---
name: leveva-slice-recording
description: How to record a leveva P11 feature slice (plan file + p11.md + PLAN.md row) and the TDD/inverse-invariant discipline the user expects
metadata: 
  node_type: memory
  type: feedback
  originSessionId: 2421e25a-47e2-42c2-820a-e3b2195f771e
---

Each substantive leveva change is a **numbered P11 slice**. To record one (the
user pointed at the P5 [command-cluster-port] skill for this discipline even
though that skill itself is P5-only/retired):

1. **Plan file** under `docs/superpowers/plans/YYYY-MM-DD-p11-slice<N>-<slug>.md`
   (Goal / Locked decisions / Design / Tests / Divergences / Gate).
2. **Progress entry** appended to `docs/progress-log/p11.md` — append via shell
   heredoc (`cat >> … <<'EOF'`), do **not** Read+Edit (the log is huge). Header
   `## YYYY-MM-DD — P11 slice <N>: <title>`, then `### Mechanism / Divergences /
   Tests / Docs`, a `**Plan:**` pointer, and a `**Gate:**` line.
3. **PLAN.md P11 row**: bump the `**Done: N slices`** count and append a concise
   `; <N> = …` clause. Keep it to one clause — see [[plan-md-rows-stay-thin]].

Find the next slice number with `grep -n "slice 5" docs/progress-log/p11.md`.

**Why:** the project is a strangler-fig migration where every step is logged and
gated; an un-recorded slice breaks that provenance chain.

**How to apply (the discipline that matters most):** write the failing test
FIRST, and **test the inverse invariants, not just the happy path** — for every
"X happens" assert the matching "X does *not* happen when it shouldn't" (non-match
ignored, already-applied not duplicated, removal doesn't undo a prior grant,
non-member skipped). Gate = `cargo test -p leveva` green + `cargo clippy -p leveva
--tests` clean + `cargo build --workspace` 0 warnings. Commit discipline:
[[commit-one-test-per-commit]], on master directly ([[work-on-master-directly]]).
Related: [[leveva-ircv3-track]], [[leveva-command-folder]].
=====NEXTSTEP=====
---
name: leveva-next-step-s2s-completeness
description: "leveva P11: S2S + auth + full client surface DONE; the parity matrix toward P12 is UNDERWAY — slices 45 (channel-lifecycle inverses) + 46 (burst/netsplit teardown inverses) + 47 (WHO/WHOIS/WHOX) + 48 (CAP framework, IRCv3) + 49 (PASS + connection-password gate) + 50 (STATS k/K active k-lines) + 51 (IRCv3 multi-prefix) + 52 (live two-node link integration: two real leveva subprocesses, real CONNECT, PRIVMSG/TOPIC/MODE relay) + 53 (WebSocket transport via axum at /socket + the +W umode/WHOIS 320, first transport slice) DONE; remaining matrix areas = more registration edge cases (full I-line enforcement / class assignment) / more STATS letters (l/L/p/P/t/T/f/F/a/? — all need per-conn or live infra leveva lacks) / (LINKS/MAP network-mirror enumeration DONE in slice 88 — true tree, not flattened) / rehash-restart / iauth end-to-end / more IRCv3 caps. IRCv3 ACCOUNT track COMPLETE: slice 139 (account identity via ENCAP * SU → WHOIS 330 / WHO %a) + 140 (account-notify) + 141 (account-tag @account msg tag) + 142 (extended-join) DONE. The four originally-named matrix areas are ALL done now (45/46/47 + registration 49/99 + STATS 50/109) — that 'ask user' note is STALE. Slice 143 (2026-06-13) DONE = hunt_server target-resolution FUZZING (model-lockstep query_routing_proptest over VERSION/TIME/ADMIN/INFO/LUSERS/USERS/MOTD/STATS forward path incl. slice-110 remote-forward + own-name precedence + netsplit-revert; summon_proptest 411/445/402 + golden_summon; STATS idx-1 forward unit) — a confirm-and-lock parity slice, no bug. §4 fuzzing gaps now essentially closed; nearly every command has unit+golden+proptest. NEXT toward P12 = ask user: remaining IRCv3 caps (SASL the keystone — auth INTO the slice-139 account SoT; or utf8only/labeled-response/batch) vs the P12 deletion itself (delete ircd-common/ircd-rs once §7 def-of-done met)"
metadata: 
  node_type: memory
  type: project
  originSessionId: 90eead6b-cbcf-4bb0-bbbd-d299622cd3a6
---

**The leveva (P11) work is S2S-completeness** — per the user (2026-06-09). After
slice 34 (channel modes), the remaining in-scope `msgtab` rows are the **server-to-server**
ones, so build those rather than more client/oper commands.

**Slice 35 DONE (2026-06-09): `ERROR`/`ENCAP`/`SDIE`** — the relay/notice cluster, in
`leveva/src/s2s/forward.rs` (`inbound_encap`/`inbound_sdie`/`inbound_error`), wired into
`s2s::dispatch`. ENCAP+SDIE onward-relay verbatim (`msg.to_wire()`) split-horizon via
`PeerLinks::broadcast`; ERROR is absorbed (`eprintln!`). **Key finding:** `m_encap`/`m_sdie`
are IRCnet **placeholders** (git `7c3931d1`; `m_sdie` only `sendto_serv_v(...); return 0;`,
**no** `s_die()`) → leveva's SDIE is a pure relay that does **not** kill the process; wiring
it to `control` would be a divergence. `golden_s2s_forward` guards that regression.

