sailkick-boat 0.14.1 → 0.14.4

package/README.md

@@ -7,8 +7,8 @@
 > and a **local proxy that keeps the sailkick app and its charts/maps fully usable
 > offline** on board. The service runs at **[www.sailkick.io](https://www.sailkick.io)**.
 >
-> **Pairing needs an invite code** — there is no open registration yet, so installing
-> this plugin from the Signal K Appstore is not enough on its own. Expect breaking
+> **Registration is invite-only** and happens on the website, not in the plugin — so
+> installing this from the Signal K Appstore is not enough on its own. Expect breaking
 > changes while the version is 0.x.
 >
 > **Want an invite, or more information?** Get in touch:
@@ -159,22 +159,42 @@ works **offline** with the boat's own data. Only when neither a local InfluxDB n
 telemetry is available do these paths **fall through to the cloud mirror**, so an
 online boat is never worse off than before.
 
-## Setup: pair the boat once
-Fill the **Sailkick account** section — **invite code + boat name + password** — and
-save. The plugin calls the app's `POST /api/auth/signup` once: that creates your
-account, provisions its cloud storage, and returns the write token, bucket, org and
-InfluxDB URL for your boat. The bundle is cached (0600) in the plugin data dir and
-reused on every later start, so sync keeps working **offline** and across restarts.
+## Setup: register on the web, then paste the token
+1. Register your boat at **[www.sailkick.io](https://www.sailkick.io)** (an invite code
+   is needed — see above). The signup screen shows your boat's ingest credentials.
+2. **Copy the "Write token"** — it is shown **once** and cannot be recovered. If you
+   lose it you need a new one minted.
+3. In Plugin Config, fill the **Sailkick account** section — **boat name + write
+   token** — and save.
 
-Pairing is **one-time by design** — the invite code is single-use, so the plugin never
-calls signup twice. Once `account.json` exists the account fields are no longer read;
-delete that file to re-pair (which needs a fresh invite).
+That is the whole handshake. The plugin resolves everything else locally (`bucket` =
+`<slug>_raw`, `org` = `sailkick`) and never calls the app for configuration, so setup
+works with no internet and there is nothing to re-fetch after a restart.
+
+> **Upgrading from before 0.14?** Old versions had visible `influxUrl` / `sailkickUrl`
+> fields. Whatever was typed into them is still in your saved config, and since 0.14.4
+> those leftovers are **ignored** — the plugin says so in the log and the status line
+> rather than silently obeying a dev address. To keep your own endpoints deliberately,
+> set `sync.selfHosted: true` / `proxy.selfHosted: true` in the config JSON.
+>
+> **Ignore the "Influx URL", "Organization" and "Bucket" on that screen** — they are for
+> the community `signalk-to-influxdb-v2` plugin. This plugin always writes to
+> `https://sync.sailkick.io`; the endpoint is fleet-wide and cannot be set from the UI,
+> so a wrong value can never redirect your telemetry. (Self-hosters: hand-edit
+> `sync.influxUrl` in the plugin config JSON.) If the status line ever warns that sync is
+> writing to a local address, telemetry is not leaving the boat.
+
+Registration deliberately happens **only** in the web app. The plugin cannot sign up,
+so there is no way to half-create an account or burn an invite from the boat.
+
+> Changing the token later — after a rotation, say — is just editing the field and
+> saving. Pasted values are trimmed, and the boat name is lower-cased for you.
 
 ## Config
 The page is deliberately small — everything else has a right answer and is a constant
 in `index.js`.
 
-- **Sailkick account**: `invite`, `slug` (boat name), `password`
+- **Sailkick account**: `slug` (boat name), `writeToken`
 - **Telemetry sync → cloud**: `enabled`
 - **Offline app & maps**: `enabled`, `proxyPort` (default 8080), `localSignalkUrl`
   (default `http://127.0.0.1:3000`), `dataDir`, `seedEnabled`, `prefetchRadiusNm`,
@@ -217,6 +237,32 @@ a VE.Can↔Micro-C drop cable; leave the spare RJ45 unterminated) or a USB GPS/N
 gateway. Without a position source, the live boat / trends / area-download stay
 idle — energy telemetry still syncs to the cloud.
