Merge master into 3ca0-announcements-purgatory

18 files changed, 1493 insertions, 397 deletions

diff --git a/src/config.rs b/src/config.rs
index 7062187..dd7b1e3 100644
--- a/src/config.rs
+++ b/src/config.rs
@@ -115,16 +115,19 @@ pub struct ArchiveConfig {
     ///
     /// WARNING: Setting this to true allows anyone to mirror any repository
     /// to this relay, potentially causing storage/bandwidth exhaustion.
+    #[serde(default)]
     pub archive_all: bool,
 
     /// Whitelist entries for selective archiving
     ///
     /// If empty and archive_all is false, GRASP-05 is disabled (GRASP-01 strict mode).
+    #[serde(default)]
     pub whitelist: Vec<WhitelistEntry>,
 
     /// GRASP server domains to archive (archive all repositories from these domains)
     ///
     /// If non-empty, archives all repositories from the specified GRASP server domains.
+    #[serde(default)]
     pub grasp_services: Vec<String>,
 
     /// Read-only archive mode: relay is a read-only sync of archived repositories
@@ -132,6 +135,7 @@ pub struct ArchiveConfig {
     /// When true, the relay ONLY accepts announcements matching the archive whitelist/all.
     /// Announcements listing the relay but not in the whitelist are rejected.
     /// When false, the relay operates in GRASP-01 mode for unwhitelisted repos.
+    #[serde(default)]
     pub read_only: bool,
 }
 
@@ -178,6 +182,7 @@ pub struct RepositoryConfig {
     /// Whitelist entries for selective repository acceptance
     ///
     /// If empty, all repositories listing the service are accepted (GRASP-01 mode).
+    #[serde(default)]
     pub whitelist: Vec<WhitelistEntry>,
 }
 
@@ -204,6 +209,7 @@ pub struct BlacklistConfig {
     ///
     /// If empty, no repositories are blacklisted.
     /// Blacklist takes precedence over both archive and repository whitelists.
+    #[serde(default)]
     pub blacklist: Vec<WhitelistEntry>,
 }
 
@@ -245,6 +251,7 @@ pub struct EventBlacklistConfig {
     ///
     /// If empty, no events are blacklisted by author.
     /// Applies to ALL event types, preventing events from reaching both the relay and purgatory.
+    #[serde(default)]
     pub blacklisted_npubs: Vec<String>,
 }
 
@@ -466,6 +473,10 @@ pub struct Config {
     /// Prevents connection exhaustion DoS attacks
     #[arg(long, env = "NGIT_MAX_CONNECTIONS", default_value_t = 4096)]
     pub max_connections: usize,
+
+    /// Log level for application logging
+    #[arg(long, env = "NGIT_LOG_LEVEL", default_value = "info")]
+    pub log_level: String,
 }
 
 impl Config {
@@ -748,6 +759,7 @@ impl Config {
             repository_blacklist: String::new(),
             event_blacklist: String::new(),
             max_connections: 500,
+            log_level: "debug".to_string(),
         }
     }
 }
@@ -1069,14 +1081,14 @@ mod tests {
     fn test_archive_read_only_defaults() {
         // Default: false when no archive mode
         let config = Config::for_testing();
-        assert_eq!(config.archive_config().read_only, false);
+        assert!(!config.archive_config().read_only);
 
         // Default: true when archive_all is set
         let config = Config {
             archive_all: true,
             ..Config::for_testing()
         };
-        assert_eq!(config.archive_config().read_only, true);
+        assert!(config.archive_config().read_only);
 
         // Default: true when archive_whitelist is set
         let keys = Keys::generate();
@@ -1085,7 +1097,7 @@ mod tests {
             archive_whitelist: test_npub,
             ..Config::for_testing()
         };
-        assert_eq!(config.archive_config().read_only, true);
+        assert!(config.archive_config().read_only);
     }
 
     #[test]
@@ -1096,7 +1108,7 @@ mod tests {
             archive_read_only: Some(true),
             ..Config::for_testing()
         };
-        assert_eq!(config.archive_config().read_only, true);
+        assert!(config.archive_config().read_only);
 
         // Explicit false with archive_all (unusual but allowed)
         let config = Config {
@@ -1104,14 +1116,14 @@ mod tests {
             archive_read_only: Some(false),
             ..Config::for_testing()
         };
-        assert_eq!(config.archive_config().read_only, false);
+        assert!(!config.archive_config().read_only);
 
         // Explicit false without archive mode
         let config = Config {
             archive_read_only: Some(false),
             ..Config::for_testing()
         };
-        assert_eq!(config.archive_config().read_only, false);
+        assert!(!config.archive_config().read_only);
     }
 
     #[test]
@@ -1514,7 +1526,7 @@ mod tests {
         };
         let archive_config = config.archive_config();
         assert!(archive_config.enabled());
-        assert_eq!(archive_config.read_only, true); // Default to true
+        assert!(archive_config.read_only); // Default to true
     }
 
     #[test]
@@ -1524,7 +1536,7 @@ mod tests {
             archive_grasp_services: "git.example.com".to_string(),
             ..Config::for_testing()
         };
-        assert_eq!(config.archive_config().read_only, true);
+        assert!(config.archive_config().read_only);
     }
 
     #[test]
@@ -1535,7 +1547,7 @@ mod tests {
             archive_read_only: Some(false),
             ..Config::for_testing()
         };
-        assert_eq!(config.archive_config().read_only, false);
+        assert!(!config.archive_config().read_only);
     }
 
     #[test]
diff --git a/src/git/authorization.rs b/src/git/authorization.rs
index 69a0751..df780bb 100644
--- a/src/git/authorization.rs
+++ b/src/git/authorization.rs
@@ -609,6 +609,28 @@ pub async fn get_state_authorization_for_specific_owner_repo(
         owner_pubkey
     );
 
+    // Accept pushes where all refs are already at the desired state (old_oid == new_oid)
+    // This handles race conditions where state events are applied between fetch and push
+    if !pushed_refs.is_empty() {
+        let all_refs_unchanged = pushed_refs
+            .iter()
+            .all(|(old_oid, new_oid, _)| old_oid == new_oid);
+
+        if all_refs_unchanged {
+            debug!(
+                "All pushed refs unchanged (old_oid == new_oid) for {} owned by {}, accepting without purgatory check",
+                identifier, owner_pubkey
+            );
+            return Ok(AuthorizationResult {
+                authorized: true,
+                reason: "Push accepted: all refs already at desired state (no-op)".to_string(),
+                state: None,
+                maintainers: authorized.into_iter().collect(),
+                purgatory_events: vec![],
+            });
+        }
+    }
+
     // Check purgatory for matching state events
     // Convert pushed refs to RefUpdate (filter out refs/nostr/* refs)
     let pushed_updates: Vec<RefUpdate> = pushed_refs
@@ -699,12 +721,88 @@ pub async fn get_state_authorization_for_specific_owner_repo(
             debug!("Purgatory events found but none from authorized authors");
         }
     } else {
-        debug!("No matching state events found in purgatory");
+        // Check if there are ANY state events in purgatory for this identifier
+        let all_purgatory_states = purgatory.find_state(identifier);
+
+        if !all_purgatory_states.is_empty() {
+            // There are state events but none match the push - diagnose why
+            debug!(
+                "Found {} state event(s) in purgatory for {} but none match the push",
+                all_purgatory_states.len(),
+                identifier
+            );
+
+            // Count authorized state events and collect diagnostic info
+            let mut authorized_count = 0;
+            let mut diagnostic_reasons = Vec::new();
+
+            // Diagnose why each authorized state event doesn't match
+            for entry in all_purgatory_states.iter() {
+                let author_hex = entry.event.pubkey.to_hex();
+                if authorized.contains(&author_hex) {
+                    authorized_count += 1;
+                    if let Some(reason) = crate::purgatory::diagnose_state_mismatch(
+                        &entry.event,
+                        &pushed_updates,
+                        &local_refs,
+                    ) {
+                        debug!(
+                            "State event {} from authorized author {} doesn't match push: {}",
+                            entry.event.id,
+                            entry
+                                .event
+                                .pubkey
+                                .to_bech32()
+                                .unwrap_or_else(|_| author_hex.clone()),
+                            reason
+                        );
+                        diagnostic_reasons.push(reason);
+                    }
+                }
+            }
+
+            // Create concise WARN message summarizing the rejection
+            let summary = if authorized_count > 0 {
+                let reason_summary = if !diagnostic_reasons.is_empty() {
+                    // Take the first diagnostic reason as representative
+                    format!(" ({})", diagnostic_reasons[0])
+                } else {
+                    String::new()
+                };
+                format!(
+                    "{} state event{} in purgatory from authorized publisher{} but doesn't match push{}",
+                    authorized_count,
+                    if authorized_count == 1 { "" } else { "s" },
+                    if authorized_count == 1 { "" } else { "s" },
+                    reason_summary
+                )
+            } else {
+                format!(
+                    "{} state event{} in purgatory but none from authorized publishers",
+                    all_purgatory_states.len(),
+                    if all_purgatory_states.len() == 1 {
+                        ""
+                    } else {
+                        "s"
+                    }
+                )
+            };
+
+            warn!("Push rejected for {}: {}", identifier, summary);
+            return Ok(AuthorizationResult::denied(summary));
+        } else {
+            debug!("No state events found in purgatory for {}", identifier);
+            warn!(
+                "Push rejected for {}: No state events in purgatory",
+                identifier
+            );
+            return Ok(AuthorizationResult::denied("No state events in purgatory"));
+        }
     }
 
     // No matching state found in purgatory
     Ok(AuthorizationResult::denied(
-        "No state event found in purgatory from authorized publishers",
+        "No matching state event found in purgatory from authorized publishers",
     ))
 }
 
diff --git a/src/git/handlers.rs b/src/git/handlers.rs
index 13d6ba0..f43cbb6 100644
--- a/src/git/handlers.rs
+++ b/src/git/handlers.rs
@@ -100,6 +100,42 @@ pub async fn handle_info_refs(
         .unwrap())
 }
 
+/// Build an HTTP 200 OK response with an ERR pkt-line for git protocol errors.
+///
+/// Per the git smart HTTP protocol spec, protocol-level errors (like "not our ref")
+/// should be returned as HTTP 200 OK with the error message in pkt-line format:
+/// `PKT-LINE("ERR" SP explanation-text)`
+///
+/// This allows git clients to properly parse and display the error message.
+fn build_git_protocol_error_response(
+    service: GitService,
+    error_message: &str,
+) -> Response<Full<Bytes>> {
+    // Format: "ERR <message>\n"
+    let err_content = format!("ERR {}\n", error_message.trim());
+    let err_pktline = PktLine::data(err_content.as_bytes()).encode();
+
+    Response::builder()
+        .status(StatusCode::OK)
+        .header("content-type", service.result_content_type())
+        .header("cache-control", "no-cache")
+        .body(Full::new(Bytes::from(err_pktline)))
+        .unwrap()
+}
+
+/// Check if a git process failure is a protocol error (vs transport error).
+///
+/// Protocol errors are communicated via stderr when git exits with code 128.
+/// These should be returned to the client as HTTP 200 with ERR pkt-line.
+///
+/// Transport errors (process spawn failures, I/O errors, signals) should
+/// remain as HTTP 500 errors.
+fn is_git_protocol_error(exit_code: Option<i32>, stderr: &[u8]) -> bool {
+    // Git uses exit code 128 for protocol/usage errors
+    // If there's stderr content, it's a protocol error message
+    exit_code == Some(128) && !stderr.is_empty()
+}
+
 /// Handle POST /git-upload-pack (clone/fetch)
 pub async fn handle_upload_pack(
     repo_path: PathBuf,
@@ -121,7 +157,10 @@ pub async fn handle_upload_pack(
         stdin
             .write_all(&request_body)
             .await
-            .map_err(GitError::IoError)?;
+            .map_err(|e| {
+                error!("Failed to write to git upload-pack stdin: {}", e);
+                GitError::IoError(e)
+            })?;
         // Close stdin to signal end of input
         drop(stdin);
     }
@@ -135,7 +174,10 @@ pub async fn handle_upload_pack(
         stdout
             .read_to_end(&mut output)
             .await
-            .map_err(GitError::IoError)?;
+            .map_err(|e| {
+                error!("Failed to read git upload-pack stdout: {}", e);
+                GitError::IoError(e)
+            })?;
     }
 
     if let Some(stderr) = git.take_stderr() {
@@ -143,14 +185,35 @@ pub async fn handle_upload_pack(
         stderr
             .read_to_end(&mut stderr_output)
             .await
-            .map_err(GitError::IoError)?;
+            .map_err(|e| {
+                error!("Failed to read git upload-pack stderr: {}", e);
+                GitError::IoError(e)
+            })?;
     }
 
     // Wait for process
-    let status = git.wait().await.map_err(GitError::IoError)?;
+    let status = git.wait().await.map_err(|e| {
+        error!("Failed to wait for git upload-pack process: {}", e);
+        GitError::IoError(e)
+    })?;
 
     if !status.success() {
         let stderr_str = String::from_utf8_lossy(&stderr_output);
+
+        // Check if this is a git protocol error (exit code 128 with stderr)
+        // Protocol errors should be returned as HTTP 200 with ERR pkt-line
+        if is_git_protocol_error(status.code(), &stderr_output) {
+            warn!(
+                "Git upload-pack protocol error (returning ERR pkt-line): {}",
+                stderr_str
+            );
+            return Ok(build_git_protocol_error_response(
+                GitService::UploadPack,
+                &stderr_str,
+            ));
+        }
+
+        // Transport errors (spawn failures, signals, etc.) remain as HTTP 500
         error!("Git upload-pack failed: {}", stderr_str);
         return Err(GitError::GitFailed(status.code()));
     }
@@ -206,7 +269,7 @@ pub async fn handle_receive_pack(
     }
 