**Slice 36 DONE (2026-06-09): `UMODE`** — remote user-mode propagation, in
`leveva/src/s2s/umode.rs`. Outbound `relay::local_umode` emits `:<uid> UMODE <nick> <diff>`
(masked to `SEND_UMODES` = all umodes except `+O` locop = oracle `61`) from the slice-14
local `umode` handler; inbound `umode::inbound_umode` (reached by the `UMODE` verb AND a
user-target `MODE` — dispatch `MODE` arm guards on `is_s2s_channel`) applies the masked diff
to the `RemoteUser::umodes` mirror + registry record, then onward-relays split-horizon. No
client fan-out (user modes aren't broadcast). **Key divergence:** the oracle *emits*
`MODE <nick> :<diff>` (`send_umode_out`) while *accepting* `UMODE`; leveva standardises on
emitting `UMODE` (the row) but accepts both forms on input. Tests: 9 unit + 3-property
`s2s_umode_proptest` + `golden_s2s_umode`.

**Slice 37 DONE (2026-06-09): multi-hop `SERVER`-behind-peer introduction** — the SMASK
prerequisite, built first by user decision (asked, chose "multi-hop SERVER first, then
SMASK"). New `leveva/src/s2s/server.rs` `handle_server` parses `:<announcing_sid> SERVER
<name> <hopcount> <sid> <version> :<info>` (the shape `build_burst` already emits), mirrors
the server into `Network` with **`uplink` = the DIRECT peer's `Sid`** (NOT the announcing
prefix — load-bearing: routing `uplink_of`→`PeerLinks::route` keys on directly-linked peers,
and `squit_subtree` tears it down with the link), onward-relays verbatim split-horizon.
Absorbs (not link-drop) on bad/colliding SID. Wired `"SERVER" =>` into `s2s::dispatch`.
Tests: 7 unit + 3-prop `s2s_server_proptest` + `golden_s2s_server`.

**Slice 38 DONE (2026-06-09): `SMASK`** — masked-server introduction, the **LAST**
server-sourced `msgtab` row. New `leveva/src/s2s/smask.rs` `handle_server` parses
`:<announcing_sid> SMASK <sid> <version>` (oracle `m_smask`, `s_serv.c:533`), the masked cousin
of slice-37 `SERVER`: the masked server inherits the announcer's `name` (oracle
`serv->namebuf = sptr->name`) + `hopcount + 1`, description = literal `"Masked Server"`;
announcer resolved from the line **prefix** SID via `Network` (unknown announcer → dropped,
SMASK-specific). `uplink` = the DIRECT peer (same load-bearing reason as slice 37). Version is
required-present but NOT mirrored (`RemoteServer` has no version field, like `SERVER`). Absorbs
(not link-drop) on bad/colliding SID. Wired `"SMASK" =>` into `s2s::dispatch`. Tests: 8 unit +
3-prop `s2s_smask_proptest` + `golden_s2s_smask`.

**✅ S2S-COMPLETENESS REACHED — every server-sourced `msgtab` row is now handled.** No S2S row
remains unported.

**Slice 39 DONE (2026-06-09): native in-process authentication + ident** — see
[[iauth-subsumed-into-leveva]]. User chose to **subsume iauth into leveva** (not spawn a child
over a socketpair). New `leveva-iauth` crate (Module trait + ModuleCtx/ModuleOutcome +
AuthPipeline) + the ident (RFC 1413) module; the `iauth` block configures auth in-process
(`ident` flag + `timeout`, child-config-path field dropped); ident runs concurrently with the
NICK/USER handshake and folds into registration via the deferred-finalize seam
(`Session::pending_complete`/`resolve_auth`, sync `feed` / async ident). `~user` rule in
`registration::resolve_username`. Restored a `leveva-integration` differential (first since
`wdhms2sec`): leveva-iauth parser vs `iauth-rs` (now the auth oracle until P12).

**Slice 40 DONE (2026-06-09): `dnsbl` subsumed into `leveva-iauth` + the `465` auth-deny
gate** — the FIRST denying module. `leveva-iauth/src/dnsbl.rs` (idiomatic rewrite of the
faithful iauth-rs dnsbl): reverse IP→`<rev>.<zone>`, resolve via **hickory-dns** (the locked
choice, `hickory-resolver = 0.26`, lazy shared `TokioResolver`) behind an injectable
`Resolver`; deny iff `paranoid || (reject && 127.0.0.x)`. Dropped the C `hostlog` cache
(redundant under tokio) + use config order not C's reversed `host_list` (documented). **Pipeline
`Box`→`Arc`** (`AuthPipeline: Vec<Arc<dyn Module>>`, modules built once in `from_config`,
dnsbl-first). `AuthConfig` gains `modules` + `any()` (keeps `ident: bool` for the `~` rule);
defer decision keys on `ctx.auth.any()` so a dnsbl-only config still defers. **The `465` gate**:
`finalize_registration` renders `verdict.deny` as `465`+`ERROR :Closing Link` (reason default
`Denied access`) — same uniform refusal as the K-line gate (C just `exit_client`s). Config:
`iauth { dnsbl { servers …; reject; paranoid; reason … } }`, parse-time validated. Differential:
leveva `reversed_name` vs `iauth_rs::modules::dnsbl::build_name` (made `pub`). Fuzz = proptest
(stable toolchain → no cargo-fuzz/L3). `golden_dnsbl` boots an `.invalid` (NXDOMAIN) zone.