 
+## Troubleshooting: is telemetry actually leaving the boat?
+The plugin logs one unconditional line at startup naming its real target:
+```
+[sailkick-boat] sync -> https://sync.sailkick.io org=sailkick bucket=<slug>_raw
+```
+If that shows anything other than the endpoint you expect, a stale config field is the
+usual cause — see the upgrade note above.
+
+Failures reach the **normal server log**, not just the debug channel:
+- `cannot write to <url> — unreachable …; N failed attempt(s), telemetry is buffering
+  on disk` — once per outage, then every 5 min while it lasts, then a `recovered` line.
+- `batch REJECTED (HTTP 401) and quarantined …` — the write token is not valid for that
+  bucket. These are never retried, so they are always logged.
+- `sync: ⚠ writing to <url> — a private address` — a loopback/RFC1918 target, i.e.
+  nothing is reaching the cloud.
+
+Nothing at all in the log means the plugin never started; check it is enabled. The
+status line in Plugin Config carries the same information continuously.
+
+To prove credentials independently of the plugin:
+```bash
+curl -i -XPOST "https://sync.sailkick.io/api/v2/write?org=sailkick&bucket=<slug>_raw&precision=ns" \
+  -H "Authorization: Token $TOKEN" --data-binary "probe,context=vessels.self,self=true,source=manual value=1"
+```
+`204` = good, `401` = token not valid for that bucket.
+
 ## Dev / tests
 ```bash
 npm install && npm test   # proxy: mirror/cache/offline + Express route; sync: subscribe+buffer

package/index.js

@@ -14,10 +14,18 @@ const { resolveAccountConfig } = require('./lib/account')
 // Kept as separate modules so a proxy fault can't wedge the data-critical sync.
 
 // Fixed cloud endpoints. Boats never choose these, so they are constants rather than
-// config fields — but every module still reads its option first (see startModules), so
-// a hand-edited plugin-config JSON can override any of them for self-hosting.
+// config fields, and NOTHING in a saved config may override them unless `selfHosted` is
+// explicitly set (see resolveEndpoint).
+//
+// v0.14.3 kept `sync.influxUrl` / `proxy.sailkickUrl` as a silent escape hatch, on the
+// reasoning that a value could only get there by deliberate hand-editing. That was
+// wrong: both were VISIBLE FIELDS before v0.14.0, so every upgraded install still has
+// whatever was typed into them — and since they are no longer in the schema, the owner
+// can neither see nor clear them from the UI. One boat spent a day POSTing valid cloud
+// credentials at a dev LAN address for exactly this reason. Stale wins over intent, so
+// leftovers are now ignored and reported rather than obeyed.
 const SAILKICK_APP_URL = 'https://www.sailkick.io' // signup + mirror upstream
-const SAILKICK_INFLUX_URL = 'https://sync.sailkick.io' // data egress; pairing overrides this
+const SAILKICK_INFLUX_URL = 'https://sync.sailkick.io' // data egress
 
 // Tuning that has a right answer. Deliberately NOT on the config page: a boat owner has
 // no basis to choose these, and a wrong value silently degrades sync or the cache.
@@ -45,6 +53,32 @@ const HISTORY_TUNING = {
   ringSampleSec: 15
 }
 
+// A *cloud* endpoint on a loopback or private address means telemetry never leaves the
+// LAN. On the wire that is indistinguishable from a normal offline backlog — the spool
+// just grows — so it has to be called out explicitly. Covers RFC1918 as well as
+// loopback: the case that actually bit was a 192.168.x dev box, which a loopback-only
+// check sailed straight past. (The local history DB is legitimately on 127.0.0.1; this
+// is only ever applied to the sync path.)
+function isPrivateHostUrl (u) {
+  try {
+    const h = new URL(u).hostname.replace(/^\[|\]$/g, '')
+    if (h === 'localhost' || h === '::1' || /^127\./.test(h)) return true
+    if (/^10\./.test(h) || /^192\.168\./.test(h)) return true
+    if (/^172\.(1[6-9]|2\d|3[01])\./.test(h)) return true
+    return false
+  } catch { return false }
+}
+
+// Endpoint resolution with one rule: the constant wins unless self-hosting is declared.
