device_id+sequence idempotency keys collide across different devices

This service supports two idempotency schemes: a client-supplied event_id UUID, or a (device_id, sequence) pair for clients that can't mint UUIDs. The second scheme's key is built by concatenating the two fields with no separator between them. Because both fields are variable-length, two completely different, unrelated events from two different devices can produce the identical event_key string — which means the second one silently vanishes, dropped by the ON CONFLICT DO NOTHING upsert as if it were a duplicate. This is common for any pair of devices whose IDs share a prefix relationship (e.g. "device1", "device12"). Events go missing with no error, no log line, and no way to tell from the API response that anything was lost.

The (device_id, sequence)-based idempotency key is built by concatenating the two fields with no separator between them, so two different (device_id, sequence) pairs can produce the identical key string.

1. cd fastapi/ingest_service && .venv/bin/python -c "from app.schemas import EventIn; a = EventIn(device_id='d1', event_type='t', sequence=23); b = EventIn(device_id='d12', event_type='t', sequence=3); print(a.event_key(), b.event_key(), a.event_key() == b.event_key())"
2. Observe: prints d123 d123 True — two different events, same key.

Building a composite key by naive string concatenation without a delimiter is a classic way to accidentally make a supposedly-unique key non-injective. It's especially insidious here because the failure is silent by design — the whole point of ON CONFLICT DO NOTHING is to make duplicates disappear without an error, so a key collision between two genuinely different events looks identical to the system working exactly as intended.

Look at EventIn.event_key() in app/schemas.py. The event_id-based branch already works (a UUID string can't collide with the composite scheme). Focus on the f"{self.device_id}{self.sequence}" line — what would make two different (device_id, sequence) pairs guaranteed to produce different strings?