     // GRASP Authorization Check
-    info!(
+    debug!(
         "Authorizing push for {} owned by {} via database query",
         identifier, owner_pubkey
     );
@@ -251,7 +314,10 @@ pub async fn handle_receive_pack(
         stdin
             .write_all(&request_body)
             .await
-            .map_err(GitError::IoError)?;
+            .map_err(|e| {
+                error!("Failed to write to git receive-pack stdin: {}", e);
+                GitError::IoError(e)
+            })?;
         drop(stdin);
     }
 
@@ -264,7 +330,10 @@ pub async fn handle_receive_pack(
         stdout
             .read_to_end(&mut output)
             .await
-            .map_err(GitError::IoError)?;
+            .map_err(|e| {
+                error!("Failed to read git receive-pack stdout: {}", e);
+                GitError::IoError(e)
+            })?;
     }
 
     if let Some(stderr) = git.take_stderr() {
@@ -272,14 +341,35 @@ pub async fn handle_receive_pack(
         stderr
             .read_to_end(&mut stderr_output)
             .await
-            .map_err(GitError::IoError)?;
+            .map_err(|e| {
+                error!("Failed to read git receive-pack stderr: {}", e);
+                GitError::IoError(e)
+            })?;
     }
 
     // Wait for process
-    let status = git.wait().await.map_err(GitError::IoError)?;
+    let status = git.wait().await.map_err(|e| {
+        error!("Failed to wait for git receive-pack process: {}", e);
+        GitError::IoError(e)
+    })?;
 
     if !status.success() {
         let stderr_str = String::from_utf8_lossy(&stderr_output);
+
+        // Check if this is a git protocol error (exit code 128 with stderr)
+        // Protocol errors should be returned as HTTP 200 with ERR pkt-line
+        if is_git_protocol_error(status.code(), &stderr_output) {
+            warn!(
+                "Git receive-pack protocol error (returning ERR pkt-line): {}",
+                stderr_str
+            );
+            return Ok(build_git_protocol_error_response(
+                GitService::ReceivePack,
+                &stderr_str,
+            ));
+        }
+
+        // Transport errors (spawn failures, signals, etc.) remain as HTTP 500
         error!("Git receive-pack failed: {}", stderr_str);
         return Err(GitError::GitFailed(status.code()));
     }
diff --git a/src/git/mod.rs b/src/git/mod.rs
index b3fee69..1255b6f 100644
--- a/src/git/mod.rs
+++ b/src/git/mod.rs
@@ -253,7 +253,7 @@ pub fn update_ref(repo_path: &Path, ref_name: &str, commit_hash: &str) -> Result
         return Err(format!("git update-ref failed: {}", stderr));
     }
 
-    info!(
+    debug!(
         "Updated ref {} to {} in {}",
         ref_name,
         commit_hash,
diff --git a/src/git/sync.rs b/src/git/sync.rs
index 8401736..c24d16b 100644
--- a/src/git/sync.rs
+++ b/src/git/sync.rs
@@ -673,7 +673,7 @@ pub fn align_repository_with_state(repo_path: &Path, state: &RepositoryState) ->
         match git::update_ref(repo_path, ref_name, expected_commit) {
             Ok(()) => {
                 if current_commit.is_some() {
-                    info!(
+                    debug!(
                         "Updated {} to {} in {}",
                         ref_name,
                         expected_commit,
@@ -681,7 +681,7 @@ pub fn align_repository_with_state(repo_path: &Path, state: &RepositoryState) ->
                     );
                     result.refs_updated += 1;
                 } else {
-                    info!(
+                    debug!(
                         "Created {} at {} in {}",
                         ref_name,
                         expected_commit,
@@ -707,7 +707,7 @@ pub fn align_repository_with_state(repo_path: &Path, state: &RepositoryState) ->
             if let Some(head_commit) = state.get_branch_commit(branch_name) {
                 match git::try_set_head_if_available(repo_path, head_ref, head_commit) {
                     Ok(true) => {
-                        info!("Set HEAD to {} in {}", head_ref, repo_path.display());
+                        debug!("Set HEAD to {} in {}", head_ref, repo_path.display());
                         result.head_set = true;
                     }
                     Ok(false) => {
diff --git a/src/http/mod.rs b/src/http/mod.rs
index cfd7c52..76ffef3 100644
--- a/src/http/mod.rs
+++ b/src/http/mod.rs
@@ -345,7 +345,7 @@ impl Service<Request<Incoming>> for HttpService {
                             .unwrap())
                     }
                     Err(e) => {
-                        tracing::error!("Git handler error: {}", e);
+                        // Errors are already logged at their source with full context
                         let error_msg = format!("Git error: {}", e);
                         Ok(add_cors_headers(Response::builder())
                             .status(e.status_code())
diff --git a/src/main.rs b/src/main.rs
index 6769cf3..bf3aefb 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -3,8 +3,8 @@ use std::{path::PathBuf, sync::Arc};
 
 use anyhow::Result;
 use tokio::signal;
-use tracing::{error, info, warn, Level};
-use tracing_subscriber::FmtSubscriber;
+use tracing::{error, info, warn};
+use tracing_subscriber::{EnvFilter, FmtSubscriber};
 
 use ngit_grasp::{
     config::{Config, DatabaseBackend},
@@ -17,16 +17,16 @@ use ngit_grasp::{
 
 #[tokio::main]
 async fn main() -> Result<()> {
-    // Initialize tracing
+    // Load configuration first (priority: CLI flags > env vars > .env file > defaults)
+    let config = Config::load()?;
+
+    // Initialize tracing with configured log level
     let subscriber = FmtSubscriber::builder()
-        .with_max_level(Level::DEBUG)
+        .with_env_filter(EnvFilter::new(&config.log_level))
         .finish();
     tracing::subscriber::set_global_default(subscriber)?;
 
-    info!("Starting ngit-grasp with nostr-relay-builder...");
-
-    // Load configuration (priority: CLI flags > env vars > .env file > defaults)
-    let config = Config::load()?;
+    info!("Starting ngit-grasp with log level: {}", config.log_level);
 
     // Validate configuration and fail fast on fatal errors
     // Recoverable issues (e.g., malformed whitelist entries) are logged as warnings
@@ -189,8 +189,8 @@ async fn main() -> Result<()> {
         ));
 
         // Create throttle manager for rate limiting remote git servers
-        // Default: 5 concurrent requests per domain, 30 requests per minute per domain
-        let throttle_manager = Arc::new(ThrottleManager::new(5, 30));
+        // Default: 5 concurrent requests per domain, 60 requests per minute per domain
+        let throttle_manager = Arc::new(ThrottleManager::new(5, 60));
         throttle_manager.set_context(sync_ctx.clone());
         throttle_manager.set_git_naughty_list(git_naughty_list.clone());
 
@@ -212,20 +212,49 @@ async fn main() -> Result<()> {
         let http_write_policy = Arc::new(relay_with_db.write_policy.clone());
 
         // Run server until shutdown signal, then cleanup
-        tokio::select! {
-            result = http::run_server(
-                config,
-                relay_with_db.relay,
-                relay_with_db.database,
-                metrics,
-                purgatory,
-                http_write_policy,
-                http_rejected_index,
-            ) => {
-                result?
+        #[cfg(unix)]
+        {
+            use tokio::signal::unix::{signal, SignalKind};
+            let mut sigterm = signal(SignalKind::terminate())?;
+
+            tokio::select! {
+                result = http::run_server(
+                    config,
+                    relay_with_db.relay,
+                    relay_with_db.database,
+                    metrics,
+                    purgatory,
+                    http_write_policy,
+                    http_rejected_index,
+                ) => {
+                    result?
+                }
+                _ = signal::ctrl_c() => {
+                    info!("Received SIGINT (Ctrl+C), cleaning up...");
+                }
+                _ = sigterm.recv() => {
+                    info!("Received SIGTERM, cleaning up...");
+                }
             }
-            _ = signal::ctrl_c() => {
-                info!("Received shutdown signal, cleaning up...");
+        }
+
+        #[cfg(not(unix))]
+        {
+            tokio::select! {
+                result = http::run_server(
+                    config,
+                    relay_with_db.relay,
+                    relay_with_db.database,
+                    metrics,
+                    purgatory,
+                    http_write_policy,
+                    http_rejected_index,
+                ) => {
+                    result?
+                }
+                _ = signal::ctrl_c() => {
+                    info!("Received SIGINT (Ctrl+C), cleaning up...");
+                }
             }
         }
 
diff --git a/src/nostr/builder.rs b/src/nostr/builder.rs
index d056e46..7a05348 100644
--- a/src/nostr/builder.rs
+++ b/src/nostr/builder.rs
@@ -102,6 +102,62 @@ impl Nip34WritePolicy {
         self.ctx.set_local_relay(relay);
     }
 
+    /// Extract repository identifier from event's 'd' tag.
+    ///
+    /// Used for structured logging when parsing fails - we try to extract
+    /// the identifier even if full parsing failed.
+    fn extract_identifier_from_event(event: &Event) -> String {
+        use nostr_relay_builder::prelude::TagKind;
+        event
+            .tags
+            .iter()
+            .find(|t| t.kind() == TagKind::d())
+            .and_then(|t| t.content())
+            .map(|s| s.to_string())
+            .unwrap_or_else(|| "unknown".to_string())
+    }
+
+    /// Extract ALL repository identifiers from PR event's 'a' tags.
+    ///
+    /// PR events can reference multiple repositories via multiple 'a' tags
+    /// (e.g., when there are multiple maintainers). Each tag has format
+    /// `30617:<owner_pubkey>:<identifier>`.
+    ///
+    /// Returns a vector of unique identifiers, or `["unknown"]` if none found.
+    fn extract_repos_from_pr_event(event: &Event) -> Vec<String> {
+        let repos: Vec<String> = event
+            .tags
+            .iter()
+            .filter_map(|tag| {
+                let tag_vec = tag.clone().to_vec();
+                if tag_vec.len() >= 2 && tag_vec[0] == "a" && tag_vec[1].starts_with("30617:") {
+                    // Format: 30617:<owner_pubkey>:<identifier>
+                    let parts: Vec<&str> = tag_vec[1].split(':').collect();
+                    if parts.len() >= 3 {
+                        Some(parts[2].to_string())
+                    } else {
+                        None
+                    }
+                } else {
+                    None
+                }
+            })
+            .collect();
+
+        // Deduplicate while preserving order
+        let mut seen = std::collections::HashSet::new();
+        let unique_repos: Vec<String> = repos
+            .into_iter()
+            .filter(|r| seen.insert(r.clone()))
+            .collect();
+
+        if unique_repos.is_empty() {
+            vec!["unknown".to_string()]
+        } else {
+            unique_repos
+        }
+    }
+
     /// Handle repository announcement event
     async fn handle_announcement(&self, event: &Event) -> WritePolicyResult {
         let event_id_str = event.id.to_bech32().unwrap_or_else(|_| event.id.to_hex());
@@ -133,10 +189,21 @@ impl Nip34WritePolicy {
                         WritePolicyResult::Accept
                     }
                     Err(e) => {
+                        let npub = event
+                            .pubkey
+                            .to_bech32()
+                            .unwrap_or_else(|_| event.pubkey.to_hex());
+                        let event_id_short = &event.id.to_hex()[..12];
+                        // Try to extract repo identifier from 'd' tag even if parsing failed
+                        let repo = Self::extract_identifier_from_event(event);
+                        // Structured log for migration scripts
                         tracing::warn!(
-                            "Failed to parse repository announcement {}: {}",
-                            event_id_str,
-                            e
+                            "[PARSE_FAIL] kind={} event_id={}... reason=\"{}\" repo={} npub={}",
+                            event.kind.as_u16(),
+                            event_id_short,
+                            e,
+                            repo,
+                            npub
                         );
                         WritePolicyResult::reject(format!("Failed to parse announcement: {}", e))
                     }
@@ -185,10 +252,21 @@ impl Nip34WritePolicy {
                         WritePolicyResult::Accept
                     }
                     Err(e) => {
+                        let npub = event
+                            .pubkey
+                            .to_bech32()
+                            .unwrap_or_else(|_| event.pubkey.to_hex());
+                        let event_id_short = &event.id.to_hex()[..12];
+                        // Try to extract repo identifier from 'd' tag even if parsing failed
+                        let repo = Self::extract_identifier_from_event(event);
+                        // Structured log for migration scripts
                         tracing::warn!(
-                            "Failed to parse maintainer announcement {}: {}",
-                            event_id_str,
-                            e
+                            "[PARSE_FAIL] kind={} event_id={}... reason=\"{}\" repo={} npub={}",
+                            event.kind.as_u16(),
+                            event_id_short,
+                            e,
+                            repo,
+                            npub
                         );
                         WritePolicyResult::reject(format!("Failed to parse announcement: {}", e))
                     }
@@ -211,8 +289,6 @@ impl Nip34WritePolicy {
     /// * `event` - The state event to validate
     /// * `is_synced` - True if this event came from proactive sync (vs user-submitted)
     async fn handle_state(&self, event: &Event, is_synced: bool) -> WritePolicyResult {
-        let event_id_str = event.id.to_bech32().unwrap_or_else(|_| event.id.to_hex());
-
         match self.state_policy.validate(event) {
             StateResult::Accept => {
                 // Process state alignment asynchronously
@@ -223,7 +299,22 @@ impl Nip34WritePolicy {
                 {
                     Ok(poilicy_result) => poilicy_result,
                     Err(e) => {
-                        tracing::warn!("Failed to process state event {}: {}", event_id_str, e);
+                        let npub = event
+                            .pubkey
+                            .to_bech32()
+                            .unwrap_or_else(|_| event.pubkey.to_hex());
+                        let event_id_short = &event.id.to_hex()[..12];
+                        // Try to extract repo identifier from 'd' tag even if parsing failed
+                        let repo = Self::extract_identifier_from_event(event);
+                        // Structured log for migration scripts
+                        tracing::warn!(
+                            "[PARSE_FAIL] kind={} event_id={}... reason=\"{}\" repo={} npub={}",
+                            event.kind.as_u16(),
+                            event_id_short,
+                            e,
+                            repo,
+                            npub
+                        );
                         // reject if processing failed
                         WritePolicyResult::Reject {
                             status: false,
@@ -233,7 +324,22 @@ impl Nip34WritePolicy {
                 }
             }
             StateResult::Reject(reason) => {
-                tracing::warn!("Rejected repository state {}: {}", event_id_str, reason);
+                let npub = event
+                    .pubkey
+                    .to_bech32()
+                    .unwrap_or_else(|_| event.pubkey.to_hex());
+                let event_id_short = &event.id.to_hex()[..12];
+                // Try to extract repo identifier from 'd' tag even if parsing failed
+                let repo = Self::extract_identifier_from_event(event);
+                // Structured log for migration scripts
+                tracing::warn!(
+                    "[PARSE_FAIL] kind={} event_id={}... reason=\"{}\" repo={} npub={}",
+                    event.kind.as_u16(),
+                    event_id_short,
+                    reason,
+                    repo,
+                    npub
+                );
                 WritePolicyResult::reject(reason)
             }
         }
@@ -331,9 +437,12 @@ impl Nip34WritePolicy {
                 );
 
