Merge relay.ngit.dev migration: bug fixes and migration tooling

This merge includes critical bug fixes and comprehensive migration tooling
developed during the relay.ngit.dev migration effort.

Bug Fixes:
- Fix git protocol error handling to return HTTP 200 with ERR pkt-line
- Fix naughty list false positives and DNS failure identification
- Fix database query filters in load_existing_events (remove .since())
- Fix OID fetch tracking to distinguish 0 OIDs from successful fetches
- Fix purgatory event source tracking for filtered expiry logging
- Implement OID retry logic for 'not our ref' errors

Migration Tools & Documentation:
- Complete 5-phase migration analysis pipeline with orchestration script
- Phase 1: Event fetching from source relay
- Phase 2: Git sync verification
- Phase 3: Categorization and relay comparison
- Phase 4: Log extraction (parse failures, purgatory expiry)
- Phase 5: Action classification for migration decisions
- Comprehensive migration guide with lessons learned
- Troubleshooting guide for permission and corruption issues

Configuration:
- Add NGIT_LOG_LEVEL configuration option
- Update git throttle limits to 60/minute
- Improve logging throughout for better observability

3 files changed, 430 insertions, 199 deletions

diff --git a/src/sync/mod.rs b/src/sync/mod.rs
index bc8c428..d6634ff 100644
--- a/src/sync/mod.rs
+++ b/src/sync/mod.rs
@@ -584,6 +584,7 @@ impl SyncManager {
     /// * `config` - Configuration for sync settings
     /// * `data_path` - Path to git data directory (for persistence)
     /// * `sync_metrics` - Optional pre-registered SyncMetrics (passed from Metrics if metrics are enabled)
+    #[allow(clippy::too_many_arguments)]
     pub fn new(
         bootstrap_relay_url: Option<String>,
         service_domain: String,
@@ -1442,6 +1443,7 @@ impl SyncManager {
             self.service_domain.clone(),
             Arc::clone(&self.repo_sync_index),
             action_tx,
+            self.database.clone(),
         );
         let subscriber_shutdown = shutdown_tx.subscribe();
         tokio::spawn(async move { self_subscriber.run(Some(subscriber_shutdown)).await });
@@ -2811,6 +2813,7 @@ impl SyncManager {
                                     event_id = %event.id,
                                     kind = %event.kind.as_u16(),
                                     identifier = %identifier,
+                                    pubkey = %event.pubkey,
                                     "Added rejected announcement to two-tier index"
                                 );
                             }
diff --git a/src/sync/naughty_list.rs b/src/sync/naughty_list.rs
index 35fcc0f..0abb986 100644
--- a/src/sync/naughty_list.rs
+++ b/src/sync/naughty_list.rs
@@ -101,6 +101,69 @@ impl NaughtyListTracker {
         Self::new(12)
     }
 
