@@ -475,7 +475,7 @@ appendCapped = \ref items maxN getKey -> do
475475-- Add `server` to the named list ref if absent. Returns the new total.
476476addServerToList = \listRef server -> atomic do
477477 current <- *listRef
478− let updated = if elem current server then current else union current [server]
478+ let updated = unique (union current [server])
479479 set *listRef = updated
480480 yield (count updated)
481481
@@ -487,14 +487,9 @@ removeServerFromList = \listRef server -> atomic do
487487
488488headOf = \items -> fold (\_ x -> Just {value: x}) Nothing {} (take 1 items)
489489
490−-- Sort then take head: O(n log n) but no fold-with-Maybe boilerplate.
491−minBy = \items getKey -> headOf (sortBy getKey items)
492−
493−-- LRU-style eviction: drop the single entry with the smallest key.
494−evictOldest = \items getKey -> drop 1 (sortBy getKey items)
495−
490+-- Cap to maxN by dropping the single entry with the smallest key (LRU-style).
496491capList = \items maxN getKey ->
497− if count items > maxN then evictOldest items getKey else items
492+ if count items > maxN then drop 1 (sortBy getKey items) else items
498493
499494-- Integer percentage with zero-denominator guard.
500495pct = \cur maxN -> if maxN > 0 then cur * 100 / maxN else 0
@@ -518,7 +513,7 @@ removeForKey = \pred -> do
518513capPerKey = \items pred maxN getKey ->
519514 let mine = filter items pred in
520515 if count mine >= maxN
521− then union (removeWhere items pred) (evictOldest mine getKey)
516+ then union (removeWhere items pred) (drop 1 (sortBy getKey mine))
522517 else items
523518
524519-- Shared empty/error shape for /poll. Only a few fields ever vary.
@@ -600,7 +595,7 @@ matchIp = \clientIp sessionIp -> sessionIp == "" || clientIp == sessionIp
600595
601596extractToken = \authHeader ->
602597 let token = drop 7 authHeader in
603− if take 7 authHeader == "Bearer " && token != "" && not (tooLong token maxTokenLen)
598+ if hasPrefix "Bearer " authHeader && token != "" && not (tooLong token maxTokenLen)
604599 then Just {value: token}
605600 else Nothing {}
606601
@@ -666,7 +661,7 @@ generateFederationAuth = \scope requestTimestamp ->
666661
667662-- Verify a federation request: signed (Ed25519 over scope|ts|fromServer|nonce) or callback Bearer token.
668663verifyFederationAuth = \authorization fromServer scope requestTimestamp -> do
669− if take 7 authorization == "Signed " then do
664+ if hasPrefix "Signed " authorization then do
670665 let payload = drop 7 authorization
671666 if payload == "" || tooLong payload (maxSignatureLen + 25) then yield False
672667 else do
@@ -1211,9 +1206,7 @@ sendMessageCore = \senderKey to encryptedBlob clampedTs effMsgId expiresInMs msg
12111206 msgs <- *messages
12121207 aids <- *ackedIds
12131208 dids <- *deliveredIds
1214− let isDup = (effMsgId != "" && any msgs (\m -> m.messageId == effMsgId && m.toKey == to))
1215− || hasMessage effMsgId to aids
1216− || hasMessage effMsgId to dids
1209+ let isDup = hasMessage effMsgId to msgs || hasMessage effMsgId to aids || hasMessage effMsgId to dids
12171210 srLim <- chargeRate sendRates senderKey maxSendRatePerKey sendRateWindowMs t
12181211 prLim <- chargeRate pairRates (senderKey ++ "|" ++ to) maxPairRatePerPair pairRateWindowMs t
12191212 rrLim <- chargeRate recvRates to maxRecvRatePerKey recvRateWindowMs t
@@ -1471,9 +1464,7 @@ storeFederated = \toKey encryptedBlob timestamp originServer messageId expiresAt
14711464 msgs <- *messages
14721465 aids <- *ackedIds
14731466 dids <- *deliveredIds
1474− if any msgs (\m -> m.messageId == messageId && m.toKey == toKey)
1475− || hasMessage messageId toKey aids
1476− || hasMessage messageId toKey dids
1467+ if hasMessage messageId toKey msgs || hasMessage messageId toKey aids || hasMessage messageId toKey dids
14771468 then yield ""
14781469 else if count msgs >= maxMessages then yield "global_full"
14791470 else if countWhere msgs (\m -> m.toKey == toKey) >= maxMessagesPerRecipient then yield "mailbox_full"