                 // Add to purgatory
-                self.ctx
-                    .purgatory
-                    .add_pr(event.clone(), event.id.to_hex(), commit.clone());
+                self.ctx.purgatory.add_pr(
+                    event.clone(),
+                    event.id.to_hex(),
+                    commit.clone(),
+                    is_synced,
+                );
 
                 WritePolicyResult::Reject {
                     status: true, // Client sees OK
@@ -351,11 +460,25 @@ impl Nip34WritePolicy {
             }
             Err(e) => {
                 // Error checking git data - reject event
-                tracing::warn!(
-                    "Failed to check git data for PR event {}: {}",
-                    event_id_str,
-                    e
-                );
+                let npub = event
+                    .pubkey
+                    .to_bech32()
+                    .unwrap_or_else(|_| event.pubkey.to_hex());
+                let event_id_short = &event.id.to_hex()[..12];
+                // Extract ALL repo identifiers from 'a' tags for PR events
+                // (PR events can reference multiple repos when there are multiple maintainers)
+                let repos = Self::extract_repos_from_pr_event(event);
+                // Structured log for migration scripts - log once per repo
+                for repo in &repos {
+                    tracing::warn!(
+                        "[PARSE_FAIL] kind={} event_id={}... reason=\"git data check failed: {}\" repo={} npub={}",
+                        event.kind.as_u16(),
+                        event_id_short,
+                        e,
+                        repo,
+                        npub
+                    );
+                }
                 WritePolicyResult::reject(format!("Failed to check git data: {}", e))
             }
         }
@@ -462,9 +585,11 @@ impl Nip34WritePolicy {
                 let (addressable_refs, event_refs) =
                     RelatedEventPolicy::extract_reference_tags(event);
                 tracing::info!(
-                    "Rejected orphan {} event {}: no references to accepted repos or events (checked {} addressable, {} event refs)",
+                    "Rejected orphan {} event {} (kind={}, pubkey={}): no references to accepted repos or events (checked {} addressable, {} event refs)",
                     event_type,
-                    event_id_str,
+                    event.id.to_hex(),
+                    event.kind.as_u16(),
+                    event.pubkey.to_hex(),
                     addressable_refs.len(),
                     event_refs.len()
                 );
diff --git a/src/nostr/events.rs b/src/nostr/events.rs
index b9784f7..a441742 100644
--- a/src/nostr/events.rs
+++ b/src/nostr/events.rs
@@ -424,7 +424,7 @@ pub fn validate_announcement(
         {
             return AnnouncementResult::Reject(format!(
                 "Announcement lists service but does not match repository whitelist. \
-                     Repository {}/{} not in whitelist",
+                 Repository {}/{} not in whitelist",
                 npub, announcement.identifier
             ));
         }
diff --git a/src/nostr/policy/state.rs b/src/nostr/policy/state.rs
index e6de54e..df743ae 100644
--- a/src/nostr/policy/state.rs
+++ b/src/nostr/policy/state.rs
@@ -276,9 +276,12 @@ impl StatePolicy {
 
             // If no git data - add to purgatory
             // (add_state automatically enqueues for background sync)
-            self.ctx
-                .purgatory
-                .add_state(event.clone(), state.identifier.clone(), event.pubkey);
+            self.ctx.purgatory.add_state(
+                event.clone(),
+                state.identifier.clone(),
+                event.pubkey,
+                is_synced,
+            );
 
             tracing::info!(
                 "state event added to purgatory: eventid: {}, identifier: {}",
diff --git a/src/purgatory/helpers.rs b/src/purgatory/helpers.rs
index 193ef99..a9f6e66 100644
--- a/src/purgatory/helpers.rs
+++ b/src/purgatory/helpers.rs
@@ -225,6 +225,117 @@ pub fn get_unpushed_refs(event: &Event, pushed_refs: &[RefPair]) -> Vec<RefPair>
         .collect()
 }
 
+/// Diagnose why a state event doesn't match the push.
+///
+/// Returns a human-readable explanation of the mismatch between the state event
+/// and what would result from applying the push to local refs.
+///
+/// # Arguments
+/// * `event` - The state event to check
+/// * `pushed_updates` - Ref updates in the current push operation
+/// * `local_refs` - Refs already existing locally (ref_name -> SHA)
+///
+/// # Returns
+/// String explaining why the state doesn't match, or None if it matches
+pub fn diagnose_state_mismatch(
+    event: &Event,
+    pushed_updates: &[RefUpdate],
+    local_refs: &HashMap<String, String>,
+) -> Option<String> {
+    let state_refs = extract_refs_from_state(event);
+
+    // Filter local_refs to only branches and tags
+    let mut would_be_state: HashMap<String, String> = local_refs
+        .iter()
+        .filter(|(ref_name, _)| {
+            ref_name.starts_with("refs/heads/") || ref_name.starts_with("refs/tags/")
+        })
+        .map(|(k, v)| (k.clone(), v.clone()))
+        .collect();
+
+    // Apply all pushed updates to create the would-be state
+    for update in pushed_updates {
+        // Only process branches and tags
+        if !update.ref_name.starts_with("refs/heads/") && !update.ref_name.starts_with("refs/tags/")
+        {
+            continue;
+        }
+
+        if update.is_deletion() {
+            would_be_state.remove(&update.ref_name);
+        } else {
+            would_be_state.insert(update.ref_name.clone(), update.new_oid.clone());
+        }
+    }
+
+    // Convert event's state refs to a HashMap for comparison
+    let declared_state: HashMap<String, String> = state_refs
+        .into_iter()
+        .map(|r| (r.ref_name, r.object_sha))
+        .collect();
+
+    // Check if they match
+    if would_be_state == declared_state {
+        return None; // No mismatch
+    }
+
+    // Build diagnostic message
+    let mut reasons = Vec::new();
+
+    // Check for refs in declared state but not in would-be state
+    for (ref_name, declared_sha) in &declared_state {
+        if let Some(would_be_sha) = would_be_state.get(ref_name) {
+            if would_be_sha != declared_sha {
+                let would_be_short = if would_be_sha.len() >= 8 {
+                    &would_be_sha[..8]
+                } else {
+                    would_be_sha.as_str()
+                };
+                let declared_short = if declared_sha.len() >= 8 {
+                    &declared_sha[..8]
+                } else {
+                    declared_sha.as_str()
+                };
+                reasons.push(format!(
+                    "{} would be at {} but state declares {}",
+                    ref_name, would_be_short, declared_short
+                ));
+            }
+        } else {
+            let declared_short = if declared_sha.len() >= 8 {
+                &declared_sha[..8]
+            } else {
+                declared_sha.as_str()
+            };
+            reasons.push(format!(
+                "{} missing (state declares {})",
+                ref_name, declared_short
+            ));
+        }
+    }
+
+    // Check for refs in would-be state but not in declared state
+    for (ref_name, would_be_sha) in &would_be_state {
+        if !declared_state.contains_key(ref_name) {
+            let would_be_short = if would_be_sha.len() >= 8 {
+                &would_be_sha[..8]
+            } else {
+                would_be_sha.as_str()
+            };
+            reasons.push(format!(
+                "{} would exist at {} but state doesn't declare it",
+                ref_name, would_be_short
+            ));
+        }
+    }
+
+    if reasons.is_empty() {
+        Some("Unknown mismatch".to_string())
+    } else {
+        Some(reasons.join("; "))
+    }
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -695,4 +806,97 @@ mod tests {
         // Should return true - real OID exists, symbolic ref skipped
         assert!(can_apply_state(&event, repo_path));
     }
+
+    #[test]
+    fn test_diagnose_state_mismatch_missing_ref() {
+        // State declares both main and test branches
+        let event = create_test_state_event(
+            "test-repo",
+            vec![("refs/heads/main", "abc123"), ("refs/heads/test", "def456")],
+        );
+
+        // Push only creates test branch
+        let pushed_updates = vec![RefUpdate {
+            old_oid: "0000000000000000000000000000000000000000".to_string(),
+            new_oid: "def456".to_string(),
+            ref_name: "refs/heads/test".to_string(),
+        }];
+
+        // No local refs
+        let local_refs = HashMap::new();
+
+        let diagnosis = diagnose_state_mismatch(&event, &pushed_updates, &local_refs);
+        assert!(diagnosis.is_some());
+        let msg = diagnosis.unwrap();
+        assert!(msg.contains("refs/heads/main"));
+        assert!(msg.contains("missing"));
+    }
+
+    #[test]
+    fn test_diagnose_state_mismatch_wrong_sha() {
+        // State declares main at abc123
+        let event = create_test_state_event("test-repo", vec![("refs/heads/main", "abc123")]);
+
+        // Push updates main to different SHA
+        let pushed_updates = vec![RefUpdate {
+            old_oid: "0000000000000000000000000000000000000000".to_string(),
+            new_oid: "wrong123".to_string(),
+            ref_name: "refs/heads/main".to_string(),
+        }];
+
+        let local_refs = HashMap::new();
+
+        let diagnosis = diagnose_state_mismatch(&event, &pushed_updates, &local_refs);
+        assert!(diagnosis.is_some());
+        let msg = diagnosis.unwrap();
+        assert!(msg.contains("refs/heads/main"));
+        assert!(msg.contains("would be at"));
+        assert!(msg.contains("state declares"));
+    }
+
+    #[test]
+    fn test_diagnose_state_mismatch_extra_ref() {
+        // State declares only main
+        let event = create_test_state_event("test-repo", vec![("refs/heads/main", "abc123")]);
+
+        // Push creates both main and test
+        let pushed_updates = vec![
+            RefUpdate {
+                old_oid: "0000000000000000000000000000000000000000".to_string(),
+                new_oid: "abc123".to_string(),
+                ref_name: "refs/heads/main".to_string(),
+            },
+            RefUpdate {
+                old_oid: "0000000000000000000000000000000000000000".to_string(),
+                new_oid: "def456".to_string(),
+                ref_name: "refs/heads/test".to_string(),
+            },
+        ];
+
+        let local_refs = HashMap::new();
+
+        let diagnosis = diagnose_state_mismatch(&event, &pushed_updates, &local_refs);
+        assert!(diagnosis.is_some());
+        let msg = diagnosis.unwrap();
+        assert!(msg.contains("refs/heads/test"));
+        assert!(msg.contains("doesn't declare"));
+    }
+
+    #[test]
+    fn test_diagnose_state_mismatch_no_mismatch() {
+        // State declares main
+        let event = create_test_state_event("test-repo", vec![("refs/heads/main", "abc123")]);
+
+        // Push creates main at correct SHA
+        let pushed_updates = vec![RefUpdate {
+            old_oid: "0000000000000000000000000000000000000000".to_string(),
+            new_oid: "abc123".to_string(),
+            ref_name: "refs/heads/main".to_string(),
+        }];
+
+        let local_refs = HashMap::new();
+
+        let diagnosis = diagnose_state_mismatch(&event, &pushed_updates, &local_refs);
+        assert!(diagnosis.is_none()); // No mismatch
+    }
 }
diff --git a/src/purgatory/mod.rs b/src/purgatory/mod.rs
index 9a63bf6..bb6ff54 100644
--- a/src/purgatory/mod.rs
+++ b/src/purgatory/mod.rs
@@ -16,11 +16,12 @@ pub mod persistence;
 pub mod sync;
 mod types;
 