+// Returns { url, ignored } — `ignored` is the stale value we refused, so the caller can
+// say so out loud instead of leaving the owner to guess why nothing arrives.
+function resolveEndpoint (configured, constant, selfHosted) {
+  const v = typeof configured === 'string' ? configured.trim() : ''
+  if (!v || v === constant) return { url: constant, ignored: null }
+  if (selfHosted) return { url: v, ignored: null }
+  return { url: constant, ignored: v }
+}
+
 module.exports = function (app) {
   let sync = null
   let proxy = null
@@ -52,6 +86,7 @@ module.exports = function (app) {
   let history = null
   let statusTimer = null
   let accountStatus = null
+  let syncWarning = null
 
   const plugin = {
     id: 'sailkick-boat',
@@ -66,12 +101,11 @@ module.exports = function (app) {
     properties: {
       account: {
         type: 'object',
-        title: 'Sailkick account (one-time pairing)',
-        description: 'Pair this boat with your sailkick account once. The plugin creates the account, provisions its cloud storage, and stores the result locally — so it keeps syncing offline and after restarts. Your invite code is single-use; once paired these fields are no longer read.',
+        title: 'Sailkick account',
+        description: 'Register your boat at www.sailkick.io first — the signup screen shows a write token. Paste it here together with your boat name. Keep that token safe: it is shown only once and cannot be recovered.',
         properties: {
-          invite: { type: 'string', title: 'Invite code' },
-          slug: { type: 'string', title: 'Boat name', description: '2–40 characters: lowercase letters, numbers, dashes. This is your permanent boat id.' },
-          password: { type: 'string', title: 'Password', description: 'At least 8 characters.' }
+          slug: { type: 'string', title: 'Boat name', description: 'Exactly as registered on the website.' },
+          writeToken: { type: 'string', title: 'Write token', description: 'From the signup screen ("Write token"). Everything else — Influx URL, organization, bucket — is derived from it and your boat name.' }
         }
       },
       sync: {
@@ -115,23 +149,17 @@ module.exports = function (app) {
 
   plugin.start = function (options) {
     const opts = options || {}
-    // Pairing first: on the very first start this provisions the account and caches the
-    // bundle; on every later start it is a disk read (see lib/account — signup is
-    // single-use and must never run twice).
-    ;(async () => {
-      const r = await resolveAccountConfig(app, opts.account, { appUrl: SAILKICK_APP_URL })
-      if (r.bundle) {
-        accountStatus = r.source === 'paired'
-          ? `account: paired as ${r.bundle.slug}`
-          : `account: ${r.bundle.slug}`
-      } else if (r.error) {
-        accountStatus = `account: pairing failed — ${r.error}${r.terminal ? '' : ' (will retry on restart)'}`
-        ;(app.error || console.error)('[sailkick-boat] pairing failed: ' + r.error)
-      } else {
-        accountStatus = 'account: not paired — enter your invite code'
-      }
+    try {
+      // Purely local: the boat registers on the website, the owner pastes the write
+      // token here. Nothing to fetch, so nothing that can fail while offline.
+      const r = resolveAccountConfig(app, opts.account)
+      if (r.bundle) accountStatus = `account: ${r.bundle.slug}`
+      else if (r.error) accountStatus = `account: ${r.error}`
+      else accountStatus = 'account: not configured — register at www.sailkick.io, then paste your write token'
       startModules(opts, r.bundle)
-    })().catch((e) => (app.error || console.error)('[sailkick-boat] start failed: ' + e.message))
+    } catch (e) {
+      (app.error || console.error)('[sailkick-boat] start failed: ' + e.message)
+    }
   }
 
   function startModules (opts, bundle) {
@@ -146,12 +174,17 @@ module.exports = function (app) {
     const store = p.dataDir || p.storeDir || undefined
     const spoolDir = s.spoolDir || (p.dataDir ? path.join(p.dataDir, 'spool') : undefined)
 
+    // Self-hosting is opt-in and explicit. Without it, a saved endpoint is treated as a
+    // leftover from an older version rather than as intent.
