@tinycloud/courier 0.6.0-beta.33 → 0.6.0-beta.35

package/dist/watch.js

@@ -5,7 +5,7 @@ import { errInfo, CourierError } from './errors.js';
 import { k, PREFIX, stateKeys } from './keys.js';
 import { isRecord, messageView, oneLine, taskView } from './a2a.js';
 import { commitReceipts, selectUndelivered } from './inbox.js';
-import { del, getJson, listAll, putCreate, putMatch, putOverwrite } from './store.js';
+import { del, getJson, isTooLarge, listAll, putCreate, putMatch, putOverwrite, readJsonMany } from './store.js';
 import { appendNotice } from './notify.js';
 import { nextNoticeId, writePauseMarker } from './pause.js';
 import { HANDLE, ULID } from './request.js';
@@ -44,6 +44,8 @@ const MAX_OUTBOX = 50;
 const MAX_OUTBOX_TRIES = 8;
 const MAX_NOTICE_ATTEMPTS = 3;
 const MAX_HELD_PER_THREAD = 100;
+/** An action put off because its authority check gave no verdict is dropped after this; its peer's human is told once. */
+const DEFERRAL_LIMIT_MS = DAY_MS;
 /** The subject is peer-controlled text that reaches state, prompts and environments: one line, control characters removed, capped. */
 const MAX_SUBJECT = 200;
 /** Thread and message ids come from key names the peer controls; they reach prompts and argv, so only ULID-like ids pass. */
@@ -58,13 +60,16 @@ const needsKey = (peer, kind) => `needs:${peer}:${kind}`;
 const emptyEpisode = () => ({ kind: '', eventId: ZERO_ULID, repeats: '000000', ...emptyNoticeRetry() });
 const incrementCount = (count) => String(Math.min(MAX_COALESCED_PAUSES, Number(count) + 1)).padStart(6, '0');
 const episodeKey = (key, slot) => `notice:${key}:${slot}`;
+const accessKey = (peer) => `access:${peer}`;
 function threadNoticeState() {
     return { ourPaused: false, peerPaused: false, lastPeerNoticeId: '0'.repeat(26), lastNoticeSentAt: new Date(0).toISOString(),
         ourMarkerId: '', episodes: [emptyEpisode(), emptyEpisode()], informPending: false, informText: '' };
 }
+export const peerIdentity = (peer) => ({ did: peer.courierDid, space: peer.spaceId, session: peer.sessionId ?? null });
+export const sameIdentity = (a, b) => a !== undefined && a.did === b.did && a.space === b.space && a.session === b.session;
 export const WATCH_DEFAULTS = { debounceMs: 30_000, pollMs: 60_000, ticketSeconds: 25, wakeBudget: 12 };
 export function emptyWatchState() {
-    return { v: 1, pending: {}, woken: [], approvalsSeen: [], wakes: {}, paused: [], wakeRetries: {}, approvalRetries: {}, outbox: [], held: {}, threadNotices: {}, peerNotices: {}, noticeGlobalLog: [], noticeLog: {} };
+    return { v: 1, pending: {}, woken: [], approvalsSeen: [], wakes: {}, paused: [], wakeRetries: {}, approvalRetries: {}, outbox: [], held: {}, threadNotices: {}, peerNotices: {}, noticeGlobalLog: [], noticeLog: {}, unverified: {} };
 }
 /** Wake time: `debounce` after the latest message, but never later than twice `debounce` after the first. */
 export function wakeDueAt(pending, debounceMs) {
@@ -122,7 +127,6 @@ export class Watcher {
     profileId;
     pid;
     isAlive;
-    lastClaimPrune = 0;
     /** Set when another watcher is writing this profile's state: this one stops and `run` throws it. */
     fatalError;
     /** Set once `run` is told to stop: nothing new is woken after that. */
@@ -130,8 +134,17 @@ export class Watcher {
     onFatal;
     /** Etag of this agent's watch.json as this watcher last saw it: null = absent, undefined = unknown (fetch before writing). */
     stateEtag;
+    /** Per `<peer handle>\n<peer task key>`: two peers may use the same name for us, so a key alone is ambiguous. */
     taskCache = new Map();
-    metaMirrored = new Set();
+    /** Peer keys whose value is over the batch cap: reported once and not read again by this process. */