-pub use helpers::{can_apply_state, can_satisfy_state, extract_refs_from_state, get_unpushed_refs};
-pub use types::{AnnouncementPurgatoryEntry, PrPurgatoryEntry, RefPair, RefUpdate, StatePurgatoryEntry};
+pub use helpers::{can_apply_state, can_satisfy_state, diagnose_state_mismatch, extract_refs_from_state, get_unpushed_refs};
+pub use types::{AnnouncementPurgatoryEntry, EventSource, PrPurgatoryEntry, RefPair, RefUpdate, StatePurgatoryEntry};
 
 use dashmap::DashMap;
 use nostr_sdk::prelude::*;
+use nostr_sdk::ToBech32;
 use serde::{Deserialize, Serialize};
 use std::collections::HashMap;
 use std::collections::HashSet;
@@ -64,6 +65,9 @@ struct SerializableStatePurgatoryEntry {
     created_at_offset_secs: u64,
     /// Duration offset from saved_at for expires_at
     expires_at_offset_secs: u64,
+    /// Source of this event (direct submission vs sync)
+    #[serde(default)]
+    source: types::EventSource,
 }
 
 /// Serializable wrapper for `PrPurgatoryEntry` with time offsets.
@@ -81,6 +85,9 @@ struct SerializablePrPurgatoryEntry {
     created_at_offset_secs: u64,
     /// Duration offset from saved_at for expires_at
     expires_at_offset_secs: u64,
+    /// Source of this event (direct submission vs sync)
+    #[serde(default)]
+    source: types::EventSource,
 }
 
 /// Serializable wrapper for `AnnouncementPurgatoryEntry` with time offsets.
@@ -313,11 +320,38 @@ impl Purgatory {
     /// For sync-triggered events, the SyncManager calls `enqueue_sync_immediate` separately
     /// to override this delay.
     ///
+    /// If an event already exists in purgatory with `Sync` source and the new submission
+    /// is direct (`!from_sync`), the source is upgraded to `Direct` without extending expiry.
+    ///
     /// # Arguments
     /// * `event` - The state event (kind 30618) to hold
     /// * `identifier` - The repository identifier from the 'd' tag
     /// * `author` - The event author's public key
-    pub fn add_state(&self, event: Event, identifier: String, author: PublicKey) {
+    /// * `from_sync` - True if this event came from proactive sync (vs user-submitted)
+    pub fn add_state(&self, event: Event, identifier: String, author: PublicKey, from_sync: bool) {
+        let source = if from_sync {
+            types::EventSource::Sync
+        } else {
+            types::EventSource::Direct
+        };
+
+        // Check if event already exists - if so, potentially upgrade source
+        if let Some(mut entries) = self.state_events.get_mut(&identifier) {
+            if let Some(existing) = entries.iter_mut().find(|e| e.event.id == event.id) {
+                // Upgrade source from Sync to Direct if new submission is direct
+                if existing.source == types::EventSource::Sync && !from_sync {
+                    existing.source = types::EventSource::Direct;
+                    existing.expires_at = Instant::now() + DEFAULT_EXPIRY;
+                    tracing::debug!(
+                        event_id = %event.id,
+                        identifier = %identifier,
+                        "Upgraded purgatory entry source from Sync to Direct, reset expiry"
+                    );
+                }
+                return; // Event already exists, don't add duplicate
+            }
+        }
+
         let now = Instant::now();
         let entry = StatePurgatoryEntry {
             event,
@@ -325,6 +359,7 @@ impl Purgatory {
             author,
             created_at: now,
             expires_at: now + DEFAULT_EXPIRY,
+            source,
         };
 
         self.state_events
@@ -344,11 +379,35 @@ impl Purgatory {
     /// Automatically enqueues the referenced repository identifier for background sync
     /// with the default delay (3 minutes), giving time for a git push to arrive.
     ///
+    /// If an event already exists in purgatory with `Sync` source and the new submission
+    /// is direct (`!from_sync`), the source is upgraded to `Direct` without extending expiry.
+    ///
     /// # Arguments
     /// * `event` - The PR event (kind 1617/1618) to hold
     /// * `event_id` - The event ID (hex string) from the 'e' tag
     /// * `commit` - The commit SHA from the 'c' tag
-    pub fn add_pr(&self, event: Event, event_id: String, commit: String) {
+    /// * `from_sync` - True if this event came from proactive sync (vs user-submitted)
+    pub fn add_pr(&self, event: Event, event_id: String, commit: String, from_sync: bool) {
+        let source = if from_sync {
+            types::EventSource::Sync
+        } else {
+            types::EventSource::Direct
+        };
+
+        // Check if event already exists - if so, potentially upgrade source
+        if let Some(mut existing) = self.pr_events.get_mut(&event_id) {
+            // Upgrade source from Sync to Direct if new submission is direct
+            if existing.source == types::EventSource::Sync && !from_sync {
+                existing.source = types::EventSource::Direct;
+                existing.expires_at = Instant::now() + DEFAULT_EXPIRY;
+                tracing::debug!(
+                    event_id = %event_id,
+                    "Upgraded PR purgatory entry source from Sync to Direct, reset expiry"
+                );
+            }
+            return; // Event already exists, don't add duplicate
+        }
+
         // Extract identifier from the event's `a` tag for sync enqueueing
         let identifier = crate::git::sync::extract_identifier_from_pr_event(&event);
 
@@ -358,6 +417,7 @@ impl Purgatory {
             commit,
             created_at: now,
             expires_at: now + DEFAULT_EXPIRY,
+            source,
         };
 
         self.pr_events.insert(event_id, entry);
@@ -371,6 +431,8 @@ impl Purgatory {
     /// Add a PR placeholder (git data arrived before PR event).
     ///
     /// Creates a placeholder entry waiting for the corresponding PR event.
+    /// Placeholders are always marked as `Direct` source since they originate
+    /// from git pushes (direct user action).
     ///
     /// # Arguments
     /// * `event_id` - The expected event ID (from git ref name)
@@ -382,6 +444,7 @@ impl Purgatory {
             commit,
             created_at: now,
             expires_at: now + DEFAULT_EXPIRY,
+            source: types::EventSource::Direct, // Git pushes are direct user actions
         };
 
         self.pr_events.insert(event_id, entry);
@@ -892,6 +955,9 @@ impl Purgatory {
     /// prevent infinite re-sync loops. Events that expire without finding git data
     /// will be filtered out during future negentropy/REQ sync operations.
     ///
+    /// Emits structured `[PURGATORY_EXPIRED]` log entries for each expired event
+    /// to support migration scripts and operational monitoring.
+    ///
     /// # Returns
     /// Tuple of (num_announcement_removed, num_state_removed, num_pr_removed)
     pub fn cleanup(&self) -> (usize, usize, usize) {
@@ -976,18 +1042,38 @@ impl Purgatory {
         let mut state_removed = 0;
 
         // Remove expired state events and mark them as expired
-        self.state_events.retain(|_, entries| {
+        self.state_events.retain(|identifier, entries| {
             let original_len = entries.len();
-            // Collect event IDs before removing
-            let expired_ids: Vec<EventId> = entries
-                .iter()
-                .filter(|entry| entry.expires_at <= now)
-                .map(|entry| entry.event.id)
-                .collect();
 
-            // Mark as expired to prevent re-sync
-            for event_id in expired_ids {
-                self.mark_expired(event_id);
+            // Log and collect expired entries before removing
+            for entry in entries.iter().filter(|e| e.expires_at <= now) {
+                let npub = entry.author.to_bech32().unwrap_or_else(|_| entry.author.to_hex());
+                let event_id_short = &entry.event.id.to_hex()[..12];
+                let source_str = if entry.source.is_direct() { "direct" } else { "sync" };
+
+                // Structured log for migration scripts
+                // Direct submissions log at WARN, synced events at DEBUG
+                if entry.source.is_direct() {
+                    tracing::warn!(
+                        "[PURGATORY_EXPIRED] repo={} npub={} event_id={}... kind={} source={} reason=\"git data not received within 30 minutes\"",
+                        identifier,
+                        npub,
+                        event_id_short,
+                        entry.event.kind.as_u16(),
+                        source_str
+                    );
+                } else {
+                    tracing::debug!(
+                        "[PURGATORY_EXPIRED] repo={} npub={} event_id={}... kind={} source={} reason=\"git data not received within 30 minutes\"",
+                        identifier,
+                        npub,
+                        event_id_short,
+                        entry.event.kind.as_u16(),
+                        source_str
+                    );
+                }
+
+                self.mark_expired(entry.event.id);
             }
 
             // Remove expired entries
@@ -997,21 +1083,103 @@ impl Purgatory {
         });
 
         // Remove expired PR events and mark them as expired
-        let expired_prs: Vec<(String, Option<EventId>)> = self
+        let expired_prs: Vec<_> = self
             .pr_events
             .iter()
             .filter(|entry| entry.value().expires_at <= now)
             .map(|entry| {
-                let event_id = entry.value().event.as_ref().map(|e| e.id);
-                (entry.key().clone(), event_id)
+                let pr_entry = entry.value();
+                let event_id_str = entry.key().clone();
+                let event_opt = pr_entry.event.clone();
+                let commit = pr_entry.commit.clone();
+                let source = pr_entry.source;
+                (event_id_str, event_opt, commit, source)
             })
             .collect();
 
         let pr_removed = expired_prs.len();
-        for (event_id_str, event_id_opt) in expired_prs {
-            // Mark actual PR events as expired (not placeholders)
-            if let Some(event_id) = event_id_opt {
-                self.mark_expired(event_id);
+        for (event_id_str, event_opt, commit, source) in expired_prs {
+            // Log structured entry for PR events (not placeholders)
+            if let Some(ref event) = event_opt {
+                let npub = event
+                    .pubkey
+                    .to_bech32()
+                    .unwrap_or_else(|_| event.pubkey.to_hex());
+                let event_id_short = &event.id.to_hex()[..12];
+                let source_str = if source.is_direct() { "direct" } else { "sync" };
+
+                // Extract ALL repo identifiers from 'a' tags
+                // (PR events can reference multiple repos when there are multiple maintainers)
+                let repos: Vec<String> = event
+                    .tags
+                    .iter()
+                    .filter_map(|tag| {
+                        let tag_vec = tag.clone().to_vec();
+                        if tag_vec.len() >= 2
+                            && tag_vec[0] == "a"
+                            && tag_vec[1].starts_with("30617:")
+                        {
+                            // Format: 30617:<owner_pubkey>:<identifier>
+                            let parts: Vec<&str> = tag_vec[1].split(':').collect();
+                            if parts.len() >= 3 {
+                                Some(parts[2].to_string())
+                            } else {
+                                None
+                            }
+                        } else {
+                            None
+                        }
+                    })
+                    .collect();
+
+                // Deduplicate while preserving order
+                let mut seen = std::collections::HashSet::new();
+                let unique_repos: Vec<String> = repos
+                    .into_iter()
+                    .filter(|r| seen.insert(r.clone()))
+                    .collect();
+
+                let repos_to_log = if unique_repos.is_empty() {
+                    vec!["unknown".to_string()]
+                } else {
+                    unique_repos
+                };
+
+                // Structured log for migration scripts - log once per repo
+                // Direct submissions log at WARN, synced events at DEBUG
+                for repo in &repos_to_log {
+                    if source.is_direct() {
+                        tracing::warn!(
+                            "[PURGATORY_EXPIRED] repo={} npub={} event_id={}... kind={} commit={} source={} reason=\"git data not received within 30 minutes\"",
+                            repo,
+                            npub,
+                            event_id_short,
+                            event.kind.as_u16(),
+                            &commit[..commit.len().min(12)],
+                            source_str
+                        );
+                    } else {
+                        tracing::debug!(
+                            "[PURGATORY_EXPIRED] repo={} npub={} event_id={}... kind={} commit={} source={} reason=\"git data not received within 30 minutes\"",
+                            repo,
+                            npub,
+                            event_id_short,
+                            event.kind.as_u16(),
+                            &commit[..commit.len().min(12)],
+                            source_str
+                        );
+                    }
+                }
+
+                self.mark_expired(event.id);
+            } else {
+                // Placeholder (git data arrived first, but PR event never came)
+                // Placeholders are always Direct source (from git push)
+                tracing::debug!(
+                    "[PURGATORY_EXPIRED] placeholder event_id={} commit={} source=direct reason=\"PR event not received within 30 minutes\"",
+                    &event_id_str[..event_id_str.len().min(12)],
+                    &commit[..commit.len().min(12)]
+                );
             }
             self.pr_events.remove(&event_id_str);
         }
@@ -1191,6 +1359,7 @@ impl Purgatory {
                         author: e.author,
                         created_at_offset_secs: created_offset.as_secs(),
                         expires_at_offset_secs: expires_offset.as_secs(),
+                        source: e.source,
                     }
                 })
                 .collect();
@@ -1213,6 +1382,7 @@ impl Purgatory {
                 commit: e.commit.clone(),
                 created_at_offset_secs: created_offset.as_secs(),
                 expires_at_offset_secs: expires_offset.as_secs(),
+                source: e.source,
             };
             pr_events.insert(event_id, serializable);
         }
@@ -1355,6 +1525,7 @@ impl Purgatory {
                         author: e.author,
                         created_at,
                         expires_at,
+                        source: e.source,
                     }
                 })
                 .collect();
@@ -1380,6 +1551,7 @@ impl Purgatory {
                 commit: e.commit,
                 created_at,
                 expires_at,
+                source: e.source,
             };
 
             self.pr_events.insert(event_id, entry);
@@ -1439,8 +1611,18 @@ mod tests {
             .sign_with_keys(&keys)
             .unwrap();
 
-        purgatory.add_state(event.clone(), "test-repo".to_string(), keys.public_key());
-        purgatory.add_pr(event, "test-event-id".to_string(), "abc123".to_string());
+        purgatory.add_state(
+            event.clone(),
+            "test-repo".to_string(),
+            keys.public_key(),
+            false,
+        );
+        purgatory.add_pr(
+            event,
+            "test-event-id".to_string(),
+            "abc123".to_string(),
+            false,
+        );
 
         let (announcement_count, state_count, pr_count) = purgatory.count();
         assert_eq!(announcement_count, 0);
@@ -1492,7 +1674,7 @@ mod tests {
         let event = EventBuilder::text_note("state")
             .sign_with_keys(&keys)
             .unwrap();
-        purgatory.add_state(event, "test-repo".to_string(), keys.public_key());
+        purgatory.add_state(event, "test-repo".to_string(), keys.public_key(), false);
 