+    /// Strip URLs from an error message to prevent false positives from URL components.
+    ///
+    /// URLs can contain path components, repository names, or user identifiers that
+    /// accidentally match error patterns (e.g., "my-openssl-project", "ssl-team",
+    /// "certificate-manager"). By stripping URLs before classification, we ensure
+    /// only the actual error message text is analyzed.
+    ///
+    /// Handles: http://, https://, git://, ws://, wss://
+    fn strip_urls(error: &str) -> String {
+        let mut result = String::with_capacity(error.len());
+        let mut chars = error.chars().peekable();
+
+        while let Some(c) = chars.next() {
+            // Check for URL start patterns
+            let potential_url = match c {
+                'h' => {
+                    // Check for http:// or https://
+                    let rest: String = chars.clone().take(7).collect();
+                    rest.starts_with("ttp://") || rest.starts_with("ttps://")
+                }
+                'g' => {
+                    // Check for git://
+                    let rest: String = chars.clone().take(5).collect();
+                    rest.starts_with("it://")
+                }
+                'w' => {
+                    // Check for ws:// or wss://
+                    let rest: String = chars.clone().take(5).collect();
+                    rest.starts_with("s://") || rest.starts_with("ss://")
+                }
+                _ => false,
+            };
+
+            if potential_url {
+                // Found URL start, consume until URL end
+                result.push_str("[URL]");
+
+                // Skip until we hit a URL terminator
+                loop {
+                    match chars.peek() {
+                        Some(&ch) if Self::is_url_char(ch) => {
+                            chars.next();
+                        }
+                        _ => break,
+                    }
+                }
+            } else {
+                result.push(c);
+            }
+        }
+
+        result
+    }
+
+    /// Check if a character can be part of a URL
+    #[inline]
+    fn is_url_char(c: char) -> bool {
+        // URLs end at whitespace, quotes, or certain brackets
+        // This is conservative - real URLs can contain more, but git errors
+        // typically have URLs followed by these terminators
+        !matches!(c, ' ' | '\t' | '\n' | '\r' | '"' | '\'' | '>' | ']' | ')')
+    }
+
     /// Classify an error string into a naughty category or return None for transient errors
     ///
     /// # Arguments
@@ -112,21 +175,56 @@ impl NaughtyListTracker {
     /// - `Some(NaughtyCategory)` if the error indicates a persistent infrastructure issue
     /// - `None` if the error is a transient network issue (use HealthTracker backoff)
     pub fn classify_error(error: &str) -> Option<NaughtyCategory> {
-        let error_lower = error.to_lowercase();
+        // Filter out remote warnings - these are informational messages from the remote
+        // server that don't indicate infrastructure problems with the domain itself.
+        // Example: "remote: warning: unable to access '/root/.config/git/attributes': Permission denied"
+        // These warnings are about the remote server's internal configuration, not connectivity.
+        let filtered_error: String = error
+            .lines()
+            .filter(|line| {
+                let line_lower = line.to_lowercase();
+                // Keep lines that are NOT remote warnings
+                !(line_lower.starts_with("remote: warning:")
+                    || line_lower.starts_with("warning: remote"))
+            })
+            .collect::<Vec<_>>()
+            .join("\n");
+
+        // If after filtering we have no content, this was just warnings - not a real error
+        if filtered_error.trim().is_empty() {
+            return None;
+        }
+
+        // Strip URLs to prevent false positives from URL components
+        // (e.g., repository named "openssl-test" or path containing "certificate")
+        let url_stripped = Self::strip_urls(&filtered_error);
+        let error_lower = url_stripped.to_lowercase();
 
         // DNS lookup failures
         if error_lower.contains("failed to lookup address")
             || error_lower.contains("name or service not known")
             || error_lower.contains("nodename nor servname provided")
-            || (error_lower.contains("dns") && !error_lower.contains("timeout"))
+            || error_lower.contains("dns error")
+            || error_lower.contains("dns lookup")
+            || error_lower.contains("dns resolution")
+            || error_lower.contains("getaddrinfo")
         {
             return Some(NaughtyCategory::DnsLookupFailed);
         }
 
         // TLS certificate errors
         if error_lower.contains("certificate")
-            || error_lower.contains("ssl")
-            || error_lower.contains("tls")
+            || error_lower.contains("ssl error")
+            || error_lower.contains("ssl certificate")
+            || error_lower.contains("ssl handshake")
+            || error_lower.contains("ssl_error")
+            || error_lower.contains("tls error")
+            || error_lower.contains("tls handshake")
+            || error_lower.contains("tls alert")
+            || error_lower.contains("tls_error")
+            || error_lower.contains("openssl")
+            || error_lower.contains("schannel")
+            || error_lower.contains("secure channel")
         {
             // Exclude timeout errors that mention TLS
             if !error_lower.contains("timeout") && !error_lower.contains("timed out") {
@@ -134,12 +232,12 @@ impl NaughtyListTracker {
             }
         }
 
-        // Protocol errors
-        if error_lower.contains("websocket")
-            || error_lower.contains("protocol")
-            || error_lower.contains("invalid frame")
-        {
-            // Exclude connection errors
+        // Protocol errors - specifically WebSocket/Nostr protocol violations
+        // Note: We check for "websocket" specifically, NOT generic "protocol" keyword
+        // because git errors often contain "protocol error" (e.g., "fatal: protocol error: bad line length")
+        // which are transient network issues, not persistent infrastructure problems.
+        if error_lower.contains("websocket") || error_lower.contains("invalid frame") {
+            // Exclude connection errors (transient)
             if !error_lower.contains("connection")
                 && !error_lower.contains("timeout")
                 && !error_lower.contains("refused")
@@ -290,183 +388,216 @@ impl NaughtyListTracker {
 mod tests {
     use super::*;
 
