date().toISOString()
-    appendSchedulerRun({
+    await appendSchedulerRun({
       jobKey,
       startedAt: startedIso,
       finishedAt: finishedIso,
@@ -177,7 +177,7 @@ async function runSchedulerJobBody(jobKey: SchedulerJobKey): Promise<void> {
       result: snapshot ?? null,
     })
     if (shouldAppendSchedulerOkEvent(jobKey)) {
-      appendEvent({
+      await appendEvent({
         level: "info",
         eventType: "scheduler.job.ok",
         sourceModule: "scheduler",
@@ -205,7 +205,7 @@ async function runSchedulerJobBody(jobKey: SchedulerJobKey): Promise<void> {
   } catch (e) {
     const msg = e instanceof Error ? e.message : String(e)
     const finishedIso = new Date().toISOString()
-    appendSchedulerRun({
+    await appendSchedulerRun({
       jobKey,
       startedAt: startedIso,
       finishedAt: finishedIso,
@@ -214,7 +214,7 @@ async function runSchedulerJobBody(jobKey: SchedulerJobKey): Promise<void> {
       durationMs: Date.now() - startedAt,
       result: snapshot ?? null,
     })
-    appendEvent({
+    await appendEvent({
       level: "critical",
       eventType: "scheduler.job.failed",
       sourceModule: "scheduler",
@@ -267,10 +267,10 @@ function clearAllTimers() {
 }
 
 /** Пересоздать интервалы после смены настроек. */
-export function refreshScheduler(): void {
+export async function refreshScheduler(): Promise<void> {
   clearAllTimers()
 
-  const traffic = getTrafficSettings()
+  const traffic = await getTrafficSettings()
   if (traffic.enabled) {
     const ms = Math.max(5_000, traffic.intervalSec * 1000)
     void executeSchedulerJob("traffic").catch(() => {})
@@ -282,8 +282,8 @@ export function refreshScheduler(): void {
     )
   }
 
-  const apiPing = getServersApiPingSettings()
-  const internetPath = getInternetPathSettings()
+  const apiPing = await getServersApiPingSettings()
+  const internetPath = await getInternetPathSettings()
   if (apiPing.enabled) {
     const apiMs = Math.max(10_000, apiPing.intervalSec * 1000)
     void executeSchedulerJob("servers_rest_ping").catch(() => {})
@@ -295,7 +295,7 @@ export function refreshScheduler(): void {
     )
   }
 
-  const uptime = getUptimeSettings()
+  const uptime = await getUptimeSettings()
   const resOn = uptime.resourcesEnabled ?? uptime.enabled
   const pingOn = uptime.pingEnabled ?? uptime.enabled
   const spdOn = uptime.speedEnabled ?? uptime.enabled
@@ -353,7 +353,7 @@ export function refreshScheduler(): void {
     }, greBgpMs),
   )
 
-  const certRenew = getCertificateRenewSettings()
+  const certRenew = await getCertificateRenewSettings()
   if (certRenew.enabled) {
     const certRenewMs = Math.max(300_000, certRenew.intervalSec * 1000)
     void executeSchedulerJob("certificates_renew").catch(() => {})
@@ -365,7 +365,7 @@ export function refreshScheduler(): void {
     )
   }
 
-  const backupSchedule = getBackupScheduleSettings()
+  const backupSchedule = await getBackupScheduleSettings()
   if (backupSchedule.enabled) {
     const backupMs = 60_000
     void executeSchedulerJob("backups").catch(() => {})
@@ -395,21 +395,20 @@ export function isJobRunning(jobKey: string): boolean {
   return isSchedulerJobRunning(jobKey)
 }
 
-function lastRunForJob(jobKey: string) {
-  return db.select().from(schedulerRuns)
+async function lastRunForJob(jobKey: string) {
+  return (await db.select().from(schedulerRuns)
     .where(eq(schedulerRuns.jobKey, jobKey))
     .orderBy(desc(schedulerRuns.finishedAt))
-    .limit(1)
-    .all()[0]
+    .limit(1))[0]
 }
 
-export function getSchedulerStatus() {
-  const traffic = getTrafficSettings()
-  const uptime = getUptimeSettings()
-  const apiPing = getServersApiPingSettings()
-  const internetPath = getInternetPathSettings()
-  const certRenew = getCertificateRenewSettings()
-  const backupSchedule = getBackupScheduleSettings()
+export async function getSchedulerStatus() {
+  const traffic = await getTrafficSettings()
+  const uptime = await getUptimeSettings()
+  const apiPing = await getServersApiPingSettings()
+  const internetPath = await getInternetPathSettings()
+  const certRenew = await getCertificateRenewSettings()
+  const backupSchedule = await getBackupScheduleSettings()
 
   const resOn = uptime.resourcesEnabled ?? uptime.enabled
   const pingOn = uptime.pingEnabled ?? uptime.enabled
@@ -429,8 +428,8 @@ export function getSchedulerStatus() {
   }
 
   return {
-    jobs: JOB_KEYS.map((jobKey) => {
-      const last = lastRunForJob(jobKey)
+    jobs: await Promise.all(JOB_KEYS.map(async (jobKey) => {
+      const last = await lastRunForJob(jobKey)
       const m = jobMeta[jobKey]
       return {
         jobKey,
@@ -442,29 +441,27 @@ export function getSchedulerStatus() {
         lastDurationMs: last?.durationMs ?? null,
         lastError: last?.error ?? null,
       }
-    }),
+    })),
   }
 }
 
-export function listSchedulerRuns(opts: { jobKey?: string; limit: number; offset: number }) {
+export async function listSchedulerRuns(opts: { jobKey?: string; limit: number; offset: number }) {
   const limit = Math.min(200, Math.max(1, opts.limit))
   const offset = Math.max(0, opts.offset)
   if (opts.jobKey) {
     return {
-      runs: db.select().from(schedulerRuns)
+      runs: await db.select().from(schedulerRuns)
         .where(eq(schedulerRuns.jobKey, opts.jobKey))
         .orderBy(desc(schedulerRuns.finishedAt))
         .limit(limit)
-        .offset(offset)
-        .all(),
+        .offset(offset),
     }
   }
   return {
-    runs: db.select().from(schedulerRuns)
+    runs: await db.select().from(schedulerRuns)
       .orderBy(desc(schedulerRuns.finishedAt))
       .limit(limit)
-      .offset(offset)
-      .all(),
+      .offset(offset),
   }
 }
 
diff --git a/backend/src/services/servers-rest-ping-collector.ts b/backend/src/services/servers-rest-ping-collector.ts
index c96f0db..4a066e7 100644
--- a/backend/src/services/servers-rest-ping-collector.ts
+++ b/backend/src/services/servers-rest-ping-collector.ts
@@ -1,5 +1,5 @@
 import { eq, or } from "drizzle-orm"
-import { db, sqliteDatabase } from "../db/index.js"
+import { db, dbAll, dbQuery } from "../db/index.js"
 import { servers, serversApiPingSettings, serversRestPingSamples } from "../db/schema.js"
 import type { ServersRestPingRunSnapshot } from "../types/scheduler-run-snapshot.js"
 import { SCHEDULER_RUN_SNAPSHOT_VERSION } from "../types/scheduler-run-snapshot.js"
@@ -7,75 +7,67 @@ import { MikrotikClient } from "./mikrotik.js"
 
 let collecting = false
 
-function getSettingsRow() {
-  const row = db.select().from(serversApiPingSettings).where(eq(serversApiPingSettings.id, 1)).limit(1).all()[0]
+async function getSettingsRow() {
+  const row = (await db.select().from(serversApiPingSettings).where(eq(serversApiPingSettings.id, 1)).limit(1))[0]
   if (row) return row
   const now = new Date().toISOString()
-  db.insert(serversApiPingSettings).values({
+  await db.insert(serversApiPingSettings).values({
     id: 1,
     enabled: false,
     intervalSec: 120,
     createdAt: now,
     updatedAt: now,
-  }).run()
-  return db.select().from(serversApiPingSettings).where(eq(serversApiPingSettings.id, 1)).limit(1).all()[0]
+  })
+  return (await db.select().from(serversApiPingSettings).where(eq(serversApiPingSettings.id, 1)).limit(1))[0]
 }
 
 /** Как uptime: включённые в каталоге или Home Router (часто «выкл.» при доступе только из LAN). */
-function serversForRestProbe() {
-  return db
+async function serversForRestProbe() {
+  return await db
     .select()
     .from(servers)
     .where(or(eq(servers.enabled, true), eq(servers.type, "home-router")))
-    .all()
 }
 
-export function getServersApiPingSettings() {
-  return getSettingsRow()
+export async function getServersApiPingSettings() {
+  return await getSettingsRow()
 }
 
-export function updateServersApiPingSettings(patch: { enabled?: boolean; intervalSec?: number }) {
-  const prev = getSettingsRow()
+export async function updateServersApiPingSettings(patch: { enabled?: boolean; intervalSec?: number }) {
+  const prev = await getSettingsRow()
   const next = {
     enabled: patch.enabled ?? prev.enabled,
     intervalSec: patch.intervalSec ?? prev.intervalSec,
     updatedAt: new Date().toISOString(),
   }
-  db.update(serversApiPingSettings).set(next).where(eq(serversApiPingSettings.id, 1)).run()
-  return getSettingsRow()
+  await db.update(serversApiPingSettings).set(next).where(eq(serversApiPingSettings.id, 1))
+  return await getSettingsRow()
 }
 
 export function getServersRestPingCollectorState(): { running: boolean } {
   return { running: collecting }
 }
 
-function loadLastRestSampleByServer(): Map<number, { ok: boolean }> {
-  const rows = sqliteDatabase
-    .prepare(
-      `SELECT s.server_id AS serverId, s.ok
-       FROM servers_rest_ping_samples s
-       INNER JOIN (
-         SELECT server_id, MAX(id) AS mid FROM servers_rest_ping_samples GROUP BY server_id
-       ) t ON t.mid = s.id`,
-    )
-    .all() as { serverId: number; ok: number }[]
+async function loadLastRestSampleByServer(): Promise<Map<number, { ok: boolean }>> {
+  const rows = await dbAll<{ serverId: number; ok: boolean | number }>(
+    `SELECT DISTINCT ON (server_id) server_id AS "serverId", ok
+     FROM servers_rest_ping_samples
+     ORDER BY server_id, sampled_at DESC`,
+  )
   const m = new Map<number, { ok: boolean }>()
   for (const r of rows) m.set(r.serverId, { ok: Boolean(r.ok) })
   return m
 }
 
 /** Последний сэмпл ресурсов — для согласования «восстановился» с REST без второго тика uptime. */
-function loadLatestResourceDownServerIds(): Set<number> {
-  const rows = sqliteDatabase
-    .prepare(
-      `WITH r AS (
-         SELECT urs.server_id AS serverId, urs.status,
-                ROW_NUMBER() OVER (PARTITION BY urs.server_id ORDER BY urs.id DESC) AS rn
-         FROM uptime_resource_samples urs
-       )
-       SELECT serverId FROM r WHERE rn = 1 AND status IN ('offline', 'degraded')`,
-    )
-    .all() as { serverId: number }[]
+async function loadLatestResourceDownServerIds(): Promise<Set<number>> {
+  const rows = await dbAll<{ serverId: number }>(
+    `SELECT server_id AS "serverId" FROM (
+       SELECT DISTINCT ON (server_id) server_id, status
+       FROM uptime_resource_samples
+       ORDER BY server_id, sampled_at DESC
+     ) latest WHERE status IN ('offline', 'degraded')`,
+  )
   return new Set(rows.map((x) => x.serverId))
 }
 
@@ -104,7 +96,7 @@ export async function collectServersRestPingOnce(): Promise<ServersRestPingRunSn
   }
 
   try {
-    const targets = serversForRestProbe()
+    const targets = await serversForRestProbe()
     const rows = await Promise.all(
       targets.map(async (srv) => {
         const name = srv.name || srv.host
@@ -134,23 +126,23 @@ export async function collectServersRestPingOnce(): Promise<ServersRestPingRunSn
     )
     snapshot.servers = rows.sort((a, b) => a.serverId - b.serverId)
 
-    const lastByServer = loadLastRestSampleByServer()
-    const resourceDown = loadLatestResourceDownServerIds()
+    const lastByServer = await loadLastRestSampleByServer()
+    const resourceDown = await loadLatestResourceDownServerIds()
 
-    db.transaction((tx) => {
+    await db.transaction(async (tx) => {
       for (const row of snapshot.servers) {
         const sid = row.serverId
         const last = lastByServer.get(sid)
         const errText = row.ok ? null : (row.error ?? null)
 
-        const insertOne = (ok: boolean, latencyMs: number | null, error: string | null) => {
-          tx.insert(serversRestPingSamples).values({
+        const insertOne = async (ok: boolean, latencyMs: number | null, error: string | null) => {
+          await tx.insert(serversRestPingSamples).values({
             serverId: sid,
             sampledAt,
             ok,
             latencyMs,
             error,
-          }).run()
+          })
         }
 
         const lat = row.latencyMs ?? null
@@ -158,23 +150,21 @@ export async function collectServersRestPingOnce(): Promise<ServersRestPingRunSn
         if (row.ok) {
           const downRes = resourceDown.has(sid)
           if (last === undefined && downRes) {
-            insertOne(false, null, null)
+            await insertOne(false, null, null)
           }
-          insertOne(true, lat, null)
+          await insertOne(true, lat, null)
           if (last?.ok === false || (last === undefined && downRes)) {
-            insertOne(true, lat, null)
+            await insertOne(true, lat, null)
           }
         } else {
-          insertOne(false, null, errText)
+          await insertOne(false, null, errText)
         }
       }
     })
 
-    sqliteDatabase
-      .prepare(`DELETE FROM servers_rest_ping_samples WHERE sampled_at < datetime('now', '-30 days')`)
-      .run()
+    await dbQuery(`DELETE FROM servers_rest_ping_samples WHERE sampled_at < now() - interval '30 days'`)
 
-    db.update(serversApiPingSettings)
+    await db.update(serversApiPingSettings)
       .set({
         lastCollectedAt: sampledAt,
         lastDurationMs: Date.now() - startedAt,
@@ -182,11 +172,10 @@ export async function collectServersRestPingOnce(): Promise<ServersRestPingRunSn
         updatedAt: sampledAt,
       })
       .where(eq(serversApiPingSettings.id, 1))
-      .run()
   } catch (e) {
     const msg = e instanceof Error ? e.message : String(e)
     snapshot.fatalError = msg
-    db.update(serversApiPingSettings)
+    await db.update(serversApiPingSettings)
       .set({
         lastCollectedAt: sampledAt,
         lastDurationMs: Date.now() - startedAt,
@@ -194,7 +183,6 @@ export async function collectServersRestPingOnce(): Promise<ServersRestPingRunSn
         updatedAt: sampledAt,
       })
       .where(eq(serversApiPingSettings.id, 1))
-      .run()
   } finally {
     collecting = false
   }
diff --git a/backend/src/services/sqlite-write-opt.test.ts b/backend/src/services/sqlite-write-opt.test.ts
deleted file mode 100644
index b09556a..0000000
--- a/backend/src/services/sqlite-write-opt.test.ts
+++ /dev/null
@@ -1,144 +0,0 @@
-import assert from "node:assert/strict"
-import { randomUUID } from "node:crypto"
-import { countSqliteWrites, sqliteDatabase } from "../db/index.js"
-import { events } from "../db/schema.js"
-import { db } from "../db/index.js"
-import {
-  attachEngineSqlite,
-  bumpPacketMeta,
-  configureEngine,
-  flushPending,
-  ingestParsedFlowsForServerForTests,
-  resetEngineForTests,
-  setEngineError,
-} from "./traffic-flow-engine.js"
-import { collectGreBgpSnapshotOnce } from "./gre-bgp-snapshot-collector.js"
-import { shouldAppendSchedulerOkEvent, executeSchedulerJob } from "./scheduler.js"
-import { savePrevLiveMap, loadPrevLiveMap } from "./alert-engine/prev-live-store.js"
-import {
-  invalidateFlowCatalogCache,
-  loadFlowTopology,
-  seedFlowTopologyForTests,
-} from "./traffic-flow-topology.js"
-
-resetEngineForTests()
-attachEngineSqlite(sqliteDatabase)
-seedFlowTopologyForTests(null)
-invalidateFlowCatalogCache()
-
-const idle1 = countSqliteWrites(() => {
-  flushPending()
-})
-assert.equal(idle1.stats.walCheckpoint, 0)
-assert.ok(idle1.stats.update >= 1, "first idle flush persists listener stats")
-
-const idle2 = countSqliteWrites(() => {
-  flushPending()
-})
-assert.equal(idle2.stats.update, 0, "unchanged listener stats skip UPDATE")
-assert.equal(idle2.stats.walCheckpoint, 0)
-
-bumpPacketMeta("203.0.113.9")
-const changed = countSqliteWrites(() => {
-  flushPending()
-})
-assert.equal(changed.stats.update, 1, "changed packets persist once")
-assert.equal(changed.stats.walCheckpoint, 0)
-
-setEngineError("boom")
-const errWrite = countSqliteWrites(() => {
-  flushPending()
-})
-assert.equal(errWrite.stats.update, 1)
-setEngineError("")
-flushPending()
-
-resetEngineForTests()
-configureEngine({ topN: 20 })
-ingestParsedFlowsForServerForTests(9, [{
-  src: "10.1.1.1",
-  dst: "8.8.8.8",
-  proto: 6,
-  srcPort: 40000,
-  dstPort: 443,
-  bytes: 100,
-  packets: 1,
-  inIface: "2",
-  outIface: "",
-}])
-const withData = countSqliteWrites(() => {
-  flushPending()
-})
-assert.equal(withData.stats.walCheckpoint, 0, "flush with data must not TRUNCATE WAL")
-assert.ok(withData.stats.insert >= 1, "flow upsert writes")
-
-sqliteDatabase.prepare(`DELETE FROM flow_buckets WHERE server_id = 9`).run()
-sqliteDatabase.prepare(`DELETE FROM flow_minute_stats WHERE server_id = 9`).run()
-sqliteDatabase.prepare(`DELETE FROM flow_minute_dims WHERE server_id = 9`).run()
-sqliteDatabase.prepare(`DELETE FROM flow_daily_dims WHERE server_id = 9`).run()
-
-const plan = sqliteDatabase.prepare(`
-  EXPLAIN QUERY PLAN
-  SELECT id FROM flow_buckets WHERE bucket_at >= ? ORDER BY bytes DESC LIMIT 100
-`).all("2000-01-01T00:00:00.000Z") as Array<{ detail?: string }>
-const planText = plan.map((p) => String(p.detail ?? "")).join(" | ")
-assert.ok(planText.length > 0, "EXPLAIN QUERY PLAN returned rows")
-
-invalidateFlowCatalogCache()
-seedFlowTopologyForTests(null)
-const topoA = loadFlowTopology()
-const topoB = loadFlowTopology()
-assert.equal(topoA, topoB, "topology cache returns same object")
-invalidateFlowCatalogCache()
-const topoC = loadFlowTopology()
-assert.notEqual(topoA, topoC, "invalidate rebuilds topology")
-
-assert.equal(shouldAppendSchedulerOkEvent("traffic"), false)
-assert.equal(shouldAppendSchedulerOkEvent("alert_engine"), false)
-assert.equal(shouldAppendSchedulerOkEvent("gre_bgp"), false)
-assert.equal(shouldAppendSchedulerOkEvent("backups"), true)
-assert.equal(shouldAppendSchedulerOkEvent("certificates_renew"), true)
-assert.equal(shouldAppendSchedulerOkEvent("internet_path"), true)
-
-savePrevLiveMap("gre", { a: "up" })
-const prevSame = countSqliteWrites(() => {
-  savePrevLiveMap("gre", { a: "up" })
-})
-assert.equal(prevSame.stats.update, 0)
-assert.equal(prevSame.stats.insert, 0)
-savePrevLiveMap("gre", { a: "down" })
-assert.equal(loadPrevLiveMap("gre").a, "down")
-savePrevLiveMap("gre", { a: "up" })
-
-const greBefore = sqliteDatabase.prepare(`SELECT COUNT(*) AS n FROM alert_gre_tunnel_samples`).get() as { n: number }
-const bgpBefore = sqliteDatabase.prepare(`SELECT COUNT(*) AS n FROM alert_bgp_peer_samples`).get() as { n: number }
-await collectGreBgpSnapshotOnce()
-const greAfter = sqliteDatabase.prepare(`SELECT COUNT(*) AS n FROM alert_gre_tunnel_samples`).get() as { n: number }
-const bgpAfter = sqliteDatabase.prepare(`SELECT COUNT(*) AS n FROM alert_bgp_peer_samples`).get() as { n: number }
-assert.equal(greAfter.n, greBefore.n)
-assert.equal(bgpAfter.n, bgpBefore.n)
-
-const oldId = `evt-old-${randomUUID()}`
-db.insert(events).values({
-  id: oldId,
-  createdAt: new Date(Date.now() - 40 * 24 * 60 * 60 * 1000).toISOString(),
-  level: "info",
-  eventType: "test.retention",
-  sourceModule: "system",
-  title: "old",
-  message: "old",
-}).run()
-const eventsBefore = sqliteDatabase.prepare(
-  `SELECT COUNT(*) AS n FROM events WHERE event_type = 'scheduler.job.ok' AND entity_id = 'alert_engine'`,
-).get() as { n: number }
-await executeSchedulerJob("alert_engine")
-const oldGone = sqliteDatabase.prepare(`SELECT COUNT(*) AS n FROM events WHERE id = ?`).get(oldId) as { n: number }
-assert.equal(oldGone.n, 0, "events older than 30 days are purged")
-const eventsAfter = sqliteDatabase.prepare(
-  `SELECT COUNT(*) AS n FROM events WHERE event_type = 'scheduler.job.ok' AND entity_id = 'alert_engine'`,
-).get() as { n: number }
-assert.equal(eventsAfter.n, eventsBefore.n, "quiet jobs do not append scheduler.job.ok")
-
-resetEngineForTests()
-console.log("sqlite-write-opt.test.ts: ok")
-console.log("EXPLAIN listStoredFlowRows:", planText)
diff --git a/backend/src/services/system-database-backup.ts b/backend/src/services/system-database-backup.ts
index 3a2e8a7..78cfbd3 100644
--- a/backend/src/services/system-database-backup.ts
+++ b/backend/src/services/system-database-backup.ts
@@ -1,68 +1,78 @@
 import { randomUUID } from "node:crypto"
+import { spawn } from "node:child_process"
 import { mkdir, readFile, rm, writeFile } from "node:fs/promises"
 import os from "node:os"
 import path from "node:path"
-import Database from "better-sqlite3"
 import { env } from "../config.js"
-import { beginSqliteExclusiveOp, endSqliteExclusiveOp, reopenSqlite, sqliteDatabase } from "../db/index.js"
+import { withAdvisoryLock } from "../db/index.js"
 import { refreshScheduler, stopScheduler } from "./scheduler.js"
 import {
-  reattachFlowSqlite,
   startTrafficFlowListener,
   stopTrafficFlowListener,
 } from "./traffic-flow-ingest.js"
 
-const SQLITE_MAGIC = Buffer.from("SQLite format 3\0")
+const PG_DUMP_MAGIC = Buffer.from("PGDMP")
 const MAX_RESTORE_BYTES = 512 * 1024 * 1024
-
-type SqliteHandle = InstanceType<typeof Database>
+const BACKUP_LOCK_KEY = 8_723_102
 
 function fmtTimestamp(date = new Date()): string {
   const pad = (n: number) => String(n).padStart(2, "0")
   return `${date.getFullYear()}-${pad(date.getMonth() + 1)}-${pad(date.getDate())}_${pad(date.getHours())}-${pad(date.getMinutes())}-${pad(date.getSeconds())}`
 }
 
-function resolveDatabasePath(): string {
-  return path.resolve(process.cwd(), env.DATABASE_PATH)
-}
-
-function assertSqliteFile(buffer: Buffer): void {
-  if (buffer.length < SQLITE_MAGIC.length) {
-    throw new Error("Файл слишком маленький для SQLite")
+function assertPgDumpFile(buffer: Buffer): void {
+  if (buffer.length < PG_DUMP_MAGIC.length) {
+    throw new Error("Файл слишком маленький для дампа PostgreSQL")
   }
-  if (!buffer.subarray(0, SQLITE_MAGIC.length).equals(SQLITE_MAGIC)) {
-    throw new Error("Файл не похож на резервную копию SQLite")
+  if (!buffer.subarray(0, PG_DUMP_MAGIC.length).equals(PG_DUMP_MAGIC)) {
+    throw new Error("Файл не похож на резервную копию PostgreSQL (ожидается формат custom, PGDMP)")
   }
 }
 