         // Now should have pending events
         assert!(purgatory.has_pending_events("test-repo"));
@@ -1522,7 +1704,12 @@ mod tests {
             .sign_with_keys(&keys)
             .unwrap();
 
-        purgatory.add_pr(event, "pr-event-id".to_string(), "commit123".to_string());
+        purgatory.add_pr(
+            event,
+            "pr-event-id".to_string(),
+            "commit123".to_string(),
+            false,
+        );
 
         // Now should have pending events for test-repo
         assert!(purgatory.has_pending_events("test-repo"));
@@ -1587,6 +1774,7 @@ fn test_pr_event_vs_placeholder() {
         event.clone(),
         "event-id-1".to_string(),
         "commit-abc".to_string(),
+        false,
     );
 
     // Add a placeholder (no event)
@@ -1643,8 +1831,14 @@ fn test_cleanup_removes_expired_entries() {
         state_event.clone(),
         "test-repo".to_string(),
         keys.public_key(),
+        false,
+    );
+    purgatory.add_pr(
+        pr_event,
+        "pr-123".to_string(),
+        "commit-abc".to_string(),
+        false,
     );
-    purgatory.add_pr(pr_event, "pr-123".to_string(), "commit-abc".to_string());
     purgatory.add_pr_placeholder("pr-456".to_string(), "commit-def".to_string());
 
     // Verify entries are there
@@ -1691,8 +1885,18 @@ fn test_cleanup_preserves_non_expired_entries() {
         .unwrap();
 
     // Add fresh entries
-    purgatory.add_state(state_event, "test-repo".to_string(), keys.public_key());
-    purgatory.add_pr(pr_event, "pr-123".to_string(), "commit-abc".to_string());
+    purgatory.add_state(
+        state_event,
+        "test-repo".to_string(),
+        keys.public_key(),
+        false,
+    );
+    purgatory.add_pr(
+        pr_event,
+        "pr-123".to_string(),
+        "commit-abc".to_string(),
+        false,
+    );
 
     // Run cleanup
     let (_, state_removed, pr_removed) = purgatory.cleanup();
@@ -1722,8 +1926,8 @@ fn test_cleanup_mixed_expired_and_fresh() {
         .sign_with_keys(&keys)
         .unwrap();
 
-    purgatory.add_state(event1, "test-repo".to_string(), keys.public_key());
-    purgatory.add_state(event2, "test-repo".to_string(), keys.public_key());
+    purgatory.add_state(event1, "test-repo".to_string(), keys.public_key(), false);
+    purgatory.add_state(event2, "test-repo".to_string(), keys.public_key(), false);
 
     // Expire only the first one
     if let Some(mut entries) = purgatory.state_events.get_mut("test-repo") {
@@ -1740,8 +1944,8 @@ fn test_cleanup_mixed_expired_and_fresh() {
         .sign_with_keys(&keys)
         .unwrap();
 
-    purgatory.add_pr(pr1, "pr-1".to_string(), "commit-1".to_string());
-    purgatory.add_pr(pr2, "pr-2".to_string(), "commit-2".to_string());
+    purgatory.add_pr(pr1, "pr-1".to_string(), "commit-1".to_string(), false);
+    purgatory.add_pr(pr2, "pr-2".to_string(), "commit-2".to_string(), false);
 
     // Expire only first PR
     if let Some(mut entry) = purgatory.pr_events.get_mut("pr-1") {
@@ -1773,8 +1977,8 @@ fn test_remove_expired_legacy_method() {
         .unwrap();
     let pr_event = EventBuilder::text_note("pr").sign_with_keys(&keys).unwrap();
 
-    purgatory.add_state(state_event, "repo".to_string(), keys.public_key());
-    purgatory.add_pr(pr_event, "pr-id".to_string(), "commit".to_string());
+    purgatory.add_state(state_event, "repo".to_string(), keys.public_key(), false);
+    purgatory.add_pr(pr_event, "pr-id".to_string(), "commit".to_string(), false);
 
     // Expire both
     if let Some(mut entries) = purgatory.state_events.get_mut("repo") {
@@ -1808,8 +2012,8 @@ fn test_expired_event_tracking() {
     let pr_event_id = pr_event.id;
 
     // Add events to purgatory
-    purgatory.add_state(state_event, "repo".to_string(), keys.public_key());
-    purgatory.add_pr(pr_event, "pr-id".to_string(), "commit".to_string());
+    purgatory.add_state(state_event, "repo".to_string(), keys.public_key(), false);
+    purgatory.add_pr(pr_event, "pr-id".to_string(), "commit".to_string(), false);
 
     // Events should not be marked as expired yet
     assert!(!purgatory.is_expired(&state_event_id));
@@ -1861,7 +2065,7 @@ fn test_cleanup_expired_events() {
     let event2_id = event2.id;
 
     // Add and immediately expire event1
-    purgatory.add_state(event1, "repo1".to_string(), keys.public_key());
+    purgatory.add_state(event1, "repo1".to_string(), keys.public_key(), false);
     if let Some(mut entries) = purgatory.state_events.get_mut("repo1") {
         for entry in entries.iter_mut() {
             entry.expires_at = Instant::now() - Duration::from_secs(1);
@@ -1870,7 +2074,7 @@ fn test_cleanup_expired_events() {
     purgatory.cleanup();
 
     // Add and expire event2 (will be more recent)
-    purgatory.add_state(event2, "repo2".to_string(), keys.public_key());
+    purgatory.add_state(event2, "repo2".to_string(), keys.public_key(), false);
     if let Some(mut entries) = purgatory.state_events.get_mut("repo2") {
         for entry in entries.iter_mut() {
             entry.expires_at = Instant::now() - Duration::from_secs(1);
@@ -1912,7 +2116,7 @@ fn test_expired_events_prevent_readdition() {
     let event_id = event.id;
 
     // Add event to purgatory
-    purgatory.add_state(event.clone(), "repo".to_string(), keys.public_key());
+    purgatory.add_state(event.clone(), "repo".to_string(), keys.public_key(), false);
 
     // Expire it
     if let Some(mut entries) = purgatory.state_events.get_mut("repo") {
@@ -1932,7 +2136,7 @@ fn test_expired_events_prevent_readdition() {
     // This simulates what negentropy/REQ+EOSE should do:
     // Check if event is in event_ids() before adding
     if !ids.contains(&event_id) {
-        purgatory.add_state(event, "repo".to_string(), keys.public_key());
+        purgatory.add_state(event, "repo".to_string(), keys.public_key(), false);
     }
 
     // Event should NOT be re-added
@@ -1975,7 +2179,7 @@ fn test_user_can_resubmit_expired_event() {
     let event_id = event.id;
 
     // Add event to purgatory
-    purgatory.add_state(event.clone(), "repo".to_string(), keys.public_key());
+    purgatory.add_state(event.clone(), "repo".to_string(), keys.public_key(), false);
 
     // Expire it
     if let Some(mut entries) = purgatory.state_events.get_mut("repo") {
@@ -2024,8 +2228,18 @@ async fn test_save_and_restore_state_events() {
     let event1_id = event1.id;
     let event2_id = event2.id;
 
-    purgatory.add_state(event1.clone(), "test-repo".to_string(), keys.public_key());
-    purgatory.add_state(event2.clone(), "test-repo".to_string(), keys.public_key());
+    purgatory.add_state(
+        event1.clone(),
+        "test-repo".to_string(),
+        keys.public_key(),
+        false,
+    );
+    purgatory.add_state(
+        event2.clone(),
+        "test-repo".to_string(),
+        keys.public_key(),
+        false,
+    );
 
     // Save to disk
     purgatory.save_to_disk(&state_file).unwrap();
@@ -2087,6 +2301,7 @@ async fn test_save_and_restore_pr_events() {
         pr_event.clone(),
         "pr-event-id".to_string(),
         "commit-abc".to_string(),
+        false,
     );
 
     // Save to disk
@@ -2156,7 +2371,7 @@ async fn test_save_and_restore_expired_events() {
     let event_id = event.id;
 
     // Add and expire event
-    purgatory.add_state(event, "repo".to_string(), keys.public_key());
+    purgatory.add_state(event, "repo".to_string(), keys.public_key(), false);
     if let Some(mut entries) = purgatory.state_events.get_mut("repo") {
         for entry in entries.iter_mut() {
             entry.expires_at = Instant::now() - Duration::from_secs(1);
@@ -2295,7 +2510,7 @@ async fn test_downtime_calculation() {
         .sign_with_keys(&keys)
         .unwrap();
 
-    purgatory.add_state(event.clone(), "repo".to_string(), keys.public_key());
+    purgatory.add_state(event.clone(), "repo".to_string(), keys.public_key(), false);
 
     // Get original expiry time
     let original_entries = purgatory.find_state("repo");
@@ -2351,7 +2566,7 @@ async fn test_expiry_times_preserved() {
         .sign_with_keys(&keys)
         .unwrap();
 
-    purgatory.add_state(event.clone(), "repo".to_string(), keys.public_key());
+    purgatory.add_state(event.clone(), "repo".to_string(), keys.public_key(), false);
 
     // Manually set expiry to a specific time in the future
     let custom_expiry = Instant::now() + Duration::from_secs(600); // 10 minutes
@@ -2410,16 +2625,19 @@ async fn test_multiple_state_events_same_identifier() {
         event1.clone(),
         "shared-repo".to_string(),
         keys1.public_key(),
+        false,
     );
     purgatory.add_state(
         event2.clone(),
         "shared-repo".to_string(),
         keys2.public_key(),
+        false,
     );
     purgatory.add_state(
         event3.clone(),
         "shared-repo".to_string(),
         keys3.public_key(),
+        false,
     );
 
     // Save to disk
@@ -2466,6 +2684,7 @@ async fn test_mixed_pr_events_and_placeholders() {
         pr_event.clone(),
         "pr-with-event".to_string(),
         "commit-abc".to_string(),
+        false,
     );
 
     // Add PR placeholder
@@ -2511,7 +2730,7 @@ async fn test_file_cleanup_after_successful_restore() {
     let event = EventBuilder::text_note("test")
         .sign_with_keys(&keys)
         .unwrap();
-    purgatory.add_state(event, "repo".to_string(), keys.public_key());
+    purgatory.add_state(event, "repo".to_string(), keys.public_key(), false);
 
     // Save to disk
     purgatory.save_to_disk(&state_file).unwrap();
@@ -2697,8 +2916,18 @@ async fn test_comprehensive_roundtrip() {
         .sign_with_keys(&keys2)
         .unwrap();
 
-    purgatory.add_state(state1.clone(), "repo1".to_string(), keys1.public_key());
-    purgatory.add_state(state2.clone(), "repo2".to_string(), keys2.public_key());
+    purgatory.add_state(
+        state1.clone(),
+        "repo1".to_string(),
+        keys1.public_key(),
+        false,
+    );
+    purgatory.add_state(
+        state2.clone(),
+        "repo2".to_string(),
+        keys2.public_key(),
+        false,
+    );
 
     // Add PR event
     let tags = vec![Tag::custom(
@@ -2709,7 +2938,12 @@ async fn test_comprehensive_roundtrip() {
         .tags(tags)
         .sign_with_keys(&keys1)
         .unwrap();
-    purgatory.add_pr(pr_event.clone(), "pr-1".to_string(), "commit-1".to_string());
+    purgatory.add_pr(
+        pr_event.clone(),
+        "pr-1".to_string(),
+        "commit-1".to_string(),
+        false,
+    );
 