+    // =========================================================================
+    // URL STRIPPING TESTS
+    // =========================================================================
+
     #[test]
-    fn test_classify_dns_errors() {
-        assert_eq!(
-            NaughtyListTracker::classify_error("failed to lookup address information"),
-            Some(NaughtyCategory::DnsLookupFailed)
-        );
+    fn test_strip_urls_basic_protocols() {
+        // HTTP/HTTPS
         assert_eq!(
-            NaughtyListTracker::classify_error("Name or service not known"),
-            Some(NaughtyCategory::DnsLookupFailed)
-        );
-        assert_eq!(
-            NaughtyListTracker::classify_error("nodename nor servname provided"),
-            Some(NaughtyCategory::DnsLookupFailed)
+            NaughtyListTracker::strip_urls("error: https://example.com/repo.git failed"),
+            "error: [URL] failed"
         );
         assert_eq!(
-            NaughtyListTracker::classify_error("dns error: NXDOMAIN"),
-            Some(NaughtyCategory::DnsLookupFailed)
+            NaughtyListTracker::strip_urls("error: http://example.com/path failed"),
+            "error: [URL] failed"
         );
-    }
 
-    #[test]
-    fn test_classify_tls_errors() {
+        // Git protocol
         assert_eq!(
-            NaughtyListTracker::classify_error("certificate not valid for 'example.com'"),
-            Some(NaughtyCategory::TlsCertificateInvalid)
+            NaughtyListTracker::strip_urls("fatal: git://github.com/user/repo.git not found"),
+            "fatal: [URL] not found"
         );
+
+        // WebSocket protocols (used for relay URLs)
         assert_eq!(
-            NaughtyListTracker::classify_error("SSL certificate problem"),
-            Some(NaughtyCategory::TlsCertificateInvalid)
+            NaughtyListTracker::strip_urls("error: wss://relay.example.com failed"),
+            "error: [URL] failed"
         );
         assert_eq!(
-            NaughtyListTracker::classify_error("TLS handshake failed"),
-            Some(NaughtyCategory::TlsCertificateInvalid)
+            NaughtyListTracker::strip_urls("error: ws://localhost:8080 failed"),
+            "error: [URL] failed"
         );
+    }
 
-        // TLS timeout should NOT be classified as naughty
-        assert_eq!(
-            NaughtyListTracker::classify_error("TLS connection timed out"),
-            None
-        );
+    #[test]
+    fn test_strip_urls_multiple() {
+        let error = "failed to clone https://a.com/repo.git and wss://relay.com";
+        let stripped = NaughtyListTracker::strip_urls(error);
+        assert_eq!(stripped, "failed to clone [URL] and [URL]");
     }
 
     #[test]
-    fn test_classify_protocol_errors() {
-        assert_eq!(
-            NaughtyListTracker::classify_error("websocket protocol error"),
-            Some(NaughtyCategory::ProtocolError)
-        );
+    fn test_strip_urls_preserves_error_text() {
+        let error =
+            "fatal: unable to access 'https://example.com/repo.git/': SSL certificate problem";
+        let stripped = NaughtyListTracker::strip_urls(error);
+        assert!(stripped.contains("SSL certificate problem"));
+        assert!(!stripped.contains("example.com"));
+    }
+
+    // =========================================================================
+    // EDGE CASES: TIMEOUT/CONNECTION EXCEPTIONS
+    // These are the "unusual rules" where a pattern matches but should be excluded
+    // =========================================================================
+
+    #[test]
+    fn test_tls_timeout_not_naughty() {
+        // TLS errors with timeout should NOT be classified as naughty
+        // (timeout is transient, not a certificate problem)
         assert_eq!(
-            NaughtyListTracker::classify_error("invalid frame header"),
-            Some(NaughtyCategory::ProtocolError)
+            NaughtyListTracker::classify_error("TLS connection timed out"),
+            None
         );
-
-        // WebSocket connection errors should NOT be classified as naughty
         assert_eq!(
-            NaughtyListTracker::classify_error("websocket connection refused"),
+            NaughtyListTracker::classify_error("SSL handshake timeout"),
             None
         );
     }
 