-async function withDatabaseOperation<T>(fn: () => Promise<T> | T): Promise<T> {
-  beginSqliteExclusiveOp()
-  stopTrafficFlowListener()
-  stopScheduler()
-  try {
-    return await fn()
-  } finally {
-    startTrafficFlowListener()
-    refreshScheduler()
-    endSqliteExclusiveOp()
-  }
+function spawnCollected(command: string, args: string[], opts?: { stdin?: Buffer }): Promise<Buffer> {
+  return new Promise((resolve, reject) => {
+    const child = spawn(command, args, {
+      env: { ...process.env, DATABASE_URL: env.DATABASE_URL },
+      stdio: ["pipe", "pipe", "pipe"],
+    })
+    const chunks: Buffer[] = []
+    let err = ""
+    child.stdout.on("data", (chunk: Buffer) => chunks.push(chunk))
+    child.stderr.on("data", (chunk: Buffer) => {
+      err += chunk.toString("utf8")
+    })
+    child.on("error", reject)
+    child.on("close", (code) => {
+      if (code !== 0) {
+        reject(new Error(err.trim() || `${command} завершился с кодом ${code}`))
+        return
+      }
+      resolve(Buffer.concat(chunks))
+    })
+    if (opts?.stdin) child.stdin.end(opts.stdin)
+    else child.stdin.end()
+  })
+}
+
+async function withDatabaseOperation<T>(fn: () => Promise<T>): Promise<T> {
+  return await withAdvisoryLock(BACKUP_LOCK_KEY, async () => {
+    stopTrafficFlowListener()
+    stopScheduler()
+    try {
+      return await fn()
+    } finally {
+      await startTrafficFlowListener()
+      await refreshScheduler()
+    }
+  })
 }
 
 export async function exportSystemDatabaseBackup(): Promise<{ filename: string; buffer: Buffer }> {
-  return withDatabaseOperation(async () => {
-    sqliteDatabase.pragma("wal_checkpoint(TRUNCATE)")
-    const tempDir = path.join(os.tmpdir(), "mmapp-db-backup")
-    await mkdir(tempDir, { recursive: true })
-    const tempPath = path.join(tempDir, `manager-${randomUUID()}.db`)
-    try {
-      await sqliteDatabase.backup(tempPath)
-      const buffer = await readFile(tempPath)
-      return {
-        filename: `mikrotik-manager_${fmtTimestamp()}.db`,
-        buffer,
-      }
-    } finally {
-      await rm(tempPath, { force: true })
+  return await withDatabaseOperation(async () => {
+    const buffer = await spawnCollected("pg_dump", ["-Fc", env.DATABASE_URL])
+    return {
+      filename: `mikrotik-manager_${fmtTimestamp()}.dump`,
+      buffer,
     }
   })
 }
@@ -71,27 +81,21 @@ export async function restoreSystemDatabaseBackup(buffer: Buffer): Promise<void>
   if (buffer.length > MAX_RESTORE_BYTES) {
     throw new Error("Файл бэкапа слишком большой")
   }
-  assertSqliteFile(buffer)
+  assertPgDumpFile(buffer)
 
   await withDatabaseOperation(async () => {
     const tempDir = path.join(os.tmpdir(), "mmapp-db-restore")
     await mkdir(tempDir, { recursive: true })
-    const tempPath = path.join(tempDir, `restore-${randomUUID()}.db`)
-    let source: SqliteHandle | null = null
+    const tempPath = path.join(tempDir, `restore-${randomUUID()}.dump`)
     try {
       await writeFile(tempPath, buffer)
-      source = new Database(tempPath, { readonly: true, fileMustExist: true })
-      await source.backup(resolveDatabasePath())
-      reopenSqlite()
-      reattachFlowSqlite()
-      sqliteDatabase.pragma("wal_checkpoint(TRUNCATE)")
+      await spawnCollected("pg_restore", ["--clean", "--if-exists", "-d", env.DATABASE_URL, tempPath])
     } finally {
-      source?.close()
       await rm(tempPath, { force: true })
     }
   })
 }
 
 export function getSystemDatabasePath(): string {
-  return resolveDatabasePath()
+  return env.DATABASE_URL
 }
diff --git a/backend/src/services/traffic-collector.ts b/backend/src/services/traffic-collector.ts
index 8a688c2..d162b9e 100644
--- a/backend/src/services/traffic-collector.ts
+++ b/backend/src/services/traffic-collector.ts
@@ -64,38 +64,36 @@ function toNum(raw: unknown): number {
   return Number.isFinite(n) ? Math.max(0, Math.round(n)) : 0
 }
 
-function getSettingsRow() {
-  const row = db.select().from(trafficSettings).where(eq(trafficSettings.id, 1)).limit(1).all()[0]
+async function getSettingsRow() {
+  const row = (await db.select().from(trafficSettings).where(eq(trafficSettings.id, 1)).limit(1))[0]
   if (row) return row
   const now = new Date().toISOString()
-  db.insert(trafficSettings).values({
+  await db.insert(trafficSettings).values({
     id: 1,
     enabled: true,
     intervalSec: 30,
     retentionDays: 14,
     createdAt: now,
     updatedAt: now,
-  }).run()
-  return db.select().from(trafficSettings).where(eq(trafficSettings.id, 1)).limit(1).all()[0]
+  })
+  return (await db.select().from(trafficSettings).where(eq(trafficSettings.id, 1)).limit(1))[0]
 }
 
-function cleanupOldSamples(retentionDays: number) {
+async function cleanupOldSamples(retentionDays: number) {
   const cutoff = new Date(Date.now() - retentionDays * 24 * 60 * 60 * 1000).toISOString()
-  db.delete(trafficSamples)
+  await db.delete(trafficSamples)
     .where(lt(trafficSamples.sampledAt, cutoff))
-    .run()
 }
 
-function readPreviousWave(serverId: number): Map<string, { rxBytes: number; txBytes: number; sampledAt: string }> {
-  const last = db
+async function readPreviousWave(serverId: number): Promise<Map<string, { rxBytes: number; txBytes: number; sampledAt: string }>> {
+  const last = (await db
     .select({ sampledAt: trafficSamples.sampledAt })
     .from(trafficSamples)
     .where(eq(trafficSamples.serverId, serverId))
     .orderBy(desc(trafficSamples.sampledAt))
-    .limit(1)
-    .all()[0]
+    .limit(1))[0]
   if (!last) return new Map()
-  const rows = db
+  const rows = await db
     .select({
       interfaceName: trafficSamples.interfaceName,
       peerPublicKey: trafficSamples.peerPublicKey,
@@ -108,7 +106,6 @@ function readPreviousWave(serverId: number): Map<string, { rxBytes: number; txBy
       eq(trafficSamples.serverId, serverId),
       eq(trafficSamples.sampledAt, last.sampledAt),
     ))
-    .all()
   return new Map(rows.map((r) => [`${r.interfaceName}\0${r.peerPublicKey ?? ""}`, r]))
 }
 
@@ -126,7 +123,7 @@ export async function collectTrafficOnce(): Promise<TrafficRunSnapshot> {
   collecting = true
   const startedAt = Date.now()
   const now = sampledAt
-  const settings = getSettingsRow()
+  const settings = await getSettingsRow()
   const snapshot: TrafficRunSnapshot = {
     v: SCHEDULER_RUN_SNAPSHOT_VERSION,
     job: "traffic",
@@ -135,7 +132,7 @@ export async function collectTrafficOnce(): Promise<TrafficRunSnapshot> {
   }
 
   try {
-    const enabledServers = db.select().from(servers).where(eq(servers.enabled, true)).all()
+    const enabledServers = await db.select().from(servers).where(eq(servers.enabled, true))
 
     for (const srv of enabledServers) {
       const name = srv.name || srv.host
@@ -143,7 +140,7 @@ export async function collectTrafficOnce(): Promise<TrafficRunSnapshot> {
         const client = MikrotikClient.fromServer(srv)
         const ifaces = await client.get<RosIfaceTraffic[]>("/interface")
         rememberServerIfaces(srv.id, ifaces)
-        const prevWave = readPreviousWave(srv.id)
+        const prevWave = await readPreviousWave(srv.id)
         const nowMs = Date.parse(now)
         let sumRxMbps = 0
         let sumTxMbps = 0
@@ -205,7 +202,7 @@ export async function collectTrafficOnce(): Promise<TrafficRunSnapshot> {
           /* WG peers optional — iface samples already recorded */
         }
         if (rows.length > 0) {
-          db.insert(trafficSamples).values(rows).run()
+          await db.insert(trafficSamples).values(rows)
         }
         snapshot.servers.push({
           serverId: srv.id,
@@ -227,22 +224,22 @@ export async function collectTrafficOnce(): Promise<TrafficRunSnapshot> {
       }
     }
 
-    cleanupOldSamples(Math.max(1, settings.retentionDays))
-    db.update(trafficSettings).set({
+    await cleanupOldSamples(Math.max(1, settings.retentionDays))
+    await db.update(trafficSettings).set({
       lastCollectedAt: now,
       lastDurationMs: Date.now() - startedAt,
       lastError: "",
       updatedAt: now,
-    }).where(eq(trafficSettings.id, 1)).run()
+    }).where(eq(trafficSettings.id, 1))
   } catch (e) {
     const msg = e instanceof Error ? e.message : String(e)
     snapshot.fatalError = msg
-    db.update(trafficSettings).set({
+    await db.update(trafficSettings).set({
       lastCollectedAt: now,
       lastDurationMs: Date.now() - startedAt,
       lastError: msg,
       updatedAt: now,
-    }).where(eq(trafficSettings.id, 1)).run()
+    }).where(eq(trafficSettings.id, 1))
   } finally {
     collecting = false
   }
@@ -254,8 +251,8 @@ export function stopTrafficCollector() {}
 
 export function restartTrafficCollector() {}
 
-export function getTrafficCollectorState(): TrafficCollectorState {
-  const s = getSettingsRow()
+export async function getTrafficCollectorState(): Promise<TrafficCollectorState> {
+  const s = await getSettingsRow()
   return {
     running: Boolean(s.enabled),
     lastRunAt: s.lastCollectedAt ?? null,
@@ -263,38 +260,37 @@ export function getTrafficCollectorState(): TrafficCollectorState {
   }
 }
 
-/** Идёт активный прогон `collectTrafficOnce` (запись в SQLite ещё не завершена). */
+/** Идёт активный прогон `collectTrafficOnce` (запись в PostgreSQL ещё не завершена). */
 export function isTrafficCollecting(): boolean {
   return collecting
 }
 
-export function getTrafficSettings() {
-  return getSettingsRow()
+export async function getTrafficSettings() {
+  return await getSettingsRow()
 }
 
-export function updateTrafficSettings(patch: {
+export async function updateTrafficSettings(patch: {
   enabled?: boolean
   intervalSec?: number
   retentionDays?: number
 }) {
-  const prev = getSettingsRow()
+  const prev = await getSettingsRow()
   const next = {
     enabled: patch.enabled ?? prev.enabled,
     intervalSec: patch.intervalSec ?? prev.intervalSec,
     retentionDays: patch.retentionDays ?? prev.retentionDays,
     updatedAt: new Date().toISOString(),
   }
-  db.update(trafficSettings).set(next).where(eq(trafficSettings.id, 1)).run()
-  return getSettingsRow()
+  await db.update(trafficSettings).set(next).where(eq(trafficSettings.id, 1))
+  return await getSettingsRow()
 }
 
-export function readServerSamplesInRange(serverId: number, sinceIso: string) {
-  return db.select()
+export async function readServerSamplesInRange(serverId: number, sinceIso: string) {
+  return await db.select()
     .from(trafficSamples)
     .where(and(
       eq(trafficSamples.serverId, serverId),
       gte(trafficSamples.sampledAt, sinceIso),
     ))
     .orderBy(asc(trafficSamples.sampledAt))
-    .all()
 }
diff --git a/backend/src/services/traffic-flow-analytics.test.ts b/backend/src/services/traffic-flow-analytics.test.ts
index 60561bd..b3afb7f 100644
--- a/backend/src/services/traffic-flow-analytics.test.ts
+++ b/backend/src/services/traffic-flow-analytics.test.ts
@@ -5,7 +5,8 @@ import {
   resetFlowRingsForTests,
 } from "./traffic-flow-ingest.js"
 import { buildFlowAnalytics, formatLiveSseFromBuilder, getFlowMonthly, listFlowClients, listFlowExporters } from "./traffic-flow-analytics.js"
-import { sqliteDatabase } from "../db/index.js"
+import { withPgOrSkip } from "../test/pg.js"
+import { dbQuery } from "../db/index.js"
 import { seedFlowTopologyForTests, type FlowTopology } from "./traffic-flow-topology.js"
 import { disableCatalogFetchForTests, resetFlowCatalogForTests, seedFlowCatalogForTests } from "./traffic-flow-classify.js"
 import {
@@ -15,6 +16,11 @@ import {
   seedRipeCacheForTests,
 } from "./traffic-flow-ripe.js"
 
+if (!(await withPgOrSkip())) {
+  console.log("traffic-flow-analytics.test.ts: skip")
+  process.exit(0)
+}
+
 disableCatalogFetchForTests()
 resetFlowCatalogForTests()
 disableRipePersistForTests()
@@ -63,7 +69,7 @@ ingestParsedFlowsForServerForTests(7, [
 ])
 
 try {
-  const all = buildFlowAnalytics({ minutes: 5, serverId: 7 })
+  const all = await buildFlowAnalytics({ minutes: 5, serverId: 7 })
   assert.equal(all.applications[0]?.label, "HTTPS")
   assert.ok(all.protocols.some((p) => p.label === "TCP"))
   assert.equal(all.ifaces[0]?.name, "ether1")
@@ -75,14 +81,14 @@ try {
   assert.equal(conv.application, "HTTPS")
   assert.ok(!/^\d+$/.test(conv.inIface))
 
-  const filtered = buildFlowAnalytics({ minutes: 5, serverId: 7, iface: "ether1" })
+  const filtered = await buildFlowAnalytics({ minutes: 5, serverId: 7, iface: "ether1" })
   assert.ok(filtered.bytes >= 12_000)
   assert.equal(filtered.ifaces[0]?.name, "ether1")
 
-  const miss = buildFlowAnalytics({ minutes: 5, serverId: 7, iface: "wg-flow" })
+  const miss = await buildFlowAnalytics({ minutes: 5, serverId: 7, iface: "wg-flow" })
   assert.equal(miss.conversations, 0)
 
-  const other = buildFlowAnalytics({ minutes: 5, serverId: 99 })
+  const other = await buildFlowAnalytics({ minutes: 5, serverId: 99 })
   assert.equal(other.conversations, 0)
 } finally {
   resetFlowRingsForTests()
@@ -121,10 +127,10 @@ ingestParsedFlowsForServerForTests(7, [
   },
 ])
 try {
-  const summed = buildFlowAnalytics({ minutes: 5, serverId: 7, dedup: false })
+  const summed = await buildFlowAnalytics({ minutes: 5, serverId: 7, dedup: false })
   assert.equal(summed.bytes, 21_000)
   assert.equal(summed.conversations, 2)
-  const deduped = buildFlowAnalytics({ minutes: 5, serverId: 7, dedup: true })
+  const deduped = await buildFlowAnalytics({ minutes: 5, serverId: 7, dedup: true })
   assert.equal(deduped.bytes, 12_000)
   assert.equal(deduped.conversations, 1)
   assert.equal(deduped.dedupApplied, true)
@@ -165,7 +171,7 @@ ingestParsedFlowsForServerForTests(7, [
   },
 ])
 try {
-  const geo = buildFlowAnalytics({ minutes: 5, serverId: 7 })
+  const geo = await buildFlowAnalytics({ minutes: 5, serverId: 7 })
   assert.equal(geo.categories?.[0]?.label, "Игры")
   assert.ok(geo.asns?.some((r) => r.label.includes("AS15169")))
   assert.equal(geo.countries?.[0]?.id, "US")
@@ -210,7 +216,7 @@ ingestParsedFlowsForServerForTests(7, [
   },
 ])
 try {
-  const cf = buildFlowAnalytics({ minutes: 5, serverId: 7 })
+  const cf = await buildFlowAnalytics({ minutes: 5, serverId: 7 })
   assert.equal(cf.countries?.[0]?.id, "US")
   assert.ok(cf.mapEdges?.every((e) => e.toCountry !== "?"))
   assert.equal(cf.services?.[0]?.label, "Cloudflare")
@@ -238,7 +244,7 @@ try {
       outIface: "",
     },
   ])
-  const degraded = buildFlowAnalytics({ minutes: 5, serverId: 7, skipHeavy: true })
+  const degraded = await buildFlowAnalytics({ minutes: 5, serverId: 7, skipHeavy: true })
   assert.equal(degraded.degraded, true)
   assert.equal(degraded.conversationsList.length, 0)
   assert.ok((degraded.bytes ?? 0) >= 12_000)
@@ -249,30 +255,35 @@ try {
   assert.equal((liveErr.data as { error: string }).error, "SQLITE_BUSY")
   const liveOk = formatLiveSseFromBuilder(() => ({ ok: true }))
   assert.equal(liveOk.event, "sample")
-  const exporters = listFlowExporters(5)
-  const clients = listFlowClients(5)
+  const exporters = await listFlowExporters(5)
+  const clients = await listFlowClients(5)
   assert.ok(Array.isArray(exporters.exporters))
   assert.ok(Array.isArray(clients.clients))
   resetFlowRingsForTests()
 }
 
 {
-  sqliteDatabase.prepare(`DELETE FROM flow_daily_dims WHERE server_id = 7 AND day LIKE '2026-09-%'`).run()
-  sqliteDatabase.exec(`
-    INSERT INTO flow_daily_dims (server_id, day, dim, key, bytes, packets)
-    VALUES
-      (7, '2026-09-01', 'country', 'US', 1000, 10),
-      (7, '2026-09-02', 'country', 'US', 500, 5),
-      (7, '2026-09-01', 'service', 'steam', 800, 8),
-      (7, '2026-09-01', 'asn', '15169', 900, 9),
-      (7, '2026-09-01', 'asn', 'other', 100, 1)
-  `)
-  const monthly = getFlowMonthly("2026-09", 7)
-  assert.equal(monthly.bytes, 1500)
-  assert.equal(monthly.countries[0]?.id, "US")
-  assert.equal(monthly.countries[0]?.bytes, 1500)
-  assert.ok(monthly.asns.some((row) => row.id === "other"))
-  sqliteDatabase.prepare(`DELETE FROM flow_daily_dims WHERE server_id = 7 AND day LIKE '2026-09-%'`).run()
+  if (await withPgOrSkip()) {
+    const { pool } = await import("../db/index.js")
+    const { ensurePartitionFor } = await import("../db/partitions.js")
+    await ensurePartitionFor(pool, "flow_daily_dims", "month", new Date("2026-09-01T00:00:00Z"))
+    await dbQuery(`DELETE FROM flow_daily_dims WHERE server_id = 7 AND day >= '2026-09-01' AND day < '2026-10-01'`)
+    await dbQuery(`
+      INSERT INTO flow_daily_dims (server_id, day, dim, key, bytes, packets)
+      VALUES
+        (7, '2026-09-01', 'country', 'US', 1000, 10),
+        (7, '2026-09-02', 'country', 'US', 500, 5),
+        (7, '2026-09-01', 'service', 'steam', 800, 8),
+        (7, '2026-09-01', 'asn', '15169', 900, 9),
+        (7, '2026-09-01', 'asn', 'other', 100, 1)
+    `)
+    const monthly = await getFlowMonthly("2026-09", 7)
+    assert.equal(monthly.bytes, 1500)
+    assert.equal(monthly.countries[0]?.id, "US")
+    assert.equal(monthly.countries[0]?.bytes, 1500)
+    assert.ok(monthly.asns.some((row) => row.id === "other"))
+    await dbQuery(`DELETE FROM flow_daily_dims WHERE server_id = 7 AND day >= '2026-09-01' AND day < '2026-10-01'`)
+  }
 }
 
 {
@@ -353,7 +364,7 @@ try {
     },
   ])
   try {
-    const def = buildFlowAnalytics({ minutes: 5, serverId: 7 })
+    const def = await buildFlowAnalytics({ minutes: 5, serverId: 7 })
     assert.equal(def.bytes, 12_000)
     assert.equal(def.bytesPayload, 12_000)
     assert.equal(def.bytesOverlay, 5_000_000)
@@ -371,7 +382,7 @@ try {
     assert.equal(path.clientName, "Alice")
     assert.equal(path.enName, "NSK-SERVHOST-RTK")
     assert.equal(path.dst, "173.194.160.163")
-    const withAll = buildFlowAnalytics({ minutes: 5, serverId: 7, excludeOverlay: false, excludeMesh: false })
+    const withAll = await buildFlowAnalytics({ minutes: 5, serverId: 7, excludeOverlay: false, excludeMesh: false })
     assert.equal(withAll.bytes, 12_000 + 5_000_000 + 8000)
     assert.ok(withAll.conversationsList.some((r) => r.plane === "overlay"))
     assert.ok(withAll.conversationsList.some((r) => r.plane === "client_mesh"))
@@ -415,7 +426,7 @@ try {
     },
   ])
   try {
-    const rev = buildFlowAnalytics({ minutes: 5, serverId: 7 })
+    const rev = await buildFlowAnalytics({ minutes: 5, serverId: 7 })
     const google = rev.conversationsList.find((r) => r.src === "173.194.151.65")
     const cf = rev.conversationsList.find((r) => r.src === "104.18.35.51")
     assert.equal(google?.service, "Google")
@@ -430,37 +441,42 @@ try {
 }
 
 {
-  resetFlowRingsForTests()
-  resetIfaceCacheForTests()
-  const sidRow = sqliteDatabase.prepare(`SELECT id FROM servers LIMIT 1`).get() as { id?: number } | undefined
-  if (sidRow?.id) {
-    const sid = sidRow.id
-    rememberServerIfaces(sid, [{ ".id": "*4", name: "gre-en-nsk" }])
-    ingestParsedFlowsForServerForTests(sid, [{
-      src: "10.100.1.17",
-      dst: "8.8.8.8",
-      proto: 6,
-      srcPort: 1,
-      dstPort: 443,
-      bytes: 100,
-      packets: 1,
-      inIface: "4",
-      outIface: "4",
-    }])
-    sqliteDatabase.prepare(`
-      INSERT INTO traffic_samples (server_id, interface_name, sampled_at, rx_bytes, tx_bytes, rx_bps, tx_bps)
-      VALUES (?, 'gre-en-nsk', datetime('now'), 9000000, 1000000, 40000000, 2000000)
-    `).run(sid)
-    try {
-      const wire = buildFlowAnalytics({ minutes: 5, serverId: sid })
-      assert.ok((wire.bpsWire ?? 0) >= 40_000_000)
-      assert.notEqual(wire.bpsWire, (wire.bytes * 8) / 300)
-    } finally {
-      sqliteDatabase.prepare(`DELETE FROM traffic_samples WHERE server_id = ? AND interface_name = 'gre-en-nsk'`).run(sid)
+  if (await withPgOrSkip()) {
+    resetFlowRingsForTests()
+    resetIfaceCacheForTests()
+    const sidRow = await dbQuery<{ id: number }>(`SELECT id FROM servers LIMIT 1`)
+    const sid = sidRow.rows[0]?.id
+    if (sid) {
+      const { pool } = await import("../db/index.js")
+      const { ensurePartitionFor } = await import("../db/partitions.js")
+      await ensurePartitionFor(pool, "traffic_samples", "week", new Date())
+      rememberServerIfaces(sid, [{ ".id": "*4", name: "gre-en-nsk" }])
+      ingestParsedFlowsForServerForTests(sid, [{
+        src: "10.100.1.17",
+        dst: "8.8.8.8",
+        proto: 6,
+        srcPort: 1,
+        dstPort: 443,
+        bytes: 100,
+        packets: 1,
+        inIface: "4",
+        outIface: "4",
+      }])
+      await dbQuery(`
+        INSERT INTO traffic_samples (server_id, interface_name, sampled_at, rx_bytes, tx_bytes, rx_bps, tx_bps)
+        VALUES ($1, 'gre-en-nsk', now(), 9000000, 1000000, 40000000, 2000000)
+      `, [sid])
+      try {
+        const wire = await buildFlowAnalytics({ minutes: 5, serverId: sid })
+        assert.ok((wire.bpsWire ?? 0) >= 40_000_000)
+        assert.notEqual(wire.bpsWire, (wire.bytes * 8) / 300)
+      } finally {
+        await dbQuery(`DELETE FROM traffic_samples WHERE server_id = $1 AND interface_name = 'gre-en-nsk'`, [sid])
+      }
     }
+    resetFlowRingsForTests()
+    resetIfaceCacheForTests()
   }
-  resetFlowRingsForTests()
-  resetIfaceCacheForTests()
 }
 
 console.log("traffic-flow-analytics.test.ts: ok")
diff --git a/backend/src/services/traffic-flow-analytics.ts b/backend/src/services/traffic-flow-analytics.ts
index 650f922..6df9b84 100644
--- a/backend/src/services/traffic-flow-analytics.ts
+++ b/backend/src/services/traffic-flow-analytics.ts
@@ -1,5 +1,5 @@
 import { eq } from "drizzle-orm"
-import { db, sqliteDatabase } from "../db/index.js"
+import { db, dbAll } from "../db/index.js"
 import { appUsers, userInterfaceBindings } from "../db/schema.js"
 import type {
   FlowAnalyticsDto,
@@ -94,9 +94,9 @@ function bump(
   map.set(id, prev)
 }
 
-function userIfaceAllow(userId: string): Map<number, Set<string>> | null {
+async function userIfaceAllow(userId: string): Promise<Map<number, Set<string>> | null> {
   if (!userId) return null
-  const binds = db.select().from(userInterfaceBindings).where(eq(userInterfaceBindings.userId, userId)).all()
+  const binds = await db.select().from(userInterfaceBindings).where(eq(userInterfaceBindings.userId, userId))
   const allow = new Map<number, Set<string>>()
   for (const b of binds) {
     const set = allow.get(b.serverId) ?? new Set<string>()
@@ -142,13 +142,13 @@ function topLabel(map: Map<string, { bytes: number; packets: number; label?: str
   return best
 }
 
-export function buildFlowAnalytics(q: FlowAnalyticsQuery): FlowAnalyticsDto {
+export async function buildFlowAnalytics(q: FlowAnalyticsQuery): Promise<FlowAnalyticsDto> {
   const key = analyticsQueryKey(q)
   const now = Date.now()
   if (analyticsCache && analyticsCache.key === key && now - analyticsCache.at < ANALYTICS_CACHE_TTL_MS) {
     return analyticsCache.dto
   }
-  const dto = buildFlowAnalyticsUncached(q)
+  const dto = await buildFlowAnalyticsUncached(q)
   analyticsCache = { key, at: now, dto }
   return dto
 }
@@ -174,20 +174,20 @@ function analyticsQueryKey(q: FlowAnalyticsQuery): string {
 const ANALYTICS_CACHE_TTL_MS = 2000
 let analyticsCache: { key: string; at: number; dto: FlowAnalyticsDto } | null = null
 
-function buildFlowAnalyticsUncached(q: FlowAnalyticsQuery): FlowAnalyticsDto {
-  const settings = getTrafficFlowSettingsRow()
+async function buildFlowAnalyticsUncached(q: FlowAnalyticsQuery): Promise<FlowAnalyticsDto> {
+  const settings = await getTrafficFlowSettingsRow()
   const top = Math.min(50, Math.max(10, settings.topN))
   const windowSec = Math.max(60, q.minutes * 60)
-  const raw = listFlowRowsForWindow(q.minutes)
-  const allow = q.userId ? userIfaceAllow(q.userId) : null
-  const catalog = getServerCatalog()
+  const raw = await listFlowRowsForWindow(q.minutes)
+  const allow = q.userId ? await userIfaceAllow(q.userId) : null
+  const catalog = await getServerCatalog()
   const nameById = new Map([...catalog.byId].map(([id, s]) => [id, s.name]))
   const countryById = new Map([...catalog.byId].map(([id, s]) => [id, s.country]))
   const ifaceFilter = q.iface && q.iface !== "__all__" ? q.iface : ""
   const wantDedup = q.dedup !== false && !ifaceFilter
   const excludeMesh = q.excludeMesh !== false
   const excludeOverlay = q.excludeOverlay !== false
-  const topo = loadFlowTopology()
+  const topo = await loadFlowTopology()
 
   refreshFlowCatalogInBackground()
 
@@ -447,7 +447,7 @@ function buildFlowAnalyticsUncached(q: FlowAnalyticsQuery): FlowAnalyticsDto {
     ? getRingMbps(ringServer, RING_OVERLAY)
     : { rxNow: 0, txNow: 0 }
   const greNames = ringServer ? enGreIfaceNames(topo, ringServer, [...ifacesForWire]) : []
-  const wire = ringServer ? latestWireBps(ringServer, greNames) : { bps: 0, bytes: 0 }
+  const wire = ringServer ? await latestWireBps(ringServer, greNames) : { bps: 0, bytes: 0 }
 
   return {
     bpsNow: (ring.rxNow + ring.txNow) * 1_000_000 || (totalBytes * 8) / windowSec,
@@ -505,13 +505,13 @@ function summarizeByServer(rows: PendingFlowRow[]) {
   return { bytes, sessions }
 }
 