+    tooLarge = new Set();
+    metaMirrored;
+    markerReadAt;
+    claimsPrunedAt;
+    /** Per peer, the identity the facts above were learned under: a peer that changed identity starts with none. */
+    factIdentity;
+    /** The local cache changed since it was last saved. */
+    localDirty = false;
     syncing = new Map();
     /** Peers whose last sync did not finish: a cycle between full catch-ups lists only these again. */
     dirtyPeers = new Set();
@@ -143,7 +156,7 @@ export class Watcher {
     /** Open hook streams by subscription id; absent while one is failed, ended or not yet opened. */
     hookStreams = new Map();
     /** Message keys each peer's receipts already list; receipts only grow, so a listing within this set has nothing new. */
-    receipted = new Map();
+    receipted;
     stateQueue = Promise.resolve();
     now;
     keys;
@@ -155,6 +168,46 @@ export class Watcher {
         this.pid = deps.holder?.pid ?? process.pid;
         this.isAlive = deps.holder?.isAlive ?? pidAlive;
         this.keys = stateKeys(deps.agent);
+        const cached = deps.localCache?.load();
+        this.metaMirrored = new Map(Object.entries(cached?.metaMirrored ?? {}).map(([peer, keys]) => [peer, new Set(keys)]));
+        this.markerReadAt = new Map(Object.entries(cached?.markerReadAt ?? {}));
+        this.receipted = new Map(Object.entries(cached?.receipted ?? {}).map(([peer, ids]) => [peer, new Set(ids)]));
+        this.claimsPrunedAt = cached?.claimsPrunedAt ?? 0;
+        this.factIdentity = new Map(Object.entries(cached?.identities ?? {}));
+    }
+    /**
+     * Before using or learning facts about a peer: if the peer is now a different agent, space or session than the one
+     * the facts were learned under, they are dropped, so a new peer's delivery is never skipped on an old peer's facts.
+     */
+    bindFacts(peer) {
+        const identity = peerIdentity(peer);
+        if (sameIdentity(this.factIdentity.get(peer.handle), identity))
+            return;
+        this.receipted.delete(peer.handle);
+        this.markerReadAt.delete(peer.handle);
+        this.metaMirrored.delete(peer.handle);
+        for (const cache of [this.taskCache, this.tooLarge])
+            for (const key of [...cache.keys()])
+                if (key.startsWith(`${peer.handle}\n`))
+                    cache.delete(key);
+        this.factIdentity.set(peer.handle, identity);
+        this.localDirty = true;
+    }
+    saveLocal() {
+        if (!this.localDirty || !this.deps.localCache)
+            return;
+        this.localDirty = false;
+        try {
+            this.deps.localCache.save({
+                v: 1, claimsPrunedAt: this.claimsPrunedAt, markerReadAt: Object.fromEntries(this.markerReadAt),
+                metaMirrored: Object.fromEntries([...this.metaMirrored].map(([peer, keys]) => [peer, [...keys]])),
+                receipted: Object.fromEntries([...this.receipted].map(([peer, ids]) => [peer, [...ids]])),
+                identities: Object.fromEntries(this.factIdentity),
+            });
+        }
+        catch (error) {
+            this.deps.log('sync-error', { source: 'local-cache', ...errInfo(error) });
+        }
     }
     /**
      * Before TC-2917 every agent of the owner shared `me/state/`. On an agent's first start its own keys get a copy of
@@ -164,8 +217,12 @@ export class Watcher {
      */
     async migrateLegacyState() {
         const { selfKv, log } = this.deps;
-        if (!this.deps.agent || await getJson(selfKv, this.keys.watch))
-            return;
+        if (!this.deps.agent)
+            return undefined;
+        // Already moved: this read is also the state load.