**Slice 41 DONE (2026-06-09): `socks` + `webproxy` open-proxy probes subsumed into
`leveva-iauth`** — the two open-proxy denying modules (`leveva-iauth/src/{socks,webproxy}.rs`),
idiomatic rewrites of the faithful `mod_socks.c`/`mod_webproxy.c` ports; deny an open proxy via
the slice-40 `465` gate. Same divergences as dnsbl: **cache + STATS dropped**, **`reject`+`port`
required** at config time (no probe-only mode; `megaparanoid` ⇒ paranoid+bofh). socks collapses
the SOCKS4→5 reconnect + careful SOCKS5b stages into one async flow; webproxy's careful mode keys
on the server's own `020` banner (passed to `WebProxy::new` as a config-time constant, so
`ModuleCtx` stays minimal — itsip/itsport/ourip/ourport only, NO ircd_name). Pure
`build_query`/`decide`/`resolve` kept byte-identical to the oracle → `leveva-integration`
`proxy_differential` (the oracle's pure fns + `Ver`/`Raw`/`ProxyState`/`OPT_*` made `pub`).
`build_auth_modules(iauth, ircd_name)` pushes denying modules before ident. Tests: +20 lib unit
(49 total) + `proxy_proptest` (6) + `proxy_differential` (6) + 7 config + `golden_socks` boot.

**Slice 42 DONE (2026-06-09): prometheus-backed metrics + `STATS m`/`STATS z`** — see
[[leveva-prometheus-metrics]]. Replaced the leveva istat-analog (`server::Counters`,
hand-rolled atomics) with a **per-`ServerContext` `prometheus::Registry`** in new
`leveva/src/metrics.rs` (user instruction: "replace the istat counters with prometheus
metrics"; user agreed the per-server — not global default — registry is justified for parallel
test isolation). `dispatch` records each command (name+wire-bytes); implemented the two stubbed
counter letters: `STATS m` → `212` per recorded command (sorted), `STATS z` → four `249`
live-count debug lines. **Still stubbed** (no leveva state): `l`/`L` (per-link), `p`/`P`, `t`/`T`,
`f`/`F`, `k`/`K`, `a`, `?`.

**Slice 44 DONE (2026-06-09): `pipe` external-program auth module** — port of `mod_pipe.c`
(oracle `iauth-rs/src/modules/pipe.rs`) into `leveva-iauth/src/pipe.rs`, the **LAST denying
module** → dnsbl/socks/webproxy/pipe set complete. Spawns the configured `program` with
`itsip`+`itsport` appended as **separate argv entries** (no shell — pure `build_argv` carries
that security claim), reads one stdout byte via pure `classify`: `N`→Deny (465 gate), `Y`→allow
(NoOpinion), else abstain. Security hardening over C: explicit argv, config-only command,
`stdin(null)`+`kill_on_drop`. Config: `iauth { pipe { program "…"; reason "…" } }`, `program`
required (no `reject` flag — pipe has no probe-only mode, unlike socks/webproxy). Order: after
webproxy, before ident; `any()` auto-defers. Tests: 11 unit + 3 config + `pipe_proptest` (4) +
`golden_pipe` boot. No differential (no pure oracle verdict fn). *Finding:* a write-then-exec
temp-script arg test was ETXTBSY-flaky under parallel cargo test (sibling `Command` fork
inherits the open write fd) → replaced by pure `build_argv` unit tests.

**Slice 45 DONE (2026-06-09): channel-lifecycle PARITY** — the **first parity-matrix slice**
(user chose "Channel lifecycle parity"). leveva already had per-command happy-path channel
coverage + the *forward* gates (475/474/473); slice 45 closes the **inverses** the
command-cluster-port skill demands: `-b` unban / `-i` reopen / `-k` un-key, `+l` free-slot,
INVITE one-shot re-gate (join→part→re-join 473 again), deop revokes MODE/KICK authority (482),
kick→clean-rejoin (no stale `@`), recreate-after-last-part is fresh (331 + `324 +`), QUIT
removes membership everywhere. **No bug found — parity confirmed.** Boot-golden
`golden_channel_lifecycle.rs` (7 tests) + gate-model fuzz `channel_lifecycle_proptest.rs` (2
props, 400 cases — first proptest to set modes *and* gate a JOIN). No `leveva-integration`
differential (oracle channel fns are private/impure — `match_differential` still pins the glob
matcher). Plan: `docs/superpowers/plans/2026-06-09-p11-slice45-channel-lifecycle-parity.md`.

**Slice 46 DONE (2026-06-09): burst/netsplit PARITY** — user chose "Burst / netsplit parity".
The `s2s/squit.rs::squit_subtree` teardown core was already richly *unit*-tested (headline QUIT
fan-out, multi-hop, NJOIN ghost sweep, idempotency); slice 46 added the **unpinned inverses**:
two new squit unit tests (`squit_leaf_keeps_the_peer_and_its_users` = partial-subtree teardown,
peer survives; `reburst_after_split_is_clean` = freed nick re-claimable + single fresh
membership + no double-deliver), a NEW **model-based fuzz** `s2s_netsplit_proptest.rs` (random
server forest behind a peer → SQUIT a random node → a pure uplink-fixpoint model predicts the
doomed set, survivors, and exact QUIT multiset; 200 cases + a panic-freedom prop on
`handle_squit`), and a NEW boot golden `golden_s2s_netsplit.rs` (3 tests: QUIT fan-out to a
local co-member on drop, explicit `SQUIT <leaf>` spares the peer, clean re-burst). **No bug —
parity confirmed.** *Finding:* NJOIN members are **UIDs** not nicks (`:1ZZZ NJOIN #hub
:1ZZZAAAAA`); a first cut used the nick → the remote user silently never joined and the QUIT
fan-out never fired (the exact happy-path-looks-fine trap the slice exists to catch). Plan:
`docs/superpowers/plans/2026-06-09-p11-slice46-burst-netsplit-parity.md`.