-export function listFlowExporters(minutes: number): FlowExportersDto {
-  const runtime = getFlowRuntimeCounters()
-  const rows = listFlowRowsForWindow(minutes)
+export async function listFlowExporters(minutes: number): Promise<FlowExportersDto> {
+  const runtime = await getFlowRuntimeCounters()
+  const rows = await listFlowRowsForWindow(minutes)
   const { bytes, sessions } = summarizeByServer(rows)
   const ids = new Set<number>([...bytes.keys()])
-  for (const p of listHostPeers()) ids.add(p.serverId)
-  const catalog = getServerCatalog()
+  for (const p of await listHostPeers()) ids.add(p.serverId)
+  const catalog = await getServerCatalog()
   const emptySeries = Array(60).fill(0) as number[]
   const exporters = catalog.list
     .filter((s) => ids.has(s.id))
@@ -546,16 +546,16 @@ export function listFlowExporters(minutes: number): FlowExportersDto {
   }
 }
 
-export function listFlowClients(minutes: number): FlowClientsDto {
-  const users = db.select().from(appUsers).all()
-  const binds = db.select().from(userInterfaceBindings).all()
+export async function listFlowClients(minutes: number): Promise<{ clients: { id: string; name: string; subtitle: string; site: string; country: string; status: "online" | "offline" | "degraded"; rxNow: number; txNow: number; sessions: number; rxSeries: number[]; txSeries: number[]; bytes: number; }[]; }> {
+  const users = await db.select().from(appUsers)
+  const binds = await db.select().from(userInterfaceBindings)
   const byUser = new Map<string, typeof binds>()
   for (const b of binds) {
     const list = byUser.get(b.userId) ?? []
     list.push(b)
     byUser.set(b.userId, list)
   }
-  const rows = listFlowRowsForWindow(minutes)
+  const rows = await listFlowRowsForWindow(minutes)
   const emptySeries = Array(60).fill(0) as number[]
   const windowSec = Math.max(60, minutes * 60)
   const clients: FlowEntityCard[] = []
@@ -617,9 +617,9 @@ export function safeBuildLiveFlowSample(q: Omit<FlowAnalyticsQuery, "minutes" |
   event: "sample" | "error"
   data: unknown
 } {
-  return formatLiveSseFromBuilder(() => {
+  return formatLiveSseFromBuilder(async () => {
     const skipHeavy = isFlowAnalyticsDegraded()
-    return buildFlowAnalytics({ ...q, minutes: LIVE_ANALYTICS_MINUTES, skipHeavy })
+    return await buildFlowAnalytics({ ...q, minutes: LIVE_ANALYTICS_MINUTES, skipHeavy })
   })
 }
 
@@ -653,7 +653,7 @@ function toBreakdown(
     }))
 }
 
-export function getFlowMonthly(month: string, serverId?: number): FlowMonthlyDto {
+export async function getFlowMonthly(month: string, serverId?: number): Promise<FlowMonthlyDto> {
   const bounds = monthBounds(month)
   if (!bounds) {
     return { month, bytes: 0, countries: [], services: [], asns: [] }
@@ -664,12 +664,12 @@ export function getFlowMonthly(month: string, serverId?: number): FlowMonthlyDto
     where += " AND server_id = ?"
     params.push(serverId)
   }
-  const rows = sqliteDatabase.prepare(`
+  const rows = await dbAll<{ dim: string; key: string; bytes: number; packets: number }>(`
     SELECT dim AS dim, key AS key, SUM(bytes) AS bytes, SUM(packets) AS packets
     FROM flow_daily_dims
     WHERE ${where}
     GROUP BY dim, key
-  `).all(...params) as Array<{ dim: string; key: string; bytes: number; packets: number }>
+  `, params)
 
   const countries: Array<{ key: string; bytes: number; packets: number }> = []
   const services: Array<{ key: string; bytes: number; packets: number }> = []
diff --git a/backend/src/services/traffic-flow-classify.ts b/backend/src/services/traffic-flow-classify.ts
index 3a364dc..65bd1a4 100644
--- a/backend/src/services/traffic-flow-classify.ts
+++ b/backend/src/services/traffic-flow-classify.ts
@@ -97,7 +97,7 @@ async function fetchCatalog(): Promise<void> {
   if (inflight) return inflight
   inflight = (async () => {
     try {
-      const row = db.select().from(evobgpSettings).limit(1).all()[0]
+      const row = (await db.select().from(evobgpSettings).limit(1))[0]
       if (!row?.enabled) return
       const root = String(row.baseUrl ?? "").replace(/\/+$/, "")
       const token = String(row.apiKey ?? "").replace(/^Bearer\s+/i, "").trim()
diff --git a/backend/src/services/traffic-flow-collector-ipc.ts b/backend/src/services/traffic-flow-collector-ipc.ts
index 3e2ba8b..35cd393 100644
--- a/backend/src/services/traffic-flow-collector-ipc.ts
+++ b/backend/src/services/traffic-flow-collector-ipc.ts
@@ -8,7 +8,6 @@ export interface ExporterMapPayload {
 }
 
 export interface CollectorStartPayload {
-  dbPath: string
   listenHost: string
   listenPort: number
   topN: number
diff --git a/backend/src/services/traffic-flow-collector-worker.ts b/backend/src/services/traffic-flow-collector-worker.ts
index a7b2419..2771c91 100644
--- a/backend/src/services/traffic-flow-collector-worker.ts
+++ b/backend/src/services/traffic-flow-collector-worker.ts
@@ -1,6 +1,5 @@
 import { createSocket, type Socket } from "node:dgram"
 import { parentPort } from "node:worker_threads"
-import { sqliteDatabase } from "../db/index.js"
 import type {
   CollectorStartPayload,
   ExporterMapPayload,
@@ -9,7 +8,6 @@ import type {
 } from "./traffic-flow-collector-ipc.js"
 import {
   TICK_MS,
-  attachEngineSqlite,
   configureEngine,
   flushPending,
   getEngineStats,
@@ -23,7 +21,6 @@ let socket: Socket | null = null
 let flushTimer: ReturnType<typeof setInterval> | null = null
 let bound = false
 let address: string | null = null
-let attached = false
 
 function send(msg: WorkerToMain): void {
   parentPort?.postMessage(msg)
@@ -58,22 +55,14 @@ function applyExporterMap(payload: ExporterMapPayload): void {
   })
 }
 
-function ensureSqlite(): void {
-  if (attached) return
-  attachEngineSqlite(sqliteDatabase)
-  attached = true
-}
-
 function stopListener(): void {
   if (flushTimer) {
     clearInterval(flushTimer)
     flushTimer = null
   }
-  try {
-    flushPending()
-  } catch (e) {
+  void flushPending().catch((e) => {
     setEngineError(e instanceof Error ? e.message : String(e))
-  }
+  })
   if (socket) {
     try { socket.close() } catch { /* ignore */ }
     socket = null
@@ -84,7 +73,6 @@ function stopListener(): void {
 
 function startListener(payload: CollectorStartPayload): void {
   stopListener()
-  ensureSqlite()
   configureEngine({ topN: payload.topN, retentionHours: payload.retentionHours })
   applyExporterMap(payload.exporterMap)
 
@@ -116,12 +104,9 @@ function startListener(payload: CollectorStartPayload): void {
   })
   socket = sock
   flushTimer = setInterval(() => {
-    try {
-      flushPending()
-    } catch (e) {
+    void flushPending().catch((e) => {
       setEngineError(e instanceof Error ? e.message : String(e))
-    }
-    heartbeat()
+    }).finally(() => heartbeat())
   }, TICK_MS)
 }
 
diff --git a/backend/src/services/traffic-flow-engine.ts b/backend/src/services/traffic-flow-engine.ts
index 3fd88d5..4e76f68 100644
--- a/backend/src/services/traffic-flow-engine.ts
+++ b/backend/src/services/traffic-flow-engine.ts
@@ -1,4 +1,5 @@
-import type Database from "better-sqlite3"
+import { dbAll, dbQuery, pool } from "../db/index.js"
+import { ensurePartitionFor, specForParent } from "../db/partitions.js"
 import { normalizeParsedFlow, parseFlowPacket, protoName, type ParsedFlow, type ParsedFlowInput } from "./traffic-flow-parse.js"
 import { classifyFlowPlaneLite } from "./traffic-flow-planes.js"
 import { pickServerIdForExporter, type OverlayPeerRef } from "./traffic-flow-map-exporter.js"
@@ -10,8 +11,6 @@ import { isIsoCountry } from "./traffic-flow-brands.js"
 import { maybeRefreshIfaces } from "./traffic-flow-ifaces.js"
 import { pickInternetPeer } from "./traffic-flow-ip.js"
 
-type SqliteHandle = InstanceType<typeof Database>
-
 export const TICK_MS = 2_000
 export const RING_LEN = 60
 export const MAX_PENDING = 50_000
@@ -20,6 +19,17 @@ export const DAILY_RETENTION_DAYS = 396
 export const MINUTE_RETENTION_HOURS = 48
 
 let pendingCap = MAX_PENDING
+const ensuredParts = new Set<string>()
+
+async function ensureParentPartition(parent: string, ts: string): Promise<void> {
+  const spec = specForParent(parent)
+  if (!spec) return
+  const iso = ts.length === 10 ? `${ts}T00:00:00Z` : ts
+  const key = `${parent}:${iso.slice(0, 10)}`
+  if (ensuredParts.has(key)) return
+  await ensurePartitionFor(pool, parent, spec.kind, new Date(iso))
+  ensuredParts.add(key)
+}
 
 export interface PendingFlowRow {
   serverId: number
@@ -76,7 +86,6 @@ export interface ExporterResolveCtx {
   hostIps: Map<string, number>
 }
 
-let sqliteRef: SqliteHandle | null = null
 let topN = 200
 let retentionHours = 24
 
@@ -95,7 +104,7 @@ let dropped = 0
 let rowsStored = 0
 let lastFlushUsedTransaction = false
 let lastPruneAt = 0
-let lastPassiveCheckpointAt = Date.now()
+let lastPassiveCheckpointAt = 0
 let dataEpoch = 0
 let lastPersistedStats: {
   packetsReceived: number
@@ -107,7 +116,6 @@ let exporterCtx: ExporterResolveCtx | null = null
 
 const PRUNE_MS = 5 * 60_000
 const LIVE_WINDOW_MS = 15 * 60_000
-const PASSIVE_CHECKPOINT_MS = 60_000
 
 function bumpDataEpoch(): void {
   dataEpoch += 1
@@ -201,8 +209,8 @@ function bumpRollup(serverId: number, bucketAt: string, flow: ParsedFlow, bytes:
   acc.conversations += 1
 }
 
-export function attachEngineSqlite(handle: SqliteHandle): void {
-  sqliteRef = handle
+export function attachEngineSqlite(_handle?: unknown): void {
+  /* engine uses pg pool via dbQuery/dbAll */
 }
 
 export function setPendingCapForTests(n: number | null): void {
@@ -441,7 +449,7 @@ export function applyRingSnapshot(rows: Array<{ key: string; inBps: number[]; ou
   }
 }
 
-function persistListenerStats(handle: SqliteHandle): boolean {
+async function persistListenerStats(): Promise<boolean> {
   if (
     lastPersistedStats
     && lastPersistedStats.packetsReceived === packetsReceived
@@ -451,7 +459,7 @@ function persistListenerStats(handle: SqliteHandle): boolean {
   ) {
     return false
   }
-  handle.prepare(`
+  await dbQuery(`
     UPDATE traffic_flow_settings
     SET packets_received = @packetsReceived,
         last_datagram_at = @lastDatagramAt,
@@ -459,7 +467,7 @@ function persistListenerStats(handle: SqliteHandle): boolean {
         last_error = @lastError,
         updated_at = @updatedAt
     WHERE id = 1
-  `).run({
+  `, {
     packetsReceived,
     lastDatagramAt,
     lastExporterIp,
@@ -476,110 +484,85 @@ function persistListenerStats(handle: SqliteHandle): boolean {
   return true
 }
 
-function maybePassiveCheckpoint(handle: SqliteHandle): void {
-  const now = Date.now()
-  if (now - lastPassiveCheckpointAt < PASSIVE_CHECKPOINT_MS) return
-  lastPassiveCheckpointAt = now
-  try {
-    handle.pragma("wal_checkpoint(PASSIVE)")
-  } catch {
-    /* ignore */
+async function upsertMinuteAndDaily(): Promise<void> {
+  for (const [k, acc] of minuteRollup) {
+    const [serverIdRaw, bucketAt] = k.split("\0")
+    await ensureParentPartition("flow_minute_stats", bucketAt ?? "")
+    await dbQuery(`
+      INSERT INTO flow_minute_stats (
+        server_id, bucket_at, bytes, packets, unique_src, unique_dst, conversations
+      ) VALUES (
+        @serverId, @bucketAt, @bytes, @packets, @uniqueSrc, @uniqueDst, @conversations
+      )
+      ON CONFLICT(server_id, bucket_at) DO UPDATE SET
+        bytes = flow_minute_stats.bytes + excluded.bytes,
+        packets = flow_minute_stats.packets + excluded.packets,
+        unique_src = GREATEST(flow_minute_stats.unique_src, excluded.unique_src),
+        unique_dst = GREATEST(flow_minute_stats.unique_dst, excluded.unique_dst),
+        conversations = flow_minute_stats.conversations + excluded.conversations
+    `, {
+      serverId: Number(serverIdRaw),
+      bucketAt,
+      bytes: acc.bytes,
+      packets: acc.packets,
+      uniqueSrc: acc.srcs.size,
+      uniqueDst: acc.dsts.size,
+      conversations: acc.conversations,
+    })
   }
-}
-
-function upsertMinuteAndDaily(handle: SqliteHandle): void {
-  const upsertMinute = handle.prepare(`
-    INSERT INTO flow_minute_stats (
-      server_id, bucket_at, bytes, packets, unique_src, unique_dst, conversations
-    ) VALUES (
-      @serverId, @bucketAt, @bytes, @packets, @uniqueSrc, @uniqueDst, @conversations
-    )
-    ON CONFLICT(server_id, bucket_at) DO UPDATE SET
-      bytes = bytes + excluded.bytes,
-      packets = packets + excluded.packets,
-      unique_src = MAX(unique_src, excluded.unique_src),
-      unique_dst = MAX(unique_dst, excluded.unique_dst),
-      conversations = conversations + excluded.conversations
-  `)
-  const upsertDim = handle.prepare(`
-    INSERT INTO flow_minute_dims (server_id, bucket_at, dim, key, bytes, packets)
-    VALUES (@serverId, @bucketAt, @dim, @key, @bytes, @packets)
-    ON CONFLICT(server_id, bucket_at, dim, key) DO UPDATE SET
-      bytes = bytes + excluded.bytes,
-      packets = packets + excluded.packets
-  `)
-  const upsertDaily = handle.prepare(`
-    INSERT INTO flow_daily_dims (server_id, day, dim, key, bytes, packets)
-    VALUES (@serverId, @day, @dim, @key, @bytes, @packets)
-    ON CONFLICT(server_id, day, dim, key) DO UPDATE SET
-      bytes = bytes + excluded.bytes,
-      packets = packets + excluded.packets
-  `)
-
-  const tx = handle.transaction(() => {
-    for (const [k, acc] of minuteRollup) {
-      const [serverIdRaw, bucketAt] = k.split("\0")
-      upsertMinute.run({
+  for (const [k, acc] of minuteDims) {
+    const [serverIdRaw, bucketAt, dim, key] = k.split("\0")
+    await ensureParentPartition("flow_minute_dims", bucketAt ?? "")
+    await ensureParentPartition("flow_daily_dims", dayKey(bucketAt ?? ""))
+    await dbQuery(`
+      INSERT INTO flow_minute_dims (server_id, bucket_at, dim, key, bytes, packets)
+      VALUES (@serverId, @bucketAt, @dim, @key, @bytes, @packets)
+      ON CONFLICT(server_id, bucket_at, dim, key) DO UPDATE SET
+        bytes = flow_minute_dims.bytes + excluded.bytes,
+        packets = flow_minute_dims.packets + excluded.packets
+    `, {
+      serverId: Number(serverIdRaw),
+      bucketAt,
+      dim,
+      key,
+      bytes: acc.bytes,
+      packets: acc.packets,
+    })
+    if (dim === "country" || dim === "service" || dim === "asn") {
+      await dbQuery(`
+        INSERT INTO flow_daily_dims (server_id, day, dim, key, bytes, packets)
+        VALUES (@serverId, @day, @dim, @key, @bytes, @packets)
+        ON CONFLICT(server_id, day, dim, key) DO UPDATE SET
+          bytes = flow_daily_dims.bytes + excluded.bytes,
+          packets = flow_daily_dims.packets + excluded.packets
+      `, {
         serverId: Number(serverIdRaw),
-        bucketAt,
-        bytes: acc.bytes,
-        packets: acc.packets,
-        uniqueSrc: acc.srcs.size,
-        uniqueDst: acc.dsts.size,
-        conversations: acc.conversations,
-      })
-    }
-    for (const [k, acc] of minuteDims) {
-      const [serverIdRaw, bucketAt, dim, key] = k.split("\0")
-      upsertDim.run({
-        serverId: Number(serverIdRaw),
-        bucketAt,
+        day: dayKey(bucketAt ?? ""),
         dim,
         key,
         bytes: acc.bytes,
         packets: acc.packets,
       })
-      if (dim === "country" || dim === "service" || dim === "asn") {
-        upsertDaily.run({
-          serverId: Number(serverIdRaw),
-          day: dayKey(bucketAt ?? ""),
-          dim,
-          key,
-          bytes: acc.bytes,
-          packets: acc.packets,
-        })
-      }
     }
-  })
-  tx()
+  }
   minuteRollup.clear()
   minuteDims.clear()
 }
 
-function capDailyAsn(handle: SqliteHandle): void {
+async function capDailyAsn(): Promise<void> {
   const today = nowIso().slice(0, 10)
-  const rows = handle.prepare(`
-    SELECT server_id AS serverId, key, bytes, packets
+  const rows = await dbAll<{ serverId: number; key: string; bytes: number; packets: number }>(`
+    SELECT server_id AS "serverId", key, bytes, packets
     FROM flow_daily_dims
     WHERE day = ? AND dim = 'asn'
     ORDER BY server_id, bytes DESC
-  `).all(today) as Array<{ serverId: number; key: string; bytes: number; packets: number }>
+  `, [today])
   const byServer = new Map<number, typeof rows>()
   for (const row of rows) {
     const list = byServer.get(row.serverId) ?? []
     list.push(row)
     byServer.set(row.serverId, list)
   }
-  const del = handle.prepare(`
-    DELETE FROM flow_daily_dims WHERE server_id = ? AND day = ? AND dim = 'asn' AND key = ?
-  `)
-  const upsertOther = handle.prepare(`
-    INSERT INTO flow_daily_dims (server_id, day, dim, key, bytes, packets)
-    VALUES (?, ?, 'asn', 'other', ?, ?)
-    ON CONFLICT(server_id, day, dim, key) DO UPDATE SET
-      bytes = bytes + excluded.bytes,
-      packets = packets + excluded.packets
-  `)
   for (const [serverId, list] of byServer) {
     if (list.length <= DAILY_ASN_TOP) continue
     let otherBytes = 0
@@ -588,52 +571,60 @@ function capDailyAsn(handle: SqliteHandle): void {
       if (row.key === "other") continue
       otherBytes += row.bytes
       otherPackets += row.packets
-      del.run(serverId, today, row.key)
+      await dbQuery(
+        `DELETE FROM flow_daily_dims WHERE server_id = ? AND day = ? AND dim = 'asn' AND key = ?`,
+        [serverId, today, row.key],
+      )
+    }
+    if (otherBytes > 0) {
+      await ensureParentPartition("flow_daily_dims", today)
+      await dbQuery(`
+        INSERT INTO flow_daily_dims (server_id, day, dim, key, bytes, packets)
+        VALUES (?, ?, 'asn', 'other', ?, ?)
+        ON CONFLICT(server_id, day, dim, key) DO UPDATE SET
+          bytes = flow_daily_dims.bytes + excluded.bytes,
+          packets = flow_daily_dims.packets + excluded.packets
+      `, [serverId, today, otherBytes, otherPackets])
     }
-    if (otherBytes > 0) upsertOther.run(serverId, today, otherBytes, otherPackets)
   }
 }
 
-function pruneStored(handle: SqliteHandle): void {
+async function pruneStored(): Promise<void> {
   const now = Date.now()
   if (now - lastPruneAt < PRUNE_MS) return
   lastPruneAt = now
   const flowCutoff = new Date(now - retentionHours * 3600_000).toISOString()
   const minuteCutoff = new Date(now - MINUTE_RETENTION_HOURS * 3600_000).toISOString()
   const dailyCutoff = new Date(now - DAILY_RETENTION_DAYS * 86400_000).toISOString().slice(0, 10)
-  handle.prepare(`DELETE FROM flow_buckets WHERE bucket_at < ?`).run(flowCutoff)
-  handle.prepare(`DELETE FROM flow_minute_stats WHERE bucket_at < ?`).run(minuteCutoff)
-  handle.prepare(`DELETE FROM flow_minute_dims WHERE bucket_at < ?`).run(minuteCutoff)
-  handle.prepare(`DELETE FROM flow_daily_dims WHERE day < ?`).run(dailyCutoff)
+  await dbQuery(`DELETE FROM flow_buckets WHERE bucket_at < ?`, [flowCutoff])
+  await dbQuery(`DELETE FROM flow_minute_stats WHERE bucket_at < ?`, [minuteCutoff])
+  await dbQuery(`DELETE FROM flow_minute_dims WHERE bucket_at < ?`, [minuteCutoff])
+  await dbQuery(`DELETE FROM flow_daily_dims WHERE day < ?`, [dailyCutoff])
 
   const keep = Math.max(20, topN)
-  try {
-    handle.prepare(`
-      DELETE FROM flow_buckets WHERE id IN (
-        SELECT id FROM (
-          SELECT id, ROW_NUMBER() OVER (
-            PARTITION BY server_id, bucket_at ORDER BY bytes DESC
-          ) AS rn
-          FROM flow_buckets
-        ) ranked WHERE rn > ?
-      )
-    `).run(keep)
-  } catch {
-    const buckets = handle.prepare(`
-      SELECT DISTINCT server_id AS serverId, bucket_at AS bucketAt FROM flow_buckets
-    `).all() as Array<{ serverId: number; bucketAt: string }>
-    for (const b of buckets) {
-      const rows = handle.prepare(`
-        SELECT id, bytes FROM flow_buckets
-        WHERE server_id = ? AND bucket_at = ?
-        ORDER BY bytes DESC
-      `).all(b.serverId, b.bucketAt) as Array<{ id: number; bytes: number }>
-      for (const extra of rows.slice(keep)) {
-        handle.prepare(`DELETE FROM flow_buckets WHERE id = ?`).run(extra.id)
-      }
-    }
-  }
-  pruneRipeSqlite(now)
+  await dbQuery(`
+    DELETE FROM flow_buckets fb
+    USING (
+      SELECT server_id, bucket_at, src, dst, proto, src_port, dst_port, in_iface
+      FROM (
+        SELECT server_id, bucket_at, src, dst, proto, src_port, dst_port, in_iface,
+               ROW_NUMBER() OVER (
+                 PARTITION BY server_id, bucket_at ORDER BY bytes DESC
+               ) AS rn
+        FROM flow_buckets
+      ) ranked
+      WHERE rn > ?
+    ) drop_rows
+    WHERE fb.server_id = drop_rows.server_id
+      AND fb.bucket_at = drop_rows.bucket_at
+      AND fb.src = drop_rows.src
+      AND fb.dst = drop_rows.dst
+      AND fb.proto = drop_rows.proto
+      AND fb.src_port = drop_rows.src_port
+      AND fb.dst_port = drop_rows.dst_port
+      AND fb.in_iface = drop_rows.in_iface
+  `, [keep])
+  await pruneRipeSqlite(now)
 }
 
 function topNPending(rows: PendingFlowRow[]): PendingFlowRow[] {
@@ -653,18 +644,12 @@ function topNPending(rows: PendingFlowRow[]): PendingFlowRow[] {
   return out
 }
 
-export function flushPending(): void {
+export async function flushPending(): Promise<void> {
   pruneRecent()
   rollFlowRings()
-  const handle = sqliteRef
-  if (!handle) {
-    lastFlushUsedTransaction = false
-    return
-  }
-  persistListenerStats(handle)
+  await persistListenerStats()
   if (pending.size === 0 && minuteRollup.size === 0 && minuteDims.size === 0) {
-    pruneStored(handle)
-    maybePassiveCheckpoint(handle)
+    await pruneStored()
     lastFlushUsedTransaction = false
     return
   }
@@ -672,7 +657,7 @@ export function flushPending(): void {
   pending.clear()
   for (const row of rows) mergeInto(recent, row)
 