     #[test]
-    fn test_classify_transient_errors() {
-        // Timeouts are transient
+    fn test_websocket_connection_errors_not_naughty() {
+        // WebSocket connection errors are transient, not protocol violations
         assert_eq!(
-            NaughtyListTracker::classify_error("connection timed out"),
+            NaughtyListTracker::classify_error("websocket connection refused"),
             None
         );
         assert_eq!(
-            NaughtyListTracker::classify_error("operation timed out"),
+            NaughtyListTracker::classify_error("websocket connection timeout"),
             None
         );
+    }
 
-        // Connection refused is transient
+    #[test]
+    fn test_remote_warnings_filtered() {
+        // Remote warnings should be filtered out before classification
+        let warning_only =
+            "remote: warning: unable to access '/root/.config/git/attributes': Permission denied";
+        assert_eq!(NaughtyListTracker::classify_error(warning_only), None);
+
+        // But real errors after warnings should still be classified
+        let warning_with_error = "remote: warning: something\nfatal: failed to lookup address";
         assert_eq!(
-            NaughtyListTracker::classify_error("connection refused"),
-            None
+            NaughtyListTracker::classify_error(warning_with_error),
+            Some(NaughtyCategory::DnsLookupFailed)
         );
+    }
 
-        // Generic network errors are transient
+    // =========================================================================
+    // INTEGRATION: FULL CLASSIFICATION FLOW
+    // Verify URL stripping + classification work together correctly
+    // =========================================================================
+
+    #[test]
+    fn test_url_with_keywords_not_false_positive() {
+        // URLs containing keywords should NOT trigger classification
+        let cases = [
+            ("https://example.com/my-openssl-project.git", "not found"),
+            ("https://example.com/ssl-team/repo.git", "not found"),
+            ("https://example.com/certificate-manager.git", "not found"),
+            ("https://example.com/dns-tools.git", "not found"),
+            ("wss://relay-tls-test.example.com", "connection refused"),
+        ];
+
+        for (url, suffix) in cases {
+            let error = format!("fatal: repository '{}/' {}", url, suffix);
+            assert_eq!(
+                NaughtyListTracker::classify_error(&error),
+                None,
+                "URL '{}' should not trigger false positive",
+                url
+            );
+        }
+    }
+
+    #[test]
+    fn test_real_errors_still_detected() {
+        // Real errors in the message text (not URL) should still be detected
         assert_eq!(
-            NaughtyListTracker::classify_error("network unreachable"),
-            None
+            NaughtyListTracker::classify_error(
+                "fatal: 'https://example.com/repo.git': SSL certificate problem"
+            ),
+            Some(NaughtyCategory::TlsCertificateInvalid)
+        );
+        assert_eq!(
+            NaughtyListTracker::classify_error(
+                "fatal: 'https://example.com/repo.git': failed to lookup address"
+            ),
+            Some(NaughtyCategory::DnsLookupFailed)
+        );
+        assert_eq!(
+            NaughtyListTracker::classify_error("websocket protocol error"),
+            Some(NaughtyCategory::ProtocolError)
         );
     }
 
     #[test]
-    fn test_record_new_entry() {
-        let tracker = NaughtyListTracker::with_defaults();
-        let url = "wss://bad-relay.example.com";
-
-        let is_new = tracker.record(
-            url,
-            NaughtyCategory::DnsLookupFailed,
-            "failed to lookup address".to_string(),
+    fn test_url_with_keyword_and_real_error() {
+        // URL contains keyword AND there's a real error - should detect the error
+        let error = "fatal: 'https://example.com/ssl-tools/repo.git': SSL certificate problem";
+        assert_eq!(
+            NaughtyListTracker::classify_error(error),
+            Some(NaughtyCategory::TlsCertificateInvalid)
         );
-
-        assert!(is_new);
-        assert!(tracker.is_naughty(url));
-
-        let entry = tracker.get_entry(url).unwrap();
-        assert_eq!(entry.category, NaughtyCategory::DnsLookupFailed);
-        assert_eq!(entry.occurrence_count, 1);
     }
 