+    const selfHosted = s.selfHosted === true || p.selfHosted === true
+    const influx = resolveEndpoint(s.influxUrl, SAILKICK_INFLUX_URL, selfHosted)
+    const upstream = resolveEndpoint(p.sailkickUrl, SAILKICK_APP_URL, selfHosted)
+
     // --- sync module (isolated: its failure must not affect the proxy) ---
-    // Pairing wins over hand-written fields; hand-written fields win over the constants.
     if (s.enabled !== false) {
       const syncOpts = {
         ...SYNC_TUNING,
-        influxUrl: b.influxUrl || s.influxUrl || SAILKICK_INFLUX_URL,
+        influxUrl: influx.url,
         org: b.org || s.org || SYNC_TUNING.org,
         bucket: b.bucket || s.bucket,
         token: b.writeToken || s.token,
@@ -164,6 +197,18 @@ module.exports = function (app) {
         retryMinMs: s.retryMinMs || SYNC_TUNING.retryMinMs,
         retryMaxMs: s.retryMaxMs || SYNC_TUNING.retryMaxMs
       }
+      // One unconditional line naming the actual target. This is the single most useful
+      // thing in the log: it would have shown the stale 192.168.x address instantly,
+      // instead of a day spent inferring it from an absence of errors.
+      console.log(`[sailkick-boat] sync -> ${syncOpts.influxUrl} org=${syncOpts.org} bucket=${syncOpts.bucket || '(none)'}${selfHosted ? ' [self-hosted]' : ''}`)
+
+      if (influx.ignored) {
+        syncWarning = `sync: ignoring stale influxUrl ${influx.ignored} — using ${influx.url}`
+        ;(app.error || console.error)(`[sailkick-boat] ignoring sync.influxUrl "${influx.ignored}" left over from an older config — using ${influx.url}. Set sync.selfHosted:true to keep your own endpoint.`)
+      } else if (isPrivateHostUrl(syncOpts.influxUrl)) {
+        syncWarning = `sync: ⚠ writing to ${syncOpts.influxUrl} — a private address, telemetry is NOT reaching the cloud`
+        ;(app.error || console.error)(`[sailkick-boat] sync target ${syncOpts.influxUrl} is a loopback/private address — telemetry will not reach the cloud`)
+      }
       try { sync = createSync(app, syncOpts); sync.start() } catch (e) {
         (app.error || console.error)('[sailkick-boat] sync start failed: ' + e.message)
         sync = null
@@ -175,8 +220,11 @@ module.exports = function (app) {
       const oldSeed = p.seed || {}
       const oldPrefetch = p.prefetch || {}
       const oldHistory = p.history || {}
+      if (upstream.ignored) {
+        ;(app.error || console.error)(`[sailkick-boat] ignoring proxy.sailkickUrl "${upstream.ignored}" left over from an older config — mirroring ${upstream.url}. Set proxy.selfHosted:true to keep your own server.`)
+      }
       const pOpts = {
-        sailkickUrl: p.sailkickUrl || SAILKICK_APP_URL,
+        sailkickUrl: upstream.url,
         storeDir: store,
         proxyPort: p.proxyPort == null ? 8080 : p.proxyPort,
         localSignalkUrl: p.localSignalkUrl || 'http://127.0.0.1:3000',
@@ -255,6 +303,7 @@ module.exports = function (app) {
     if (!app.setPluginStatus) return
     const parts = []
     if (accountStatus) parts.push(accountStatus)
+    if (syncWarning) parts.push(syncWarning)
     if (sync) parts.push(sync.status())
     if (proxy) parts.push(proxy.status())
     if (telemetry) parts.push(telemetry.status())
@@ -274,6 +323,7 @@ module.exports = function (app) {
     history = null
     proxy = null
     accountStatus = null
+    syncWarning = null
   }
 
   // Mounted by Signal K at /plugins/sailkick-boat. Handlers dispatch to the live

package/lib/account/index.js

@@ -1,113 +1,87 @@
 'use strict'
 
-// Sailkick account pairing — ONE TIME, then cached forever.