+        const own = await getJson(selfKv, this.keys.watch);
+        if (own)
+            return own;
         const mine = new Set(this.deps.peerHandles?.() ?? this.deps.loadPeers().map(peer => peer.handle));
         const ownKey = (key) => mine.has(key.split('/')[0]);
         let markers = 0;
@@ -192,10 +249,12 @@ export class Watcher {
         };
         await this.mirrorCreate(this.keys.watch, copy);
         log('state-migrated', { pending: Object.keys(copy.pending).length, paused: markers });
+        return undefined;
     }
     // ---------- state ----------
-    async loadState() {
-        const got = await getJson(this.deps.selfKv, this.keys.watch);
+    /** `preloaded`: this agent's watch.json as just read (saves reading it twice at startup). */
+    async loadState(preloaded) {
+        const got = preloaded ?? await getJson(this.deps.selfKv, this.keys.watch);
         const value = got?.value;
         this.stateEtag = got?.etag ?? null;
         this.state = isRecord(value) && value.v === 1
@@ -239,6 +298,12 @@ export class Watcher {
         this.state.outbox = this.state.outbox.filter(item => {
             if (item.kind === 'inform')
                 return true;
+            if (item.notice.kind === 'access-unverified') {
+                if (!this.noticeSlot(item) || item.id !== accessKey(item.notice.peer))
+                    return false;
+                this.rememberNotice(item);
+                return true;
+            }
             const kind = needsKind(item.notice.kind);
             if (kind) {
                 const slot = this.noticeSlot(item);
@@ -377,19 +442,25 @@ export class Watcher {
             this.deps.log('sync-error', { source: 'claim-release', ...errInfo(error) });
         }
     }
-    /** Claim markers are only needed while a double wake is possible; drop those older than two days. */
-    async pruneClaims() {
+    /** Claim markers are only needed while a double wake is possible; once an hour, drop those older than two days. */
+    async pruneClaimsIfDue() {
+        const at = this.now();
+        if (at - this.claimsPrunedAt <= 3600_000)
+            return;
         try {
             for (const key of await listAll(this.deps.selfKv, this.keys.wakeClaimsPrefix)) {
                 const id = /\/([^/]+)\.json$/.exec(key)?.[1];
                 const sentAt = id ? Date.parse(sentAtOf(id)) : NaN;
-                if (Number.isFinite(sentAt) && this.now() - sentAt > 2 * DAY_MS)
+                if (Number.isFinite(sentAt) && at - sentAt > 2 * DAY_MS)
                     await del(this.deps.selfKv, key);
             }
         }
         catch (error) {
             this.deps.log('sync-error', { source: 'claims', ...errInfo(error) });
+            return;
         }
+        this.claimsPrunedAt = at;
+        this.localDirty = true;
     }
     // ---------- catch-up and delivery ----------
     /**
@@ -473,23 +544,66 @@ export class Watcher {
         const handle = typeof peer === 'string' ? peer : peer.handle;
         if (!this.deps.checkAuthority)
             return true; // a library caller without an authority source
-        await this.deps.checkAuthority(handle);
+        try {
+            await this.deps.checkAuthority(handle);
+        }
+        catch (error) {
+            await this.noteUnverified(handle);
+            throw error;
+        }
+        if (Object.hasOwn(this.state.unverified, handle))
+            await this.mutate(() => this.endUnverified(handle));
         return this.deps.loadPeers().some(current => current.handle === handle);
     }
+    /**
+     * A check gave no verdict for this peer: the outage starts now if it isn't already running. Once it has lasted
+     * `DEFERRAL_LIMIT_MS`, the peer's human is told once (Naomi's TC-2951 ruling: imports keep retrying; wakes and informs
+     * deferred that long are dropped). Only configured paired peers allocate a record.
+     */
+    async noteUnverified(handle) {
+        if (!HANDLE.test(handle) || !this.deps.loadPeers().some(peer => peer.handle === handle && peer.status === 'paired'))
+            return;
+        const now = this.now();
+        const record = this.state.unverified[handle];
+        if (record && (record.eventId || now - record.since < DEFERRAL_LIMIT_MS))
+            return;
+        await this.mutate(() => {
+            const current = this.state.unverified[handle] ??= { since: now, eventId: '', notified: false, ...emptyNoticeRetry() };
+            if (current.eventId || now - current.since < DEFERRAL_LIMIT_MS)
+                return;
+            current.eventId = ulid(now);
+            this.deps.log('access-unverified', { peer: handle, since: new Date(current.since).toISOString() });
+            this.fillOutbox();
+        });
+    }
+    /** A verdict ends the outage; a notice not yet sent for it is withdrawn. Called inside mutate. */
+    endUnverified(handle) {
+        delete this.state.unverified[handle];
+        this.state.outbox = this.state.outbox.filter(item => item.id !== accessKey(handle) || this.outboxBusy.has(item.id));
+    }
     /** The scheduled renewal and authority check for every peer; each peer's next sync also reads its renewal marker. */
     async checkAuthority() {
         await this.deps.checkAuthority?.();
-        for (const peer of this.deps.loadPeers())
-            this.renewalDue.add(peer.handle);
+        // The renewal marker is read on the same schedule, across runs: a `--once` loop does not read it every run.