+    // =========================================================================
+    // TRACKER FUNCTIONALITY
+    // =========================================================================
+
     #[test]
-    fn test_record_updates_existing() {
+    fn test_tracker_record_and_update() {
         let tracker = NaughtyListTracker::with_defaults();
         let url = "wss://bad-relay.example.com";
 
         // First occurrence
-        let is_new1 = tracker.record(url, NaughtyCategory::DnsLookupFailed, "error 1".to_string());
-        assert!(is_new1);
+        let is_new = tracker.record(url, NaughtyCategory::DnsLookupFailed, "error 1".to_string());
+        assert!(is_new);
+        assert!(tracker.is_naughty(url));
 
-        // Second occurrence
+        // Second occurrence updates existing
         let is_new2 = tracker.record(url, NaughtyCategory::DnsLookupFailed, "error 2".to_string());
         assert!(!is_new2);
 
         let entry = tracker.get_entry(url).unwrap();
         assert_eq!(entry.occurrence_count, 2);
-        assert_eq!(entry.reason, "error 2"); // Updated to latest
+        assert_eq!(entry.reason, "error 2");
     }
 
     #[test]
-    fn test_is_naughty() {
-        let tracker = NaughtyListTracker::with_defaults();
-        let url = "wss://bad-relay.example.com";
-
-        assert!(!tracker.is_naughty(url));
+    fn test_tracker_expiration() {
+        let tracker = NaughtyListTracker::new(0); // Expire immediately
 
         tracker.record(
-            url,
-            NaughtyCategory::TlsCertificateInvalid,
-            "cert error".to_string(),
+            "wss://relay.example.com",
+            NaughtyCategory::DnsLookupFailed,
+            "error".to_string(),
         );
 
-        assert!(tracker.is_naughty(url));
-    }
+        // Entry exists but is expired
+        assert!(!tracker.is_naughty("wss://relay.example.com"));
 
-    #[test]
-    fn test_get_all() {
-        let tracker = NaughtyListTracker::with_defaults();
-
-        tracker.record(
-            "wss://relay1.example.com",
-            NaughtyCategory::DnsLookupFailed,
-            "dns error".to_string(),
-        );
-        tracker.record(
-            "wss://relay2.example.com",
-            NaughtyCategory::TlsCertificateInvalid,
-            "tls error".to_string(),
-        );
+        std::thread::sleep(std::time::Duration::from_millis(10));
 
-        let all = tracker.get_all();
-        assert_eq!(all.len(), 2);
+        let expired = tracker.expire_old_entries();
+        assert_eq!(expired.len(), 1);
+        assert_eq!(tracker.total_count(), 0);
     }
 
     #[test]
-    fn test_count_by_category() {
+    fn test_tracker_counts() {
         let tracker = NaughtyListTracker::with_defaults();
 
+        tracker.record("wss://r1.com", NaughtyCategory::DnsLookupFailed, "e".into());
+        tracker.record("wss://r2.com", NaughtyCategory::DnsLookupFailed, "e".into());
         tracker.record(
-            "wss://relay1.example.com",
-            NaughtyCategory::DnsLookupFailed,
-            "error".to_string(),
-        );
-        tracker.record(
-            "wss://relay2.example.com",
-            NaughtyCategory::DnsLookupFailed,
-            "error".to_string(),
-        );
-        tracker.record(
-            "wss://relay3.example.com",
+            "wss://r3.com",
             NaughtyCategory::TlsCertificateInvalid,
-            "error".to_string(),
+            "e".into(),
         );
 
+        assert_eq!(tracker.total_count(), 3);
         assert_eq!(
             tracker.count_by_category(NaughtyCategory::DnsLookupFailed),
             2
@@ -475,82 +606,84 @@ mod tests {
             tracker.count_by_category(NaughtyCategory::TlsCertificateInvalid),
             1
         );
-        assert_eq!(tracker.count_by_category(NaughtyCategory::ProtocolError), 0);
+        assert_eq!(tracker.get_all().len(), 3);
     }
 