+// Sailkick account config — a pure local resolver, no network.
 //
-// The owner enters an invite code + boat name + password once. The plugin POSTs them to
-// the app's /api/auth/signup, which provisions the boat's InfluxDB bucket + write token
-// and returns an `ingest` bundle. That bundle is cached (0600) in the plugin data dir
-// and reused on every subsequent start.
+// Registration happens in the web app: the user redeems an invite there, and the
+// signup screen shows the boat's ingest credentials once (see the app's
+// public/ui/login-overlay.js). They paste the write token into this plugin, and that
+// is the whole handshake. The plugin deliberately does NOT sign up on its own —
+// one registration path means no half-created accounts and no spent-invite dead ends.
 //
-// Cache-first is NOT an optimisation here, it is correctness: signup consumes a
-// single-use invite and creates the account, so calling it twice returns 403
-// bad-invite / 409 slug-taken. The cached bundle is the only repeatable path —
-// /auth/login issues a session cookie but no token, and the app never persists the
-// write token, so there is nothing to re-fetch.
+// Everything else about the bundle is derivable, so only two fields are asked for:
+//   bucket = "<slug>_raw"   (the app's convention — server/auth/registry.js bucketFor)
+//   org    = "sailkick"     (single org, fleet-wide)
 //
-// Dependency-free; never throws.
+// This bundle deliberately carries NO Influx URL. "Which boat am I" and "where is the
+// cloud" are separate questions, and the second one has a single fleet-wide answer that
+// index.js owns. Letting a pasted or cached value set the host is how telemetry ends up
+// spooling to a loopback address forever while the status line looks healthy — the app's
+// signup screen has been handing out its own internal http://localhost:8086.
+//
+// NB the write token cannot be re-fetched: the app shows it once at signup and never
+// stores it (registry.js keeps only passwordHash + influxReadToken). Losing it means
+// minting a new one, so the pasted value is the source of truth here.
 
 const fs = require('fs')
 const path = require('path')
 
-// Terminal = re-running with the same input can only fail the same way; the owner has
-// to change something (new invite, different boat name, longer password).
-const TERMINAL_CODES = new Set(['bad-invite', 'slug-taken', 'bad-slug', 'weak-password'])
+const DEFAULT_ORG = 'sailkick'
 
 function cacheFileFor (app) {
   const dataDir = (app.getDataDirPath && app.getDataDirPath()) || '.'
   return path.join(dataDir, 'account.json')
 }
 
+// Legacy/manual escape hatch: a hand-written (or pre-0.14.2) account.json still works,
+// so an install that was set up before the token field existed keeps syncing. Any
+// influxUrl in such a file is dropped — those were copied off the signup screen, which
+// was showing the server's own loopback address.
 function readCache (file) {
   try {
     const j = JSON.parse(fs.readFileSync(file, 'utf8'))
-    return (j && j.writeToken) ? j : null
+    if (!j || !j.writeToken) return null
+    const { influxUrl, ...rest } = j
+    return rest
   } catch { return null }
 }
 
-function writeCache (file, bundle) {
-  try {
-    fs.mkdirSync(path.dirname(file), { recursive: true })
-    const tmp = `${file}.tmp-${process.pid}`
-    fs.writeFileSync(tmp, JSON.stringify(bundle), { mode: 0o600 })
-    fs.renameSync(tmp, file)
-  } catch {}
-}
-
-// True when we could pair right now (nothing cached yet, but all three fields present).