+        const at = this.now();
+        for (const peer of this.deps.loadPeers()) {
+            this.bindFacts(peer);
+            if (at - (this.markerReadAt.get(peer.handle) ?? -Infinity) >= AUTHORITY_CHECK_MS)
+                this.renewalDue.add(peer.handle);
+        }
     }
     async syncPeer(peer, via, listPaused, renew) {
         if (peer.status !== 'paired' || !peer.inbound || !peer.theirHandleForMe)
             return;
+        this.bindFacts(peer);
         const { selfKv, log } = this.deps;
         const mailbox = peer.theirHandleForMe;
         const peerKv = await this.deps.kvFor(peer, renew);
-        if (renew)
+        if (renew) {
             this.renewalDue.delete(peer.handle);
+            this.markerReadAt.set(peer.handle, this.now());
+            this.localDirty = true;
+        }
         let allowed;
         if (this.authorityDue.delete(peer.handle)) {
             // The marker changed: check now, even with nothing to import; the verdict also serves this sync's imports.
@@ -518,17 +632,43 @@ export class Watcher {
                 for (const id of thread.delivered ?? [])
                     seen.add(`${threadId}/${id}`);
             this.receipted.set(peer.handle, seen);
+            this.localDirty = true;
         }
         const delivered = [];
-        for (const selected of unseen.filter(item => !seen.has(`${item.threadId}/${item.messageId}`))) {
-            if (!SAFE_ID.test(selected.threadId) || !SAFE_ID.test(selected.messageId)) {
-                log('ignored', { peer: peer.handle, reason: 'unsafe-id' });
+        const selectedItems = unseen.filter(item => !seen.has(`${item.threadId}/${item.messageId}`)).filter(selected => {
+            if (this.tooLarge.has(`${peer.handle}\n${selected.key}`))
+                return false;
+            if (SAFE_ID.test(selected.threadId) && SAFE_ID.test(selected.messageId))
+                return true;
+            log('ignored', { peer: peer.handle, reason: 'unsafe-id' });
+            return false;
+        });
+        if (selectedItems.length && !(await authorized()))
+            return;
+        // One batch read per 100 messages. A failed batch leaves them all for the next sync; one message's failure, only it.
+        let outcomes;
+        try {
+            outcomes = await readJsonMany(peerKv, selectedItems.map(item => item.key));
+        }
+        catch (error) {
+            this.dirtyPeers.add(peer.handle);
+            log('sync-error', { peer: peer.handle, messages: selectedItems.length, ...errInfo(error) });
+            outcomes = new Map();
+        }
+        for (const selected of selectedItems) {
+            const outcome = outcomes.get(selected.key);
+            if (!outcome)
                 continue;
-            }
-            if (!(await authorized()))
-                return;
             try {
-                const got = await getJson(peerKv, selected.key);
+                if ('error' in outcome && isTooLarge(outcome.error)) {
+                    // Over the cap: reported once and not read again by this process; the others go ahead. No receipt.
+                    this.tooLarge.add(`${peer.handle}\n${selected.key}`);
+                    log('ignored', { peer: peer.handle, threadId: selected.threadId, messageId: selected.messageId, reason: 'too-large' });
+                    continue;
+                }
+                if ('error' in outcome)
+                    throw outcome.error;
+                const got = outcome.got;
                 if (!got)
                     continue;
                 const value = got.value;
@@ -549,8 +689,13 @@ export class Watcher {
             return;
         }
         const subjects = new Map();
-        for (const threadId of new Set(delivered.map((d) => d.threadId))) {
-            const meta = await getJson(peerKv, `${PREFIX}/to/${mailbox}/threads/${threadId}/meta.json`).catch(() => undefined);
+        const threads = [...new Set(delivered.map((d) => d.threadId))];
+        const metaKey = (threadId) => `${PREFIX}/to/${mailbox}/threads/${threadId}/meta.json`;
+        // A missing or unreadable meta only costs the subject.