     #[test]
-    fn test_total_count() {
-        let tracker = NaughtyListTracker::with_defaults();
-        assert_eq!(tracker.total_count(), 0);
-
-        tracker.record(
-            "wss://relay1.example.com",
-            NaughtyCategory::DnsLookupFailed,
-            "error".to_string(),
+    fn test_category_display() {
+        assert_eq!(
+            NaughtyCategory::DnsLookupFailed.as_str(),
+            "dns_lookup_failed"
         );
-        assert_eq!(tracker.total_count(), 1);
-
-        tracker.record(
-            "wss://relay2.example.com",
-            NaughtyCategory::TlsCertificateInvalid,
-            "error".to_string(),
+        assert_eq!(
+            NaughtyCategory::TlsCertificateInvalid.as_str(),
+            "tls_certificate_invalid"
         );
-        assert_eq!(tracker.total_count(), 2);
+        assert_eq!(NaughtyCategory::ProtocolError.as_str(), "protocol_error");
     }
+}
 
-    #[test]
-    fn test_expire_old_entries() {
-        // Use very short expiration for testing
-        let tracker = NaughtyListTracker::new(0); // Expire immediately (0 hours)
-
-        tracker.record(
-            "wss://relay1.example.com",
-            NaughtyCategory::DnsLookupFailed,
-            "error".to_string(),
-        );
-
-        // Entry should exist in the map
-        assert_eq!(tracker.total_count(), 1);
-
-        // But is_naughty should return false since it's already expired (0 hours)
-        assert!(!tracker.is_naughty("wss://relay1.example.com"));
-
-        // Sleep to ensure time passes
-        std::thread::sleep(std::time::Duration::from_millis(10));
+#[cfg(test)]
+mod production_tests {
+    use super::*;
 
-        // Expire old entries (should remove the 0-hour expired entry)
-        let expired = tracker.expire_old_entries();
-        assert_eq!(expired.len(), 1);
-        assert_eq!(expired[0], "wss://relay1.example.com");
+    /// Production case from relay.ngit.dev - remote warning should not be classified
+    #[test]
+    fn test_classify_production_relay_ngit_dev_warning() {
+        let error =
+            "remote: warning: unable to access '/root/.config/git/attributes': Permission denied";
+        assert_eq!(NaughtyListTracker::classify_error(error), None);
+    }
 
-        // Entry should be gone
-        assert!(!tracker.is_naughty("wss://relay1.example.com"));
-        assert_eq!(tracker.total_count(), 0);
+    /// Git protocol errors are transient, not persistent infrastructure issues
+    #[test]
+    fn test_git_protocol_errors_not_naughty() {
+        // These are common git protocol errors that should NOT be classified as naughty
+        let git_protocol_errors = [
+            "fatal: protocol error: bad line length character: remo",
+            "fatal: protocol error: expected old/new/ref, got 'shallow",
+            "fatal: git upload-pack: protocol error",
+            "error: protocol error: bad pack header",
+            "fatal: protocol error: bad band #3",
+        ];
+
+        for error in git_protocol_errors {
+            assert_eq!(
+                NaughtyListTracker::classify_error(error),
+                None,
+                "Git protocol error should not be classified as naughty: {}",
+                error
+            );
+        }
     }
 
+    /// Remote warning followed by git protocol error - both should be filtered/ignored
     #[test]
-    fn test_category_display() {
+    fn test_warning_with_git_protocol_error() {
+        let error = "remote: warning: unable to access '/root/.config/git/attributes': Permission denied\nfatal: protocol error: bad line length character: remo";
         assert_eq!(
-            NaughtyCategory::DnsLookupFailed.to_string(),
-            "dns_lookup_failed"
+            NaughtyListTracker::classify_error(error),
+            None,
+            "Warning + git protocol error should not be classified as naughty"
         );
-        assert_eq!(
-            NaughtyCategory::TlsCertificateInvalid.to_string(),
-            "tls_certificate_invalid"
-        );
-        assert_eq!(NaughtyCategory::ProtocolError.to_string(), "protocol_error");
     }
 