-  const upsertFlow = handle.prepare(`
+  const upsertSql = `
     INSERT INTO flow_buckets (
       server_id, bucket_at, src, dst, proto, src_port, dst_port, bytes, packets, in_iface, out_iface, next_hop, flow_start_ms, flow_end_ms
     ) VALUES (
@@ -680,45 +665,44 @@ export function flushPending(): void {
     )
     ON CONFLICT(server_id, bucket_at, src, dst, proto, src_port, dst_port, in_iface)
     DO UPDATE SET
-      bytes = bytes + excluded.bytes,
-      packets = packets + excluded.packets,
-      out_iface = CASE WHEN excluded.out_iface != '' THEN excluded.out_iface ELSE out_iface END,
-      next_hop = CASE WHEN excluded.next_hop != '' THEN excluded.next_hop ELSE next_hop END,
+      bytes = flow_buckets.bytes + excluded.bytes,
+      packets = flow_buckets.packets + excluded.packets,
+      out_iface = CASE WHEN excluded.out_iface != '' THEN excluded.out_iface ELSE flow_buckets.out_iface END,
+      next_hop = CASE WHEN excluded.next_hop != '' THEN excluded.next_hop ELSE flow_buckets.next_hop END,
       flow_start_ms = CASE
-        WHEN excluded.flow_start_ms > 0 AND (flow_start_ms = 0 OR excluded.flow_start_ms < flow_start_ms)
-        THEN excluded.flow_start_ms ELSE flow_start_ms END,
-      flow_end_ms = MAX(flow_end_ms, excluded.flow_end_ms)
-  `)
+        WHEN excluded.flow_start_ms > 0 AND (flow_buckets.flow_start_ms = 0 OR excluded.flow_start_ms < flow_buckets.flow_start_ms)
+        THEN excluded.flow_start_ms ELSE flow_buckets.flow_start_ms END,
+      flow_end_ms = GREATEST(flow_buckets.flow_end_ms, excluded.flow_end_ms)
+  `
   lastFlushUsedTransaction = false
   try {
-    const tx = handle.transaction((batch: PendingFlowRow[]) => {
-      for (const r of batch) {
-        upsertFlow.run({
-          serverId: r.serverId,
-          bucketAt: r.bucketAt,
-          src: r.src,
-          dst: r.dst,
-          proto: r.proto,
-          srcPort: r.srcPort,
-          dstPort: r.dstPort,
-          bytes: r.bytes,
-          packets: r.packets,
-          inIface: r.inIface,
-          outIface: r.outIface,
-          nextHop: r.nextHop,
-          flowStartMs: r.flowStartMs,
-          flowEndMs: r.flowEndMs,
-        })
-      }
-    })
-    tx(rows)
+    for (const r of rows) {
+      await ensureParentPartition("flow_buckets", r.bucketAt)
+      await dbQuery(upsertSql, {
+        serverId: r.serverId,
+        bucketAt: r.bucketAt,
+        src: r.src,
+        dst: r.dst,
+        proto: r.proto,
+        srcPort: r.srcPort,
+        dstPort: r.dstPort,
+        bytes: r.bytes,
+        packets: r.packets,
+        inIface: r.inIface,
+        outIface: r.outIface,
+        nextHop: r.nextHop,
+        flowStartMs: r.flowStartMs,
+        flowEndMs: r.flowEndMs,
+      })
+    }
     lastFlushUsedTransaction = true
     rowsStored += rows.length
     bumpDataEpoch()
   } catch {
     for (const r of rows) {
       try {
-        upsertFlow.run({
+        await ensureParentPartition("flow_buckets", r.bucketAt)
+        await dbQuery(upsertSql, {
           serverId: r.serverId,
           bucketAt: r.bucketAt,
           src: r.src,
@@ -741,25 +725,24 @@ export function flushPending(): void {
     }
   }
   try {
-    upsertMinuteAndDaily(handle)
-    capDailyAsn(handle)
+    await upsertMinuteAndDaily()
+    await capDailyAsn()
   } catch {
     /* rollup best-effort */
   }
-  pruneStored(handle)
-  maybePassiveCheckpoint(handle)
+  await pruneStored()
 }
 
 export function lastFlushUsedTransactionForTests(): boolean {
   return lastFlushUsedTransaction
 }
 
-export function flushPendingForTests(): void {
-  flushPending()
+export async function flushPendingForTests(): Promise<void> {
+  await flushPending()
 }
 
 export function onEngineTick(): void {
-  flushPending()
+  void flushPending()
 }
 
 export function ingestParsedFlowsForServerForTests(serverId: number, flows: ParsedFlowInput[]): void {
diff --git a/backend/src/services/traffic-flow-hardening.test.ts b/backend/src/services/traffic-flow-hardening.test.ts
deleted file mode 100644
index f1b144a..0000000
--- a/backend/src/services/traffic-flow-hardening.test.ts
+++ /dev/null
@@ -1,38 +0,0 @@
-import assert from "node:assert/strict"
-import {
-  SQLITE_BUSY_TIMEOUT_MS,
-  SQLITE_CACHE_SIZE_KIB,
-  SQLITE_WAL_AUTOCHECKPOINT_PAGES,
-  sqliteDatabase,
-} from "../db/index.js"
-import {
-  MAX_FLOW_LIVE_SUBSCRIBERS,
-  resetFlowLiveSlotsForTests,
-  tryAcquireFlowLiveSlot,
-  releaseFlowLiveSlot,
-} from "../routes/traffic-flow.js"
-
-const busy = sqliteDatabase.pragma("busy_timeout") as Array<{ busy_timeout: number }>
-const busyValue = Array.isArray(busy) ? Number(Object.values(busy[0] ?? {})[0]) : Number(busy)
-assert.equal(busyValue, SQLITE_BUSY_TIMEOUT_MS)
-
-function pragmaNum(name: string): number {
-  const rows = sqliteDatabase.pragma(name) as Array<Record<string, number>>
-  const row = Array.isArray(rows) ? rows[0] : rows
-  return Number(Object.values(row ?? {})[0])
-}
-
-assert.equal(pragmaNum("wal_autocheckpoint"), SQLITE_WAL_AUTOCHECKPOINT_PAGES)
-assert.equal(pragmaNum("cache_size"), -SQLITE_CACHE_SIZE_KIB)
-assert.equal(pragmaNum("temp_store"), 2)
-
-resetFlowLiveSlotsForTests()
-for (let i = 0; i < MAX_FLOW_LIVE_SUBSCRIBERS; i++) {
-  assert.equal(tryAcquireFlowLiveSlot(), true)
-}
-assert.equal(tryAcquireFlowLiveSlot(), false)
-releaseFlowLiveSlot()
-assert.equal(tryAcquireFlowLiveSlot(), true)
-resetFlowLiveSlotsForTests()
-
-console.log("traffic-flow-hardening.test.ts: ok")
diff --git a/backend/src/services/traffic-flow-host-files.ts b/backend/src/services/traffic-flow-host-files.ts
index 054232a..b021f07 100644
--- a/backend/src/services/traffic-flow-host-files.ts
+++ b/backend/src/services/traffic-flow-host-files.ts
@@ -4,9 +4,9 @@ import type { TrafficFlowHostFile } from "@mmapp/contracts/traffic-flow"
 
 const COMPOSE_DIR = "/opt/cdn-mm"
 
-export function buildHostWgQuickConf(): string {
-  const row = getTrafficFlowSettingsRow()
-  const peers = listHostPeers()
+export async function buildHostWgQuickConf(): Promise<string> {
+  const row = await getTrafficFlowSettingsRow()
+  const peers = await listHostPeers()
   return generateNativeConf({
     name: "wg-flow",
     mtu: 1420,
@@ -23,8 +23,8 @@ export function buildHostWgQuickConf(): string {
   })
 }
 
-export function buildHostComposeOverride(): string {
-  const row = getTrafficFlowSettingsRow()
+export async function buildHostComposeOverride(): Promise<string> {
+  const row = await getTrafficFlowSettingsRow()
   return [
     "# Docker Compose merge для /opt/cdn-mm",
     "# Не править docker-compose.yml. Traefik не трогать.",
@@ -42,10 +42,10 @@ export function buildHostComposeOverride(): string {
   ].join("\n")
 }
 
-export function buildHostLinuxInstallSh(): string {
-  const row = getTrafficFlowSettingsRow()
-  const conf = buildHostWgQuickConf().replace(/\s+$/, "") + "\n"
-  const override = buildHostComposeOverride()
+export async function buildHostLinuxInstallSh(): Promise<string> {
+  const row = await getTrafficFlowSettingsRow()
+  const conf = (await buildHostWgQuickConf()).replace(/\s+$/, "") + "\n"
+  const override = await buildHostComposeOverride()
   const collector = row.collectorIp
   const flowPort = row.flowListenPort
 
@@ -104,10 +104,10 @@ echo "Готово. Traefik не трогали. UDP \${FLOW_PORT} только
 `
 }
 
-export function listTrafficFlowHostFiles(): TrafficFlowHostFile[] {
+export async function listTrafficFlowHostFiles(): Promise<TrafficFlowHostFile[]> {
   return [
-    { id: "linux", label: "Linux", filename: "install-wg-flow.sh", code: buildHostLinuxInstallSh() },
-    { id: "wg-quick", label: "wg-flow.conf", filename: "wg-flow.conf", code: buildHostWgQuickConf() },
-    { id: "compose", label: "compose", filename: "docker-compose.override.yml", code: buildHostComposeOverride() },
+    { id: "linux", label: "Linux", filename: "install-wg-flow.sh", code: await buildHostLinuxInstallSh() },
+    { id: "wg-quick", label: "wg-flow.conf", filename: "wg-flow.conf", code: await buildHostWgQuickConf() },
+    { id: "compose", label: "compose", filename: "docker-compose.override.yml", code: await buildHostComposeOverride() },
   ]
 }
diff --git a/backend/src/services/traffic-flow-ifaces.ts b/backend/src/services/traffic-flow-ifaces.ts
index f1e8a08..4e68614 100644
--- a/backend/src/services/traffic-flow-ifaces.ts
+++ b/backend/src/services/traffic-flow-ifaces.ts
@@ -28,7 +28,7 @@ async function refreshServerIfacesInner(serverId: number, force = false): Promis
   if (!force && !shouldRefreshIfaces(serverId)) return
   inflight.add(serverId)
   try {
-    const row = db.select().from(servers).where(eq(servers.id, serverId)).limit(1).all()[0]
+    const row = (await db.select().from(servers).where(eq(servers.id, serverId)).limit(1))[0]
     if (!row) return
     const client = MikrotikClient.fromServer(row)
     const ifaces = await client.get<RosIfaceIndexRow[]>("/interface")
diff --git a/backend/src/services/traffic-flow-ingest.test.ts b/backend/src/services/traffic-flow-ingest.test.ts
index 47fc027..e8fe6f9 100644
--- a/backend/src/services/traffic-flow-ingest.test.ts
+++ b/backend/src/services/traffic-flow-ingest.test.ts
@@ -22,7 +22,8 @@ import {
   simulateWorkerExitForTests,
 } from "./traffic-flow-ingest.js"
 import { configureEngine, droppedForTests, pendingSizeForTests } from "./traffic-flow-engine.js"
-import { sqliteDatabase } from "../db/index.js"
+import { dbQuery } from "../db/index.js"
+import { withPgOrSkip } from "../test/pg.js"
 
 resetIfaceCacheForTests()
 resetFlowRingsForTests()
@@ -81,16 +82,23 @@ const talkers = Array.from({ length: 25 }, (_, i) => ({
   inIface: "2",
   outIface: "",
 }))
-ingestParsedFlowsForServerForTests(9, talkers)
-flushPendingForTests()
-const stored = sqliteDatabase.prepare(`
-  SELECT COUNT(*) AS n FROM flow_buckets WHERE server_id = 9
-`).get() as { n: number }
-assert.ok(stored.n <= 20, `expected topN cap, got ${stored.n}`)
-sqliteDatabase.prepare(`DELETE FROM flow_buckets WHERE server_id = 9`).run()
-sqliteDatabase.prepare(`DELETE FROM flow_minute_stats WHERE server_id = 9`).run()
-sqliteDatabase.prepare(`DELETE FROM flow_minute_dims WHERE server_id = 9`).run()
-sqliteDatabase.prepare(`DELETE FROM flow_daily_dims WHERE server_id = 9`).run()
+if (await withPgOrSkip()) {
+  await dbQuery(`
+    INSERT INTO servers (id, name, host) VALUES (91009, 'flow-ingest-test', '127.0.0.1')
+    ON CONFLICT (id) DO NOTHING
+  `)
+  ingestParsedFlowsForServerForTests(91009, talkers)
+  await flushPendingForTests()
+  const stored = await dbQuery<{ n: number }>(
+    `SELECT COUNT(*)::int AS n FROM flow_buckets WHERE server_id = 91009`,
+  )
+  assert.ok((stored.rows[0]?.n ?? 99) <= 20, `expected topN cap, got ${stored.rows[0]?.n}`)
+  await dbQuery(`DELETE FROM flow_buckets WHERE server_id = 91009`)
+  await dbQuery(`DELETE FROM flow_minute_stats WHERE server_id = 91009`)
+  await dbQuery(`DELETE FROM flow_minute_dims WHERE server_id = 91009`)
+  await dbQuery(`DELETE FROM flow_daily_dims WHERE server_id = 91009`)
+  await dbQuery(`DELETE FROM servers WHERE id = 91009`)
+}
 
 applyHeartbeatForTests({
   bound: true,
@@ -106,7 +114,7 @@ applyHeartbeatForTests({
   rings: [],
 })
 assert.equal(getFlowListenerState().bound, true)
-assert.equal(getFlowRuntimeCounters().packetsReceived, 42)
+assert.equal((await getFlowRuntimeCounters()).packetsReceived, 42)
 assert.equal(getFlowWorkerHealth().alive, false)
 setWantListenForTests(true)
 assert.equal(simulateWorkerExitForTests(), 1)
diff --git a/backend/src/services/traffic-flow-ingest.ts b/backend/src/services/traffic-flow-ingest.ts
index a0f999a..d8a3de8 100644
--- a/backend/src/services/traffic-flow-ingest.ts
+++ b/backend/src/services/traffic-flow-ingest.ts
@@ -1,15 +1,12 @@
 import { Worker } from "node:worker_threads"
-import { existsSync, statSync } from "node:fs"
-import path from "node:path"
 import { gte, sql } from "drizzle-orm"
-import { beginSqliteExclusiveOp, db, endSqliteExclusiveOp, sqliteDatabase } from "../db/index.js"
-import { env } from "../config.js"
+import { db, dbGet, dbQuery, pool, withAdvisoryLock } from "../db/index.js"
+import { dropExpiredPartitions } from "../db/partitions.js"
 import { flowBuckets, servers } from "../db/schema.js"
 import type { FlowPurgeDto, FlowStatsDto, FlowTalkerDto } from "@mmapp/contracts/traffic-flow"
 import { protoName, type ParsedFlowInput } from "./traffic-flow-parse.js"
 import type { CollectorHeartbeat, ExporterMapPayload, MainToWorker, WorkerToMain } from "./traffic-flow-collector-ipc.js"
 import {
-  attachEngineSqlite,
   applyRingSnapshot,
   configureEngine,
   flushPending,
@@ -57,8 +54,6 @@ let lastHeartbeat: CollectorHeartbeat | null = null
 let state: FlowListenerState = { bound: false, address: null }
 let wantListen = false
 
-attachEngineSqlite(sqliteDatabase)
-
 function workerFileUrl(): URL {
   const ts = import.meta.url.includes(".ts")
   return new URL(
@@ -67,13 +62,13 @@ function workerFileUrl(): URL {
   )
 }
 
-export function buildExporterMapPayload(): ExporterMapPayload {
-  const settings = getTrafficFlowSettingsRow()
-  const rows = db.select({
+export async function buildExporterMapPayload(): Promise<ExporterMapPayload> {
+  const settings = await getTrafficFlowSettingsRow()
+  const rows = await db.select({
     id: servers.id,
     host: servers.host,
     mgmtTunnelIp: servers.mgmtTunnelIp,
-  }).from(servers).all()
+  }).from(servers)
   const byTunnelIp: Array<[string, number]> = []
   const hostIps: Array<[string, number]> = []
   for (const row of rows) {
@@ -83,13 +78,13 @@ export function buildExporterMapPayload(): ExporterMapPayload {
   return {
     overlayPrefix: settings.prefix,
     byTunnelIp,
-    peers: listHostPeers(),
+    peers: await listHostPeers(),
     hostIps,
   }
 }
 
-function applyExporterCtxFromDb(): void {
-  const payload = buildExporterMapPayload()
+async function applyExporterCtxFromDb(): Promise<void> {
+  const payload = await buildExporterMapPayload()
   setExporterResolveCtx({
     overlayPrefix: payload.overlayPrefix,
     byTunnelIp: new Map(payload.byTunnelIp),
@@ -117,11 +112,11 @@ function handleWorkerMessage(msg: WorkerToMain): void {
   }
 }
 
-function spawnWorker(): void {
+async function spawnWorker(): Promise<void> {
   stopWorkerProcess()
-  const settings = getTrafficFlowSettingsRow()
+  const settings = await getTrafficFlowSettingsRow()
   configureEngine({ topN: settings.topN, retentionHours: settings.retentionHours })
-  applyExporterCtxFromDb()
+  await applyExporterCtxFromDb()
   const w = new Worker(workerFileUrl(), { execArgv: process.execArgv })
   w.on("message", (msg: WorkerToMain) => handleWorkerMessage(msg))
   w.on("error", (err) => {
@@ -149,7 +144,7 @@ function spawnWorker(): void {
     const delay = Math.min(30_000, 1000 * 2 ** restartAttempts)
     restartAttempts += 1
     restartTimer = setTimeout(() => {
-      if (wantListen) spawnWorker()
+      if (wantListen) void spawnWorker()
     }, delay)
     void code
   })
@@ -158,12 +153,11 @@ function spawnWorker(): void {
   postToWorker({
     type: "start",
     payload: {
-      dbPath: env.DATABASE_PATH,
       listenHost: host,
       listenPort: settings.flowListenPort,
       topN: settings.topN,
       retentionHours: settings.retentionHours,
-      exporterMap: buildExporterMapPayload(),
+      exporterMap: await buildExporterMapPayload(),
     },
   })
 }
@@ -184,8 +178,24 @@ function stopWorkerProcess(): void {
   }
 }
 
+async function stopWorkerProcessAsync(): Promise<void> {
+  if (restartTimer) {
+    clearTimeout(restartTimer)
+    restartTimer = null
+  }
+  if (!worker) return
+  const current = worker
+  worker = null
+  try {
+    current.postMessage({ type: "stop" })
+    await current.terminate()
+  } catch {
+    /* ignore */
+  }
+}
+
 export function reattachFlowSqlite(): void {
-  attachEngineSqlite(sqliteDatabase)
+  /* no-op: engine uses PostgreSQL pool */
 }
 
 export function applyHeartbeatForTests(payload: CollectorHeartbeat): void {
@@ -221,44 +231,49 @@ export function getFlowWorkerHealth(): FlowWorkerHealth {
   }
 }
 
-export function getFlowRuntimeCounters() {
-  const settings = getTrafficFlowSettingsRow()
+export async function getFlowRuntimeCounters() {
   const hb = lastHeartbeat
+  if (hb) {
+    return {
+      packetsReceived: hb.packetsReceived,
+      lastExporterIp: hb.lastExporterIp ?? null,
+      lastError: hb.lastError || null,
+      lastDatagramAt: hb.lastDatagramAt ?? null,
+      dropped: hb.dropped ?? 0,
+    }
+  }
+  const settings = await getTrafficFlowSettingsRow()
   return {
-    packetsReceived: hb?.packetsReceived ?? settings.packetsReceived,
-    lastExporterIp: hb?.lastExporterIp ?? settings.lastExporterIp ?? null,
-    lastError: (hb?.lastError ?? settings.lastError) || null,
-    lastDatagramAt: hb?.lastDatagramAt ?? settings.lastDatagramAt ?? null,
-    dropped: hb?.dropped ?? 0,
+    packetsReceived: settings.packetsReceived,
+    lastExporterIp: settings.lastExporterIp ?? null,
+    lastError: settings.lastError || null,
+    lastDatagramAt: settings.lastDatagramAt ?? null,
+    dropped: 0,
   }
 }
 
-export function startTrafficFlowListener() {
+export async function startTrafficFlowListener() {
   stopTrafficFlowListener()
-  const settings = getTrafficFlowSettingsRow()
+  const settings = await getTrafficFlowSettingsRow()
   if (!settings.enabled) {
     wantListen = false
     state = { bound: false, address: null }
     return
   }
   wantListen = true
-  spawnWorker()
+  await spawnWorker()
 }
 
 export function stopTrafficFlowListener() {
   wantListen = false
   stopWorkerProcess()
-  try {
-    flushPending()
-  } catch {
-    /* ignore */
-  }
+  void flushPending().catch(() => { /* ignore */ })
   state = { bound: false, address: null }
 }
 
-export function refreshFlowExporterMap(): void {
-  applyExporterCtxFromDb()
-  postToWorker({ type: "updateExporterMap", payload: buildExporterMapPayload() })
+export async function refreshFlowExporterMap(): Promise<void> {
+  await applyExporterCtxFromDb()
+  postToWorker({ type: "updateExporterMap", payload: await buildExporterMapPayload() })
 }
 
 export function getRingMbps(serverId: number, iface = "__all__") {
@@ -280,21 +295,20 @@ function mergeInto(map: Map<string, PendingFlowRow>, row: PendingFlowRow): void
   map.set(key, { ...row })
 }
 
-export function listLiveFlowRows(sinceIso: string): PendingFlowRow[] {
+export async function listLiveFlowRows(sinceIso: string): Promise<PendingFlowRow[]> {
   if (worker && lastHeartbeat?.workerAlive) {
-    return listStoredFlowRows(sinceIso)
+    return await listStoredFlowRows(sinceIso)
   }
   return engineListLive(sinceIso)
 }
 
-export function listStoredFlowRows(sinceIso: string): PendingFlowRow[] {
-  const settings = getTrafficFlowSettingsRow()
+export async function listStoredFlowRows(sinceIso: string): Promise<PendingFlowRow[]> {
+  const settings = await getTrafficFlowSettingsRow()
   const cap = Math.max(20, settings.topN) * 60
-  const stored = db.select().from(flowBuckets)
+  const stored = await db.select().from(flowBuckets)
     .where(gte(flowBuckets.bucketAt, sinceIso))
     .orderBy(sql`${flowBuckets.bytes} DESC`)
     .limit(cap)
-    .all()
   const merged = new Map<string, PendingFlowRow>()
   for (const r of stored) {
     mergeInto(merged, {
@@ -323,17 +337,17 @@ export function listStoredFlowRows(sinceIso: string): PendingFlowRow[] {
   return [...merged.values()]
 }
 
-export function listFlowRowsForWindow(minutes: number): PendingFlowRow[] {
+export async function listFlowRowsForWindow(minutes: number): Promise<PendingFlowRow[]> {
   const sinceIso = new Date(Date.now() - minutes * 60_000).toISOString()
-  if (minutes <= 15 && !worker) return listLiveFlowRows(sinceIso)
-  return listStoredFlowRows(sinceIso)
+  if (minutes <= 15 && !worker) return await listLiveFlowRows(sinceIso)
+  return await listStoredFlowRows(sinceIso)
 }
 
-export function listFlowTalkers(minutes = 5): FlowStatsDto {
-  const settings = getTrafficFlowSettingsRow()
-  const runtime = getFlowRuntimeCounters()
-  const rows = listFlowRowsForWindow(minutes)
-  const catalog = getServerCatalog()
+export async function listFlowTalkers(minutes = 5): Promise<FlowStatsDto> {
+  const settings = await getTrafficFlowSettingsRow()
+  const runtime = await getFlowRuntimeCounters()
+  const rows = await listFlowRowsForWindow(minutes)
+  const catalog = await getServerCatalog()
   const nameById = new Map([...catalog.byId].map(([id, s]) => [id, s.name]))
   const agg = new Map<string, FlowTalkerDto & { rawBytes: number }>()
   const protoBytes = new Map<number, number>()
@@ -405,13 +419,13 @@ export function listFlowTalkers(minutes = 5): FlowStatsDto {
   }
 }
 
-export function ingestParsedFlowsForTests(exporterIp: string, flows: ParsedFlowInput[]) {
-  applyExporterCtxFromDb()
+export async function ingestParsedFlowsForTests(exporterIp: string, flows: ParsedFlowInput[]) {
+  await applyExporterCtxFromDb()
   const serverId = resolveServerId(exporterIp)
   if (serverId == null) return
   queueParsedFlows(serverId, flows)
   rollFlowRings()
-  flushPending()
+  await flushPending()
 }
 
 export function ingestParsedFlowsForServerForTests(serverId: number, flows: ParsedFlowInput[]) {
@@ -420,7 +434,6 @@ export function ingestParsedFlowsForServerForTests(serverId: number, flows: Pars
 
 export function resetFlowRingsForTests() {
   resetEngineForTests()
-  attachEngineSqlite(sqliteDatabase)
   lastHeartbeat = null
   wantListen = false
   restartAttempts = 0
@@ -430,88 +443,50 @@ export function lastFlushUsedTransactionForTests(): boolean {
   return engineLastFlushTx()
 }
 
-export function flushPendingForTests(): void {
-  flushPending()
+export async function flushPendingForTests(): Promise<void> {
+  await flushPending()
 }
 
-function tableCount(name: string): number {
-  const row = sqliteDatabase.prepare(`SELECT COUNT(*) AS n FROM ${name}`).get() as { n: number }
+async function tableCount(name: string): Promise<number> {
+  const row = await dbGet<{ n: number }>(`SELECT COUNT(*) AS n FROM ${name}`)
   return Number(row?.n) || 0
 }
 
-function dbFileBytes(): number {
-  const resolved = path.resolve(process.cwd(), env.DATABASE_PATH)
-  if (!existsSync(resolved)) return 0
-  return statSync(resolved).size
-}
+const PURGE_LOCK_KEY = 8_723_103
 
-async function stopWorkerProcessAsync(): Promise<void> {
-  if (restartTimer) {
-    clearTimeout(restartTimer)
-    restartTimer = null
-  }
-  if (!worker) return
-  const current = worker
-  worker = null
-  try {
-    current.postMessage({ type: "stop" })
-    await current.terminate()
-  } catch {
-    /* ignore */
-  }
-}
-
-/** Удаляет сессии, minute/daily rollup и сжимает SQLite. Ключи WG и пиры JH не трогает. */
+/** Удаляет сессии и minute/daily rollup. Ключи WG и пиры JH не трогает. */
 export async function purgeTrafficFlowStore(): Promise<FlowPurgeDto> {
-  beginSqliteExclusiveOp()
-  try {
+  return await withAdvisoryLock(PURGE_LOCK_KEY, async () => {
     wantListen = false
     await stopWorkerProcessAsync()
     resetEngineForTests()
-    attachEngineSqlite(sqliteDatabase)
     lastHeartbeat = null
     state = { bound: false, address: null }
-    const fileBytesBefore = dbFileBytes()
     const deleted = {
-      buckets: tableCount("flow_buckets"),
-      minuteStats: tableCount("flow_minute_stats"),
-      minuteDims: tableCount("flow_minute_dims"),
-      dailyDims: tableCount("flow_daily_dims"),
+      buckets: await tableCount("flow_buckets"),
+      minuteStats: await tableCount("flow_minute_stats"),
+      minuteDims: await tableCount("flow_minute_dims"),
+      dailyDims: await tableCount("flow_daily_dims"),
     }
-    sqliteDatabase.exec(`
-      DELETE FROM flow_buckets;
-      DELETE FROM flow_minute_stats;
-      DELETE FROM flow_minute_dims;
-      DELETE FROM flow_daily_dims;
-    `)
-    resetFlowIngestCounters()
+    await dbQuery(`DELETE FROM flow_buckets`)
+    await dbQuery(`DELETE FROM flow_minute_stats`)
+    await dbQuery(`DELETE FROM flow_minute_dims`)
+    await dbQuery(`DELETE FROM flow_daily_dims`)
+    await resetFlowIngestCounters()
+    await dropExpiredPartitions(pool)
     try {
-      sqliteDatabase.pragma("wal_checkpoint(TRUNCATE)")
+      await startTrafficFlowListener()
     } catch {
-      /* ignore */
-    }
-    let vacuumed = false
-    try {
-      sqliteDatabase.exec("VACUUM")
-      vacuumed = true
-    } catch {
-      vacuumed = false
+      /* ingest мог остаться выключенным */
     }
     return {
       ok: true,
       deleted,
-      fileBytesBefore,
-      fileBytesAfter: dbFileBytes(),
-      vacuumed,
+      fileBytesBefore: 0,
+      fileBytesAfter: 0,
+      vacuumed: false,
     }
-  } finally {
-    try {
-      startTrafficFlowListener()
-    } catch {
-      /* ingest мог остаться выключенным */
-    }
-    endSqliteExclusiveOp()
-  }
+  })
 }
 
 export { peekPendingFlows }
diff --git a/backend/src/services/traffic-flow-map-hops.test.ts b/backend/src/services/traffic-flow-map-hops.test.ts
index 7ebf90b..b966dbf 100644
--- a/backend/src/services/traffic-flow-map-hops.test.ts
+++ b/backend/src/services/traffic-flow-map-hops.test.ts
@@ -5,6 +5,7 @@ import {
   resetFlowRingsForTests,
 } from "./traffic-flow-ingest.js"
 import { buildFlowMapHops, resetFlowMapHopsCacheForTests } from "./traffic-flow-map-hops.js"
+import { withPgOrSkip } from "../test/pg.js"
 import { seedFlowTopologyForTests, type FlowTopology } from "./traffic-flow-topology.js"
 import { disableCatalogFetchForTests, resetFlowCatalogForTests } from "./traffic-flow-classify.js"
 import {
@@ -14,6 +15,11 @@ import {
   seedRipeCacheForTests,
 } from "./traffic-flow-ripe.js"
 