**Slice 47 DONE (2026-06-09): WHO / WHOIS / WHOX parity (FULL — a feature build, not just
locking inverses).** Implemented WHOX from scratch (`leveva/src/command/who.rs`): faithful
`parse_who_arg` (legacy `o` opers-only filter + `%fields[,token]`, ≤3-char token), `354
RPL_WHOSPCRPL` emitted field-by-field in the oracle's FIXED `who_one` order (`t c u i h s n f
d l a o S U r`) — field set AND order independent of typed order. Single-server divergences
match the oracle constants: `%i`=host (no DNS split), `%l`=0, `%a`=0, `%o`=n/a. Advertised
`WHOX` in ISUPPORT. **Coupled remote-field fix** (real bug, since S2S landed after WHO/WHOIS):
a `server_view`/`whois_server` helper resolves a *remote* user's own server-name/hopcount/SID
from the `Network` mirror (`ctx.net.server(sid_of_uid(uid))`) instead of hardcoding us/0 — for
`352`, `354 %s/%S/%d`, AND WHOIS `312`; plus the `*` oper flag in the status. Tests: 19 who.rs
unit + whois remote-312 + isupport WHOX; goldens `golden_whox` + the REQUIRED `golden_s2s_who`
(remote user via a peer → all fields name peer.test/hop 1/SID 1ZZZ, + the drop inverse);
`whox_proptest` (field-order model). `golden_s2s`/`golden_registration` snapshots updated for
the corrected remote `312` + the `WHOX` 005 token. No `leveva-integration` differential
(oracle who/whois are `unsafe`/global-buffer). Plan:
`docs/superpowers/plans/2026-06-09-p11-slice47-who-whois-whox-parity.md`.

**Slice 49 DONE (2026-06-09): registration edge cases — `PASS` + the connection-password
gate.** `PASS` was entirely absent and `allow{ password }` blocks were parsed but never
consulted. New pure `registration::connection_password_ok(allows,user,host,supplied)` (first
matching rule decides; wrong+`fallthrough` defers; no matching passworded rule → default-allow
— **password gate only, NOT general I-line enforcement**); `Registration` stores `PASS`
(last-wins, bare `PASS`→461), carried via `RegStep::Complete{pass}` → `PendingComplete` so it
survives the CAP/auth deferred-finalize. `session::finalize_registration` runs the gate after
username resolution, before the K-line gate → `464`+`ERROR` close on mismatch. Post-reg `PASS`
→ `462`. **Bounded/deferred:** I-line enforcement, class/restricted/kline_exempt assignment,
CIDR allow masks, PASS→iauth forwarding. Tests: +9 registration unit / +7 session unit /
`golden_pass` (3) / `pass_proptest` (3). See [[leveva-ircv3-track]] for the parallel IRCv3
track (slice 48).

**Slice 50 DONE (2026-06-10): STATS completion — `STATS k`/`K` active k-lines (216).** User
chose "STATS completion". `STATS k` now reports the live `KlineStore` (the oracle `tkconf`
temporary-ban list) via a pure `kline_report(server,nick,entries,now)` core in
`command/stats.rs` — one `216 RPL_STATSKLINE` per not-yet-expired ban, store order, ttl
clamped non-negative. leveva models **only** temporary k-lines (laid by `TKLINE`; no `KLINE`
command, no `kconf`), so `STATS K` is recognized but **always empty**; both echo their letter
in `219` (not `*`). Wire: `:srv 216 nick k <host> <user> <ttl> :<reason>` (leveva-native;
divergences: no class field, reason as trailing). Bounded to k/K — the other state letters
(l/L/P/f need per-conn traffic counters `ClientRecord` lacks; p/t/T/r/?/a/d/hub/etc. have no
leveva state) stay `*`. Tests: +6 stats unit / `golden_stats`+1 (+216-ttl canonicalizer mask)
/ `stats_proptest`+1 (active-filter model). No differential (impure oracle). Plan:
`docs/superpowers/plans/2026-06-10-p11-slice50-stats-klines.md`.

**Slice 51 DONE (2026-06-10): IRCv3 `multi-prefix` (first behavior cap).** User chose the
IRCv3 area. NAMES (353) / WHO (352 + WHOX 354 `%f`) / WHOIS (319) show **all** of a member's
status sigils (`@+`) when the requester negotiates `multi-prefix`, only the highest otherwise.
Core = `MemberStatus::prefixes(multi)` (channel.rs); the cap snapshot rides on
`Registered.caps: cap::ClientCaps` (set at finalize, re-synced post-reg). leveva-native (no
CAP in the oracle → no differential). See [[leveva-ircv3-track]] for the add-a-behavior-cap
pattern. Tests: +6 lib unit / `golden_multi_prefix` / `multi_prefix_proptest` (+ the deliberate
`golden_cap` LS-token snapshot updates). Plan:
`docs/superpowers/plans/2026-06-10-p11-slice51-multi-prefix.md`.

**Slice 52 DONE (2026-06-10): live two-node link integration (real subprocess relay).**
User-requested: the FIRST test that boots **two real `leveva` binaries** and links them (every
prior S2S test drives a hand-coded `Peer` into the *inbound* accept side only). Closes the
outbound-dial coverage gap: `command::connect`→`link::request`→`main::dial_server`→
`s2s::build_link_greeting`, and a real leveva accepting a link from another real leveva.
New harness helpers (`tests/harness/mod.rs`, additive): **`boot_two`** (boots both binaries
under ONE held port lock — two `boot_fixture` calls deadlock on separate `flock(LOCK_EX)`),
`Client::connect_port`, `Client::wait_visible(nick)` (polls `WHOIS` for `311` as the link-up
barrier). Cross-linked fixtures `node_a.kdl`/`node_b.kdl` (symmetric send/accept passwords,
oper has `connect` priv). `tests/integration_two_node.rs`: alice opers+CONNECTs on A, bob on B,
both JOIN `#live`, assert PRIVMSG/TOPIC/MODE relay BOTH directions (B→A driven before `+m`
moderation lands). Fuzz `tests/link_greeting_proptest.rs` (3 props): greeting roundtrips on
matching passwords with conserved identity / mismatch always rejects / well-formed +
panic-free under truncation. **Parity gap FOUND (not fixed, separate slice):** `m_links` still
reports only `me` — unfit as a link-up probe, hence the WHOIS barrier. Plan:
`docs/superpowers/plans/2026-06-10-p11-slice52-live-two-node-link.md`.

