The gist seems to be private.

Another problematic (I think?) usage of until is to query time slices using since+until deeper and deeper to get N events, instead of just using "limit". So instead of 1 request that returns all needed events we get 10-100 requests and user is waiting for the feed to 'get populated'.

Snort does that, and I was told it's hard to do it in any other way with many relays to poll. Haven't dug into that, but feels very awkward, and my rate-limiting isn't happy.