+if (!(await withPgOrSkip())) {
+  console.log("traffic-flow-map-hops.test.ts: skip")
+  process.exit(0)
+}
+
 disableCatalogFetchForTests()
 resetFlowCatalogForTests()
 disableRipePersistForTests()
@@ -115,7 +121,7 @@ ingestParsedFlowsForServerForTests(3, [
 
 try {
   resetFlowMapHopsCacheForTests()
-  const def = buildFlowMapHops({ minutes: 5 })
+  const def = await buildFlowMapHops({ minutes: 5 })
   assert.equal(def.excludeOverlayApplied, true)
   assert.equal(def.excludeMeshApplied, true)
   assert.equal(def.dedupApplied, true)
@@ -144,7 +150,7 @@ try {
   assert.equal(wan.bytes, 3000)
 
   resetFlowMapHopsCacheForTests()
-  const withAll = buildFlowMapHops({ minutes: 5, excludeOverlay: false, excludeMesh: false })
+  const withAll = await buildFlowMapHops({ minutes: 5, excludeOverlay: false, excludeMesh: false })
   const overlayIface = withAll.hops.find((h) => h.iface === "gre-jh-en" && h.fromId === "7")
   assert.ok(overlayIface && overlayIface.bytes >= 5_000_000)
   const meshIface = withAll.hops.find((h) => h.iface === "gre-client" && h.fromId === "7" && h.kind === "iface")
@@ -203,7 +209,7 @@ ingestParsedFlowsForServerForTests(7, [
 ])
 try {
   resetFlowMapHopsCacheForTests()
-  const six = buildFlowMapHops({ minutes: 5, minSharePct: 5 })
+  const six = await buildFlowMapHops({ minutes: 5, minSharePct: 5 })
   assert.equal(six.totalBytes, 10_000)
   const google = six.services?.find((s) => s.id === "svc:google")
   assert.ok(google, "Google ≥ 5%")
@@ -233,11 +239,11 @@ ingestParsedFlowsForServerForTests(7, [
 ])
 try {
   resetFlowMapHopsCacheForTests()
-  const four = buildFlowMapHops({ minutes: 5, minSharePct: 5 })
+  const four = await buildFlowMapHops({ minutes: 5, minSharePct: 5 })
   assert.equal(four.totalBytes, 10_000)
   assert.ok(!(four.services ?? []).some((s) => s.id === "svc:google"), "Google < 5% hidden")
   resetFlowMapHopsCacheForTests()
-  const off = buildFlowMapHops({ minutes: 5, minSharePct: 0 })
+  const off = await buildFlowMapHops({ minutes: 5, minSharePct: 0 })
   assert.ok(off.services?.some((s) => s.id === "svc:google"), "порог 0 показывает Google 4%")
 } finally {
   resetFlowRingsForTests()
@@ -270,7 +276,7 @@ ingestParsedFlowsForServerForTests(7, [
 ])
 try {
   resetFlowMapHopsCacheForTests()
-  const greOnly = buildFlowMapHops({ minutes: 5, excludeOverlay: false, minSharePct: 0 })
+  const greOnly = await buildFlowMapHops({ minutes: 5, excludeOverlay: false, minSharePct: 0 })
   assert.ok(!(greOnly.services ?? []).some((s) => s.label === "GRE"), "GRE is not a destination service")
 } finally {
   seedFlowTopologyForTests(null)
@@ -317,7 +323,7 @@ ingestParsedFlowsForServerForTests(7, [
 ])
 try {
   resetFlowMapHopsCacheForTests()
-  const rev = buildFlowMapHops({ minutes: 5, minSharePct: 0 })
+  const rev = await buildFlowMapHops({ minutes: 5, minSharePct: 0 })
   assert.ok(rev.services?.some((s) => s.id === "svc:google"), "реверс Google:443 → 10.x")
   assert.ok(rev.services?.some((s) => s.id === "svc:cloudflare"), "реверс Cloudflare:443 → 10.x")
   assert.ok(rev.serviceEdges?.some((e) => e.toId === "svc:google" && e.fromId === "9"))
@@ -356,7 +362,7 @@ ingestParsedFlowsForServerForTests(7, [
 ])
 try {
   resetFlowMapHopsCacheForTests()
-  const wan = buildFlowMapHops({ minutes: 5, minSharePct: 0 })
+  const wan = await buildFlowMapHops({ minutes: 5, minSharePct: 0 })
   const googleEdge = wan.serviceEdges?.find((e) => e.toId === "svc:google")
   assert.ok(googleEdge, "Google с WAN JH")
   assert.equal(googleEdge.fromId, "9", "якорь на EN, не на JH")
@@ -395,7 +401,7 @@ ingestParsedFlowsForServerForTests(7, [
 ])
 try {
   resetFlowMapHopsCacheForTests()
-  const wanOnly = buildFlowMapHops({ minutes: 5, minSharePct: 0 })
+  const wanOnly = await buildFlowMapHops({ minutes: 5, minSharePct: 0 })
   const googleEdge = wanOnly.serviceEdges?.find((e) => e.toId === "svc:google")
   assert.ok(googleEdge, "Google WAN без GRE payload")
   assert.equal(googleEdge.fromId, "9", "единственный EN, даже без nextHop")
diff --git a/backend/src/services/traffic-flow-map-hops.ts b/backend/src/services/traffic-flow-map-hops.ts
index 66b05c3..b7a71aa 100644
--- a/backend/src/services/traffic-flow-map-hops.ts
+++ b/backend/src/services/traffic-flow-map-hops.ts
@@ -113,9 +113,9 @@ function hopsQueryKey(q: FlowMapHopsQuery, minSharePct: number): string {
   })
 }
 
-function userIfaceAllow(userId: string): Map<number, Set<string>> | null {
+async function userIfaceAllow(userId: string): Promise<Map<number, Set<string>> | null> {
   if (!userId) return null
-  const binds = db.select().from(userInterfaceBindings).where(eq(userInterfaceBindings.userId, userId)).all()
+  const binds = await db.select().from(userInterfaceBindings).where(eq(userInterfaceBindings.userId, userId))
   const allow = new Map<number, Set<string>>()
   for (const b of binds) {
     const set = allow.get(b.serverId) ?? new Set<string>()
@@ -182,27 +182,27 @@ function classifyMapDstLite(
   return brand
 }
 
-function resolveMinSharePct(q: FlowMapHopsQuery): number {
+async function resolveMinSharePct(q: FlowMapHopsQuery): Promise<number> {
   if (q.minSharePct != null) return clampMapServiceMinSharePct(q.minSharePct)
   try {
-    const row = getTrafficFlowSettingsRow() as { mapServiceMinSharePct?: number }
+    const row = await getTrafficFlowSettingsRow()
     return clampMapServiceMinSharePct(row.mapServiceMinSharePct ?? DEFAULT_MAP_SERVICE_MIN_SHARE_PCT)
   } catch {
     return DEFAULT_MAP_SERVICE_MIN_SHARE_PCT
   }
 }
 
-function buildFlowMapHopsUncached(q: FlowMapHopsQuery, minSharePct: number): FlowMapHopsDto {
+async function buildFlowMapHopsUncached(q: FlowMapHopsQuery, minSharePct: number): Promise<FlowMapHopsDto> {
   const windowSec = Math.max(60, q.minutes * 60)
-  const raw = listFlowRowsForWindow(q.minutes)
-  const allow = q.userId ? userIfaceAllow(q.userId) : null
-  const catalog = getServerCatalog()
+  const raw = await listFlowRowsForWindow(q.minutes)
+  const allow = q.userId ? await userIfaceAllow(q.userId) : null
+  const catalog = await getServerCatalog()
   const nameById = new Map([...catalog.byId].map(([id, s]) => [id, s.name]))
   const ifaceFilter = q.iface && q.iface !== "__all__" ? q.iface : ""
   const wantDedup = q.dedup !== false && !ifaceFilter
   const excludeMesh = q.excludeMesh !== false
   const excludeOverlay = q.excludeOverlay !== false
-  const topo = loadFlowTopology()
+  const topo = await loadFlowTopology()
 
   const matched = []
   for (const r of raw) {
@@ -508,14 +508,14 @@ function buildFlowMapHopsUncached(q: FlowMapHopsQuery, minSharePct: number): Flo
 }
 
 /** Hop-rates для карты сети: те же фильтры, что у общего NetFlow (dedup / mesh / overlay). */
-export function buildFlowMapHops(q: FlowMapHopsQuery): FlowMapHopsDto {
-  const minSharePct = resolveMinSharePct(q)
+export async function buildFlowMapHops(q: FlowMapHopsQuery): Promise<FlowMapHopsDto> {
+  const minSharePct = await resolveMinSharePct(q)
   const key = hopsQueryKey(q, minSharePct)
   const now = Date.now()
   if (hopsCache && hopsCache.key === key && now - hopsCache.at < HOPS_CACHE_TTL_MS) {
     return hopsCache.dto
   }
-  const dto = buildFlowMapHopsUncached(q, minSharePct)
+  const dto = await buildFlowMapHopsUncached(q, minSharePct)
   hopsCache = { key, at: now, dto }
   return dto
 }
diff --git a/backend/src/services/traffic-flow-overlay.ts b/backend/src/services/traffic-flow-overlay.ts
index 2d94751..18cda39 100644
--- a/backend/src/services/traffic-flow-overlay.ts
+++ b/backend/src/services/traffic-flow-overlay.ts
@@ -181,14 +181,14 @@ export async function applyFlowOverlay(
   opts?: { publicEndpoint?: string; requestHost?: string },
 ): Promise<TrafficFlowOverlayResult> {
   const steps: string[] = []
-  const keys = ensureHostKeys()
-  const settings = getTrafficFlowSettingsRow()
+  const keys = await ensureHostKeys()
+  const settings = await getTrafficFlowSettingsRow()
   const hostPublicKey = settings.hostPublicKey || keys.publicKey
   if (!hostPublicKey) {
     throw Object.assign(new Error("Не удалось создать ключи хоста MM"), { statusCode: 500 })
   }
 
-  const server = getEnabledServerById(String(serverIdRaw))
+  const server = await getEnabledServerById(String(serverIdRaw))
   if (!server || !server.enabled) {
     throw Object.assign(new Error("Сервер не найден или выключен"), { statusCode: 404 })
   }
@@ -199,11 +199,8 @@ export async function applyFlowOverlay(
   }
   const peerEndpoint = `${endpointHost}:${JH_LISTEN_PORT}`
 
-  const taken = new Set(
-    db.select({ ip: servers.mgmtTunnelIp }).from(servers).all()
-      .map((r) => r.ip)
-      .filter(Boolean),
-  )
+  const takenRows = await db.select({ ip: servers.mgmtTunnelIp }).from(servers)
+  const taken = new Set(takenRows.map((r) => r.ip).filter((ip): ip is string => Boolean(ip)))
   const address = server.mgmtTunnelIp || allocateOverlayAddress(settings.prefix, settings.collectorIp, server.id, taken)
   const client = MikrotikClient.fromServer(server)
 
@@ -285,13 +282,13 @@ export async function applyFlowOverlay(
       throw new Error("Не удалось прочитать public-key интерфейса wg-flow")
     }
 
-    db.update(servers).set({
+    await db.update(servers).set({
       mgmtTunnelIp: address,
       updatedAt: new Date().toISOString(),
-    }).where(eq(servers.id, server.id)).run()
+    }).where(eq(servers.id, server.id))
     invalidateFlowCatalogCache()
 
-    upsertHostPeer({
+    await upsertHostPeer({
       serverId: server.id,
       name: server.name || server.host,
       publicKey,
@@ -300,9 +297,9 @@ export async function applyFlowOverlay(
       endpoint: peerEndpoint,
     })
 
-    enableTrafficFlowIngest()
-    startTrafficFlowListener()
-    refreshFlowExporterMap()
+    await enableTrafficFlowIngest()
+    await startTrafficFlowListener()
+    await refreshFlowExporterMap()
     steps.push("Коллектор IPFIX на MM включён")
 
     return {
@@ -314,7 +311,7 @@ export async function applyFlowOverlay(
       linuxPeerBlock: linuxPeerBlock(publicKey, address, server.name || server.host, endpointHost),
       trafficFlow: true,
       steps,
-      hostFiles: listTrafficFlowHostFiles(),
+      hostFiles: await listTrafficFlowHostFiles(),
     }
   } catch (e) {
     const msg = e instanceof MikrotikError ? e.message : e instanceof Error ? e.message : String(e)
diff --git a/backend/src/services/traffic-flow-purge.test.ts b/backend/src/services/traffic-flow-purge.test.ts
index 9c862b6..8114cb0 100644
--- a/backend/src/services/traffic-flow-purge.test.ts
+++ b/backend/src/services/traffic-flow-purge.test.ts
@@ -1,54 +1,68 @@
 import assert from "node:assert/strict"
-import { mkdtempSync, rmSync } from "node:fs"
-import os from "node:os"
-import path from "node:path"
+import { dbQuery } from "../db/index.js"
+import { withPgOrSkip } from "../test/pg.js"
+import { ensurePartitionFor } from "../db/partitions.js"
+import { pool } from "../db/index.js"
 
-const dir = mkdtempSync(path.join(os.tmpdir(), "mm-flow-purge-"))
-process.env.DATABASE_PATH = path.join(dir, "test.db")
+if (!(await withPgOrSkip())) {
+  console.log("traffic-flow-purge.test.ts: skip")
+  process.exit(0)
+}
+
+const nServers = (await dbQuery<{ n: number }>(`SELECT COUNT(*)::int AS n FROM servers`)).rows[0]?.n ?? 0
+if (nServers > 10) {
+  console.warn("traffic-flow-purge.test.ts: skip (не пустая БД)")
+  process.exit(0)
+}
 
-const { sqliteDatabase } = await import("../db/index.js")
 const {
   getFlowRuntimeCounters,
   purgeTrafficFlowStore,
   stopTrafficFlowListener,
 } = await import("./traffic-flow-ingest.js")
 
-function count(name: string): number {
-  const row = sqliteDatabase.prepare(`SELECT COUNT(*) AS n FROM ${name}`).get() as { n: number }
-  return Number(row?.n) || 0
+async function count(name: string): Promise<number> {
+  const row = await dbQuery<{ n: number }>(`SELECT COUNT(*)::int AS n FROM ${name}`)
+  return Number(row.rows[0]?.n) || 0
 }
 
-try {
-  sqliteDatabase.prepare(`
-    INSERT INTO servers (name, host) VALUES ('purge-test', '127.0.0.1')
-  `).run()
-  const serverId = Number(
-    (sqliteDatabase.prepare(`SELECT id FROM servers WHERE name = 'purge-test'`).get() as { id: number }).id,
-  )
-  sqliteDatabase.prepare(`
-    INSERT INTO flow_buckets (server_id, bucket_at, src, dst, proto, src_port, dst_port, bytes, packets, in_iface)
-    VALUES (?, '2026-01-01T00:00:00.000Z', '10.0.0.1', '8.8.8.8', 6, 50000, 443, 100, 1, 'wg-flow')
-  `).run(serverId)
-  sqliteDatabase.prepare(`
-    INSERT INTO flow_minute_stats (server_id, bucket_at, bytes, packets, unique_src, unique_dst, conversations)
-    VALUES (?, '2026-01-01T00:00:00.000Z', 100, 1, 1, 1, 1)
-  `).run(serverId)
-  sqliteDatabase.prepare(`
-    INSERT INTO flow_minute_dims (server_id, bucket_at, dim, key, bytes, packets)
-    VALUES (?, '2026-01-01T00:00:00.000Z', 'country', 'RU', 100, 1)
-  `).run(serverId)
-  sqliteDatabase.prepare(`
-    INSERT INTO flow_daily_dims (server_id, day, dim, key, bytes, packets)
-    VALUES (?, '2026-01-01', 'country', 'RU', 100, 1)
-  `).run(serverId)
-  sqliteDatabase.prepare(`
-    INSERT INTO flow_ip_meta (prefix, asn, country, holder, ok, fetched_at)
-    VALUES ('8.8.8.0/24', 15169, 'US', 'Google', 1, ?)
-  `).run(new Date().toISOString())
-  sqliteDatabase.prepare(`
-    UPDATE traffic_flow_settings SET packets_received = 42, last_exporter_ip = '10.255.254.3' WHERE id = 1
-  `).run()
+await dbQuery(`
+  INSERT INTO servers (name, host) VALUES ('purge-test', '127.0.0.1')
+`)
+const sidRow = await dbQuery<{ id: number }>(`SELECT id FROM servers WHERE name = 'purge-test'`)
+const serverId = sidRow.rows[0]!.id
+const ts = new Date("2026-01-01T00:00:00.000Z")
+await ensurePartitionFor(pool, "flow_buckets", "day", ts)
+await ensurePartitionFor(pool, "flow_minute_stats", "day", ts)
+await ensurePartitionFor(pool, "flow_minute_dims", "day", ts)
+await ensurePartitionFor(pool, "flow_daily_dims", "month", ts)
 
+await dbQuery(`
+  INSERT INTO flow_buckets (server_id, bucket_at, src, dst, proto, src_port, dst_port, bytes, packets, in_iface)
+  VALUES ($1, '2026-01-01T00:00:00.000Z', '10.0.0.1', '8.8.8.8', 6, 50000, 443, 100, 1, 'wg-flow')
+`, [serverId])
+await dbQuery(`
+  INSERT INTO flow_minute_stats (server_id, bucket_at, bytes, packets, unique_src, unique_dst, conversations)
+  VALUES ($1, '2026-01-01T00:00:00.000Z', 100, 1, 1, 1, 1)
+`, [serverId])
+await dbQuery(`
+  INSERT INTO flow_minute_dims (server_id, bucket_at, dim, key, bytes, packets)
+  VALUES ($1, '2026-01-01T00:00:00.000Z', 'country', 'RU', 100, 1)
+`, [serverId])
+await dbQuery(`
+  INSERT INTO flow_daily_dims (server_id, day, dim, key, bytes, packets)
+  VALUES ($1, '2026-01-01', 'country', 'RU', 100, 1)
+`, [serverId])
+await dbQuery(`
+  INSERT INTO flow_ip_meta (prefix, asn, country, holder, ok, fetched_at)
+  VALUES ('8.8.8.0/24', 15169, 'US', 'Google', 1, now())
+  ON CONFLICT (prefix) DO NOTHING
+`)
+await dbQuery(`
+  UPDATE traffic_flow_settings SET packets_received = 42, last_exporter_ip = '10.255.254.3' WHERE id = 1
+`)
+
+try {
   const result = await purgeTrafficFlowStore()
   stopTrafficFlowListener()
 
@@ -57,21 +71,16 @@ try {
   assert.equal(result.deleted.minuteStats, 1)
   assert.equal(result.deleted.minuteDims, 1)
   assert.equal(result.deleted.dailyDims, 1)
-  assert.equal(count("flow_buckets"), 0)
-  assert.equal(count("flow_minute_stats"), 0)
-  assert.equal(count("flow_minute_dims"), 0)
-  assert.equal(count("flow_daily_dims"), 0)
-  assert.equal(count("flow_ip_meta"), 1)
-  assert.equal(count("servers"), 1)
-  assert.equal(getFlowRuntimeCounters().packetsReceived, 0)
-  assert.equal(getFlowRuntimeCounters().lastExporterIp, null)
+  assert.equal(await count("flow_buckets"), 0)
+  assert.equal(await count("flow_minute_stats"), 0)
+  assert.equal(await count("flow_minute_dims"), 0)
+  assert.equal(await count("flow_daily_dims"), 0)
+  assert.ok((await count("flow_ip_meta")) >= 1)
+  assert.ok((await count("servers")) >= 1)
+  assert.equal((await getFlowRuntimeCounters()).packetsReceived, 0)
+  assert.equal((await getFlowRuntimeCounters()).lastExporterIp, null)
 } finally {
-  try {
-    sqliteDatabase.close()
-  } catch {
-    /* ignore */
-  }
-  rmSync(dir, { recursive: true, force: true })
+  await dbQuery(`DELETE FROM servers WHERE id = $1`, [serverId])
 }
 
 console.log("traffic-flow-purge.test.ts: ok")
diff --git a/backend/src/services/traffic-flow-ripe.ts b/backend/src/services/traffic-flow-ripe.ts
index 53fe53f..9bd8415 100644
--- a/backend/src/services/traffic-flow-ripe.ts
+++ b/backend/src/services/traffic-flow-ripe.ts
@@ -1,4 +1,4 @@
-import { sqliteDatabase } from "../db/index.js"
+import { dbAll, dbQuery } from "../db/index.js"
 import { ipv4ToInt, isNonPublicIp, parseCidrV4 } from "./traffic-flow-ip.js"
 import { resolveRipeCountry } from "./traffic-flow-brands.js"
 
@@ -155,11 +155,12 @@ function loadSqlite(): void {
     return
   }
   loaded = true
+  void loadPg()
+}
+
+async function loadPg(): Promise<void> {
   try {
-    const rows = sqliteDatabase.prepare(`
-      SELECT prefix, asn, country, lat, lng, holder, ok, fetched_at
-      FROM flow_ip_meta
-    `).all() as Array<{
+    const rows = await dbAll<{
       prefix: string
       asn: number | null
       country: string
@@ -168,7 +169,10 @@ function loadSqlite(): void {
       holder: string
       ok: number
       fetched_at: string
-    }>
+    }>(`
+      SELECT prefix, asn, country, lat, lng, holder, ok, fetched_at
+      FROM flow_ip_meta
+    `)
     for (const r of rows) {
       const fetchedAt = Date.parse(r.fetched_at)
       const asn = Number(r.asn ?? 0) || 0
@@ -184,11 +188,11 @@ function loadSqlite(): void {
         fetchedAt: Number.isFinite(fetchedAt) ? fetchedAt : 0,
       })
     }
-    const asns = sqliteDatabase.prepare(`SELECT asn, holder, fetched_at FROM flow_asn_meta`).all() as Array<{
+    const asns = await dbAll<{
       asn: number
       holder: string
       fetched_at: string
-    }>
+    }>(`SELECT asn, holder, fetched_at FROM flow_asn_meta`)
     for (const a of asns) {
       const fetchedAt = Date.parse(a.fetched_at)
       asnHolder.set(a.asn, { holder: a.holder || "", fetchedAt: Number.isFinite(fetchedAt) ? fetchedAt : 0 })
@@ -200,54 +204,46 @@ function loadSqlite(): void {
 
 function persist(entry: FlowIpMeta): void {
   if (!persistEnabled) return
-  try {
-    sqliteDatabase.prepare(`
+  void dbQuery(`
       INSERT INTO flow_ip_meta (prefix, asn, country, lat, lng, holder, ok, fetched_at)
       VALUES (@prefix, @asn, @country, @lat, @lng, @holder, @ok, @fetchedAt)
       ON CONFLICT(prefix) DO UPDATE SET
         asn=excluded.asn, country=excluded.country, lat=excluded.lat, lng=excluded.lng,
         holder=excluded.holder, ok=excluded.ok, fetched_at=excluded.fetched_at
-    `).run({
-      prefix: entry.prefix,
-      asn: entry.asn,
-      country: entry.country,
-      lat: entry.lat,
-      lng: entry.lng,
-      holder: entry.holder,
-      ok: entry.ok ? 1 : 0,
-      fetchedAt: new Date(entry.fetchedAt).toISOString(),
-    })
-  } catch {
-    /* ignore persist errors */
-  }
+    `, {
+    prefix: entry.prefix,
+    asn: entry.asn,
+    country: entry.country,
+    lat: entry.lat,
+    lng: entry.lng,
+    holder: entry.holder,
+    ok: entry.ok ? 1 : 0,
+    fetchedAt: new Date(entry.fetchedAt).toISOString(),
+  }).catch(() => { /* ignore persist errors */ })
 }
 
 function persistAsn(asn: number, holder: string): void {
   if (!persistEnabled || !asn) return
-  try {
-    sqliteDatabase.prepare(`
+  void dbQuery(`
       INSERT INTO flow_asn_meta (asn, holder, fetched_at)
       VALUES (@asn, @holder, @fetchedAt)
       ON CONFLICT(asn) DO UPDATE SET holder=excluded.holder, fetched_at=excluded.fetched_at
-    `).run({
-      asn,
-      holder,
-      fetchedAt: new Date().toISOString(),
-    })
-  } catch {
-    /* ignore */
-  }
+    `, {
+    asn,
+    holder,
+    fetchedAt: new Date().toISOString(),
+  }).catch(() => { /* ignore */ })
 }
 