**Slice 53 DONE (2026-06-10): WebSocket transport (IRCv3 `websocket`) — the first TRANSPORT
slice.** Browser clients connect over WebSocket served by **axum** at `/socket`; a nested
`websocket{}` block on a `listen{}` port. Adds the leveva-native `+W` umode + WHOIS `320`
(propagated network-wide). Full detail in [[leveva-ircv3-track]] (pure `leveva::websocket`
helpers + `leveva::websocket::server` axum glue; `tls.rs` promoted to `leveva::tls`;
end-to-end `tokio-tungstenite` golden). Also added `HELP USER_MODES`/`CHANNEL_MODES` topic
pages ([[help-files-per-command]]).

**P11 VERDICT (2026-06-10, survey): NEARLY COMPLETE.** Every RFC 2812 / oracle `msgtab`
client command is implemented and the `Numeric` enum is an effectively complete `replies[]`
transcription. The **one genuine client-command behavioral gap was PRIVMSG/NOTICE mask
targets** — **CLOSED by slice 57** (operator-only `$$<servermask>`/`$#<hostmask>` + `413`/`414`,
`command/mask.rs` + `command/message.rs` + `s2s/relay.rs`; the `407`/`MAXPENALTY` cap +
`canonize` dedup follow-up is **CLOSED by slice 87** — `canonicalize_targets` de-dups the
comma list case-insensitively and the delivery loop caps at 5 distinct recipients,
emitting `407 ERR_TOOMANYTARGETS` over-cap (PRIVMSG) / silence (NOTICE); only the
`nick!user@host`/`user%host` "Duplicate recipients" 407 stays out of scope as leveva has no
such targets. **No genuine client-command behavioral gap remains.**). Remaining minor items: SUMMON→421 vs 445, no standalone `UMODE` verb (folded into
MODE), STATS m doesn't count pre-reg commands. Out-of-scope verbs correctly 421. The big
forward surface is the IRCv3 track ([[leveva-ircv3-track]]). Standing testing plan +
native-boot capability: [[ircd-common-native-boot]] (`docs/superpowers/specs/2026-06-10-leveva-testing-plan.md`).

**Slices 54–57 DONE (2026-06-10):** 54 = eager auto-reop (+R), 55 = IRCv3 bot mode (+B), 56 =
**IRCv3 message-tags FOUNDATION** (tags on the core `Message` type + the `message-tags` cap;
the prerequisite that unblocks bot-tag/server-time/msgid/redaction/oper-tag) — both detailed in
[[leveva-ircv3-track]]; **57 = PRIVMSG/NOTICE mask targets** (`$$`/`$#` operator broadcast +
`413`/`414`, the last genuine client-command gap — see the VERDICT above). **NEXT (clearest
highest-leverage) = slice 58: message-tags BEHAVIOR** (`TAGMSG` + client-only `+`tag relay with
per-recipient cap gating + S2S + `417`), which lights up the deferred bot tag and makes
server-time/msgid thin follow-ons. Otherwise still ask-the-user among the matrix areas below.

**Slice 65 DONE (2026-06-10): `REHASH` live-reloads the MOTD** — the first rehash/restart
matrix slice (user chose "rehash/restart"). DIE/RESTART/REHASH already existed; the gap was
that REHASH only *validated* config and applied nothing live. Faithful to IRCnet `rehash()` →
`read_motd(MPATH)`: an oper edits the MOTD file, REHASHes, and the next MOTD/welcome burst
serves the new text. **Mechanism — live MOTD in the control plane (ZERO `ServerContext`-literal
churn, matching how `control.rs` routes DIE/RESTART):** new `MotdStore` (ArcSwapOption +
AtomicBool `initialized`, unit-tested on a *fresh* instance like `ServerControl`) +
`static LIVE_MOTD`/`MOTD_PATH` in `control.rs`; `main` records the resolved `--motd` path +
seeds `LIVE_MOTD` at boot; read sites (`command/mod.rs` MOTD + `session.rs` welcome burst) use
the live store when `initialized` else fall back to `ctx.motd` (keeps the 44 `ServerContext {
motd: None }` literals + every unit test untouched — the global stays uninit under `cargo
test`); `rehash.rs` calls `control::reload_motd()` after the config validation. **Divergences:**
MOTD-only hot-apply (opers/allows/classes still boot-immutable — each its own future slice);
removed file → 422; bare `\r` survives (faithful, `str::lines` only strips `\r\n`). Tests:
control units (incl. inverse `seed(None)` clears) + `golden_rehash_motd` (v1→rewrite→REHASH→v2→
truncate→REHASH→422, via additive harness `boot_minimal_with_motd`) + `motd_reload_proptest`
(400 cases: `load_motd_lines` total/framed/fixed-point + reply-shape model). Plan:
`docs/superpowers/plans/2026-06-10-p11-slice65-rehash-motd.md`.