+        const metas = await readJsonMany(peerKv, threads.map(metaKey)).catch(() => new Map());
+        for (const threadId of threads) {
+            const outcome = metas.get(metaKey(threadId));
+            const meta = outcome && 'got' in outcome ? outcome.got : undefined;
             subjects.set(threadId, isRecord(meta?.value) && typeof meta.value.subject === 'string' ? oneLine(meta.value.subject, MAX_SUBJECT) : '(no subject)');
         }
         const at = this.now();
@@ -620,6 +765,8 @@ export class Watcher {
         await commitReceipts(selfKv, new Map([[peer.handle, delivered.map(({ threadId, messageId }) => ({ threadId, messageId }))]]));
         for (const item of delivered)
             seen.add(`${item.threadId}/${item.messageId}`);
+        if (delivered.length)
+            this.localDirty = true;
         await this.mirrorThreads(peer, peerKv, keys, authorized);
     }
     /** Only locally authored meta/messages/tasks, or a local wake/pause witness, establish a known thread. */
@@ -656,9 +803,38 @@ export class Watcher {
      * message delivery and each item is isolated: a bad or unwritable peer task never blocks receipts or wakes.
      */
     async mirrorThreads(peer, peerKv, keys, authorized) {
-        for (const key of keys) {
+        // Only what may need copying is read: a meta not yet mirrored, a task not yet terminal, never a key found oversized.
+        const wanted = keys.filter(key => {
+            if (this.tooLarge.has(`${peer.handle}\n${key}`))
+                return false;
+            const meta = /\/threads\/([^/]+)\/meta\.json$/.exec(key);
+            if (meta)
+                return SAFE_ID.test(meta[1]) && !this.metaMirrored.get(peer.handle)?.has(key);
+            const task = /\/threads\/([^/]+)\/task\/([^/]+)\.json$/.exec(key);
+            return Boolean(task && SAFE_ID.test(task[1]) && SAFE_ID.test(task[2]) && !this.taskCache.get(`${peer.handle}\n${key}`)?.terminal);
+        });
+        let outcomes;
+        try {
+            outcomes = await readJsonMany(peerKv, wanted);
+        }
+        catch (error) {
+            this.dirtyPeers.add(peer.handle);
+            this.deps.log('mirror-error', { peer: peer.handle, ...errInfo(error) });
+            return;
+        }
+        for (const key of wanted) {
             try {
-                await this.mirrorThreadItem(peer, peerKv, key, authorized);
+                const outcome = outcomes.get(key);
+                if ('error' in outcome && isTooLarge(outcome.error)) {
+                    // Over the cap: reported once and not read again by this process, like an oversized message.
+                    this.tooLarge.add(`${peer.handle}\n${key}`);
+                    const [, threadId, item] = /\/threads\/([^/]+)\/(meta|task\/[^/]+)\.json$/.exec(key);
+                    this.deps.log('ignored', { peer: peer.handle, threadId, item, reason: 'too-large' });
+                    continue;
+                }
+                if ('error' in outcome)
+                    throw outcome.error;
+                await this.mirrorThreadItem(peer, key, outcome.got, authorized);
             }
             catch (error) {
                 this.dirtyPeers.add(peer.handle);
@@ -666,38 +842,27 @@ export class Watcher {
             }
         }
     }
-    async mirrorThreadItem(peer, peerKv, key, authorized) {
+    async mirrorThreadItem(peer, key, got, authorized) {
+        if (!got)
+            return;
         const meta = /\/threads\/([^/]+)\/meta\.json$/.exec(key);
         if (meta) {
-            if (!SAFE_ID.test(meta[1]))
-                return;
-            if (this.metaMirrored.has(key))
-                return;
-            const got = await getJson(peerKv, key);
-            if (!got)
-                return;
             if (!(await authorized()))
                 return;
             await this.mirrorCreate(k.mirrorMeta(peer.handle, meta[1]), got.value);
-            this.metaMirrored.add(key);
+            this.metaMirrored.set(peer.handle, (this.metaMirrored.get(peer.handle) ?? new Set()).add(key));
+            this.localDirty = true;
             return;
         }
         const task = /\/threads\/([^/]+)\/task\/([^/]+)\.json$/.exec(key);
-        if (!task || !SAFE_ID.test(task[1]) || !SAFE_ID.test(task[2]))
-            return;
-        const cached = this.taskCache.get(key);
-        if (cached?.terminal)
