@@ -215,7 +215,7 @@ type PresenceEntry = {pubkey: PubkeyHex, server: ServerName, expiresAt: Timestam
215215-- incremented by `retryPendingForwards` until `maxForwardRetries` is hit.
216216-- Identity is derived from `encryptedBlob` (see `Message`).
217217type ForwardEntry = {toServer: ServerName, toKey: PubkeyHex, encryptedBlob: BlobHex, retries: Int}
218−-- Running failure counter for a peer; keyed by `server`. Drives `retryBackoff`.
218+-- Running failure counter for a peer; keyed by `server`. Drives `shouldRetryServer`.
219219type ForwardFailure = {server: Text, failedAt: Timestamp, failures: Int, firstFailedAt: Timestamp}
220220
221221-- ============================================
@@ -241,7 +241,7 @@ type ForwardFailure = {server: Text, failedAt: Timestamp, failures: Int, firstFa
241241*presence : [PresenceEntry]
242242-- Cross-server outbox: messages queued for delivery to a peer, with retry counts.
243243*forwards : [ForwardEntry]
244−-- Per-peer failure counters; drives `retryBackoff`.
244+-- Per-peer failure counters; drives `shouldRetryServer`.
245245*forwardFailures : [ForwardFailure]
246246
247247-- Strictly-monotonic sequence used as `Message.receivedAt`; guarantees poll-cursor ordering.
@@ -332,7 +332,7 @@ isValidHex = \s -> do
332332
333333-- Recursively strip every trailing "." from `s` (DNS root form).
334334stripTrailingDot : Text -> Text
335−stripTrailingDot = \s -> if containsSuffix "." s
335+stripTrailingDot = \s -> if hasSuffix "." s
336336then stripTrailingDot (take (count (chars s) - 1) s)
337337else s
338338
@@ -345,8 +345,8 @@ hasPrefix : Text -> Text -> Bool
345345hasPrefix = \pre s -> take (count (chars pre)) s == pre
346346
347347-- True when `s` ends with `suffix`.
348−containsSuffix : Text -> Text -> Bool
349−containsSuffix = \suffix s -> drop (max 0 (count (chars s) - count (chars suffix))) s == suffix
348+hasSuffix : Text -> Text -> Bool
349+hasSuffix = \suffix s -> drop (max 0 (count (chars s) - count (chars suffix))) s == suffix
350350
351351-- Block private/reserved/internal hostnames (SSRF defense). Skips obscure encoding
352352-- tricks (octal, hex, percent-encoding) but covers the high-value cases:
@@ -365,7 +365,7 @@ isBadServerName = \sn -> sn == "" || sn == "localhost" || any (\c -> not contain
365365 "192.168.",
366366 "169.254.",
367367 "0."
368−] || any (\s -> containsSuffix s sn) [".localhost", ".local", ".internal", ".arpa", ".onion"]
368+] || any (\s -> hasSuffix s sn) [".localhost", ".local", ".internal", ".arpa", ".onion"]
369369
370370-- ============================================
371371-- Auth helpers
@@ -417,14 +417,11 @@ verifySignature = \pubkey signature challenge -> case bytesFromHex pubkey of
417417-- single read-side gate; `recordFailure`/`clearFailure` are the write side.
418418-- There is no half-open state — a single success clears all accumulated failures.
419419
420−-- Linear backoff: `retryBackoffBase * failures`, capped at `retryBackoffMax`.
421−retryBackoff : Int -> Int<Ms>
422−retryBackoff = \failures -> min retryBackoffMax (retryBackoffBase * max 1 failures)
423−
424420-- True when enough time has passed since the last failure for `server` to be
425−-- worth retrying (or no failure recorded at all).
421+-- worth retrying (or no failure recorded at all). Linear backoff:
422+-- `retryBackoffBase * failures`, capped at `retryBackoffMax`.
426423shouldRetryServer : Text -> Timestamp -> [ForwardFailure] -> Bool
427−shouldRetryServer = \server t failures -> not any (\f -> f.server == server && t - f.failedAt < retryBackoff f.failures) failures
424+shouldRetryServer = \server t failures -> not any (\f -> f.server == server && t - f.failedAt < min retryBackoffMax (retryBackoffBase * max 1 f.failures)) failures
428425
429426-- Bump the failure counter for `server`. Preserves `firstFailedAt` across
430427-- subsequent failures.
@@ -479,10 +476,8 @@ appendMessage = \toKey encryptedBlob t -> do
479476refreshLocalPresence : PubkeyHex -> Timestamp -> IO {rw *presence} [Text]
480477refreshLocalPresence = \pubkey expiry -> do
481478 pres <- *presence
482− let kept = filter (\p -> not (p.pubkey == pubkey && isLocalServer p.server)) pres
483− let newPres = union kept [{pubkey, server: serverHost, expiresAt: expiry}]
484− *presence = newPres
485− yield (collectPeers newPres (\p -> p.server))
479+ *presence = union (filter (\p -> not (p.pubkey == pubkey && isLocalServer p.server)) pres) [{pubkey, server: serverHost, expiresAt: expiry}]
480+ yield (collectPeers pres (\p -> p.server))
486481
487482-- ============================================
488483-- Pruning