**Slice 82 DONE (2026-06-10): I-line (allow-block) admission enforcement + class assignment**
— the slice-49 registration deferral. `registration::authorize_connection` (returns
`Accepted(Admission{class,restricted,kline_exempt})`/`BadPassword`/`NoAuthorization`) **replaces**
the slice-49 password-only `connection_password_ok`: configured `allow` blocks are now a real
admission gate (no matching I-line → `465 :No authorization line for your host`); **empty
`allows` stays open** (backward-compat — every bare `ServerContext` test relies on it; all 25
in-tree allow blocks use `*@*` so nothing breaks). The matched block's attributes take effect at
`session::finalize_registration`: `restricted`→`+r`, `kline-exempt` skips the K-line gate, and
the class re-arms the keepalive `ping-freq` (the hand-off `main.rs:156-159` anticipated; reads
boot `ctx.stats_conf.classes`, no live-retune — slice-81 stance). **Still deferred from the
slice-49 list:** CIDR allow masks (`/24` — glob-only matching), per-class `max-links`/`sendq`/
per-host CIDR connection caps (no live connection-accounting infra), and
`require_ident`/`no_resolve`/`xline_exempt` (carried in the model, not yet acted on). Tests:
registration units (the 6 slice-49 tests rewritten to the 3-way verdict) + session units
(465/restricted/kline-exempt/class, each with its inverse) + `golden_iline.rs` +
`iline_proptest.rs` (vs an independent model). Plan:
`docs/superpowers/plans/2026-06-10-p11-slice82-iline-enforcement.md`.

**Slice 83 DONE (2026-06-10): `REHASH` live-reloads the `allow` (I-line) blocks.** User chose
"rehash → allows/listeners". Extends the slice-81 `ConfStore` (which hot-reloaded
`operator`+`class`) to also carry the `allow` blocks, so `REHASH` hot-applies the slice-82
admission gate: `ConfStore` gains `allows: ArcSwapOption<Vec<Allow>>`; `config_conf` now returns
the `ConfBlocks` type alias `(operators, classes, allows)`; `live_allows()` global. Read sites
prefer the live store when seeded else fall back to boot `ctx.stats_conf.allows` (the slice-81
live-or-ctx pattern): `session::finalize_registration`'s `authorize_connection` gate AND
`STATS i`. An oper edits an I-line on disk, REHASHes, the next connection is admitted/refused
(`465`) per the edited rules — no restart. **Listeners DEFERRED** (documented divergence — live
socket-rebind needs accept-task management leveva lacks; its own future slice); links/admin/
options/iauth unchanged. *Finding:* the no-MOTD welcome burst ends at `422`, never `376` — the
golden uses `001 RPL_WELCOME` as the admit sentinel (the slice-81 golden silently eats a 5s
read-timeout/register on the missing `376`). Tests: control units (incl. inverse `seed(..,
empty)` clears) + `golden_rehash_iline.rs` + extended `rehash_conf_proptest.rs` (3-tuple +
allow-host model). Plan: `docs/superpowers/plans/2026-06-10-p11-slice83-rehash-allows.md`.

**Slice 88 DONE (2026-06-11): LINKS / MAP network enumeration — true-to-oracle tree.** Closed
the parity gap slice 52 flagged (`m_links`/`m_map` reported only `me` despite the `Network`
mirror tracking the whole topology since slices 31–87). User directive: **no flattening —
render the genuine multi-level tree.** The crux: `RemoteServer.uplink` is the *routing*
direct-peer (NOT the tree parent), so added a **display-only `RemoteServer.parent: Sid`** (the
true tree parent = the announcing `SERVER`/`SMASK` line prefix), populated at the 3 real
introduction sites (`handshake.rs` = our SID; `server.rs` = the `:<announcing_sid>` prefix;
`smask.rs` = announcer) + ~20 test fixtures; routing/`squit_subtree` still key on `uplink`. New
`command/topology.rs`: `topology(ctx)` enumerator (me first, remotes in Sid order, per-server
user counts, orphan-reparents-to-root) + a pure `map_lines()` tree renderer faithful to
`dump_map`'s ` |- `/` \`- ` 4-char connector cells (visited-set cycle guard → every server
emitted exactly once). `links()` shows each server's true upstream; `map()` nests behind-peer
servers under their parent. **Single-server output byte-identical → zero snapshot churn.**
Divergences: `MAP s` remote version `*` (unmirrored), Sid-sorted order, orphan→root. leveva-
native (no differential — `m_links`/`m_map` are impure). Tests: 22 lib unit (inverse SQUIT/mask
/orphan/cycle) + `golden_s2s_links_map.rs` (real Peer bursts a behind-server → me→peer→leaf
tree) + `links_map_proptest.rs` (400 cases: random forest, model-checked upstream + every-
server-once + panic-freedom). Plan:
`docs/superpowers/plans/2026-06-11-p11-slice88-links-map-network-enumeration.md`. (Note: this is
the `LINKS network-mirror enumeration` gap named in this memory's description — now CLOSED.)
*Pre-existing unrelated failure observed:* `privmsg_proptest::delivery_is_well_formed_and_conserved`
fails from a persisted regression seed (reproduces on clean master, untouched by slice 88).