+    /// WebSocket protocol errors ARE naughty (persistent infrastructure issues)
     #[test]
-    fn test_category_as_str() {
-        assert_eq!(
-            NaughtyCategory::DnsLookupFailed.as_str(),
-            "dns_lookup_failed"
-        );
-        assert_eq!(
-            NaughtyCategory::TlsCertificateInvalid.as_str(),
-            "tls_certificate_invalid"
-        );
-        assert_eq!(NaughtyCategory::ProtocolError.as_str(), "protocol_error");
+    fn test_websocket_errors_still_naughty() {
+        let websocket_errors = [
+            "websocket protocol error",
+            "websocket handshake failed",
+            "invalid frame received",
+        ];
+
+        for error in websocket_errors {
+            assert_eq!(
+                NaughtyListTracker::classify_error(error),
+                Some(NaughtyCategory::ProtocolError),
+                "WebSocket error should be classified as protocol_error: {}",
+                error
+            );
+        }
     }
 }
diff --git a/src/sync/self_subscriber.rs b/src/sync/self_subscriber.rs
index 3cc408d..86e4583 100644
--- a/src/sync/self_subscriber.rs
+++ b/src/sync/self_subscriber.rs
@@ -16,6 +16,8 @@ use nostr_sdk::Timestamp;
 use tokio::sync::broadcast::error::RecvError;
 use tokio::sync::{broadcast, mpsc};
 
+use crate::nostr::builder::SharedDatabase;
+
 use super::{AddFilters, RepoSyncIndex, RepoSyncNeeds};
 
 // =============================================================================
@@ -98,6 +100,8 @@ pub struct SelfSubscriber {
     action_tx: mpsc::Sender<AddFilters>,
     /// Last time we connected - used for since filter on reconnect
     last_connected: Option<Timestamp>,
+    /// Database for querying existing events on startup
+    database: SharedDatabase,
 }
 
 impl SelfSubscriber {
@@ -108,11 +112,13 @@ impl SelfSubscriber {
     /// * `relay_domain` - Our service domain (used for filtering relevant repos)
     /// * `repo_sync_index` - Shared index to update with discovered repos
     /// * `action_tx` - Channel to send AddFilters actions to the SyncManager
+    /// * `database` - Database for querying existing events on startup
     pub fn new(
         own_relay_url: String,
         relay_domain: String,
         repo_sync_index: RepoSyncIndex,
         action_tx: mpsc::Sender<AddFilters>,
+        database: SharedDatabase,
     ) -> Self {
         Self {
             own_relay_url,
@@ -120,6 +126,7 @@ impl SelfSubscriber {
             repo_sync_index,
             action_tx,
             last_connected: None,
+            database,
         }
     }
 
@@ -135,6 +142,101 @@ impl SelfSubscriber {
             .unwrap_or(Duration::from_millis(5000))
     }
 