 /** Удаляет просроченный RIPE-кэш с диска (hit 24h / negative 6h). */
-export function pruneRipeSqlite(nowMs = Date.now()): void {
+export async function pruneRipeSqlite(nowMs = Date.now()): Promise<void> {
   if (!persistEnabled) return
   try {
     const hitCutoff = new Date(nowMs - HIT_TTL_MS).toISOString()
     const negCutoff = new Date(nowMs - NEG_TTL_MS).toISOString()
-    sqliteDatabase.prepare(`DELETE FROM flow_ip_meta WHERE ok != 0 AND fetched_at < ?`).run(hitCutoff)
-    sqliteDatabase.prepare(`DELETE FROM flow_ip_meta WHERE ok = 0 AND fetched_at < ?`).run(negCutoff)
-    sqliteDatabase.prepare(`DELETE FROM flow_asn_meta WHERE fetched_at < ?`).run(hitCutoff)
+    await dbQuery(`DELETE FROM flow_ip_meta WHERE ok != 0 AND fetched_at < ?`, [hitCutoff])
+    await dbQuery(`DELETE FROM flow_ip_meta WHERE ok = 0 AND fetched_at < ?`, [negCutoff])
+    await dbQuery(`DELETE FROM flow_asn_meta WHERE fetched_at < ?`, [hitCutoff])
   } catch {
     /* table may not exist in isolated tests */
   }
diff --git a/backend/src/services/traffic-flow-settings.ts b/backend/src/services/traffic-flow-settings.ts
index fc95e17..700abeb 100644
--- a/backend/src/services/traffic-flow-settings.ts
+++ b/backend/src/services/traffic-flow-settings.ts
@@ -1,10 +1,13 @@
 import { eq } from "drizzle-orm"
 import { db } from "../db/index.js"
+import { parseJsonArray } from "../db/json.js"
 import { trafficFlowSettings } from "../db/schema.js"
 import type { FlowHostPeer, TrafficFlowSettingsDto, TrafficFlowSettingsPatch } from "@mmapp/contracts/traffic-flow"
 import { generateWireGuardKeyPair } from "./wg-keys.js"
 
-let settingsRowCache: ReturnType<typeof readSettingsRow> | null = null
+type SettingsRow = NonNullable<Awaited<ReturnType<typeof readSettingsRow>>>
+
+let settingsRowCache: SettingsRow | null = null
 
 function nowIso() {
   return new Date().toISOString()
@@ -14,19 +17,19 @@ export function invalidateTrafficFlowSettingsCache(): void {
   settingsRowCache = null
 }
 
-function readSettingsRow() {
-  return db.select().from(trafficFlowSettings).where(eq(trafficFlowSettings.id, 1)).limit(1).all()[0]
+async function readSettingsRow() {
+  return (await db.select().from(trafficFlowSettings).where(eq(trafficFlowSettings.id, 1)).limit(1))[0]
 }
 
-export function getTrafficFlowSettingsRow() {
+export async function getTrafficFlowSettingsRow(): Promise<SettingsRow> {
   if (settingsRowCache) return settingsRowCache
-  const row = readSettingsRow()
+  let row = await readSettingsRow()
   if (row) {
     settingsRowCache = row
     return row
   }
   const now = nowIso()
-  db.insert(trafficFlowSettings).values({
+  await db.insert(trafficFlowSettings).values({
     id: 1,
     enabled: false,
     collectorIp: "10.255.254.1",
@@ -35,27 +38,23 @@ export function getTrafficFlowSettingsRow() {
     prefix: "10.255.254.0/24",
     createdAt: now,
     updatedAt: now,
-  }).run()
-  settingsRowCache = readSettingsRow()
-  return settingsRowCache!
+  })
+  row = await readSettingsRow()
+  settingsRowCache = row!
+  return settingsRowCache
 }
 
-function parsePeers(raw: string): FlowHostPeer[] {
-  try {
-    const parsed = JSON.parse(raw) as unknown
-    if (!Array.isArray(parsed)) return []
-    return parsed.filter((p): p is FlowHostPeer =>
-      p != null && typeof p === "object" && typeof (p as FlowHostPeer).publicKey === "string",
-    )
-  } catch {
-    return []
-  }
+function parsePeers(raw: unknown): FlowHostPeer[] {
+  const arr = parseJsonArray(raw)
+  return arr.filter((p): p is FlowHostPeer =>
+    p != null && typeof p === "object" && typeof (p as FlowHostPeer).publicKey === "string",
+  )
 }
 
-export function toTrafficFlowSettingsDto(
+export async function toTrafficFlowSettingsDto(
   listener: { bound: boolean; address: string | null },
-): TrafficFlowSettingsDto {
-  const row = getTrafficFlowSettingsRow()
+): Promise<TrafficFlowSettingsDto> {
+  const row = await getTrafficFlowSettingsRow()
   return {
     enabled: row.enabled,
     collectorIp: row.collectorIp,
@@ -79,9 +78,9 @@ export function toTrafficFlowSettingsDto(
   }
 }
 
-export function updateTrafficFlowSettings(patch: TrafficFlowSettingsPatch) {
-  const row = getTrafficFlowSettingsRow()
-  db.update(trafficFlowSettings).set({
+export async function updateTrafficFlowSettings(patch: TrafficFlowSettingsPatch) {
+  const row = await getTrafficFlowSettingsRow()
+  await db.update(trafficFlowSettings).set({
     enabled: patch.enabled ?? row.enabled,
     collectorIp: patch.collectorIp ?? row.collectorIp,
     flowListenPort: patch.flowListenPort ?? row.flowListenPort,
@@ -95,75 +94,75 @@ export function updateTrafficFlowSettings(patch: TrafficFlowSettingsPatch) {
       ? row.mapServiceMinSharePct
       : Math.min(100, Math.max(0, patch.mapServiceMinSharePct)),
     updatedAt: nowIso(),
-  }).where(eq(trafficFlowSettings.id, 1)).run()
+  }).where(eq(trafficFlowSettings.id, 1))
   invalidateTrafficFlowSettingsCache()
-  return getTrafficFlowSettingsRow()
+  return await getTrafficFlowSettingsRow()
 }
 
-export function ensureHostKeys(): { publicKey: string; created: boolean } {
-  const row = getTrafficFlowSettingsRow()
+export async function ensureHostKeys(): Promise<{ publicKey: string; created: boolean }> {
+  const row = await getTrafficFlowSettingsRow()
   if (row.hostPublicKey && row.hostPrivateKey) {
     return { publicKey: row.hostPublicKey, created: false }
   }
   const keys = generateWireGuardKeyPair()
-  db.update(trafficFlowSettings).set({
+  await db.update(trafficFlowSettings).set({
     hostPublicKey: keys.publicKey,
     hostPrivateKey: keys.privateKey,
     updatedAt: nowIso(),
-  }).where(eq(trafficFlowSettings.id, 1)).run()
+  }).where(eq(trafficFlowSettings.id, 1))
   invalidateTrafficFlowSettingsCache()
   return { publicKey: keys.publicKey, created: true }
 }
 
-export function upsertHostPeer(peer: FlowHostPeer) {
-  const row = getTrafficFlowSettingsRow()
+export async function upsertHostPeer(peer: FlowHostPeer) {
+  const row = await getTrafficFlowSettingsRow()
   const peers = parsePeers(row.peersJson).filter((p) => p.serverId !== peer.serverId)
   peers.push(peer)
-  db.update(trafficFlowSettings).set({
-    peersJson: JSON.stringify(peers),
+  await db.update(trafficFlowSettings).set({
+    peersJson: peers,
     updatedAt: nowIso(),
-  }).where(eq(trafficFlowSettings.id, 1)).run()
+  }).where(eq(trafficFlowSettings.id, 1))
   invalidateTrafficFlowSettingsCache()
 }
 
-export function recordFlowPacket(exporterIp: string) {
-  const row = getTrafficFlowSettingsRow()
-  db.update(trafficFlowSettings).set({
+export async function recordFlowPacket(exporterIp: string) {
+  const row = await getTrafficFlowSettingsRow()
+  await db.update(trafficFlowSettings).set({
     lastDatagramAt: nowIso(),
     lastExporterIp: exporterIp,
     packetsReceived: row.packetsReceived + 1,
     updatedAt: nowIso(),
-  }).where(eq(trafficFlowSettings.id, 1)).run()
+  }).where(eq(trafficFlowSettings.id, 1))
   invalidateTrafficFlowSettingsCache()
 }
 
-export function recordFlowListenerError(message: string) {
-  db.update(trafficFlowSettings).set({
+export async function recordFlowListenerError(message: string) {
+  await db.update(trafficFlowSettings).set({
     lastError: message,
     updatedAt: nowIso(),
-  }).where(eq(trafficFlowSettings.id, 1)).run()
+  }).where(eq(trafficFlowSettings.id, 1))
   invalidateTrafficFlowSettingsCache()
 }
 
-export function enableTrafficFlowIngest() {
-  db.update(trafficFlowSettings).set({
+export async function enableTrafficFlowIngest() {
+  await db.update(trafficFlowSettings).set({
     enabled: true,
     updatedAt: nowIso(),
-  }).where(eq(trafficFlowSettings.id, 1)).run()
+  }).where(eq(trafficFlowSettings.id, 1))
   invalidateTrafficFlowSettingsCache()
 }
 
-export function listHostPeers(): FlowHostPeer[] {
-  return parsePeers(getTrafficFlowSettingsRow().peersJson)
+export async function listHostPeers(): Promise<FlowHostPeer[]> {
+  return parsePeers((await getTrafficFlowSettingsRow()).peersJson)
 }
 
-export function resetFlowIngestCounters(): void {
-  db.update(trafficFlowSettings).set({
+export async function resetFlowIngestCounters(): Promise<void> {
+  await db.update(trafficFlowSettings).set({
     packetsReceived: 0,
     lastDatagramAt: null,
     lastExporterIp: null,
     lastError: "",
     updatedAt: nowIso(),
-  }).where(eq(trafficFlowSettings.id, 1)).run()
+  }).where(eq(trafficFlowSettings.id, 1))
   invalidateTrafficFlowSettingsCache()
 }
diff --git a/backend/src/services/traffic-flow-topology.ts b/backend/src/services/traffic-flow-topology.ts
index 541940c..dd84a81 100644
--- a/backend/src/services/traffic-flow-topology.ts
+++ b/backend/src/services/traffic-flow-topology.ts
@@ -1,4 +1,5 @@
-import { db, sqliteDatabase } from "../db/index.js"
+import { db, dbAll } from "../db/index.js"
+import { parseJsonArray } from "../db/json.js"
 import { appUsers, servers, userInterfaceBindings } from "../db/schema.js"
 import { mapRosInterfaceType } from "../modules/users/iface-type.js"
 import type { PlaneTopology } from "./traffic-flow-planes.js"
@@ -47,12 +48,12 @@ export function invalidateFlowCatalogCache(): void {
   serverCatalogCache = null
 }
 
-export function getServerCatalog(): { list: ServerCatalogEntry[]; byId: Map<number, ServerCatalogEntry> } {
+export async function getServerCatalog(): Promise<{ list: ServerCatalogEntry[]; byId: Map<number, ServerCatalogEntry> }> {
   const now = Date.now()
   if (serverCatalogCache && now - serverCatalogCache.at < CATALOG_TTL_MS) {
     return serverCatalogCache
   }
-  const rows = db.select().from(servers).all()
+  const rows = await db.select().from(servers)
   const list: ServerCatalogEntry[] = rows.map((s) => ({
     id: s.id,
     name: s.name || s.host,
@@ -66,26 +67,22 @@ export function getServerCatalog(): { list: ServerCatalogEntry[]; byId: Map<numb
   return serverCatalogCache
 }
 
-function parseWanUplinks(raw: string): Array<{ iface?: string; ip?: string }> {
-  try {
-    const parsed = JSON.parse(raw || "[]") as unknown
-    return Array.isArray(parsed) ? parsed as Array<{ iface?: string; ip?: string }> : []
-  } catch {
-    return []
-  }
+function parseWanUplinks(raw: unknown): Array<{ iface?: string; ip?: string }> {
+  const arr = Array.isArray(raw) ? raw : parseJsonArray(raw)
+  return arr as Array<{ iface?: string; ip?: string }>
 }
 
 function ifaceKey(serverId: number, name: string): string {
   return `${serverId}|${name}`
 }
 
-export function loadFlowTopology(): FlowTopology {
+export async function loadFlowTopology(): Promise<FlowTopology> {
   if (seeded) return seeded
   const now = Date.now()
   if (topologyCache && now - topologyCache.at < CATALOG_TTL_MS) return topologyCache.topo
-  const serverRows = db.select().from(servers).all()
-  const users = db.select().from(appUsers).all()
-  const binds = db.select().from(userInterfaceBindings).all()
+  const serverRows = await db.select().from(servers)
+  const users = await db.select().from(appUsers)
+  const binds = await db.select().from(userInterfaceBindings)
   const loginById = new Map(users.map((u) => [u.id, u]))
   const clientIfaces = new Map<number, Set<string>>()
   const clientByIface = new Map<string, FlowClientBinding>()
@@ -178,21 +175,21 @@ export function enGreIfaceNames(topo: FlowTopology, serverId: number, ifaceNames
   })
 }
 
-export function latestWireBps(serverId: number, ifaceNames: string[]): { bps: number; bytes: number } {
+export async function latestWireBps(serverId: number, ifaceNames: string[]): Promise<{ bps: number; bytes: number }> {
   if (!ifaceNames.length) return { bps: 0, bytes: 0 }
   const placeholders = ifaceNames.map(() => "?").join(",")
-  const rows = sqliteDatabase.prepare(`
-    SELECT interface_name AS name, rx_bps AS rxBps, tx_bps AS txBps, rx_bytes AS rxBytes, tx_bytes AS txBytes
-    FROM traffic_samples
-    WHERE server_id = ? AND interface_name IN (${placeholders})
-    ORDER BY sampled_at DESC
-  `).all(serverId, ...ifaceNames) as Array<{
+  const rows = await dbAll<{
     name: string
     rxBps: number
     txBps: number
     rxBytes: number
     txBytes: number
-  }>
+  }>(`
+    SELECT interface_name AS name, rx_bps AS "rxBps", tx_bps AS "txBps", rx_bytes AS "rxBytes", tx_bytes AS "txBytes"
+    FROM traffic_samples
+    WHERE server_id = ? AND interface_name IN (${placeholders})
+    ORDER BY sampled_at DESC
+  `, [serverId, ...ifaceNames])
   const seen = new Set<string>()
   let bps = 0
   let bytes = 0
diff --git a/backend/src/services/traffic-users.ts b/backend/src/services/traffic-users.ts
index 3dabde3..79053d7 100644
--- a/backend/src/services/traffic-users.ts
+++ b/backend/src/services/traffic-users.ts
@@ -65,25 +65,25 @@ function seriesFromBuilt(built: BuiltTrafficSeries) {
   }
 }
 
-function serverStatus(serverId: number): "online" | "offline" {
-  const row = db.select().from(servers).where(eq(servers.id, serverId)).limit(1).all()[0]
+async function serverStatus(serverId: number): Promise<"online" | "offline"> {
+  const row = (await db.select().from(servers).where(eq(servers.id, serverId)).limit(1))[0]
   if (!row?.enabled) return "offline"
   return "online"
 }
 
-export function buildUserTrafficList(rangeStartMs: number, rangeEndMs: number): UserTrafficDto[] {
+export async function buildUserTrafficList(rangeStartMs: number, rangeEndMs: number): Promise<UserTrafficDto[]> {
   const sinceIso = new Date(rangeStartMs).toISOString()
-  const users = listUsers()
-  const sampleCache = new Map<number, ReturnType<typeof readServerSamplesInRange>>()
+  const users = await listUsers()
+  const sampleCache = new Map<number, Awaited<ReturnType<typeof readServerSamplesInRange>>>()
 
-  return users.map((user) => {
+  return Promise.all(users.map(async (user) => {
     const parts: BuiltTrafficSeries[] = []
     const interfaces: BoundIfaceTrafficDto[] = []
 
     for (const b of user.bindings) {
       let rows = sampleCache.get(b.serverId)
       if (!rows) {
-        rows = readServerSamplesInRange(b.serverId, sinceIso)
+        rows = await readServerSamplesInRange(b.serverId, sinceIso)
         sampleCache.set(b.serverId, rows)
       }
       const peerKey = b.peerPublicKey ?? ""
@@ -111,7 +111,7 @@ export function buildUserTrafficList(rangeStartMs: number, rangeEndMs: number):
         serverSite: b.serverSite,
         serverCountry: b.serverCountry,
         ...seriesFromBuilt(built),
-        status: running && serverStatus(b.serverId) === "online" ? "online" : "offline",
+        status: running && (await serverStatus(b.serverId)) === "online" ? "online" : "offline",
       })
     }
 
@@ -125,9 +125,9 @@ export function buildUserTrafficList(rangeStartMs: number, rangeEndMs: number):
       interfaces,
       ...seriesFromBuilt(merged),
     }
-  })
+  }))
 }
 
-export function buildBoundInterfaceTraffic(rangeStartMs: number, rangeEndMs: number): BoundIfaceTrafficDto[] {
-  return buildUserTrafficList(rangeStartMs, rangeEndMs).flatMap((u) => u.interfaces)
+export async function buildBoundInterfaceTraffic(rangeStartMs: number, rangeEndMs: number): Promise<BoundIfaceTrafficDto[]> {
+  return (await buildUserTrafficList(rangeStartMs, rangeEndMs)).flatMap((u) => u.interfaces)
 }
diff --git a/backend/src/services/uptime-collector.ts b/backend/src/services/uptime-collector.ts
index 9a9cd0c..f37a92a 100644
--- a/backend/src/services/uptime-collector.ts
+++ b/backend/src/services/uptime-collector.ts
@@ -43,11 +43,11 @@ function parsePingTimeMs(raw: string | undefined): number | null {
   return Number.isFinite(n) ? n : null
 }
 
-export function getSettings() {
-  const row = db.select().from(uptimeSettings).where(eq(uptimeSettings.id, 1)).limit(1).all()[0]
+export async function getSettings() {
+  const row = (await db.select().from(uptimeSettings).where(eq(uptimeSettings.id, 1)).limit(1))[0]
   if (row) return row
   const now = new Date().toISOString()
-  db.insert(uptimeSettings).values({
+  await db.insert(uptimeSettings).values({
     id: 1,
     enabled: true,
     resourcesEnabled: true,
@@ -59,14 +59,14 @@ export function getSettings() {
     retentionDays: 14,
     createdAt: now,
     updatedAt: now,
-  }).run()
-  return db.select().from(uptimeSettings).where(eq(uptimeSettings.id, 1)).limit(1).all()[0]
+  })
+  return (await db.select().from(uptimeSettings).where(eq(uptimeSettings.id, 1)).limit(1))[0]
 }
 
-function cleanup(retentionDays: number) {
+async function cleanup(retentionDays: number) {
   const cutoff = new Date(Date.now() - retentionDays * 24 * 60 * 60 * 1000).toISOString()
-  db.delete(uptimeProbeSamples).where(lt(uptimeProbeSamples.sampledAt, cutoff)).run()
-  db.delete(uptimeResourceSamples).where(lt(uptimeResourceSamples.sampledAt, cutoff)).run()
+  await db.delete(uptimeProbeSamples).where(lt(uptimeProbeSamples.sampledAt, cutoff))
+  await db.delete(uptimeResourceSamples).where(lt(uptimeResourceSamples.sampledAt, cutoff))
 }
 
 export function parsePing(results: Array<{ time?: string; status?: string; sent?: string; received?: string; "packet-loss"?: string; "avg-rtt"?: string }>) {
@@ -100,19 +100,18 @@ export function parsePing(results: Array<{ time?: string; status?: string; sent?
 }
 
 /** Узлы с REST-опросом для uptime: включённые в каталоге или любой Home Router (см. /servers — HR часто «выкл.» при доступе только из LAN). */
-function serversForUptimeRosPoll() {
-  return db
+async function serversForUptimeRosPoll() {
+  return await db
     .select()
     .from(servers)
     .where(or(eq(servers.enabled, true), eq(servers.type, "home-router")))
-    .all()
 }
 
-function lastProbeSampleTimes(): Map<string, string> {
-  const rows = db.select({
+async function lastProbeSampleTimes(): Promise<Map<string, string>> {
+  const rows = await db.select({
     probeId: uptimeProbeSamples.probeId,
     lastAt: max(uptimeProbeSamples.sampledAt),
-  }).from(uptimeProbeSamples).groupBy(uptimeProbeSamples.probeId).all()
+  }).from(uptimeProbeSamples).groupBy(uptimeProbeSamples.probeId)
   const m = new Map<string, string>()
   for (const r of rows) {
     if (r.lastAt) m.set(r.probeId, String(r.lastAt))
@@ -135,7 +134,7 @@ export async function collectResourceSamplesOnce(): Promise<ResourcesRunSnapshot
   collectingResources = true
   const started = Date.now()
   const now = sampledAt
-  const settings = getSettings()
+  const settings = await getSettings()
   const snapshot: ResourcesRunSnapshot = {
     v: SCHEDULER_RUN_SNAPSHOT_VERSION,
     job: "uptime_resources",
@@ -144,7 +143,7 @@ export async function collectResourceSamplesOnce(): Promise<ResourcesRunSnapshot
   }
 
   try {
-    const resourceTargets = serversForUptimeRosPoll()
+    const resourceTargets = await serversForUptimeRosPoll()
 
     for (const s of resourceTargets) {
       const name = s.name || s.host
@@ -157,7 +156,7 @@ export async function collectResourceSamplesOnce(): Promise<ResourcesRunSnapshot
         const freeHdd = parseRosDataSizeBytes(resource["free-hdd-space"])
         const totalHdd = parseRosDataSizeBytes(resource["total-hdd-space"])
         const uptimeSeconds = parseRosUptimeToSeconds(resource["uptime"])
-        db.insert(uptimeResourceSamples).values({
+        await db.insert(uptimeResourceSamples).values({
           serverId: s.id,
           sampledAt: now,
           status: "online",
@@ -169,7 +168,7 @@ export async function collectResourceSamplesOnce(): Promise<ResourcesRunSnapshot
           uptimeSeconds,
           boardName: String(resource["board-name"] ?? ""),
           rosVersion: String(resource["version"] ?? ""),
-        }).run()
+        })
         const memUsedMb = totalMem > 0 ? Math.round((totalMem - freeMem) / (1024 * 1024)) : 0
         const memTotalMb = totalMem > 0 ? Math.round(totalMem / (1024 * 1024)) : 0
         snapshot.servers.push({
@@ -189,7 +188,7 @@ export async function collectResourceSamplesOnce(): Promise<ResourcesRunSnapshot
         })
       } catch (err) {
         console.warn(`[uptime-collector] resource serverId=${s.id} (${s.host}):`, err instanceof Error ? err.message : err)
-        db.insert(uptimeResourceSamples).values({
+        await db.insert(uptimeResourceSamples).values({
           serverId: s.id,
           sampledAt: now,
           status: "offline",
@@ -201,7 +200,7 @@ export async function collectResourceSamplesOnce(): Promise<ResourcesRunSnapshot
           uptimeSeconds: 0,
           boardName: "",
           rosVersion: "",
-        }).run()
+        })
         snapshot.servers.push({
           serverId: s.id,
           name,
@@ -212,21 +211,21 @@ export async function collectResourceSamplesOnce(): Promise<ResourcesRunSnapshot
       }
     }
 
-    cleanup(Math.max(1, settings.retentionDays))
-    db.update(uptimeSettings).set({
+    await cleanup(Math.max(1, settings.retentionDays))
+    await db.update(uptimeSettings).set({
       lastCollectedAt: now,
       lastDurationMs: Date.now() - started,
       lastError: "",
       updatedAt: now,
-    }).where(eq(uptimeSettings.id, 1)).run()
+    }).where(eq(uptimeSettings.id, 1))
   } catch (e) {
     snapshot.fatalError = e instanceof Error ? e.message : String(e)
-    db.update(uptimeSettings).set({
+    await db.update(uptimeSettings).set({
       lastCollectedAt: now,
       lastDurationMs: Date.now() - started,
       lastError: e instanceof Error ? e.message : String(e),
       updatedAt: now,
-    }).where(eq(uptimeSettings.id, 1)).run()
+    }).where(eq(uptimeSettings.id, 1))
   } finally {
     collectingResources = false
   }
@@ -248,9 +247,9 @@ export async function collectPingProbesOnce(): Promise<PingRunSnapshot> {
   collectingPing = true
   const started = Date.now()
   const now = sampledAt
-  const settings = getSettings()
+  const settings = await getSettings()
   const defaultProbeSec = Math.max(5, settings.probeIntervalSec ?? settings.intervalSec)
-  const lastByProbe = lastProbeSampleTimes()
+  const lastByProbe = await lastProbeSampleTimes()
   const nowMs = Date.now()
   const snapshot: PingRunSnapshot = {
     v: SCHEDULER_RUN_SNAPSHOT_VERSION,
@@ -261,8 +260,8 @@ export async function collectPingProbesOnce(): Promise<PingRunSnapshot> {
   }
 
   try {
-    const rosPollServers = serversForUptimeRosPoll()
-    const probes = db.select().from(uptimeProbes).where(eq(uptimeProbes.enabled, true)).orderBy(asc(uptimeProbes.sortOrder)).all()
+    const rosPollServers = await serversForUptimeRosPoll()
+    const probes = await db.select().from(uptimeProbes).where(eq(uptimeProbes.enabled, true)).orderBy(asc(uptimeProbes.sortOrder))
 
     for (const p of probes) {
       const effectiveSec = (p.intervalSec != null && p.intervalSec > 0) ? p.intervalSec : defaultProbeSec
@@ -282,13 +281,13 @@ export async function collectPingProbesOnce(): Promise<PingRunSnapshot> {
         const client = MikrotikClient.fromServer(src)
         const results = await client.ping(p.target, 4, p.srcInterface || undefined)
         const parsed = parsePing(results)
-        db.insert(uptimeProbeSamples).values({
+        await db.insert(uptimeProbeSamples).values({
           probeId: p.id,
           sampledAt: now,
           rttMs: parsed.avgRtt,
           lossPct: parsed.loss,
           status: parsed.status,
-        }).run()
+        })
         snapshot.probes.push({
           probeId: p.id,
           name: p.name,
@@ -302,13 +301,13 @@ export async function collectPingProbesOnce(): Promise<PingRunSnapshot> {
           status: parsed.status,
         })
       } catch (err) {
-        db.insert(uptimeProbeSamples).values({
+        await db.insert(uptimeProbeSamples).values({
           probeId: p.id,
           sampledAt: now,
           rttMs: null,
           lossPct: 100,
           status: "down",
-        }).run()
+        })
         snapshot.probes.push({
           probeId: p.id,
           name: p.name,
@@ -325,21 +324,21 @@ export async function collectPingProbesOnce(): Promise<PingRunSnapshot> {
       }
     }
 