**Slice 89 DONE (2026-06-11): CIDR `allow` (I-line) host masks.** User chose "CIDR allow masks"
from the matrix. Closes the slice-49/82/83 deferral: `allow` block host masks now accept CIDR
notation (`*@10.0.0.0/24`, `*@2001:db8::/32`) alongside globs. New pure `leveva::cidr`
(`parse_cidr`/`contains`/`cidr_match`) is the **single crate-wide CIDR matcher**;
`matching::allow_host_matches` splits the mask on the last `@`, glob-matches the user component
and CIDR-or-glob-matches the host component (CIDR path only for `addr/prefix` → every existing
`*@*`/glob mask byte-unchanged); `authorize_connection` admits/refuses (`465`) by network
membership of the peer IP. Divergences: family must match (no v4-mapped-v6), malformed CIDR
degrades to a non-matching glob, CIDR only matches IP hosts. **Also consolidated
`websocket::proxy_trusted`'s private `cidr_contains`/`prefix_match` onto the shared module**
(−~35 lines). leveva-native (no differential). Gate: cidr/matching/registration units +
`golden_iline_cidr` + `cidr_proptest` (400 cases vs an independent bit-shift model). **Still
deferred from the slice-49/82 list: per-class connection caps (`max-links`/`sendq`/per-host CIDR
caps — no live connection-accounting infra) + `require_ident`/`no_resolve`/`xline_exempt` (carried
in the model, not acted on).** Plan:
`docs/superpowers/plans/2026-06-11-p11-slice89-cidr-allow-masks.md`.

**Slice 90 DONE (2026-06-11): IRCv3 `setname`.** User chose "SETNAME" from the matrix, then
gave `docs/rfcs/ircv3/setname.md`. The `SETNAME :<realname>` command + `setname` cap — a
registered client (any, not oper-gated) changes its own realname (GECOS) live, the close cousin
of slice-71 `chghost` but simpler: **no** non-cap reconnect fallback (spec forbids sending
SETNAME to non-cap clients; a realname change needs no client refresh). New `command/setname.rs`
+ `s2s/setname.rs` (`local_setname` ENCAP broadcast / `apply_encap_setname` inbound / shared
`notify_co_members`); `cap::SETNAME` + `ClientCaps::setname`; `ident::REALLEN`=50 +
`realname_valid`; `Registry::set_realname`; `isupport` `NAMELEN=50` (spec MUST); `help/SETNAME.md`.
Validity invalid → `FAIL SETNAME INVALID_REALNAME` (spec-enabled stdreply, sent regardless of
cap). Self-echo iff issuer has the cap; co-members notified only if they hold `setname` (+
extended-monitor watchers — the extended-monitor doc's "leveva has no setname" is now stale, only
`account-notify` remains out of scope). leveva-native `ENCAP * SETNAME` carrier → **no
differential** (oracle has no SETNAME). Tests: 18 lib unit + `golden_setname` + `setname_proptest`
(3 props). Snapshot churn: `setname` on CAP LS + `NAMELEN=50` in 005 (re-chunked, MONITOR→next
line). Plan: `docs/superpowers/plans/2026-06-11-p11-slice90-setname.md`.

**Slice 91 DONE (2026-06-11): `REHASH` hot-reloads the `admin` + `connect` (link) + `options`
blocks.** User chose "rehash links/admin/options blocks" from the matrix. Extends the
slice-81/83 `ConfStore` (the `ConfBlocks` tuple type alias became a **struct** + 3 new fields:
`admin: ArcSwapOption<Admin>`, `links: ArcSwapOption<Vec<Connect>>`,
`default_user_modes: ArcSwapOption<u32>`) so `REHASH` hot-applies three more re-read blocks:
the `admin` contact (read by `ADMIN` 256–259), the `connect` (link) blocks (read by `STATS c`
213 + the `CONNECT` target lookup `find_link`), and `options { default-user-modes }` (applied
fresh at each registration finalize → the slice-72 connect MODE notice). `main` seeds the
struct at boot; new global readers `live_admin()`/`live_links()`/`live_default_user_modes()`;
read sites are live-or-`ctx` (the slice-81/83 STATS idiom, so unit tests + boot-seeded goldens
see no churn). **Deferred (documented):** `default-channel-modes` (held by the live `Channels`
table, stamped internally by `channel.rs::join` — needs retuning a runtime structure), the
auto-connect **dial loop** (keeps the boot link set — only `CONNECT`/`STATS c` read live) +
**listeners** (live socket-rebind, slice-83 stance), and the other `options` fields
(`auto-connect`/`split-min-*`/`connection-accept` — no clean reloadable read site). leveva-native
(no differential). Tests: control units (incl. inverse empty-seed clears) + `golden_rehash_blocks`
(v1→rewrite admin/connect/dumodes→REHASH→v2→inverse back) + extended `rehash_conf_proptest`
(admin/links/dumodes tracked in lockstep). *Golden pitfall:* the connect MODE notice arrives in
the same TCP chunk as the welcome burst → read straight through to the MODE sentinel, don't
consume `001` first. Plan:
`docs/superpowers/plans/2026-06-11-p11-slice91-rehash-admin-options-links.md`. **Rehash matrix
now: opers/classes (81), allows (83), MOTD (65), admin/connect/default-user-modes (91); still
boot-immutable: listeners, the dial loop, links/iauth config, default-channel-modes.**