-function pairable (account) {
-  return !!(account && account.invite && account.slug && account.password)
-}
+const clean = (v) => String(v == null ? '' : v).trim()
 
 // Returns one of:
-//   { bundle, source: 'cache' }             already paired — no network call was made
-//   { bundle, source: 'paired' }            just provisioned; bundle now cached
-//   { bundle: null, source: null }          not configured (nothing to do)
-//   { bundle: null, source: null, error, terminal }   pairing attempted and failed
+//   { bundle, source: 'config' }   token pasted into the plugin config
+//   { bundle, source: 'cache' }    from a hand-written/legacy account.json
+//   { bundle: null, source: null, error? }
 //
-// bundle = { slug, influxUrl, org, bucket, writeToken }
-async function resolveAccountConfig (app, account, opts = {}) {
-  const file = cacheFileFor(app)
-
-  const cached = readCache(file)
-  if (cached) return { bundle: cached, source: 'cache' } // paired already — never call signup again
-
-  if (!pairable(account)) return { bundle: null, source: null }
-
-  const appUrl = String(opts.appUrl || '').replace(/\/+$/, '')
-  const url = appUrl + '/api/auth/signup'
-  const slug = String(account.slug).trim().toLowerCase()
-
-  let resp
-  try {
-    resp = await fetch(url, {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ invite: account.invite, slug, password: account.password, name: slug }),
-      signal: AbortSignal.timeout(opts.timeoutMs || 20000)
-    })
-  } catch (e) {
-    return { bundle: null, source: null, error: `cannot reach ${appUrl} (${e.message})`, terminal: false }
+// bundle = { slug, org, bucket, writeToken } — no influxUrl by design, see above.
+function resolveAccountConfig (app, account) {
+  const acct = account || {}
+  const slug = clean(acct.slug).toLowerCase()
+  const writeToken = clean(acct.writeToken)
+
+  if (slug && writeToken) {
+    return {
+      source: 'config',
+      bundle: {
+        slug,
+        org: clean(acct.org) || DEFAULT_ORG,
+        bucket: clean(acct.bucket) || `${slug}_raw`,
+        writeToken
+      }
+    }
   }
 
-  const j = await resp.json().catch(() => null)
-
-  if (!resp.ok || !j || j.ok === false) {
-    const code = (j && j.code) || `http-${resp.status}`
-    const message = (j && j.message) || `HTTP ${resp.status}`
-    return { bundle: null, source: null, error: `${message} (${code})`, terminal: TERMINAL_CODES.has(code) }
-  }
+  const cached = readCache(cacheFileFor(app))
+  if (cached) return { bundle: cached, source: 'cache' }
 
-  const ingest = j.ingest || {}
-  if (!ingest.writeToken) {
-    return { bundle: null, source: null, error: 'signup returned no write token', terminal: false }
-  }
-
-  // NB: signup returns no readToken (the app keeps it in its own registry), so local
-  // history falls back to the DB-less ring unless a read token is set by hand.
-  const bundle = {
-    slug: (j.boat && j.boat.slug) || slug,
-    influxUrl: ingest.url,
-    org: ingest.org,
-    bucket: ingest.bucket,
-    writeToken: ingest.writeToken
-  }
-  writeCache(file, bundle)
-  return { bundle, source: 'paired' }
+  // Half-filled: say which half, so the status line is actionable.
+  if (writeToken) return { bundle: null, source: null, error: 'boat name is missing' }
+  if (slug) return { bundle: null, source: null, error: 'write token is missing' }
+  return { bundle: null, source: null }
 }
 
-// True when the plugin either holds a bundle or has enough input to obtain one.
+// True when sync has credentials to work with.
 function accountConfigured (app, account) {
-  return !!readCache(cacheFileFor(app)) || pairable(account)
+  return !!resolveAccountConfig(app, account).bundle
 }
 
-module.exports = { resolveAccountConfig, accountConfigured, cacheFileFor }
+module.exports = { resolveAccountConfig, accountConfigured, cacheFileFor, DEFAULT_ORG }

package/lib/sync/index.js

@@ -13,6 +13,12 @@ const { deltaToLines } = require('./lineprotocol')
 
 function createSync (app, options) {
   const log = (m) => (app.debug ? app.debug('[sync] ' + m) : console.log('[sailkick-boat:sync]', m))
+  // Anything that stops telemetry reaching the cloud goes to `warn`, which lands in the
+  // normal server log. `log` is behind the plugin's debug key and is for detail only —
+  // an outage must never be visible ONLY in the status line, which is what made a
+  // day-long silent failure possible.