+    /// Load existing events from database on startup
+    ///
+    /// Queries the database with two separate queries to build the initial
+    /// PendingUpdates state. This ensures all repos get Layer 2/3 filters
+    /// created, not just those returned by the WebSocket subscription
+    /// (which has limits on the number of events returned).
+    ///
+    /// Query order:
+    /// 1. First query: Get announcements (30617) to populate repo_sync_index
+    ///    with repos and their relays
+    /// 2. Second query: Get root events (1617/1618/1621) for handle_root_event()
+    ///    to add root event IDs for Layer 3 filter creation
+    ///
+    /// Returns a PendingUpdates containing all repos that need Layer 2/3 filters.
+    async fn load_existing_events(&self) -> PendingUpdates {
+        let mut pending = PendingUpdates::new();
+
+        tracing::info!("Loading all events from database");
+
+        // First query: Get all announcements to populate repo_sync_index
+        let announcement_filter = Filter::new().kind(Kind::GitRepoAnnouncement);
+
+        let announcements = match self.database.query(announcement_filter).await {
+            Ok(events) => {
+                tracing::info!(count = events.len(), "Loaded announcements from database");
+                events
+            }
+            Err(e) => {
+                tracing::error!(
+                    error = %e,
+                    "Failed to query announcements from database"
+                );
+                return pending;
+            }
+        };
+
+        // Process announcements
+        let mut announcements_loaded = 0;
+        for event in announcements.iter() {
+            if let Some(repo_id) = Self::extract_repo_id(event) {
+                let relays = Self::extract_relay_urls(event);
+                pending.add_repo(repo_id, relays, HashSet::new());
+                announcements_loaded += 1;
+            }
+        }
+
+        // Update repo_sync_index with announcements BEFORE querying root events
+        {
+            let mut index = self.repo_sync_index.write().await;
+            for (repo_id, needs) in &pending.repos {
+                let entry = index
+                    .entry(repo_id.clone())
+                    .or_insert_with(|| RepoSyncNeeds {
+                        relays: HashSet::new(),
+                        root_events: HashSet::new(),
+                    });
+                entry.relays.extend(needs.relays.clone());
+            }
+        }
+
+        // Second query: Get all root events for handle_root_event()
+        let root_filter =
+            Filter::new().kinds(vec![Kind::GitPatch, Kind::GitIssue, Kind::GitPullRequest]);
+
+        let root_events = match self.database.query(root_filter).await {
+            Ok(events) => {
+                tracing::info!(count = events.len(), "Loaded root events from database");
+                events
+            }
+            Err(e) => {
+                tracing::error!(
+                    error = %e,
+                    "Failed to query root events from database"
+                );
+                // Continue with just announcements
+                return pending;
+            }
+        };
+
+        // Process root events
+        let mut root_events_processed = 0;
+        for event in root_events.iter() {
+            self.handle_root_event(event, &mut pending).await;
+            root_events_processed += 1;
+        }
+
+        tracing::info!(
+            announcements_loaded = announcements_loaded,
+            root_events_processed = root_events_processed,
+            "Processed existing events from database"
+        );
+
+        pending
+    }
+
     /// Process a relay pool notification
     ///
     /// Handles incoming events from the subscription, queueing 30617 announcements
@@ -276,33 +378,22 @@ impl SelfSubscriber {
         // Subscribe to announcement and root event kinds
         // Per v4 spec: 30617, 1617, 1618, 1621 (NOT 30618)
         // Plus kind 10317 (User Grasp List) for GRASP discovery
-        // Check if we have a last_connected time for reconnect filtering
-        let filter = if let Some(last) = self.last_connected {
+        let mut filter = Filter::new().kinds(vec![
+            Kind::GitRepoAnnouncement,
+            Kind::GitPatch,
+            Kind::GitIssue,
+            Kind::GitPullRequest,
+            Kind::GitUserGraspList,
+        ]);
+        if let Some(timestamp) = self.last_connected {
             // Quick reconnect - use since filter (15 min buffer)
-            let since = Timestamp::from(last.as_secs().saturating_sub(15 * 60));
+            let since = Timestamp::from(timestamp.as_secs().saturating_sub(15 * 60));
             tracing::debug!(
                 since = %since,
                 "Using since filter for reconnect"
             );
-            Filter::new()
-                .kinds(vec![
-                    Kind::GitRepoAnnouncement, // Repository Announcements
-                    Kind::GitPatch,            // Patches
-                    Kind::GitIssue,            // Issues
-                    Kind::GitPullRequest,      // Pull Requests
-                    Kind::GitUserGraspList,    // User Grasp List
-                ])
-                .since(since)
-        } else {
-            // First connection - no since filter
-            Filter::new().kinds(vec![
-                Kind::GitRepoAnnouncement, // Repository Announcements
-                Kind::GitPatch,            // Patches
-                Kind::GitIssue,            // Issues
-                Kind::GitPullRequest,      // Pull Requests
-                Kind::GitUserGraspList,    // User Grasp List
-            ])
-        };
+            filter = filter.since(since);
+        }
 
         // Update last_connected AFTER creating filter but BEFORE subscribing
         self.last_connected = Some(Timestamp::now());
@@ -323,7 +414,11 @@ impl SelfSubscriber {
 
         let mut notifications = client.notifications();
         let batch_window = Self::get_batch_window();
-        let mut pending = PendingUpdates::new();
+
+        // Load existing events from database on startup
+        // This ensures all repos get Layer 2/3 filters created, not just those
+        // returned by the WebSocket subscription (which has limits)
+        let mut pending = self.load_existing_events().await;
 
         // Timer does NOT reset on new events - use interval
         let mut timer = tokio::time::interval(batch_window);