Found it! Thank you for your report, extremely helpful.

This is the request they are making when you check the “automatically show latest notes”

["REQ","timeline:global:all-e1d014bddc2d",{"kinds":[1,6],"since":1678802443,"until":1678806043},{"kinds":[1,6],"since":1678809650,"limit":1}]

I’m not sure this is good practice but basically they are adding a 2nd filter instead of changing the params of the first one. The first filter asks for all kind 1,6 events from 2 hours ago till an hour ago (why not more recent?). The second filter asks for only events newer than 5 minutes.

At this time if we see 2 filters, we just pass the request without any filtering/changes as we did not want to break any existing functionality. I can fix this specifically for snort later today.