+  const warn = (m) => (app.error ? app.error('[sailkick-boat:sync] ' + m) : console.error('[sailkick-boat:sync]', m))
+  const WARN_REPEAT_MS = 300000 // re-state an ongoing outage every 5 min, not every retry
   let state = null
 
   function start () {
@@ -24,8 +30,9 @@ function createSync (app, options) {
       timeoutMs: options.requestTimeoutMs || 30000
     }
     if (!cfg.influxUrl || !cfg.bucket || !cfg.token) {
-      log('not started — missing influxUrl / bucket / token')
-      state = { statusLine: 'sync: not configured', stopped: true }
+      const missing = [!cfg.influxUrl && 'influxUrl', !cfg.bucket && 'bucket', !cfg.token && 'write token'].filter(Boolean)
+      warn(`not started — missing ${missing.join(' + ')}. Telemetry is NOT being sent.`)
+      state = { statusLine: `sync: not configured (missing ${missing.join(', ')})`, stopped: true }
       return
     }
 
@@ -39,7 +46,26 @@ function createSync (app, options) {
       flushTimer: null, pumpTimer: null, stopped: false, unsubscribes: [],
       retryMin: options.retryMinMs || 1000, retryMax: options.retryMaxMs || 60000,
       backoff: options.retryMinMs || 1000, idlePoll: Math.max(500, options.flushIntervalMs || 1000),
-      lastOkAt: null, pumping: false, statusLine: 'sync: starting'
+      lastOkAt: null, pumping: false, statusLine: 'sync: starting',
+      failing: false, failCount: 0, lastWarnAt: 0
+    }
+
+    // Outage transitions, not per-retry spam: the first failure, then at most one line
+    // every WARN_REPEAT_MS while it persists, then a recovery line. A boat that can
+    // never reach its endpoint used to produce no log output at all.
+    const noteFailure = (res) => {
+      state.failCount++
+      const now = Date.now()
+      if (state.failing && now - state.lastWarnAt < WARN_REPEAT_MS) return
+      state.failing = true
+      state.lastWarnAt = now
+      const why = res && res.status ? `HTTP ${res.status}` : `unreachable${res && res.error ? ` (${res.error})` : ''}`
+      warn(`cannot write to ${cfg.influxUrl} — ${why}; ${state.failCount} failed attempt(s), telemetry is buffering on disk`)
+    }
+    const noteSuccess = () => {
+      if (state.failing) warn(`recovered — writing to ${cfg.influxUrl} again after ${state.failCount} failed attempt(s)`)
+      state.failing = false
+      state.failCount = 0
     }
 
     const handleDelta = (delta) => {
@@ -73,10 +99,15 @@ function createSync (app, options) {
           const res = await writeLines(cfg, body)
           if (res.ok) {
             await spool.remove(file); state.lastOkAt = new Date(); state.backoff = state.retryMin
+            noteSuccess()
           } else if (res.retryable) {
+            noteFailure(res)
             state.pumping = false; scheduleRetry(res); return
           } else {
-            log(`batch rejected (HTTP ${res.status}) — quarantined`); await spool.quarantine(file)
+            // 4xx: bad credentials or malformed data. Never retried, so if this is not
+            // loud the batch is simply gone.
+            warn(`batch REJECTED (HTTP ${res.status}) and quarantined to ${state.spool.deadDir} — ${res.status === 401 ? 'the write token is not valid for this bucket' : 'check bucket/org and the data'}`)
+            await spool.quarantine(file)
           }
         }
       } catch (e) {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "sailkick-boat",
-  "version": "0.14.1",
-  "description": "EARLY ALPHA — cloud telemetry + offline maps for sailkick boats (www.sailkick.io; pairing is invite-only). Gapless boat→cloud telemetry sync to InfluxDB, and a local proxy that keeps the sailkick app and its charts/maps working fully offline on board.",
+  "version": "0.14.4",
+  "description": "EARLY ALPHA — cloud telemetry + offline maps for sailkick boats (www.sailkick.io; register on the web, paste the write token). Gapless boat→cloud telemetry sync to InfluxDB, and a local proxy that keeps the sailkick app and its charts/maps working fully offline on board.",
   "main": "index.js",
   "scripts": {
     "test": "node --test"