-    cleanup(Math.max(1, settings.retentionDays))
-    db.update(uptimeSettings).set({
+    await cleanup(Math.max(1, settings.retentionDays))
+    await db.update(uptimeSettings).set({
       lastCollectedAt: now,
       lastDurationMs: Date.now() - started,
       lastError: "",
       updatedAt: now,
-    }).where(eq(uptimeSettings.id, 1)).run()
+    }).where(eq(uptimeSettings.id, 1))
   } catch (e) {
     snapshot.fatalError = e instanceof Error ? e.message : String(e)
-    db.update(uptimeSettings).set({
+    await db.update(uptimeSettings).set({
       lastCollectedAt: now,
       lastDurationMs: Date.now() - started,
       lastError: e instanceof Error ? e.message : String(e),
       updatedAt: now,
-    }).where(eq(uptimeSettings.id, 1)).run()
+    }).where(eq(uptimeSettings.id, 1))
   } finally {
     collectingPing = false
   }
@@ -367,12 +366,12 @@ export async function collectPingForProbeIds(probeIds: string[]): Promise<{ poll
 
   collectingPing = true
   const now = new Date().toISOString()
-  const settings = getSettings()
+  const settings = await getSettings()
   let polled = 0
 
   try {
-    const rosPollServers = serversForUptimeRosPoll()
-    const rows = db.select().from(uptimeProbes).where(inArray(uptimeProbes.id, uniqueIds)).all()
+    const rosPollServers = await serversForUptimeRosPoll()
+    const rows = await db.select().from(uptimeProbes).where(inArray(uptimeProbes.id, uniqueIds))
 
     for (const p of rows) {
       const src = rosPollServers.find((s) => s.id === p.srcServerId)
@@ -381,26 +380,26 @@ export async function collectPingForProbeIds(probeIds: string[]): Promise<{ poll
         const client = MikrotikClient.fromServer(src)
         const results = await client.ping(p.target, 4, p.srcInterface || undefined)
         const parsed = parsePing(results)
-        db.insert(uptimeProbeSamples).values({
+        await db.insert(uptimeProbeSamples).values({
           probeId: p.id,
           sampledAt: now,
           rttMs: parsed.avgRtt,
           lossPct: parsed.loss,
           status: parsed.status,
-        }).run()
+        })
       } catch {
-        db.insert(uptimeProbeSamples).values({
+        await db.insert(uptimeProbeSamples).values({
           probeId: p.id,
           sampledAt: now,
           rttMs: null,
           lossPct: 100,
           status: "down",
-        }).run()
+        })
       }
       polled += 1
     }
 
-    cleanup(Math.max(1, settings.retentionDays))
+    await cleanup(Math.max(1, settings.retentionDays))
     return { polled }
   } finally {
     collectingPing = false
@@ -418,11 +417,11 @@ export function restartUptimeCollector() {}
 
 export function stopUptimeCollector() {}
 
-export function readUptimeSettings() {
-  return getSettings()
+export async function readUptimeSettings() {
+  return await getSettings()
 }
 
-export function updateUptimeSettings(patch: {
+export async function updateUptimeSettings(patch: {
   /** Устаревший: если передан без per-job флагов — выставляет все три job-флага. */
   enabled?: boolean
   resourcesEnabled?: boolean
@@ -435,7 +434,7 @@ export function updateUptimeSettings(patch: {
   speedIntervalSec?: number
   retentionDays?: number
 }) {
-  const prev = getSettings()
+  const prev = await getSettings()
   const anyJobFlag =
     patch.resourcesEnabled !== undefined
     || patch.pingEnabled !== undefined
@@ -464,24 +463,24 @@ export function updateUptimeSettings(patch: {
     retentionDays: patch.retentionDays ?? prev.retentionDays,
     updatedAt: new Date().toISOString(),
   }
-  db.update(uptimeSettings).set(next).where(eq(uptimeSettings.id, 1)).run()
-  return readUptimeSettings()
+  await db.update(uptimeSettings).set(next).where(eq(uptimeSettings.id, 1))
+  return await readUptimeSettings()
 }
 
-export function readProbeRows() {
-  return db.select().from(uptimeProbes).orderBy(asc(uptimeProbes.sortOrder)).all()
+export async function readProbeRows() {
+  return await db.select().from(uptimeProbes).orderBy(asc(uptimeProbes.sortOrder))
 }
 
-export function updateProbeShowOnDashboard(probeId: string, showOnDashboard: boolean): boolean {
+export async function updateProbeShowOnDashboard(probeId: string, showOnDashboard: boolean): Promise<boolean> {
   const now = new Date().toISOString()
-  const r = db.update(uptimeProbes)
+  const r = await db.update(uptimeProbes)
     .set({ showOnDashboard, updatedAt: now })
     .where(eq(uptimeProbes.id, probeId))
-    .run()
-  return (r.changes ?? 0) > 0
+    .returning({ id: uptimeProbes.id })
+  return r.length > 0
 }
 
-export function replaceProbes(rows: Array<{
+export async function replaceProbes(rows: Array<{
   id: string
   srcServerId: number
   srcInterface: string
@@ -493,12 +492,12 @@ export function replaceProbes(rows: Array<{
   intervalSec?: number
 }>) {
   const now = new Date().toISOString()
-  const existing = db.select({ id: uptimeProbes.id }).from(uptimeProbes).all()
+  const existing = await db.select({ id: uptimeProbes.id }).from(uptimeProbes)
   const nextIds = new Set(rows.map((r) => r.id))
 
   for (const p of existing) {
     if (nextIds.has(p.id)) continue
-    db.delete(uptimeProbes).where(eq(uptimeProbes.id, p.id)).run()
+    await db.delete(uptimeProbes).where(eq(uptimeProbes.id, p.id))
   }
 
   for (let i = 0; i < rows.length; i += 1) {
@@ -516,29 +515,27 @@ export function replaceProbes(rows: Array<{
       sortOrder: i,
       updatedAt: now,
     }
-    const updated = db.update(uptimeProbes).set(patch).where(eq(uptimeProbes.id, r.id)).run()
-    if ((updated.changes ?? 0) > 0) continue
-    db.insert(uptimeProbes).values({
+    const updated = await db.update(uptimeProbes).set(patch).where(eq(uptimeProbes.id, r.id)).returning({ id: uptimeProbes.id })
+    if (updated.length > 0) continue
+    await db.insert(uptimeProbes).values({
       id: r.id,
       ...patch,
       createdAt: now,
-    }).run()
+    })
   }
 }
 
-export function readProbeSamplesSince(sinceIso: string) {
-  return db.select().from(uptimeProbeSamples)
+export async function readProbeSamplesSince(sinceIso: string) {
+  return await db.select().from(uptimeProbeSamples)
     .where(gte(uptimeProbeSamples.sampledAt, sinceIso))
     .orderBy(asc(uptimeProbeSamples.sampledAt))
-    .all()
 }
 
-export function readResourceSamplesSince(sinceIso: string, serverId: number) {
-  return db.select().from(uptimeResourceSamples)
+export async function readResourceSamplesSince(sinceIso: string, serverId: number) {
+  return await db.select().from(uptimeResourceSamples)
     .where(and(
       eq(uptimeResourceSamples.serverId, serverId),
       gte(uptimeResourceSamples.sampledAt, sinceIso),
     ))
     .orderBy(asc(uptimeResourceSamples.sampledAt))
-    .all()
 }
diff --git a/backend/src/services/uptime-speed-service.ts b/backend/src/services/uptime-speed-service.ts
index 23bcc79..cbf7aba 100644
--- a/backend/src/services/uptime-speed-service.ts
+++ b/backend/src/services/uptime-speed-service.ts
@@ -90,8 +90,8 @@ function humanizeSpeedError(raw: string): string {
 export async function executeBandwidthSpeedTestInner(params: SpeedTestRunParams): Promise<SpeedTestRunResult> {
   const srcId = params.srcServerId
   const dstId = params.dstServerId
-  const src = db.select().from(servers).where(eq(servers.id, srcId)).limit(1).all()[0]
-  const dst = db.select().from(servers).where(eq(servers.id, dstId)).limit(1).all()[0]
+  const src = (await db.select().from(servers).where(eq(servers.id, srcId)).limit(1))[0]
+  const dst = (await db.select().from(servers).where(eq(servers.id, dstId)).limit(1))[0]
   if (!src || !dst) throw new Error("Server not found")
 
   const protocol = params.protocol === "udp" ? "udp" : "tcp"
@@ -154,7 +154,7 @@ export async function executeBandwidthSpeedTestInner(params: SpeedTestRunParams)
   const probeId = String(params.probeId ?? "").trim()
   const runId = String(params.runId ?? "").trim() || `sr-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`
   if (probeId) {
-    db.update(uptimeSpeedProbes).set({
+    await db.update(uptimeSpeedProbes).set({
       lastRunAt: pingNow,
       lastTxAvgMbps: txFinal,
       lastRxAvgMbps: rxFinal,
@@ -165,9 +165,9 @@ export async function executeBandwidthSpeedTestInner(params: SpeedTestRunParams)
       lastPingAt: pingNow,
       lastPingError: afterBtPing.error ?? "",
       updatedAt: pingNow,
-    }).where(eq(uptimeSpeedProbes.id, probeId)).run()
+    }).where(eq(uptimeSpeedProbes.id, probeId))
   }
-  db.insert(uptimeSpeedTestRuns).values({
+  await db.insert(uptimeSpeedTestRuns).values({
     id: runId,
     probeId: probeId || null,
     srcServerId: srcId,
@@ -189,7 +189,7 @@ export async function executeBandwidthSpeedTestInner(params: SpeedTestRunParams)
     status: "done",
     error: null,
     createdAt: pingNow,
-  }).run()
+  })
 
   return {
     runId,
@@ -216,10 +216,10 @@ export async function runBandwidthSpeedTest(params: SpeedTestRunParams): Promise
   const srcId = params.srcServerId
   const dstId = params.dstServerId
   if (srcId === dstId) throw new Error("Source and destination must be different")
-  return withBtestNodeLocks([srcId, dstId], () => executeBandwidthSpeedTestInner(params))
+  return await withBtestNodeLocks([srcId, dstId], () => executeBandwidthSpeedTestInner(params))
 }
 
-export function recordSpeedTestFailure(params: {
+export async function recordSpeedTestFailure(params: {
   probeId?: string
   runId?: string
   srcServerId: number
@@ -234,14 +234,14 @@ export function recordSpeedTestFailure(params: {
   const probeId = String(params.probeId ?? "").trim()
   const message = humanizeSpeedError(params.message)
   if (probeId) {
-    db.update(uptimeSpeedProbes).set({
+    await db.update(uptimeSpeedProbes).set({
       lastRunAt: new Date().toISOString(),
       lastStatus: "error",
       lastError: message,
       updatedAt: new Date().toISOString(),
-    }).where(eq(uptimeSpeedProbes.id, probeId)).run()
+    }).where(eq(uptimeSpeedProbes.id, probeId))
   }
-  db.insert(uptimeSpeedTestRuns).values({
+  await db.insert(uptimeSpeedTestRuns).values({
     id: String(params.runId ?? "").trim() || `sr-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`,
     probeId: probeId || null,
     srcServerId: params.srcServerId,
@@ -263,11 +263,11 @@ export function recordSpeedTestFailure(params: {
     status: "error",
     error: message,
     createdAt: new Date().toISOString(),
-  }).run()
+  })
 }
 
-function serverDisplayName(id: number): string {
-  const s = db.select().from(servers).where(eq(servers.id, id)).limit(1).all()[0]
+async function serverDisplayName(id: number): Promise<string> {
+  const s = (await db.select().from(servers).where(eq(servers.id, id)).limit(1))[0]
   return s ? (s.name || s.host) : `#${id}`
 }
 
@@ -275,7 +275,7 @@ function serverDisplayName(id: number): string {
 export async function runScheduledSpeedProbesOnce(): Promise<SpeedScheduledRunSnapshot> {
   const sampledAt = new Date().toISOString()
   const runs: SpeedRunSnapshot[] = []
-  const rows = db.select().from(uptimeSpeedProbes).orderBy(asc(uptimeSpeedProbes.sortOrder)).all()
+  const rows = await db.select().from(uptimeSpeedProbes).orderBy(asc(uptimeSpeedProbes.sortOrder))
   const enabled = rows.filter((r) => r.enabled !== false && r.srcServerId !== r.dstServerId)
   const protocol = (p: (typeof enabled)[number]) => (p.protocol === "udp" ? "udp" : "tcp")
   const direction = (p: (typeof enabled)[number]) =>
@@ -297,9 +297,9 @@ export async function runScheduledSpeedProbesOnce(): Promise<SpeedScheduledRunSn
       runs.push({
         probeId: p.id,
         srcServerId: p.srcServerId,
-        srcServerName: serverDisplayName(p.srcServerId),
+        srcServerName: await serverDisplayName(p.srcServerId),
         dstServerId: p.dstServerId,
-        dstServerName: serverDisplayName(p.dstServerId),
+        dstServerName: await serverDisplayName(p.dstServerId),
         srcInterface: r.srcInterface ?? "",
         dstInterface: r.dstInterface ?? "",
         protocol: r.protocol,
@@ -314,7 +314,7 @@ export async function runScheduledSpeedProbesOnce(): Promise<SpeedScheduledRunSn
       })
     } catch (e) {
       const msg = e instanceof Error ? e.message : String(e)
-      recordSpeedTestFailure({
+      await recordSpeedTestFailure({
         probeId: p.id,
         srcServerId: p.srcServerId,
         dstServerId: p.dstServerId,
@@ -328,9 +328,9 @@ export async function runScheduledSpeedProbesOnce(): Promise<SpeedScheduledRunSn
       runs.push({
         probeId: p.id,
         srcServerId: p.srcServerId,
-        srcServerName: serverDisplayName(p.srcServerId),
+        srcServerName: await serverDisplayName(p.srcServerId),
         dstServerId: p.dstServerId,
-        dstServerName: serverDisplayName(p.dstServerId),
+        dstServerName: await serverDisplayName(p.dstServerId),
         srcInterface: p.srcInterface || "",
         dstInterface: p.dstInterface || "",
         protocol: protocol(p),
diff --git a/backend/src/services/wireguard-live.ts b/backend/src/services/wireguard-live.ts
index ebc86e5..92646a2 100644
--- a/backend/src/services/wireguard-live.ts
+++ b/backend/src/services/wireguard-live.ts
@@ -168,10 +168,10 @@ export async function listWireGuardInterfaces(opts?: {
     if (!Number.isFinite(id)) {
       return { interfaces: [], failures: [{ serverId: String(opts.serverId), error: "Некорректный serverId" }] }
     }
-    const row = db.select().from(servers).where(eq(servers.id, id)).limit(1).all()[0]
+    const row = (await db.select().from(servers).where(eq(servers.id, id)).limit(1))[0]
     serverRows = row ? [row] : []
   } else {
-    serverRows = db.select().from(servers).where(eq(servers.enabled, true)).all()
+    serverRows = await db.select().from(servers).where(eq(servers.enabled, true))
   }
 
   const failures: WgListResult["failures"] = []
@@ -195,7 +195,7 @@ export async function listWireGuardInterfaces(opts?: {
 export async function countWireGuardInterfaces(): Promise<number> {
   try {
     const result = await Promise.race([
-      listWireGuardInterfaces({ includePrivateKey: false }),
+      await listWireGuardInterfaces({ includePrivateKey: false }),
       new Promise<null>((resolve) => setTimeout(() => resolve(null), 8_000)),
     ])
     if (!result) return 0
@@ -205,10 +205,10 @@ export async function countWireGuardInterfaces(): Promise<number> {
   }
 }
 
-export function getEnabledServerById(serverId: string | number): ServerRow | null {
+export async function getEnabledServerById(serverId: string | number) {
   const id = typeof serverId === "number" ? serverId : Number.parseInt(String(serverId), 10)
   if (!Number.isFinite(id)) return null
-  return db.select().from(servers).where(eq(servers.id, id)).limit(1).all()[0] ?? null
+  return (await db.select().from(servers).where(eq(servers.id, id)).limit(1))[0] ?? null
 }
 
 export type CatalogWgPeer = {
@@ -227,7 +227,7 @@ export async function listWireGuardPeersForCatalog(serverId: number): Promise<{
   peers: CatalogWgPeer[]
   error?: string
 }> {
-  const row = getEnabledServerById(serverId)
+  const row = await getEnabledServerById(serverId)
   if (!row) return { peers: [], error: "Сервер не найден" }
   try {
     const client = MikrotikClient.fromServer(row)
diff --git a/backend/src/test/pg.ts b/backend/src/test/pg.ts
new file mode 100644
index 0000000..c3df76c
--- /dev/null
+++ b/backend/src/test/pg.ts
@@ -0,0 +1,22 @@
+import { initDatabase } from "../db/bootstrap.js"
+
+let ready: Promise<boolean> | null = null
+
+/** Initialize schema against DATABASE_URL; return false if PostgreSQL is unreachable. */
+export function withPgOrSkip(): Promise<boolean> {
+  if (!ready) {
+    ready = (async () => {
+      try {
+        await initDatabase()
+        return true
+      } catch (err) {
+        console.warn(
+          "skip: PostgreSQL недоступен",
+          err instanceof Error ? err.message : err,
+        )
+        return false
+      }
+    })()
+  }
+  return ready
+}
diff --git a/backend/src/types/scheduler-run-snapshot.ts b/backend/src/types/scheduler-run-snapshot.ts
index 7363b41..eecb45c 100644
--- a/backend/src/types/scheduler-run-snapshot.ts
+++ b/backend/src/types/scheduler-run-snapshot.ts
@@ -161,7 +161,7 @@ export interface AlertEngineRunSnapshot {
   ruleDiag?: AlertEngineRuleDiagSnapshot[]
 }
 
-/** Снимок джобы `gre_bgp`: запись GRE/BGP в SQLite для алерт-движка. */
+/** Снимок джобы `gre_bgp`: запись GRE/BGP в PostgreSQL для алерт-движка. */
 export interface GreBgpSnapshotRunSnapshot {
   v: typeof SCHEDULER_RUN_SNAPSHOT_VERSION
   job: "gre_bgp"
diff --git a/components/traffic/netflow-purge-dialog.tsx b/components/traffic/netflow-purge-dialog.tsx
index 3522858..ee802dc 100644
--- a/components/traffic/netflow-purge-dialog.tsx
+++ b/components/traffic/netflow-purge-dialog.tsx
@@ -14,20 +14,13 @@ import {
 import type { FlowPurgeDto } from "@mmapp/contracts/traffic-flow"
 import { AlertCircleIcon, LoaderCircleIcon } from "lucide-react"
 
-function formatDbFileBytes(n: number): string {
-  if (n < 1024) return `${n} Б`
-  if (n < 1024 * 1024) return `${(n / 1024).toFixed(1)} КБ`
-  return `${(n / (1024 * 1024)).toFixed(1)} МБ`
-}
-
 export function formatFlowPurgeResult(result: FlowPurgeDto): string {
   const rows =
     result.deleted.buckets +
     result.deleted.minuteStats +
     result.deleted.minuteDims +
     result.deleted.dailyDims
-  const vacuumHint = result.vacuumed ? "" : " VACUUM не выполнен."
-  return `Удалено строк: ${rows}. Файл ${formatDbFileBytes(result.fileBytesBefore)} → ${formatDbFileBytes(result.fileBytesAfter)}.${vacuumHint}`
+  return `Удалено строк: ${rows}.`
 }
 
 export function NetflowPurgeConfirm({
@@ -50,7 +43,7 @@ export function NetflowPurgeConfirm({
           </AlertDialogMedia>
           <AlertDialogTitle>Сбросить данные NetFlow?</AlertDialogTitle>
           <AlertDialogDescription>
-            Будут удалены сессии и агрегаты (minute/daily) из SQLite, затем VACUUM.
+            Будут удалены сессии и агрегаты (minute/daily) в PostgreSQL.
             Ключи WireGuard, пиры JH, настройки коллектора и кэш RIPE сохранятся.
             На время операции приём IPFIX остановится.
           </AlertDialogDescription>
diff --git a/components/traffic/netflow-settings-panel.tsx b/components/traffic/netflow-settings-panel.tsx
index 39eda81..80ddb33 100644
--- a/components/traffic/netflow-settings-panel.tsx
+++ b/components/traffic/netflow-settings-panel.tsx
@@ -167,7 +167,7 @@ function NetflowSettingsPanel({
           <InfoIcon />
           <AlertTitle>Ключи и UDP 4739</AlertTitle>
           <AlertDescription>
-            Приватный ключ хранится в SQLite панели, не коммитьте его. Порт IPFIX публикуйте только на адресе wg-flow, не на 0.0.0.0.
+            Приватный ключ хранится в PostgreSQL панели, не коммитьте его. Порт IPFIX публикуйте только на адресе wg-flow, не на 0.0.0.0.
           </AlertDescription>
         </Alert>
 
@@ -262,7 +262,7 @@ function NetflowSettingsPanel({
           <div className="min-w-0">
             <p className="text-sm font-medium">Сбросить данные NetFlow</p>
             <p className="text-xs text-muted-foreground mt-0.5">
-              Удалит сессии и агрегаты из SQLite, затем VACUUM. Ключи WG и пиры не трогает.
+              Удалит сессии и агрегаты в PostgreSQL. Ключи WG и пиры не трогает.
             </p>
           </div>
           <Button
diff --git a/deploy/docker-compose.cdn-mm.yml b/deploy/docker-compose.cdn-mm.yml
index b9421e2..affd110 100644
--- a/deploy/docker-compose.cdn-mm.yml
+++ b/deploy/docker-compose.cdn-mm.yml
@@ -117,6 +117,49 @@ services:
         max-size: "10m"
         max-file: "3"
 
+  postgres:
+    image: ${POSTGRES_IMAGE_TAG:-postgres:18-alpine}
+    container_name: mmapp-postgres
+    restart: unless-stopped
+    shm_size: "256mb"
+    environment:
+      POSTGRES_USER: mmapp
+      POSTGRES_DB: mmapp
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD in .env}
+      POSTGRES_INITDB_ARGS: "--encoding=UTF8 --locale=C.UTF-8 --data-checksums"
+      TZ: UTC
+      PGTZ: UTC
+    command:
+      - postgres
+      - -c
+      - timezone=UTC
+      - -c
+      - listen_addresses=*
+      - -c
+      - max_connections=100
+      - -c
+      - shared_buffers=256MB
+      - -c
+      - work_mem=16MB
+      - -c
+      - maintenance_work_mem=128MB
+      - -c
+      - wal_compression=on
+    volumes:
+      - mmapp-pgdata:/var/lib/postgresql/data
+    networks:
+      - mmapp
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U mmapp -d mmapp"]
+      interval: 5s
+      timeout: 5s
+      retries: 10
+    logging:
+      driver: json-file
+      options:
+        max-size: "10m"
+        max-file: "3"
+
   # --- MikrotikManager -------------------------------------------------------
   backend:
     image: git.shx.one/denozord/mikrotikmanager-backend:${MM_BACKEND_IMAGE_TAG:-latest}
@@ -124,10 +167,14 @@ services:
     container_name: mmapp-backend
     restart: unless-stopped
     depends_on:
-      - traefik
+      traefik:
+        condition: service_started
+      postgres:
+        condition: service_healthy
     environment:
       NODE_ENV: production
       PORT: "8000"
+      DATABASE_URL: postgres://mmapp:${POSTGRES_PASSWORD}@postgres:5432/mmapp
       DATABASE_PATH: /app/data/mikrotik.db
       CORS_ORIGIN: ${CORS_ORIGIN:-https://mm.shnt.top}
       AUTH_REQUIRED: ${AUTH_REQUIRED:-true}
@@ -160,7 +207,7 @@ services:
       interval: 30s
       timeout: 5s
       retries: 3
-      start_period: 15s
+      start_period: 300s
     logging:
       driver: json-file
       options:
@@ -222,7 +269,7 @@ services:
       REGISTRY_USERNAME: ${REGISTRY_USERNAME:-}
       REGISTRY_PASSWORD: ${REGISTRY_PASSWORD:-}
       POLL_INTERVAL_SECONDS: ${POLL_INTERVAL_SECONDS:-300}
-      HEALTH_TIMEOUT_SECONDS: ${HEALTH_TIMEOUT_SECONDS:-120}
+      HEALTH_TIMEOUT_SECONDS: ${HEALTH_TIMEOUT_SECONDS:-600}
       STOP_TIMEOUT_SECONDS: ${STOP_TIMEOUT_SECONDS:-30}
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
@@ -239,6 +286,7 @@ services:
 volumes:
   traefik_letsencrypt:
     name: cdn_mm_traefik_letsencrypt
+  mmapp-pgdata:
 
 networks:
   edge:
diff --git a/deploy/docker-compose.postgres.yml b/deploy/docker-compose.postgres.yml
new file mode 100644
index 0000000..5007edd
--- /dev/null
+++ b/deploy/docker-compose.postgres.yml
@@ -0,0 +1,50 @@
+# Local PostgreSQL 18 for MikrotikManager (dev / ETL dry-run).
+#   copy env.postgres.example → deploy/.env.postgres
+#   docker compose -f deploy/docker-compose.postgres.yml --env-file deploy/.env.postgres up -d
+
+services:
+  postgres:
+    image: ${POSTGRES_IMAGE_TAG:-postgres:18-alpine}
+    container_name: mmapp-postgres
+    restart: unless-stopped
+    shm_size: "256mb"
+    environment:
+      POSTGRES_USER: mmapp
+      POSTGRES_DB: mmapp
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD in .env}
+      POSTGRES_INITDB_ARGS: "--encoding=UTF8 --locale=C.UTF-8 --data-checksums"
+      TZ: UTC
+      PGTZ: UTC
+    command:
+      - postgres
+      - -c
+      - timezone=UTC
+      - -c
+      - listen_addresses=*
+      - -c
+      - max_connections=100
+      - -c
+      - shared_buffers=256MB
+      - -c
+      - work_mem=16MB
+      - -c
+      - maintenance_work_mem=128MB
+      - -c
+      - wal_compression=on
+    volumes:
+      - mmapp-pgdata:/var/lib/postgresql/data
+    ports:
+      - "127.0.0.1:${POSTGRES_PORT:-5432}:5432"
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U mmapp -d mmapp"]
+      interval: 5s
+      timeout: 5s
+      retries: 10
+    logging:
+      driver: json-file
+      options:
+        max-size: "10m"
+        max-file: "3"
+
+volumes:
+  mmapp-pgdata:
diff --git a/deploy/docker-compose.traefik-cdn.yml b/deploy/docker-compose.traefik-cdn.yml
index 1ca1407..3ae79fa 100644
--- a/deploy/docker-compose.traefik-cdn.yml
+++ b/deploy/docker-compose.traefik-cdn.yml
@@ -19,14 +19,61 @@
 #                                              └─ rewrite /api,/health → backend:8000 (network mmapp)
 
 services:
+  postgres:
+    image: ${POSTGRES_IMAGE_TAG:-postgres:18-alpine}
+    container_name: mmapp-postgres
+    restart: unless-stopped
+    shm_size: "256mb"
+    environment:
+      POSTGRES_USER: mmapp
+      POSTGRES_DB: mmapp
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD in .env}
+      POSTGRES_INITDB_ARGS: "--encoding=UTF8 --locale=C.UTF-8 --data-checksums"
+      TZ: UTC
+      PGTZ: UTC
+    command:
+      - postgres
+      - -c
+      - timezone=UTC
+      - -c
+      - listen_addresses=*
+      - -c
+      - max_connections=100
+      - -c
+      - shared_buffers=256MB
+      - -c
+      - work_mem=16MB
+      - -c
+      - maintenance_work_mem=128MB
+      - -c
+      - wal_compression=on
+    volumes:
+      - mmapp-pgdata:/var/lib/postgresql/data
+    networks:
+      - mmapp
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U mmapp -d mmapp"]
+      interval: 5s
+      timeout: 5s
+      retries: 10
+    logging:
+      driver: json-file
+      options:
+        max-size: "10m"
+        max-file: "3"
+
   backend:
     image: git.shx.one/denozord/mikrotikmanager-backend:${MM_BACKEND_IMAGE_TAG:-latest}
     pull_policy: always
     container_name: mmapp-backend
     restart: unless-stopped
+    depends_on:
+      postgres:
+        condition: service_healthy
     environment:
       NODE_ENV: production
       PORT: "8000"
+      DATABASE_URL: postgres://mmapp:${POSTGRES_PASSWORD}@postgres:5432/mmapp
       DATABASE_PATH: /app/data/mikrotik.db
       CORS_ORIGIN: ${CORS_ORIGIN:-https://mm.shnt.top}
       AUTH_REQUIRED: ${AUTH_REQUIRED:-true}
@@ -54,7 +101,7 @@ services:
       interval: 30s
       timeout: 5s
       retries: 3
-      start_period: 15s
+      start_period: 300s
     logging:
       driver: json-file
       options:
@@ -116,7 +163,7 @@ services:
       REGISTRY_USERNAME: ${REGISTRY_USERNAME:-}
       REGISTRY_PASSWORD: ${REGISTRY_PASSWORD:-}
       POLL_INTERVAL_SECONDS: ${POLL_INTERVAL_SECONDS:-300}
-      HEALTH_TIMEOUT_SECONDS: ${HEALTH_TIMEOUT_SECONDS:-120}
+      HEALTH_TIMEOUT_SECONDS: ${HEALTH_TIMEOUT_SECONDS:-600}
       STOP_TIMEOUT_SECONDS: ${STOP_TIMEOUT_SECONDS:-30}
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
@@ -136,3 +183,6 @@ networks:
   cdnmanager:
     external: true
     name: cdnmanager
+
+volumes:
+  mmapp-pgdata:
diff --git a/deploy/docker-compose.traefik.yml b/deploy/docker-compose.traefik.yml
index 6e44daa..e05720d 100644
--- a/deploy/docker-compose.traefik.yml
+++ b/deploy/docker-compose.traefik.yml
@@ -54,17 +54,64 @@ services:
         max-size: "10m"
         max-file: "3"
 
