Sanitized device hostname forks the sync identity and never migrates bucket hostnames #272

DeviceHostname.kt sanitizes the device name used for sync:

internal fun sanitizeDeviceHostname(raw: String?): String {
    val value = raw?.trim()?.takeIf { it.isNotEmpty() } ?: return "unknown"
    return value
        .lowercase(Locale.ROOT)
        .replace(Regex("[^a-z0-9_-]+"), "_")
        .trim('_')
        .ifEmpty { "unknown" }
}

so Settings.Global.DEVICE_NAME = "POCO F8 Ultra" becomes poco_f8_ultra, and that is what SyncInterface.syncPush(port, hostname) passes to the Rust side as the sync folder name.

The sanitization itself is right. The problem is that it changed the sync identity of already-syncing devices without migrating anything, and it only renamed the folder — not the hostname recorded on the buckets.

Symptom 1: the folder forks

A device that synced before and after the change ends up with two directories in the shared sync folder, both holding a database for the same device_id:

POCO F8 Ultra/41662faa-7dc4-4e50-970b-f986d59a1819/test.db      9.4 MB
poco_f8_ultra/41662faa-7dc4-4e50-970b-f986d59a1819/test.db      273 MB

The old folder is orphaned — nothing writes to it again, nothing cleans it up, and Syncthing keeps replicating it to every peer forever. Worse, desktop peers import both, which can silently truncate ~5 years of history depending on directory walk order; filed as ActivityWatch/aw-server-rust#683.

Symptom 2: the bucket hostname is never migrated

Inside both databases, every bucket row still carries the unsanitized name:

aw-watcher-android         | POCO F8 Ultra | aw-android | currentwindow
aw-watcher-android-unlock  | POCO F8 Ultra | aw-android | os.lockscreen.unlocks
aw-stopwatch               | POCO F8 Ultra | aw-webui   | general.stopwatch

aw-server-rust derives sync provenance from the bucket's hostname field (get_or_create_sync_bucket in aw-sync/src/sync.rs), not from the folder name. So after a successful pull the desktop creates buckets named:

aw-watcher-android-synced-from-POCO F8 Ultra

— spaces and mixed case in a bucket ID that then has to survive REST paths (/api/0/buckets/{id}), the /#/activity/{host}/ route, and query strings. Which is exactly what the sanitization was introduced to avoid; it just doesn't reach the data that ends up on other machines.

(Also note these buckets have no _{hostname} suffix at all, unlike the aw-watcher-android_$hostname convention that UpgradeWithHistoryTest expects — so on this device the sanitized name currently appears nowhere except the folder.)

Suggested fix

• Migrate existing state when the sanitized name changes, rather than silently starting a new one: on startup, if a sync folder exists under the old unsanitized name for this device_id, rename it (and remove the stale one) instead of leaving both. A WatcherAndroidBucketMigration-style one-shot would fit.
• Rewrite the hostname on local buckets to the sanitized value as part of that migration, so the sanitized identity is what actually propagates to peers.
• Longer term the robust fix is for the sync protocol to key on device_id and carry hostname only as a display label — then renaming a device is free and this class of bug disappears. That also addresses Any way to rename the host? I want to merge my devices #133 ("Any way to rename the host? I want to merge my devices"). Tracked in aw-sync: duplicate folders for one device_id silently truncate history on pull aw-server-rust#683.

Found on v0.14.2b1 syncing to a macOS desktop via Syncthing. Related: #133, ActivityWatch/aw-server-rust#682, ActivityWatch/aw-server-rust#683.

cc @TimeToBuildBob