     // Add PR placeholder
     purgatory.add_pr_placeholder("pr-2".to_string(), "commit-2".to_string());
@@ -2719,7 +2953,12 @@ async fn test_comprehensive_roundtrip() {
         .sign_with_keys(&keys1)
         .unwrap();
     let expired_id = expired_event.id;
-    purgatory.add_state(expired_event, "repo3".to_string(), keys1.public_key());
+    purgatory.add_state(
+        expired_event,
+        "repo3".to_string(),
+        keys1.public_key(),
+        false,
+    );
     if let Some(mut entries) = purgatory.state_events.get_mut("repo3") {
         for entry in entries.iter_mut() {
             entry.expires_at = Instant::now() - Duration::from_secs(1);
diff --git a/src/purgatory/sync/context.rs b/src/purgatory/sync/context.rs
index ece8cd6..8297515 100644
--- a/src/purgatory/sync/context.rs
+++ b/src/purgatory/sync/context.rs
@@ -375,94 +375,121 @@ impl SyncContext for RealSyncContext {
         let naughty_list = self.git_naughty_list.clone();
 
         tokio::task::spawn_blocking(move || -> Result<Vec<String>> {
-            // git fetch <remote> <sha1> <sha2> ... - fetch all OIDs with full history
-            let mut args = vec!["fetch", &url];
-            args.extend(missing_oids.iter().map(|s| s.as_str()));
-
-            let output = Command::new("git")
-                .args(&args)
-                .current_dir(&repo_path)
-                .output();
-
-            match output {
-                Ok(result) if result.status.success() => {
-                    // Count how many OIDs we now have
-                    let fetched: Vec<String> = missing_oids
-                        .iter()
-                        .filter(|oid| crate::git::oid_exists(&repo_path, oid))
-                        .cloned()
-                        .collect();
-
-                    debug!(fetched_count = fetched.len(), "Successfully fetched OIDs");
-
-                    Ok(fetched)
+            let mut remaining_oids = missing_oids.clone();
+            let mut missing_from_remote: Vec<String> = Vec::new();
+
+            // Retry loop: keep fetching until success or no OIDs left
+            loop {
+                if remaining_oids.is_empty() {
+                    // All OIDs were missing from remote
+                    debug!(
+                        url = %url,
+                        missing_count = missing_from_remote.len(),
+                        "All requested OIDs missing from remote"
+                    );
+                    return Ok(vec![]);
                 }
-                Ok(result) => {
-                    let stderr = String::from_utf8_lossy(&result.stderr);
-
-                    // Extract domain and classify error for naughty list
-                    if let Some(domain) = extract_domain(&url) {
-                        if let Some(category) = NaughtyListTracker::classify_error(&stderr) {
-                            let is_new = naughty_list.record(&domain, category, stderr.to_string());
-
-                            if is_new {
-                                tracing::warn!(
-                                    domain = %domain,
-                                    category = %category,
-                                    error = %stderr,
-                                    "Git remote domain added to naughty list"
-                                );
-                            } else {
-                                debug!(
-                                    domain = %domain,
-                                    category = %category,
-                                    "Git remote domain still on naughty list"
-                                );
-                            }
+
+                // git fetch <remote> <sha1> <sha2> ... - fetch all OIDs with full history
+                let mut args = vec!["fetch".to_string(), url.clone()];
+                args.extend(remaining_oids.iter().cloned());
+
+                let output = Command::new("git")
+                    .args(&args)
+                    .current_dir(&repo_path)
+                    .output();
+
+                match output {
+                    Ok(result) if result.status.success() => {
+                        // Fetch succeeded - count how many OIDs we now have
+                        let fetched: Vec<String> = missing_oids
+                            .iter()
+                            .filter(|oid| crate::git::oid_exists(&repo_path, oid))
+                            .cloned()
+                            .collect();
+
+                        if !missing_from_remote.is_empty() {
+                            debug!(
+                                url = %url,
+                                fetched_count = fetched.len(),
+                                missing_count = missing_from_remote.len(),
+                                missing_oids = ?missing_from_remote,
+                                "Fetch completed after retries - some OIDs were missing from remote"
+                            );
+                        } else {
+                            debug!(url = %url, fetched_count = fetched.len(), "Successfully fetched OIDs");
                         }
+
+                        return Ok(fetched);
                     }
+                    Ok(result) => {
+                        let stderr = String::from_utf8_lossy(&result.stderr);
 
-                    // Check for "not our ref" errors and provide a clearer error message
-                    let error_msg = if stderr.contains("upload-pack: not our ref") {
-                        // Parse out the missing OID from stderr (git only reports one at a time)
-                        let missing_oid = stderr
-                            .lines()
-                            .find_map(|line| {
+                        // Check for "not our ref" error - this is retryable
+                        if stderr.contains("upload-pack: not our ref") {
+                            // Parse out the missing OID from stderr
+                            let missing_oid = stderr.lines().find_map(|line| {
                                 if line.contains("not our ref") {
                                     // Extract the OID from lines like:
                                     // "fatal: remote error: upload-pack: not our ref <oid>"
-                                    line.split("not our ref").nth(1).map(|s| s.trim().to_string())
+                                    line.split("not our ref")
+                                        .nth(1)
+                                        .map(|s| s.trim().to_string())
                                 } else {
                                     None
                                 }
                             });
 
-                        let total_requested = missing_oids.len();
+                            if let Some(ref oid) = missing_oid {
+                                // Remove the missing OID and retry with remaining
+                                remaining_oids.retain(|o| o != oid);
+                                missing_from_remote.push(oid.clone());
 
-                        if let Some(oid) = missing_oid {
-                            if total_requested > 1 {
-                                // BUG: Git stops at first missing OID, so we don't know if the others exist
-                                // We need retry logic to fetch remaining OIDs individually
-                                tracing::warn!(
+                                debug!(
                                     url = %url,
                                     missing_oid = %oid,
-                                    total_requested = total_requested,
-                                    "Git fetch failed on first missing OID - other requested OIDs may exist but were not fetched. Retry logic needed."
+                                    remaining_count = remaining_oids.len(),
+                                    "OID not found on remote, retrying with remaining OIDs"
                                 );
-                                format!("remote missing oid {} (BUG: {} other oids not attempted)", oid, total_requested - 1)
-                            } else {
-                                format!("remote missing only oid requested: {}", oid)
+
+                                continue; // Retry with remaining OIDs
+                            }
+                        }
+
+                        // Non-retryable error - record to naughty list and return error
+                        if let Some(domain) = extract_domain(&url) {
+                            if let Some(category) = NaughtyListTracker::classify_error(&stderr) {
+                                let is_new =
+                                    naughty_list.record(&domain, category, stderr.to_string());
+
+                                if is_new {
+                                    tracing::warn!(
+                                        domain = %domain,
+                                        category = %category,
+                                        error = %stderr,
+                                        "Git remote domain added to naughty list"
+                                    );
+                                } else {
+                                    debug!(
+                                        domain = %domain,
+                                        category = %category,
+                                        error = %stderr,
+                                        "Git fetch failed (domain on naughty list)"
+                                    );
+                                }
                             }
-                        } else {
-                            format!("git fetch failed: {}", stderr)
                         }
-                    } else {
-                        format!("git fetch failed: {}", stderr)
-                    };
 
-                    Err(anyhow::anyhow!("{}", error_msg))
+                        return Err(anyhow::anyhow!("git fetch failed for {}: {}", url, stderr));
+                    }
+                    Err(e) => {
+                        return Err(anyhow::anyhow!(
+                            "git fetch command error for {}: {}",
+                            url,
+                            e
+                        ))
+                    }
                 }
-                Err(e) => Err(anyhow::anyhow!("git fetch command error: {}", e)),
             }
         })
         .await
diff --git a/src/purgatory/sync/functions.rs b/src/purgatory/sync/functions.rs
index 65d29af..9207d58 100644
--- a/src/purgatory/sync/functions.rs
+++ b/src/purgatory/sync/functions.rs
@@ -368,15 +368,23 @@ pub async fn sync_identifier_from_url<C: SyncContext + ?Sized>(
     let fetch_result = ctx.fetch_oids(&target_repo, url, &needed_oids).await;
     throttle_manager.complete_request(&domain);
 
-    let oids_fetched = match fetch_result {
-        Ok(fetched) => {
+    let fetched_oids = match fetch_result {
+        Ok(fetched) if !fetched.is_empty() => {
             debug!(
                 identifier = %identifier,
                 url = %url,
                 oids_fetched = fetched.len(),
                 "Fetch succeeded"
             );
-            fetched.len()
+            fetched
+        }
+        Ok(_) => {
+            debug!(
+                identifier = %identifier,
+                url = %url,
+                "Fetch returned no OIDs (not available on remote)"
+            );
+            vec![]
         }
         Err(e) => {
             debug!(
@@ -385,13 +393,13 @@ pub async fn sync_identifier_from_url<C: SyncContext + ?Sized>(
                 error = %e,
                 "Fetch failed"
             );
-            0
+            vec![]
         }
     };
 
     // Try to process any events that can now be satisfied
-    if oids_fetched > 0 {
-        let new_oids: HashSet<String> = needed_oids.into_iter().collect();
+    if !fetched_oids.is_empty() {
+        let new_oids: HashSet<String> = fetched_oids.iter().cloned().collect();
         if let Err(e) = ctx
             .process_newly_available_git_data(&target_repo, &new_oids)
             .await
@@ -404,7 +412,7 @@ pub async fn sync_identifier_from_url<C: SyncContext + ?Sized>(
         }
     }
 
-    oids_fetched
+    fetched_oids.len()
 }
 
 /// Sync git data for an identifier.
diff --git a/src/purgatory/types.rs b/src/purgatory/types.rs
index d891bc9..1af5c4e 100644
--- a/src/purgatory/types.rs
+++ b/src/purgatory/types.rs
@@ -10,6 +10,28 @@ use std::collections::HashSet;
 use std::path::PathBuf;
 use std::time::Instant;
 
+/// Source of an event entering purgatory.
+///
+/// Tracks whether an event was submitted directly by a user or fetched via
+/// proactive sync from another relay. This distinction is used for:
+/// - Filtered logging: Direct submissions log at WARN level, synced at DEBUG
+/// - Operational monitoring: Helps identify user-facing issues vs sync noise
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize, Default)]
+pub enum EventSource {
+    /// Event was published directly to this relay by a user
+    #[default]
+    Direct,
+    /// Event was fetched via proactive sync from another relay
+    Sync,
+}
+
+impl EventSource {
+    /// Returns true if this is a direct submission (not synced)
+    pub fn is_direct(&self) -> bool {
+        matches!(self, EventSource::Direct)
+    }
+}
+
 /// Default value for Instant fields during deserialization
 fn instant_now() -> Instant {
     Instant::now()
@@ -88,6 +110,10 @@ pub struct StatePurgatoryEntry {
     /// Expiry deadline (30 min from creation, may be extended)
     #[serde(skip, default = "instant_now")]
     pub expires_at: Instant,
+
+    /// Source of this event (direct submission vs sync)
+    #[serde(default)]
+    pub source: EventSource,
 }
 
 /// Entry for a PR event (kind 1617/1618) or placeholder waiting in purgatory.
@@ -114,6 +140,10 @@ pub struct PrPurgatoryEntry {
     /// Expiry deadline (30 min from creation, may be extended)
     #[serde(skip, default = "instant_now")]
     pub expires_at: Instant,
+
+    /// Source of this event (direct submission vs sync)
+    #[serde(default)]
+    pub source: EventSource,
 }
 
 /// Entry for a repository announcement (kind 30617) waiting in purgatory.
diff --git a/src/sync/mod.rs b/src/sync/mod.rs
index 44efbf0..cd62380 100644
--- a/src/sync/mod.rs
+++ b/src/sync/mod.rs
@@ -1512,6 +1512,7 @@ impl SyncManager {
             self.service_domain.clone(),
             Arc::clone(&self.repo_sync_index),
             action_tx,
+            self.database.clone(),
         );
         let subscriber_shutdown = shutdown_tx.subscribe();
         tokio::spawn(async move { self_subscriber.run(Some(subscriber_shutdown)).await });
@@ -2969,6 +2970,7 @@ impl SyncManager {
                                     event_id = %event.id,
                                     kind = %event.kind.as_u16(),
                                     identifier = %identifier,
+                                    pubkey = %event.pubkey,
                                     "Added rejected announcement to two-tier index"
                                 );
                             }
diff --git a/src/sync/naughty_list.rs b/src/sync/naughty_list.rs
index 35fcc0f..0abb986 100644
--- a/src/sync/naughty_list.rs
+++ b/src/sync/naughty_list.rs
@@ -101,6 +101,69 @@ impl NaughtyListTracker {
         Self::new(12)
     }
 
+    /// Strip URLs from an error message to prevent false positives from URL components.
+    ///
+    /// URLs can contain path components, repository names, or user identifiers that
+    /// accidentally match error patterns (e.g., "my-openssl-project", "ssl-team",
+    /// "certificate-manager"). By stripping URLs before classification, we ensure
+    /// only the actual error message text is analyzed.
+    ///
+    /// Handles: http://, https://, git://, ws://, wss://
+    fn strip_urls(error: &str) -> String {
+        let mut result = String::with_capacity(error.len());
+        let mut chars = error.chars().peekable();
+
+        while let Some(c) = chars.next() {
+            // Check for URL start patterns
+            let potential_url = match c {
+                'h' => {
+                    // Check for http:// or https://
+                    let rest: String = chars.clone().take(7).collect();
+                    rest.starts_with("ttp://") || rest.starts_with("ttps://")
+                }
+                'g' => {
+                    // Check for git://
+                    let rest: String = chars.clone().take(5).collect();
+                    rest.starts_with("it://")
+                }
+                'w' => {
+                    // Check for ws:// or wss://
+                    let rest: String = chars.clone().take(5).collect();
+                    rest.starts_with("s://") || rest.starts_with("ss://")
+                }
+                _ => false,
+            };
+
+            if potential_url {
+                // Found URL start, consume until URL end
+                result.push_str("[URL]");
+
+                // Skip until we hit a URL terminator
+                loop {
+                    match chars.peek() {
+                        Some(&ch) if Self::is_url_char(ch) => {
+                            chars.next();
+                        }
+                        _ => break,
+                    }
+                }
+            } else {
+                result.push(c);
+            }
+        }
+
+        result
+    }
+
+    /// Check if a character can be part of a URL
+    #[inline]
+    fn is_url_char(c: char) -> bool {
+        // URLs end at whitespace, quotes, or certain brackets
+        // This is conservative - real URLs can contain more, but git errors
+        // typically have URLs followed by these terminators
+        !matches!(c, ' ' | '\t' | '\n' | '\r' | '"' | '\'' | '>' | ']' | ')')
+    }
+
     /// Classify an error string into a naughty category or return None for transient errors
     ///
     /// # Arguments
@@ -112,21 +175,56 @@ impl NaughtyListTracker {
     /// - `Some(NaughtyCategory)` if the error indicates a persistent infrastructure issue
     /// - `None` if the error is a transient network issue (use HealthTracker backoff)
     pub fn classify_error(error: &str) -> Option<NaughtyCategory> {
-        let error_lower = error.to_lowercase();
+        // Filter out remote warnings - these are informational messages from the remote
+        // server that don't indicate infrastructure problems with the domain itself.
+        // Example: "remote: warning: unable to access '/root/.config/git/attributes': Permission denied"
+        // These warnings are about the remote server's internal configuration, not connectivity.
+        let filtered_error: String = error
+            .lines()
+            .filter(|line| {
+                let line_lower = line.to_lowercase();
+                // Keep lines that are NOT remote warnings
+                !(line_lower.starts_with("remote: warning:")
+                    || line_lower.starts_with("warning: remote"))
+            })
+            .collect::<Vec<_>>()
+            .join("\n");
+
+        // If after filtering we have no content, this was just warnings - not a real error
+        if filtered_error.trim().is_empty() {
+            return None;
+        }
+
+        // Strip URLs to prevent false positives from URL components
+        // (e.g., repository named "openssl-test" or path containing "certificate")
+        let url_stripped = Self::strip_urls(&filtered_error);
+        let error_lower = url_stripped.to_lowercase();
 