-            return;
-        const got = await getJson(peerKv, key);
-        if (!got)
-            return;
+        const cached = this.taskCache.get(`${peer.handle}\n${key}`);
         if (cached && got.etag && cached.etag === got.etag)
             return;
         if (!(await authorized()))
             return;
         await putOverwrite(this.deps.selfKv, k.mirrorTask(peer.handle, task[1], task[2]), got.value);
         const state = taskView(got.value).state;
-        this.taskCache.set(key, { etag: got.etag, terminal: Boolean(state && TERMINAL_TASK_STATES.has(state)) });
+        this.taskCache.set(`${peer.handle}\n${key}`, { etag: got.etag, terminal: Boolean(state && TERMINAL_TASK_STATES.has(state)) });
     }
     /**
      * Own `me/approvals/` (only the owner's view session can write there). A new decision on a request this agent
@@ -900,6 +1065,22 @@ export class Watcher {
         }
         catch (error) {
             await this.releaseClaim(pending.peer, pending.threadId, claimId);
+            const now = this.now();
+            const since = this.state.pending[key]?.deferredSince ?? now;
+            if (now - since >= DEFERRAL_LIMIT_MS) {
+                // Put off for 24 h without a verdict: dropped. The peer's human gets the one outage notice.
+                await this.mutate(() => {
+                    delete this.state.pending[key];
+                    delete this.state.wakeRetries[key];
+                    delete this.state.approvalRetries[key];
+                });
+                this.deps.log('wake-dropped', { peer: pending.peer, threadId: pending.threadId, messageIds: woken, approvalIds: approvedIds, reason: 'authority-unverified-24h', ...errInfo(error) });
+                return;
+            }
+            if (this.state.pending[key] && this.state.pending[key].deferredSince === undefined) {
+                await this.mutate(() => { if (this.state.pending[key])
+                    this.state.pending[key].deferredSince ??= since; });
+            }
             this.retryAt.set(key, at + WAKE_RETRY_MS);
             this.deps.log('wake-deferred', { peer: pending.peer, threadId: pending.threadId, reason: 'authority-unverified', ...errInfo(error) });
             return;
@@ -921,6 +1102,8 @@ export class Watcher {
                 this.state.threadNotices[key] ??= threadNoticeState();
                 if (woken.length)
                     this.state.wakes[key] = [...this.recentWakes(key), this.now()];
+                if (this.state.pending[key])
+                    delete this.state.pending[key].deferredSince;
             });
         }
         catch (error) {
@@ -1072,6 +1255,10 @@ export class Watcher {
         }
     }
     noticeSlot(item) {
+        if (item.notice.kind === 'access-unverified') {
+            const record = this.state.unverified[item.notice.peer];
+            return record?.eventId && !record.notified && record.eventId === item.notice.eventId ? record : undefined;
+        }
         const kind = needsKind(item.notice.kind);
         if (kind) {
             const slot = this.state.peerNotices[item.notice.peer]?.[kind];
@@ -1168,6 +1355,13 @@ export class Watcher {
                         } };
             }
         }
+        for (const [peer, record] of Object.entries(this.state.unverified)) {
+            if (record.eventId && !record.notified)
+                yield { id: accessKey(peer), kind: 'notify',
+                    tries: record.tries, nextAttemptAt: record.nextAttemptAt, logged: record.logged, notice: {
+                        kind: 'access-unverified', peer, threadId: ZERO_ULID, eventId: record.eventId, detail: 'authority unverified for 24 h',
+                    } };
+        }
     }
     /** Admit local work first, allowing eligible peers to pass deferred entries in a full queue. */
     fillOutbox() {
@@ -1201,7 +1395,13 @@ export class Watcher {
         const peer = item.kind === 'inform' ? item.peer : item.notice.peer;
         const threadId = item.kind === 'inform' ? item.threadId : item.notice.threadId;
         const record = this.state.threadNotices[`${peer}/${threadId}`];
-        if (item.kind === 'notify' && needsKind(item.notice.kind)) {
+        if (item.kind === 'notify' && item.notice.kind === 'access-unverified') {
+            // One notice per outage, delivered or given up on: it is not queued again until a verdict ends the outage.
