diff --git a/app/server/db.mjs b/app/server/db.mjs
index 468450c..68d5914 100644
--- a/app/server/db.mjs
+++ b/app/server/db.mjs
@@ -335,6 +335,11 @@ function openDb(dbPath) {
   fs.mkdirSync(path.join(path.dirname(dbPath), 'attachments'), { recursive: true });
   const d = new DatabaseSync(dbPath);
   d.exec('PRAGMA foreign_keys = ON;');
+  // 性能 PRAGMA：WAL 读写并发 + 回归风险更低（synchronous=NORMAL，掉电仅丢最后事务不改库）
+  d.exec('PRAGMA journal_mode = WAL;');
+  d.exec('PRAGMA synchronous = NORMAL;');
+  d.exec('PRAGMA temp_store = MEMORY;');
+  d.exec('PRAGMA cache_size = -8000;'); // 8MB 页缓存（负数 = KB 计）
   preMigrateColumns(d);
   d.exec(fs.readFileSync(path.join(__dirname, '..', 'schema.sql'), 'utf8'));
   // 个人信息表兜底（确保任何挂载形态下都存在）
diff --git a/sync-server/src/auth.mjs b/sync-server/src/auth.mjs
index 6a09c24..b8c1447 100644
--- a/sync-server/src/auth.mjs
+++ b/sync-server/src/auth.mjs
@@ -95,6 +95,7 @@ export function authUser(req) {
   if (row.expires_at < new Date().toISOString().slice(0, 19).replace('T', ' ')) {
     throw Object.assign(new Error('凭据已过期，请重新登录'), { code: 401 });
   }
-  d.prepare("UPDATE devices SET last_seen_at=datetime('now','localtime') WHERE id=?").run(row.device_id);
+  // 节流：仅当 last_seen 距今 >60s 才回写（否则命中索引跳过），消除每请求一次的写放大
+  d.prepare("UPDATE devices SET last_seen_at=datetime('now','localtime') WHERE id=? AND last_seen_at < datetime('now','-1 minutes')").run(row.device_id);
   return { user_id: row.user_id, device_id: row.device_id };
 }