         // DNS lookup failures
         if error_lower.contains("failed to lookup address")
             || error_lower.contains("name or service not known")
             || error_lower.contains("nodename nor servname provided")
-            || (error_lower.contains("dns") && !error_lower.contains("timeout"))
+            || error_lower.contains("dns error")
+            || error_lower.contains("dns lookup")
+            || error_lower.contains("dns resolution")
+            || error_lower.contains("getaddrinfo")
         {
             return Some(NaughtyCategory::DnsLookupFailed);
         }
 
         // TLS certificate errors
         if error_lower.contains("certificate")
-            || error_lower.contains("ssl")
-            || error_lower.contains("tls")
+            || error_lower.contains("ssl error")
+            || error_lower.contains("ssl certificate")
+            || error_lower.contains("ssl handshake")
+            || error_lower.contains("ssl_error")
+            || error_lower.contains("tls error")
+            || error_lower.contains("tls handshake")
+            || error_lower.contains("tls alert")
+            || error_lower.contains("tls_error")
+            || error_lower.contains("openssl")
+            || error_lower.contains("schannel")
+            || error_lower.contains("secure channel")
         {
             // Exclude timeout errors that mention TLS
             if !error_lower.contains("timeout") && !error_lower.contains("timed out") {
@@ -134,12 +232,12 @@ impl NaughtyListTracker {
             }
         }
 
-        // Protocol errors
-        if error_lower.contains("websocket")
-            || error_lower.contains("protocol")
-            || error_lower.contains("invalid frame")
-        {
-            // Exclude connection errors
+        // Protocol errors - specifically WebSocket/Nostr protocol violations
+        // Note: We check for "websocket" specifically, NOT generic "protocol" keyword
+        // because git errors often contain "protocol error" (e.g., "fatal: protocol error: bad line length")
+        // which are transient network issues, not persistent infrastructure problems.
+        if error_lower.contains("websocket") || error_lower.contains("invalid frame") {
+            // Exclude connection errors (transient)
             if !error_lower.contains("connection")
                 && !error_lower.contains("timeout")
                 && !error_lower.contains("refused")
@@ -290,183 +388,216 @@ impl NaughtyListTracker {
 mod tests {
     use super::*;
 
+    // =========================================================================
+    // URL STRIPPING TESTS
+    // =========================================================================
+
     #[test]
-    fn test_classify_dns_errors() {
-        assert_eq!(
-            NaughtyListTracker::classify_error("failed to lookup address information"),
-            Some(NaughtyCategory::DnsLookupFailed)
-        );
+    fn test_strip_urls_basic_protocols() {
+        // HTTP/HTTPS
         assert_eq!(
-            NaughtyListTracker::classify_error("Name or service not known"),
-            Some(NaughtyCategory::DnsLookupFailed)
-        );
-        assert_eq!(
-            NaughtyListTracker::classify_error("nodename nor servname provided"),
-            Some(NaughtyCategory::DnsLookupFailed)
+            NaughtyListTracker::strip_urls("error: https://example.com/repo.git failed"),
+            "error: [URL] failed"
         );
         assert_eq!(
-            NaughtyListTracker::classify_error("dns error: NXDOMAIN"),
-            Some(NaughtyCategory::DnsLookupFailed)
+            NaughtyListTracker::strip_urls("error: http://example.com/path failed"),
+            "error: [URL] failed"
         );
-    }
 
-    #[test]
-    fn test_classify_tls_errors() {
+        // Git protocol
         assert_eq!(
-            NaughtyListTracker::classify_error("certificate not valid for 'example.com'"),
-            Some(NaughtyCategory::TlsCertificateInvalid)
+            NaughtyListTracker::strip_urls("fatal: git://github.com/user/repo.git not found"),
+            "fatal: [URL] not found"
         );
+
+        // WebSocket protocols (used for relay URLs)
         assert_eq!(
-            NaughtyListTracker::classify_error("SSL certificate problem"),
-            Some(NaughtyCategory::TlsCertificateInvalid)
+            NaughtyListTracker::strip_urls("error: wss://relay.example.com failed"),
+            "error: [URL] failed"
         );
         assert_eq!(
-            NaughtyListTracker::classify_error("TLS handshake failed"),
-            Some(NaughtyCategory::TlsCertificateInvalid)
+            NaughtyListTracker::strip_urls("error: ws://localhost:8080 failed"),
+            "error: [URL] failed"
         );
+    }
 
-        // TLS timeout should NOT be classified as naughty
-        assert_eq!(
-            NaughtyListTracker::classify_error("TLS connection timed out"),
-            None
-        );
+    #[test]
+    fn test_strip_urls_multiple() {
+        let error = "failed to clone https://a.com/repo.git and wss://relay.com";
+        let stripped = NaughtyListTracker::strip_urls(error);
+        assert_eq!(stripped, "failed to clone [URL] and [URL]");
     }
 
     #[test]
-    fn test_classify_protocol_errors() {
-        assert_eq!(
-            NaughtyListTracker::classify_error("websocket protocol error"),
-            Some(NaughtyCategory::ProtocolError)
-        );
+    fn test_strip_urls_preserves_error_text() {
+        let error =
+            "fatal: unable to access 'https://example.com/repo.git/': SSL certificate problem";
+        let stripped = NaughtyListTracker::strip_urls(error);
+        assert!(stripped.contains("SSL certificate problem"));
+        assert!(!stripped.contains("example.com"));
+    }
+
+    // =========================================================================
+    // EDGE CASES: TIMEOUT/CONNECTION EXCEPTIONS
+    // These are the "unusual rules" where a pattern matches but should be excluded
+    // =========================================================================
+
+    #[test]
+    fn test_tls_timeout_not_naughty() {
+        // TLS errors with timeout should NOT be classified as naughty
+        // (timeout is transient, not a certificate problem)
         assert_eq!(
-            NaughtyListTracker::classify_error("invalid frame header"),
-            Some(NaughtyCategory::ProtocolError)
+            NaughtyListTracker::classify_error("TLS connection timed out"),
+            None
         );
-
-        // WebSocket connection errors should NOT be classified as naughty
         assert_eq!(
-            NaughtyListTracker::classify_error("websocket connection refused"),
+            NaughtyListTracker::classify_error("SSL handshake timeout"),
             None
         );
     }
 
     #[test]
-    fn test_classify_transient_errors() {
-        // Timeouts are transient
+    fn test_websocket_connection_errors_not_naughty() {
+        // WebSocket connection errors are transient, not protocol violations
         assert_eq!(
-            NaughtyListTracker::classify_error("connection timed out"),
+            NaughtyListTracker::classify_error("websocket connection refused"),
             None
         );
         assert_eq!(
-            NaughtyListTracker::classify_error("operation timed out"),
+            NaughtyListTracker::classify_error("websocket connection timeout"),
             None
         );
+    }
 
-        // Connection refused is transient
+    #[test]
+    fn test_remote_warnings_filtered() {
+        // Remote warnings should be filtered out before classification
+        let warning_only =
+            "remote: warning: unable to access '/root/.config/git/attributes': Permission denied";
+        assert_eq!(NaughtyListTracker::classify_error(warning_only), None);
+
+        // But real errors after warnings should still be classified
+        let warning_with_error = "remote: warning: something\nfatal: failed to lookup address";
         assert_eq!(
-            NaughtyListTracker::classify_error("connection refused"),
-            None
+            NaughtyListTracker::classify_error(warning_with_error),
+            Some(NaughtyCategory::DnsLookupFailed)
         );
+    }
 
-        // Generic network errors are transient
+    // =========================================================================
+    // INTEGRATION: FULL CLASSIFICATION FLOW
+    // Verify URL stripping + classification work together correctly
+    // =========================================================================
+
+    #[test]
+    fn test_url_with_keywords_not_false_positive() {
+        // URLs containing keywords should NOT trigger classification
+        let cases = [
+            ("https://example.com/my-openssl-project.git", "not found"),
+            ("https://example.com/ssl-team/repo.git", "not found"),
+            ("https://example.com/certificate-manager.git", "not found"),
+            ("https://example.com/dns-tools.git", "not found"),
+            ("wss://relay-tls-test.example.com", "connection refused"),
+        ];
+
+        for (url, suffix) in cases {
+            let error = format!("fatal: repository '{}/' {}", url, suffix);
+            assert_eq!(
+                NaughtyListTracker::classify_error(&error),
+                None,
+                "URL '{}' should not trigger false positive",
+                url
+            );
+        }
+    }
+
+    #[test]
+    fn test_real_errors_still_detected() {
+        // Real errors in the message text (not URL) should still be detected
         assert_eq!(
-            NaughtyListTracker::classify_error("network unreachable"),
-            None
+            NaughtyListTracker::classify_error(
+                "fatal: 'https://example.com/repo.git': SSL certificate problem"
+            ),
+            Some(NaughtyCategory::TlsCertificateInvalid)
+        );
+        assert_eq!(
+            NaughtyListTracker::classify_error(
+                "fatal: 'https://example.com/repo.git': failed to lookup address"
+            ),
+            Some(NaughtyCategory::DnsLookupFailed)
+        );
+        assert_eq!(
+            NaughtyListTracker::classify_error("websocket protocol error"),
+            Some(NaughtyCategory::ProtocolError)
         );
     }
 
     #[test]
-    fn test_record_new_entry() {
-        let tracker = NaughtyListTracker::with_defaults();
-        let url = "wss://bad-relay.example.com";
-
-        let is_new = tracker.record(
-            url,
-            NaughtyCategory::DnsLookupFailed,
-            "failed to lookup address".to_string(),
+    fn test_url_with_keyword_and_real_error() {
+        // URL contains keyword AND there's a real error - should detect the error
+        let error = "fatal: 'https://example.com/ssl-tools/repo.git': SSL certificate problem";
+        assert_eq!(
+            NaughtyListTracker::classify_error(error),
+            Some(NaughtyCategory::TlsCertificateInvalid)
         );
-
-        assert!(is_new);
-        assert!(tracker.is_naughty(url));
-
-        let entry = tracker.get_entry(url).unwrap();
-        assert_eq!(entry.category, NaughtyCategory::DnsLookupFailed);
-        assert_eq!(entry.occurrence_count, 1);
     }
 
+    // =========================================================================
+    // TRACKER FUNCTIONALITY
+    // =========================================================================
+
     #[test]
-    fn test_record_updates_existing() {
+    fn test_tracker_record_and_update() {
         let tracker = NaughtyListTracker::with_defaults();
         let url = "wss://bad-relay.example.com";
 
         // First occurrence
-        let is_new1 = tracker.record(url, NaughtyCategory::DnsLookupFailed, "error 1".to_string());
-        assert!(is_new1);
+        let is_new = tracker.record(url, NaughtyCategory::DnsLookupFailed, "error 1".to_string());
+        assert!(is_new);
+        assert!(tracker.is_naughty(url));
 
-        // Second occurrence
+        // Second occurrence updates existing
         let is_new2 = tracker.record(url, NaughtyCategory::DnsLookupFailed, "error 2".to_string());
         assert!(!is_new2);
 
         let entry = tracker.get_entry(url).unwrap();
         assert_eq!(entry.occurrence_count, 2);
-        assert_eq!(entry.reason, "error 2"); // Updated to latest
+        assert_eq!(entry.reason, "error 2");
     }
 
     #[test]
-    fn test_is_naughty() {
-        let tracker = NaughtyListTracker::with_defaults();
-        let url = "wss://bad-relay.example.com";
-
-        assert!(!tracker.is_naughty(url));
+    fn test_tracker_expiration() {
+        let tracker = NaughtyListTracker::new(0); // Expire immediately
 
         tracker.record(
-            url,
-            NaughtyCategory::TlsCertificateInvalid,
-            "cert error".to_string(),
+            "wss://relay.example.com",
+            NaughtyCategory::DnsLookupFailed,
+            "error".to_string(),
         );
 
-        assert!(tracker.is_naughty(url));
-    }
+        // Entry exists but is expired
+        assert!(!tracker.is_naughty("wss://relay.example.com"));
 
-    #[test]
-    fn test_get_all() {
-        let tracker = NaughtyListTracker::with_defaults();
-
-        tracker.record(
-            "wss://relay1.example.com",
-            NaughtyCategory::DnsLookupFailed,
-            "dns error".to_string(),
-        );
-        tracker.record(
-            "wss://relay2.example.com",
-            NaughtyCategory::TlsCertificateInvalid,
-            "tls error".to_string(),
-        );
+        std::thread::sleep(std::time::Duration::from_millis(10));
 
-        let all = tracker.get_all();
-        assert_eq!(all.len(), 2);
+        let expired = tracker.expire_old_entries();
+        assert_eq!(expired.len(), 1);
+        assert_eq!(tracker.total_count(), 0);
     }
 