+            const slot = this.noticeSlot(item);
+            if (slot)
+                slot.notified = true;
+        }
+        else if (item.kind === 'notify' && needsKind(item.notice.kind)) {
             const slot = this.noticeSlot(item);
             if (slot) {
                 const arrivals = slot.dispatchArrivals === '------' ? '000000' : slot.dispatchArrivals;
@@ -1335,11 +1535,22 @@ export class Watcher {
                             allowed = await this.authorized(item.peer);
                         }
                         catch (error) {
+                            const now = this.now();
+                            const stored = this.state.outbox.find(o => o.id === item.id);
+                            const since = stored?.kind === 'inform' ? stored.deferredSince ?? now : now;
+                            if (now - since >= DEFERRAL_LIMIT_MS) {
+                                // Put off for 24 h without a verdict: dropped. The peer's human gets the one outage notice.
+                                this.deps.log('inform-dropped', { id: item.id, peer: item.peer, threadId: item.threadId, reason: 'authority-unverified-24h', ...errInfo(error) });
+                                await this.mutate(() => this.finishOutbox(item));
+                                return;
+                            }
                             this.deps.log('inform-deferred', { id: item.id, peer: item.peer, threadId: item.threadId, reason: 'authority-unverified', ...errInfo(error) });
                             await this.mutate(() => {
-                                const stored = this.state.outbox.find(o => o.id === item.id);
-                                if (stored)
-                                    stored.nextAttemptAt = this.now() + WAKE_RETRY_MS;
+                                const current = this.state.outbox.find(o => o.id === item.id);
+                                if (current?.kind !== 'inform')
+                                    return;
+                                current.nextAttemptAt = now + WAKE_RETRY_MS;
+                                current.deferredSince ??= since;
                             });
                             return;
                         }
@@ -1348,6 +1559,15 @@ export class Watcher {
                             await this.mutate(() => this.finishOutbox(item));
                             return;
                         }
+                        if (item.deferredSince !== undefined) {
+                            // A positive verdict ends the deferral: a post that then fails is retried on its own clock, never dropped
+                            // for the earlier outage.
+                            await this.mutate(() => {
+                                const current = this.state.outbox.find(o => o.id === item.id);
+                                if (current?.kind === 'inform')
+                                    delete current.deferredSince;
+                            });
+                        }
                         await this.deps.postInform?.(item.peer, item.threadId, item.text, item.pauseId);
                     }
                     else {
@@ -1374,7 +1594,7 @@ export class Watcher {
                             if (episode) {
                                 if ('repeats' in episode)
                                     item.notice.repeats = stored.notice.repeats = episode.repeats;
-                                else {
+                                else if ('count' in episode) {
                                     item.notice.threadId = stored.notice.threadId = episode.threadId;
                                     item.notice.count = stored.notice.count = episode.count;
                                     episode.arrivalFirstSeenAt = EPOCH;
@@ -1540,11 +1760,9 @@ export class Watcher {
             await this.deps.beforePoll?.();
             await this.checkAuthority();
             let authorityAt = this.now();
-            await this.migrateLegacyState();
-            await this.loadState();
+            await this.loadState(await this.migrateLegacyState());
             log('start', { debounceMs: this.opts.debounceMs, pollMs: this.opts.pollMs, ticketSeconds: this.opts.ticketSeconds, once: Boolean(options.once) });
-            await this.pruneClaims();
-            this.lastClaimPrune = this.now();
+            await this.pruneClaimsIfDue();
             const reconcile = () => {
                 const desired = new Map();
                 for (const peer of this.deps.loadPeers()) {
@@ -1618,10 +1836,8 @@ export class Watcher {
                     else {
                         await this.syncDirty();
                     }
-                    if (this.now() - this.lastClaimPrune > 3600_000) {
-                        this.lastClaimPrune = this.now();
-                        await this.pruneClaims();
-                    }
+                    await this.pruneClaimsIfDue();
+                    this.saveLocal();
                 }
             }
         }
@@ -1636,6 +1852,7 @@ export class Watcher {
                 controller.abort();
             external.removeEventListener('abort', onExternalAbort);
             this.onFatal = undefined;
+            this.saveLocal();
             log('stop');
         }
         if (this.fatalError)