+  postgres:
+    image: ${POSTGRES_IMAGE_TAG:-postgres:18-alpine}
+    container_name: mmapp-postgres
+    restart: unless-stopped
+    shm_size: "256mb"
+    environment:
+      POSTGRES_USER: mmapp
+      POSTGRES_DB: mmapp
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD in .env}
+      POSTGRES_INITDB_ARGS: "--encoding=UTF8 --locale=C.UTF-8 --data-checksums"
+      TZ: UTC
+      PGTZ: UTC
+    command:
+      - postgres
+      - -c
+      - timezone=UTC
+      - -c
+      - listen_addresses=*
+      - -c
+      - max_connections=100
+      - -c
+      - shared_buffers=256MB
+      - -c
+      - work_mem=16MB
+      - -c
+      - maintenance_work_mem=128MB
+      - -c
+      - wal_compression=on
+    volumes:
+      - mmapp-pgdata:/var/lib/postgresql/data
+    networks:
+      - mmapp
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U mmapp -d mmapp"]
+      interval: 5s
+      timeout: 5s
+      retries: 10
+    logging:
+      driver: json-file
+      options:
+        max-size: "10m"
+        max-file: "3"
+
   backend:
     image: git.shx.one/denozord/mikrotikmanager-backend:${MM_BACKEND_IMAGE_TAG:-latest}
     pull_policy: always
     container_name: mmapp-backend
     restart: unless-stopped
     depends_on:
-      - traefik
+      traefik:
+        condition: service_started
+      postgres:
+        condition: service_healthy
     # No host ports — frontend reaches backend on the Compose network.
     environment:
       NODE_ENV: production
       PORT: "8000"
+      DATABASE_URL: postgres://mmapp:${POSTGRES_PASSWORD}@postgres:5432/mmapp
       DATABASE_PATH: /app/data/mikrotik.db
       CORS_ORIGIN: ${CORS_ORIGIN:-https://mm.shnt.top}
       AUTH_REQUIRED: ${AUTH_REQUIRED:-true}
@@ -90,7 +137,7 @@ services:
       interval: 30s
       timeout: 5s
       retries: 3
-      start_period: 15s
+      start_period: 300s
     logging:
       driver: json-file
       options:
@@ -150,7 +197,7 @@ services:
       REGISTRY_USERNAME: ${REGISTRY_USERNAME:-}
       REGISTRY_PASSWORD: ${REGISTRY_PASSWORD:-}
       POLL_INTERVAL_SECONDS: ${POLL_INTERVAL_SECONDS:-300}
-      HEALTH_TIMEOUT_SECONDS: ${HEALTH_TIMEOUT_SECONDS:-120}
+      HEALTH_TIMEOUT_SECONDS: ${HEALTH_TIMEOUT_SECONDS:-600}
       STOP_TIMEOUT_SECONDS: ${STOP_TIMEOUT_SECONDS:-30}
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
@@ -167,6 +214,7 @@ services:
 volumes:
   traefik_letsencrypt:
     name: mmapp_traefik_letsencrypt
+  mmapp-pgdata:
 
 networks:
   mmapp:
diff --git a/deploy/docker-compose.yml b/deploy/docker-compose.yml
index 540e700..cb48a91 100644
--- a/deploy/docker-compose.yml
+++ b/deploy/docker-compose.yml
@@ -1,18 +1,71 @@
 services:
+  postgres:
+    image: ${POSTGRES_IMAGE_TAG:-postgres:18-alpine}
+    container_name: mmapp-postgres
+    restart: unless-stopped
+    shm_size: "256mb"
+    environment:
+      POSTGRES_USER: mmapp
+      POSTGRES_DB: mmapp
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD in .env}
+      POSTGRES_INITDB_ARGS: "--encoding=UTF8 --locale=C.UTF-8 --data-checksums"
+      TZ: UTC
+      PGTZ: UTC
+    command:
+      - postgres
+      - -c
+      - timezone=UTC
+      - -c
+      - listen_addresses=*
+      - -c
+      - max_connections=100
+      - -c
+      - shared_buffers=256MB
+      - -c
+      - work_mem=16MB
+      - -c
+      - maintenance_work_mem=128MB
+      - -c
+      - wal_compression=on
+    volumes:
+      - mmapp-pgdata:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U mmapp -d mmapp"]
+      interval: 5s
+      timeout: 5s
+      retries: 10
+
   backend:
     image: git.shx.one/denozord/mikrotikmanager-backend:latest
     container_name: mmapp-backend
     restart: unless-stopped
+    depends_on:
+      postgres:
+        condition: service_healthy
     ports:
       - "8000:8000"
       # IPFIX: только на WG-адресе хоста после `wg-quick up wg-flow`, не 0.0.0.0
       # - "10.255.254.1:4739:4739/udp"
     environment:
       CORS_ORIGIN: ${CORS_ORIGIN:-http://localhost:3000}
-      # Внутри контейнера слушаем все интерфейсы; на хосте UDP 4739 публикуется только на WG-IP
+      DATABASE_URL: postgres://mmapp:${POSTGRES_PASSWORD}@postgres:5432/mmapp
+      DATABASE_PATH: /app/data/mikrotik.db
+      # IPFIX: внутри контейнера слушаем все интерфейсы; на хосте UDP 4739 публикуется только на WG-IP
       FLOW_LISTEN_HOST: "0.0.0.0"
     volumes:
       - /opt/mmapp/data:/app/data
+    healthcheck:
+      test:
+        [
+          "CMD",
+          "node",
+          "-e",
+          "fetch('http://127.0.0.1:8000/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))",
+        ]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 300s
     labels:
       mmapp.updater.managed: "true"
       mmapp.updater.target: backend
@@ -42,9 +95,12 @@ services:
       REGISTRY_USERNAME: ${REGISTRY_USERNAME:-}
       REGISTRY_PASSWORD: ${REGISTRY_PASSWORD:-}
       POLL_INTERVAL_SECONDS: ${POLL_INTERVAL_SECONDS:-300}
-      HEALTH_TIMEOUT_SECONDS: ${HEALTH_TIMEOUT_SECONDS:-120}
+      HEALTH_TIMEOUT_SECONDS: ${HEALTH_TIMEOUT_SECONDS:-600}
       STOP_TIMEOUT_SECONDS: ${STOP_TIMEOUT_SECONDS:-30}
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
       - /opt/mmapp/state:/state
       - /opt/mmapp/updater/targets.json:/etc/updater/targets.json:ro
+
+volumes:
+  mmapp-pgdata:
diff --git a/deploy/env.cdn-mm.example b/deploy/env.cdn-mm.example
index 2863a56..98a139f 100644
--- a/deploy/env.cdn-mm.example
+++ b/deploy/env.cdn-mm.example
@@ -29,6 +29,9 @@ CLOUDFLARE_API_TOKEN=
 LOG_LEVEL=info
 NODE_ENV=production
 
+# --- MikrotikManager PostgreSQL ---
+POSTGRES_PASSWORD=
+
 # Portal SSO — used by CDN Manager and MikrotikManager backend
 AUTH_REQUIRED=true
 # Same HS256 secret as auth-portal JWT_SECRET (required)
diff --git a/deploy/env.postgres.example b/deploy/env.postgres.example
new file mode 100644
index 0000000..06cab02
--- /dev/null
+++ b/deploy/env.postgres.example
@@ -0,0 +1,8 @@
+# Copy to deploy/.env.postgres (gitignored) or merge into prod .env
+POSTGRES_PASSWORD=change-me
+POSTGRES_PORT=5432
+# POSTGRES_IMAGE_TAG=postgres:18-alpine
+
+# Backend
+DATABASE_URL=postgres://mmapp:change-me@127.0.0.1:5432/mmapp
+DATABASE_PATH=./mikrotik.db
diff --git a/deploy/env.postgres.snippet.example b/deploy/env.postgres.snippet.example
new file mode 100644
index 0000000..fb62152
--- /dev/null
+++ b/deploy/env.postgres.snippet.example
@@ -0,0 +1,4 @@
+# PostgreSQL 18 for MikrotikManager backend.
+
+POSTGRES_PASSWORD=
+HEALTH_TIMEOUT_SECONDS=600
diff --git a/deploy/env.traefik.example b/deploy/env.traefik.example
index fff87f9..adb3cd6 100644
--- a/deploy/env.traefik.example
+++ b/deploy/env.traefik.example
@@ -24,6 +24,9 @@ LETSENCRYPT_EMAIL=admin@shnt.top
 # TRAEFIK_HTTPS_PORT=443
 # TRAEFIK_LOG_LEVEL=INFO
 
+# --- PostgreSQL ---
+POSTGRES_PASSWORD=
+
 # --- Images ---
 MM_BACKEND_IMAGE_TAG=latest
 MM_FRONTEND_IMAGE_TAG=latest
diff --git a/deploy/run-beside-cdn-traefik.sh b/deploy/run-beside-cdn-traefik.sh
index 7e7a9cb..46e94c3 100644
--- a/deploy/run-beside-cdn-traefik.sh
+++ b/deploy/run-beside-cdn-traefik.sh
@@ -80,6 +80,36 @@ fi
 echo "==> Ensure internal network mmapp"
 docker network inspect mmapp >/dev/null 2>&1 || docker network create mmapp >/dev/null
 
+: "${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD}"
+
+echo "==> Ensure mmapp-postgres"
+if ! docker inspect mmapp-postgres >/dev/null 2>&1; then
+  docker volume inspect mmapp-pgdata >/dev/null 2>&1 || docker volume create mmapp-pgdata >/dev/null
+  docker run -d \
+    --name mmapp-postgres \
+    --restart unless-stopped \
+    --network mmapp \
+    --network-alias postgres \
+    --shm-size 256mb \
+    -e POSTGRES_USER=mmapp \
+    -e POSTGRES_DB=mmapp \
+    -e POSTGRES_PASSWORD="${POSTGRES_PASSWORD}" \
+    -e POSTGRES_INITDB_ARGS="--encoding=UTF8 --locale=C.UTF-8 --data-checksums" \
+    -e TZ=UTC \
+    -e PGTZ=UTC \
+    -v mmapp-pgdata:/var/lib/postgresql/data \
+    --health-cmd="pg_isready -U mmapp -d mmapp" \
+    --health-interval=5s \
+    --health-timeout=5s \
+    --health-retries=10 \
+    postgres:18-alpine \
+    postgres -c timezone=UTC -c listen_addresses=* -c max_connections=100 \
+      -c shared_buffers=256MB -c work_mem=16MB -c maintenance_work_mem=128MB -c wal_compression=on
+fi
+until docker exec mmapp-postgres pg_isready -U mmapp -d mmapp >/dev/null 2>&1; do
+  sleep 1
+done
+
 if [[ -n "${REGISTRY_USERNAME:-}" && -n "${REGISTRY_PASSWORD:-}" ]]; then
   echo "==> docker login ${REGISTRY}"
   echo "${REGISTRY_PASSWORD}" | docker login "${REGISTRY}" -u "${REGISTRY_USERNAME}" --password-stdin
@@ -107,6 +137,7 @@ docker run -d \
   --network-alias backend \
   -e NODE_ENV=production \
   -e PORT=8000 \
+  -e DATABASE_URL="postgres://mmapp:${POSTGRES_PASSWORD}@mmapp-postgres:5432/mmapp" \
   -e DATABASE_PATH=/app/data/mikrotik.db \
   -e "CORS_ORIGIN=${CORS_ORIGIN}" \
   -e "AUTH_REQUIRED=${AUTH_REQUIRED:-true}" \
@@ -121,7 +152,7 @@ docker run -d \
   --health-interval=30s \
   --health-timeout=5s \
   --health-retries=3 \
-  --health-start-period=15s \
+  --health-start-period=300s \
   --log-driver json-file \
   --log-opt max-size=10m \
   --log-opt max-file=3 \
diff --git a/deploy/updater/Dockerfile b/deploy/updater/Dockerfile
index d6da98f..2478df4 100644
--- a/deploy/updater/Dockerfile
+++ b/deploy/updater/Dockerfile
@@ -14,7 +14,7 @@ RUN chmod +x /updater/entrypoint.sh
 ENV TARGETS_FILE=/etc/updater/targets.json
 ENV STATE_FILE=/state/updater-state.json
 ENV POLL_INTERVAL_SECONDS=300
-ENV HEALTH_TIMEOUT_SECONDS=120
+ENV HEALTH_TIMEOUT_SECONDS=600
 ENV STOP_TIMEOUT_SECONDS=30
 ENV REGISTRY=git.shx.one
 
diff --git a/deploy/updater/entrypoint.sh b/deploy/updater/entrypoint.sh
index f7c0e2b..f7213e6 100644
--- a/deploy/updater/entrypoint.sh
+++ b/deploy/updater/entrypoint.sh
@@ -4,7 +4,7 @@ set -euo pipefail
 TARGETS_FILE="${TARGETS_FILE:-/etc/updater/targets.json}"
 STATE_FILE="${STATE_FILE:-/state/updater-state.json}"
 POLL_INTERVAL_SECONDS="${POLL_INTERVAL_SECONDS:-300}"
-HEALTH_TIMEOUT_SECONDS="${HEALTH_TIMEOUT_SECONDS:-120}"
+HEALTH_TIMEOUT_SECONDS="${HEALTH_TIMEOUT_SECONDS:-600}"
 STOP_TIMEOUT_SECONDS="${STOP_TIMEOUT_SECONDS:-30}"
 REGISTRY="${REGISTRY:-git.shx.one}"
 MANAGED_LABEL="mmapp.updater.managed"
diff --git a/lib/scheduler-settings.ts b/lib/scheduler-settings.ts
index 1d17b0c..94a2a21 100644
--- a/lib/scheduler-settings.ts
+++ b/lib/scheduler-settings.ts
@@ -30,7 +30,7 @@ export const SCHEDULER_JOB_LABELS: Record<string, string> = {
 
 /** Кратко — для раскрытой карточки прогона и подсказок. */
 export const SCHEDULER_JOB_DESCRIPTIONS: Record<string, string> = {
-  traffic: "Опрос интерфейсов RouterOS, запись сэмплов трафика в SQLite.",
+  traffic: "Опрос интерфейсов RouterOS, запись сэмплов трафика в PostgreSQL.",
   servers_rest_ping:
     "Проверка доступности каталога серверов: GET /system/identity (RouterOS REST), замер задержки без полного опроса.",
   uptime_resources: "CPU, память, температура и др. метрики с устройств.",
@@ -38,13 +38,13 @@ export const SCHEDULER_JOB_DESCRIPTIONS: Record<string, string> = {
   uptime_speed: "Фоновые btest / speed-пробы между узлами (при включённых пробах).",
   internet_path: "Снимок данных для карты интернет-маршрута на dashboard (WAN/JH/EN, route+runtime, speed-пробы).",
   gre_bgp:
-    "Опрос GRE-туннелей и BGP-сессий на включённых серверах, запись сэмплов в SQLite для движка оповещений.",
+    "Опрос GRE-туннелей и BGP-сессий на включённых серверах, запись сэмплов в PostgreSQL для движка оповещений.",
   certificates_renew:
     "Проверка сертификатов, выпущенных через UI, и автообновление через ACME DNS-01 (Cloudflare) до истечения срока.",
   backups:
     "Плановые бэкапы RouterOS по расписанию со страницы «Бэкапы»; тик планировщика раз в минуту.",
   alert_engine:
-    "Оценка правил по данным из SQLite (сэмплы пишут джобы сбора, в т.ч. «GRE + BGP» и «Серверы: REST API»).",
+    "Оценка правил по данным из PostgreSQL (сэмплы пишут джобы сбора, в т.ч. «GRE + BGP» и «Серверы: REST API»).",
 }
 
 export interface CollectorSettingsDto {
diff --git a/package-lock.json b/package-lock.json
index f40dbb7..1b1b8c4 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -60,12 +60,14 @@
         "drizzle-orm": "^0.45.2",
         "fastify": "^5.8.5",
         "fastify-plugin": "^5.1.0",
+        "pg": "^8.23.0",
         "undici": "^8.1.0",
         "zod": "^4.4.1"
       },
       "devDependencies": {
         "@types/better-sqlite3": "^7.6.13",
         "@types/node": "^22.15.3",
+        "@types/pg": "^8.23.1",
         "drizzle-kit": "^0.31.10",
         "jose": "^6.2.11",
         "pino-pretty": "^13.1.3",
@@ -4362,6 +4364,18 @@
         "undici-types": "~6.21.0"
       }
     },
+    "node_modules/@types/pg": {
+      "version": "8.23.1",
+      "resolved": "https://registry.npmjs.org/@types/pg/-/pg-8.23.1.tgz",
+      "integrity": "sha512-fKVHpikPdg4GKks3JuLEhvwSyvwzF23hnabPy6DD8ljVbC7+6J5dQzdv4arV6jqq57djnMgs1HKBxX4P8aBI3A==",
+      "devOptional": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/node": "*",
+        "pg-protocol": "*",
+        "pg-types": "^2.2.0"
+      }
+    },
     "node_modules/@types/react": {
       "version": "19.2.14",
       "resolved": "https://registry.npmjs.org/@types/react/-/react-19.2.14.tgz",
@@ -10885,6 +10899,95 @@
       "integrity": "sha512-Yhpw4T9C6hPpgPeA28us07OJeqZ5EzQTkbfwuhsUg0c237RomFoETJgmp2sa3F/41gfLE6G5cqcYwznmeEeOlQ==",
       "license": "MIT"
     },
+    "node_modules/pg": {
+      "version": "8.23.0",
+      "resolved": "https://registry.npmjs.org/pg/-/pg-8.23.0.tgz",
+      "integrity": "sha512-Ip2EQCngowJLGOfCwkFhPXU7/ljlhn6Rxlmy4XYfL2Y+vyRM59+8uR2xqRWKdYmbXmxCFOAmKxBuSUCdF34qLg==",
+      "license": "MIT",
+      "dependencies": {
+        "pg-connection-string": "^2.14.0",
+        "pg-pool": "^3.14.0",
+        "pg-protocol": "^1.16.0",
+        "pg-types": "2.2.0",
+        "pgpass": "1.0.5"
+      },
+      "engines": {
+        "node": ">= 16.0.0"
+      },
+      "optionalDependencies": {
+        "pg-cloudflare": "^1.4.0"
+      },
+      "peerDependencies": {
+        "pg-native": ">=3.0.1"
+      },
+      "peerDependenciesMeta": {
+        "pg-native": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/pg-cloudflare": {
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/pg-cloudflare/-/pg-cloudflare-1.4.0.tgz",
+      "integrity": "sha512-Vo7z/6rrQYxpNRylp4Tlob2elzbh+N/MOQbxFVWCxS7oEx6jF53GTJFxK2WWpKuBRkmiin4Mt+xofFDjx09R0A==",
+      "license": "MIT",
+      "optional": true
+    },
+    "node_modules/pg-connection-string": {
+      "version": "2.14.0",
+      "resolved": "https://registry.npmjs.org/pg-connection-string/-/pg-connection-string-2.14.0.tgz",
+      "integrity": "sha512-XwWDGcLRGCXAR8F/AM5bG7Q+A3Wm2s6QeEjlOKZLlH3UYcguiqCWKyWXVag5TLTIjR7oOJUY8kcADaZgWPyLeg==",
+      "license": "MIT"
+    },
+    "node_modules/pg-int8": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/pg-int8/-/pg-int8-1.0.1.tgz",
+      "integrity": "sha512-WCtabS6t3c8SkpDBUlb1kjOs7l66xsGdKpIPZsg4wR+B3+u9UAum2odSsF9tnvxg80h4ZxLWMy4pRjOsFIqQpw==",
+      "license": "ISC",
+      "engines": {
+        "node": ">=4.0.0"
+      }
+    },
+    "node_modules/pg-pool": {
+      "version": "3.14.0",
+      "resolved": "https://registry.npmjs.org/pg-pool/-/pg-pool-3.14.0.tgz",
+      "integrity": "sha512-gKtPkFdQPU3DksooVLi9LsjZxrsBUZIpa+7aVx+LV5pNh0KzP4Zleud2po+ConrxbuXGBJ6Hfer6hdgpIBpBaw==",
+      "license": "MIT",
+      "peerDependencies": {
+        "pg": ">=8.0"
+      }
+    },
+    "node_modules/pg-protocol": {
+      "version": "1.16.0",
+      "resolved": "https://registry.npmjs.org/pg-protocol/-/pg-protocol-1.16.0.tgz",
+      "integrity": "sha512-sILXutLVjCLjcDuOmvhX5e2Z4cS5qG/6Bu3VkpFwdf/633ElGLpEh9bgmuI5I4sqKqkifQiGyiCcx1HdtrK7tg==",
+      "license": "MIT"
+    },
+    "node_modules/pg-types": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/pg-types/-/pg-types-2.2.0.tgz",
+      "integrity": "sha512-qTAAlrEsl8s4OiEQY69wDvcMIdQN6wdz5ojQiOy6YRMuynxenON0O5oCpJI6lshc6scgAY8qvJ2On/p+CXY0GA==",
+      "license": "MIT",
+      "dependencies": {
+        "pg-int8": "1.0.1",
+        "postgres-array": "~2.0.0",
+        "postgres-bytea": "~1.0.0",
+        "postgres-date": "~1.0.4",
+        "postgres-interval": "^1.1.0"
+      },
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/pgpass": {
+      "version": "1.0.5",
+      "resolved": "https://registry.npmjs.org/pgpass/-/pgpass-1.0.5.tgz",
+      "integrity": "sha512-FdW9r/jQZhSeohs1Z3sI1yxFQNFvMcnmfuj4WBMUTxOrAyLMaTcE1aAMBiTlbMNaXvBCQuVi0R7hd8udDSP7ug==",
+      "license": "MIT",
+      "dependencies": {
+        "split2": "^4.1.0"
+      }
+    },
     "node_modules/picocolors": {
       "version": "1.1.1",
       "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.1.1.tgz",
@@ -11038,6 +11141,45 @@
         "node": ">=4"
       }
     },
+    "node_modules/postgres-array": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/postgres-array/-/postgres-array-2.0.0.tgz",
+      "integrity": "sha512-VpZrUqU5A69eQyW2c5CA1jtLecCsN2U/bD6VilrFDWq5+5UIEVO7nazS3TEcHf1zuPYO/sqGvUvW62g86RXZuA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/postgres-bytea": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/postgres-bytea/-/postgres-bytea-1.0.1.tgz",
+      "integrity": "sha512-5+5HqXnsZPE65IJZSMkZtURARZelel2oXUEO8rH83VS/hxH5vv1uHquPg5wZs8yMAfdv971IU+kcPUczi7NVBQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/postgres-date": {
+      "version": "1.0.7",
+      "resolved": "https://registry.npmjs.org/postgres-date/-/postgres-date-1.0.7.tgz",
+      "integrity": "sha512-suDmjLVQg78nMK2UZ454hAG+OAW+HQPZ6n++TNDUX+L0+uUlLywnoxJKDou51Zm+zTCjrCl0Nq6J9C5hP9vK/Q==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/postgres-interval": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/postgres-interval/-/postgres-interval-1.2.0.tgz",
+      "integrity": "sha512-9ZhXKM/rw350N1ovuWHbGxnGh/SNJ4cnxHiM0rxE4VN41wsg8P8zWn9hv/buK00RP4WvlOyr/RBDiptyxVbkZQ==",
+      "license": "MIT",
+      "dependencies": {
+        "xtend": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
     "node_modules/powershell-utils": {
       "version": "0.1.0",
       "resolved": "https://registry.npmjs.org/powershell-utils/-/powershell-utils-0.1.0.tgz",
@@ -14259,21 +14401,6 @@
       "dependencies": {
         "zod": "^4.4.1"
       }
-    },
-    "node_modules/@next/swc-win32-x64-msvc": {
-      "version": "16.2.4",
-      "resolved": "https://registry.npmjs.org/@next/swc-win32-x64-msvc/-/swc-win32-x64-msvc-16.2.4.tgz",
-      "integrity": "sha512-kMVGgsqhO5YTYODD9IPGGhA6iprWidQckK3LmPeW08PIFENRmgfb4MjXHO+p//d+ts2rpjvK5gXWzXSMrPl9cw==",
-      "cpu": [
-        "x64"
-      ],
-      "optional": true,
-      "os": [
-        "win32"
-      ],
-      "engines": {
-        "node": ">= 10"
-      }
     }
   }
 }