     #[test]
-    fn test_count_by_category() {
+    fn test_tracker_counts() {
         let tracker = NaughtyListTracker::with_defaults();
 
+        tracker.record("wss://r1.com", NaughtyCategory::DnsLookupFailed, "e".into());
+        tracker.record("wss://r2.com", NaughtyCategory::DnsLookupFailed, "e".into());
         tracker.record(
-            "wss://relay1.example.com",
-            NaughtyCategory::DnsLookupFailed,
-            "error".to_string(),
-        );
-        tracker.record(
-            "wss://relay2.example.com",
-            NaughtyCategory::DnsLookupFailed,
-            "error".to_string(),
-        );
-        tracker.record(
-            "wss://relay3.example.com",
+            "wss://r3.com",
             NaughtyCategory::TlsCertificateInvalid,
-            "error".to_string(),
+            "e".into(),
         );
 
+        assert_eq!(tracker.total_count(), 3);
         assert_eq!(
             tracker.count_by_category(NaughtyCategory::DnsLookupFailed),
             2
@@ -475,82 +606,84 @@ mod tests {
             tracker.count_by_category(NaughtyCategory::TlsCertificateInvalid),
             1
         );
-        assert_eq!(tracker.count_by_category(NaughtyCategory::ProtocolError), 0);
+        assert_eq!(tracker.get_all().len(), 3);
     }
 
     #[test]
-    fn test_total_count() {
-        let tracker = NaughtyListTracker::with_defaults();
-        assert_eq!(tracker.total_count(), 0);
-
-        tracker.record(
-            "wss://relay1.example.com",
-            NaughtyCategory::DnsLookupFailed,
-            "error".to_string(),
+    fn test_category_display() {
+        assert_eq!(
+            NaughtyCategory::DnsLookupFailed.as_str(),
+            "dns_lookup_failed"
         );
-        assert_eq!(tracker.total_count(), 1);
-
-        tracker.record(
-            "wss://relay2.example.com",
-            NaughtyCategory::TlsCertificateInvalid,
-            "error".to_string(),
+        assert_eq!(
+            NaughtyCategory::TlsCertificateInvalid.as_str(),
+            "tls_certificate_invalid"
         );
-        assert_eq!(tracker.total_count(), 2);
+        assert_eq!(NaughtyCategory::ProtocolError.as_str(), "protocol_error");
     }
+}
 
-    #[test]
-    fn test_expire_old_entries() {
-        // Use very short expiration for testing
-        let tracker = NaughtyListTracker::new(0); // Expire immediately (0 hours)
-
-        tracker.record(
-            "wss://relay1.example.com",
-            NaughtyCategory::DnsLookupFailed,
-            "error".to_string(),
-        );
-
-        // Entry should exist in the map
-        assert_eq!(tracker.total_count(), 1);
-
-        // But is_naughty should return false since it's already expired (0 hours)
-        assert!(!tracker.is_naughty("wss://relay1.example.com"));
-
-        // Sleep to ensure time passes
-        std::thread::sleep(std::time::Duration::from_millis(10));
+#[cfg(test)]
+mod production_tests {
+    use super::*;
 
-        // Expire old entries (should remove the 0-hour expired entry)
-        let expired = tracker.expire_old_entries();
-        assert_eq!(expired.len(), 1);
-        assert_eq!(expired[0], "wss://relay1.example.com");
+    /// Production case from relay.ngit.dev - remote warning should not be classified
+    #[test]
+    fn test_classify_production_relay_ngit_dev_warning() {
+        let error =
+            "remote: warning: unable to access '/root/.config/git/attributes': Permission denied";
+        assert_eq!(NaughtyListTracker::classify_error(error), None);
+    }
 
-        // Entry should be gone
-        assert!(!tracker.is_naughty("wss://relay1.example.com"));
-        assert_eq!(tracker.total_count(), 0);
+    /// Git protocol errors are transient, not persistent infrastructure issues
+    #[test]
+    fn test_git_protocol_errors_not_naughty() {
+        // These are common git protocol errors that should NOT be classified as naughty
+        let git_protocol_errors = [
+            "fatal: protocol error: bad line length character: remo",
+            "fatal: protocol error: expected old/new/ref, got 'shallow",
+            "fatal: git upload-pack: protocol error",
+            "error: protocol error: bad pack header",
+            "fatal: protocol error: bad band #3",
+        ];
+
+        for error in git_protocol_errors {
+            assert_eq!(
+                NaughtyListTracker::classify_error(error),
+                None,
+                "Git protocol error should not be classified as naughty: {}",
+                error
+            );
+        }
     }
 
+    /// Remote warning followed by git protocol error - both should be filtered/ignored
     #[test]
-    fn test_category_display() {
+    fn test_warning_with_git_protocol_error() {
+        let error = "remote: warning: unable to access '/root/.config/git/attributes': Permission denied\nfatal: protocol error: bad line length character: remo";
         assert_eq!(
-            NaughtyCategory::DnsLookupFailed.to_string(),
-            "dns_lookup_failed"
+            NaughtyListTracker::classify_error(error),
+            None,
+            "Warning + git protocol error should not be classified as naughty"
         );
-        assert_eq!(
-            NaughtyCategory::TlsCertificateInvalid.to_string(),
-            "tls_certificate_invalid"
-        );
-        assert_eq!(NaughtyCategory::ProtocolError.to_string(), "protocol_error");
     }
 
+    /// WebSocket protocol errors ARE naughty (persistent infrastructure issues)
     #[test]
-    fn test_category_as_str() {
-        assert_eq!(
-            NaughtyCategory::DnsLookupFailed.as_str(),
-            "dns_lookup_failed"
-        );
-        assert_eq!(
-            NaughtyCategory::TlsCertificateInvalid.as_str(),
-            "tls_certificate_invalid"
-        );
-        assert_eq!(NaughtyCategory::ProtocolError.as_str(), "protocol_error");
+    fn test_websocket_errors_still_naughty() {
+        let websocket_errors = [
+            "websocket protocol error",
+            "websocket handshake failed",
+            "invalid frame received",
+        ];
+
+        for error in websocket_errors {
+            assert_eq!(
+                NaughtyListTracker::classify_error(error),
+                Some(NaughtyCategory::ProtocolError),
+                "WebSocket error should be classified as protocol_error: {}",
+                error
+            );
+        }
     }
 }
diff --git a/src/sync/self_subscriber.rs b/src/sync/self_subscriber.rs
index ab10c49..4d69c9a 100644
--- a/src/sync/self_subscriber.rs
+++ b/src/sync/self_subscriber.rs
@@ -16,6 +16,8 @@ use nostr_sdk::Timestamp;
 use tokio::sync::broadcast::error::RecvError;
 use tokio::sync::{broadcast, mpsc};
 
+use crate::nostr::builder::SharedDatabase;
+
 use super::{AddFilters, RepoSyncIndex, RepoSyncNeeds, SyncLevel};
 
 // =============================================================================
@@ -99,6 +101,8 @@ pub struct SelfSubscriber {
     action_tx: mpsc::Sender<AddFilters>,
     /// Last time we connected - used for since filter on reconnect
     last_connected: Option<Timestamp>,
+    /// Database for querying existing events on startup
+    database: SharedDatabase,
 }
 
 impl SelfSubscriber {
@@ -109,11 +113,13 @@ impl SelfSubscriber {
     /// * `relay_domain` - Our service domain (used for filtering relevant repos)
     /// * `repo_sync_index` - Shared index to update with discovered repos
     /// * `action_tx` - Channel to send AddFilters actions to the SyncManager
+    /// * `database` - Database for querying existing events on startup
     pub fn new(
         own_relay_url: String,
         relay_domain: String,
         repo_sync_index: RepoSyncIndex,
         action_tx: mpsc::Sender<AddFilters>,
+        database: SharedDatabase,
     ) -> Self {
         Self {
             own_relay_url,
@@ -121,6 +127,7 @@ impl SelfSubscriber {
             repo_sync_index,
             action_tx,
             last_connected: None,
+            database,
         }
     }
 
@@ -136,6 +143,102 @@ impl SelfSubscriber {
         }
     }
 
+    /// Load existing events from database on startup
+    ///
+    /// Queries the database with two separate queries to build the initial
+    /// PendingUpdates state. This ensures all repos get Layer 2/3 filters
+    /// created, not just those returned by the WebSocket subscription
+    /// (which has limits on the number of events returned).
+    ///
+    /// Query order:
+    /// 1. First query: Get announcements (30617) to populate repo_sync_index
+    ///    with repos and their relays
+    /// 2. Second query: Get root events (1617/1618/1621) for handle_root_event()
+    ///    to add root event IDs for Layer 3 filter creation
+    ///
+    /// Returns a PendingUpdates containing all repos that need Layer 2/3 filters.
+    async fn load_existing_events(&self) -> PendingUpdates {
+        let mut pending = PendingUpdates::new();
+
+        tracing::info!("Loading all events from database");
+
+        // First query: Get all announcements to populate repo_sync_index
+        let announcement_filter = Filter::new().kind(Kind::GitRepoAnnouncement);
+
+        let announcements = match self.database.query(announcement_filter).await {
+            Ok(events) => {
+                tracing::info!(count = events.len(), "Loaded announcements from database");
+                events
+            }
+            Err(e) => {
+                tracing::error!(
+                    error = %e,
+                    "Failed to query announcements from database"
+                );
+                return pending;
+            }
+        };
+
+        // Process announcements
+        let mut announcements_loaded = 0;
+        for event in announcements.iter() {
+            if let Some(repo_id) = Self::extract_repo_id(event) {
+                let relays = Self::extract_relay_urls(event);
+                pending.add_repo(repo_id, relays, HashSet::new());
+                announcements_loaded += 1;
+            }
+        }
+
+        // Update repo_sync_index with announcements BEFORE querying root events
+        {
+            let mut index = self.repo_sync_index.write().await;
+            for (repo_id, needs) in &pending.repos {
+                let entry = index
+                    .entry(repo_id.clone())
+                    .or_insert_with(|| RepoSyncNeeds {
+                        relays: HashSet::new(),
+                        root_events: HashSet::new(),
+                        sync_level: SyncLevel::StateOnly,
+                    });
+                entry.relays.extend(needs.relays.clone());
+            }
+        }
+
+        // Second query: Get all root events for handle_root_event()
+        let root_filter =
+            Filter::new().kinds(vec![Kind::GitPatch, Kind::GitIssue, Kind::GitPullRequest]);
+
+        let root_events = match self.database.query(root_filter).await {
+            Ok(events) => {
+                tracing::info!(count = events.len(), "Loaded root events from database");
+                events
+            }
+            Err(e) => {
+                tracing::error!(
+                    error = %e,
+                    "Failed to query root events from database"
+                );
+                // Continue with just announcements
+                return pending;
+            }
+        };
+
+        // Process root events
+        let mut root_events_processed = 0;
+        for event in root_events.iter() {
+            self.handle_root_event(event, &mut pending).await;
+            root_events_processed += 1;
+        }
+
+        tracing::info!(
+            announcements_loaded = announcements_loaded,
+            root_events_processed = root_events_processed,
+            "Processed existing events from database"
+        );
+
+        pending
+    }
+
     /// Process a relay pool notification
     ///
     /// Handles incoming events from the subscription, queueing 30617 announcements
@@ -277,33 +380,22 @@ impl SelfSubscriber {
         // Subscribe to announcement and root event kinds
         // Per v4 spec: 30617, 1617, 1618, 1621 (NOT 30618)
         // Plus kind 10317 (User Grasp List) for GRASP discovery
-        // Check if we have a last_connected time for reconnect filtering
-        let filter = if let Some(last) = self.last_connected {
+        let mut filter = Filter::new().kinds(vec![
+            Kind::GitRepoAnnouncement,
+            Kind::GitPatch,
+            Kind::GitIssue,
+            Kind::GitPullRequest,
+            Kind::GitUserGraspList,
+        ]);
+        if let Some(timestamp) = self.last_connected {
             // Quick reconnect - use since filter (15 min buffer)
-            let since = Timestamp::from(last.as_secs().saturating_sub(15 * 60));
+            let since = Timestamp::from(timestamp.as_secs().saturating_sub(15 * 60));
             tracing::debug!(
                 since = %since,
                 "Using since filter for reconnect"
             );
-            Filter::new()
-                .kinds(vec![
-                    Kind::GitRepoAnnouncement, // Repository Announcements
-                    Kind::GitPatch,            // Patches
-                    Kind::GitIssue,            // Issues
-                    Kind::GitPullRequest,      // Pull Requests
-                    Kind::GitUserGraspList,    // User Grasp List
-                ])
-                .since(since)
-        } else {
-            // First connection - no since filter
-            Filter::new().kinds(vec![
-                Kind::GitRepoAnnouncement, // Repository Announcements
-                Kind::GitPatch,            // Patches
-                Kind::GitIssue,            // Issues
-                Kind::GitPullRequest,      // Pull Requests
-                Kind::GitUserGraspList,    // User Grasp List
-            ])
-        };
+            filter = filter.since(since);
+        }
 
         // Update last_connected AFTER creating filter but BEFORE subscribing
         self.last_connected = Some(Timestamp::now());
@@ -324,7 +416,11 @@ impl SelfSubscriber {
 
         let mut notifications = client.notifications();
         let batch_window = Self::get_batch_window();
-        let mut pending = PendingUpdates::new();
+
+        // Load existing events from database on startup
+        // This ensures all repos get Layer 2/3 filters created, not just those
+        // returned by the WebSocket subscription (which has limits)
+        let mut pending = self.load_existing_events().await;
 
         // Timer does NOT reset on new events - use interval
         let mut timer = tokio::time::interval(batch_window);