**Slices 100–115 (2026-06-11) closed the testing-plan §3 differential matrix AND the §4
fuzzing-gaps list.** The native cross-daemon skeleton differential now covers every command
surface (100–111, 111 = the last undiffed surface, S2S inbound live-relay), and slices 112–115
backfilled the named §4 proptest gaps: 112 = nick-collision, 113 = post-registration gating
(found+fixed a real CR-framing bug), 114 = VERSION, **115 = iauth registration-seam** (native
leveva — `iauth_seam_proptest`, the `resolve_auth`→`finalize_registration` deferred-finalize gate
fuzzed over random verdict × arrival order; headline = byte-identical output regardless of order).
**Slice 116 (2026-06-11) then closed the last non-nightly §4 item — the prometheus-output
golden** — by turning it into a real feature: a `metrics { port; bind? }` config block stands up
an axum `GET /metrics` endpoint serving `Counters::encode_text()` (see [[leveva-prometheus-metrics]]),
pinned by `golden_metrics.rs` (boot + raw-HTTP scrape) + `metrics_endpoint_proptest.rs` (3 props).
The §4 "concrete fuzzing gaps" list is now **fully closed**. **Slice 117 (2026-06-12)** then
closed the §4 *lower-priority* "features fuzzed but never boot-tested" tail for the **client
keepalive** plane (heartbeat + ping): `golden_keepalive.rs` drives the real binary's keepalive
over a live socket (client PING→PONG, server-PINGs-idle-client, ping-timeout ERROR + close, and
the active-client-never-dropped inverse — the client twin of the existing `golden_s2s_keepalive`),
plus a Session-layer `keepalive_proptest` pinning the wire+state contract the pure-core
`heartbeat_proptest` never reached. **Slice 118 (2026-06-12)** landed the §4 "cargo-fuzz tier
over `Message::parse` + the full `Session::feed` byte path" as its **verifiable structured
analogue** (the libfuzzer tier needs a nightly toolchain → stays optional/P12):
`feed_framing_proptest.rs` (5 props — never-panic/well-formed output, chunk-boundary
reassembly invariance, the 512/8191 edges) + `golden_recvq.rs`, and **found+fixed a real
unbounded-`self.buf` DoS** — the raw-TCP serve loop fed 4 KB chunks into an uncapped
accumulation buffer (a client that never sent CR/LF grew it without bound), now bounded at
`MAX_INBOUND_LINE` (tag budget + body = 8703) with a `417` + skip-to-terminator resync,
faithful in spirit to `dbuf_getmsg`. **The §4 concrete fuzzing gaps are now EXHAUSTED.**
Only the optional nightly cargo-fuzz
tier (needs nightly; marked P12) remains. P11 is at its §7 definition-of-done; next is the **deferred infra items**
(per-class connection caps, listener live-rebind, the auto-connect dial loop, default-channel-modes
rehash — each needs live-accounting/accept-task infra leveva lacks) or **P12 proper** (delete
`ircd-common`/`ircd-rs`). **Ask the user.**

**Next P11 work** — the parity matrix toward P12 is **underway** (45 = channels, 46 =
burst/netsplit, 47 = WHO/WHOIS/WHOX, 48 = CAP/IRCv3, 49 = PASS/connection-password, 50 = STATS
k/K, 51 = IRCv3 multi-prefix, 52 = live two-node link integration, 53 = WebSocket transport +
`+W`, 54 = auto-reop, 55 = bot mode, 56 = message-tags foundation, 65 = rehash → live MOTD
reload, **81 = rehash → live opers/classes**, **83 = rehash → live allows/I-lines**, **88 =
LINKS/MAP network enumeration**). Remaining
matrix areas: **rehash beyond opers/classes/allows** (slices 81+83 hot-reload `operator` +
`class` + `allow` blocks via a `ConfStore` global in `control.rs` — the slice-65 `MotdStore`
pattern, read preferentially over the immutable boot `ServerContext` by OPER/STATS o/STATS
y/STATS i + the registration I-line gate; **still boot-immutable: listeners** — needs live
socket-rebind/accept-task infra — **+ links/admin/options/iauth**, each its own slice), **more
registration edge cases** (I-line
enforcement + class assignment DONE slice 82, CIDR masks DONE slice 89; remaining = per-class
connection caps + require_ident/no_resolve/xline_exempt — need live connection-accounting infra),
the **other STATS
letters** (l/L/p/P/t/T/f/F/a/? — each blocked on per-connection traffic counters or live infra
leveva doesn't track yet; a deliberate non-trivial dependency, not a quick add),
**rehash/restart**, **iauth end-to-end**, and **more IRCv3 caps** (userhost-in-names,
message-tags, server-time, … — each its own slice per [[leveva-ircv3-track]]). Each is an
independent slice with no single obvious order → **ask the user which area next** (as with
slices 45–51). The end is P12: retire
`ircd-common`/`ircd-rs`, leveva is the product.

**Slice 136 DONE (2026-06-13): per-class connection caps — the long-deferred registration item
(punted at 49/82/89).** Built the live connection-accounting infra: new `leveva::connlimit`
(pure `check_admission` decision + the per-`ServerContext` `ConnLimits` store with atomic
`try_admit`/`release` + `ConnTicket`) + `cidr::network_base`. Enforces a matched class's
`max-links` / `max-local-per-host` / `max-local-per-user-host` / `cidr` caps at
`session::finalize_registration` (after the nick `try_claim`, before the class ping re-arm):
a full cap undoes the claim and refuses with `ERROR :Closing Link: <host> (<reason>)` (no
numeric — class-full isn't a ban); `Session::release` frees the ticket (`Session.conn_ticket`).
`0` = unlimited; caps read the boot class set (slice-81 stance); ticket captures the pre-cloak
host. **Local clients only** — server links/opers/remote users don't traverse finalize, so the
network-wide `max_global_*` caps stay deferred (need to count the `Network` mirror) +
`require_ident`/`no_resolve`/`xline_exempt` still carried-not-acted. leveva-native (no
differential). Gate: connlimit/cidr/session units + `golden_conn_limits` + `conn_limit_proptest`
(pure truth-table + stateful model fuzz). **Remaining matrix:** the other STATS letters
(l/L/p/P/t/T/f/F — per-conn traffic counters), listener live-rebind, the auto-connect dial loop /
default-channel-modes rehash, `account`/SASL infra (the last S2S-notify tag), or **P12 proper**.
**Ask the user.**

**Slice 137 DONE (2026-06-13): listener live-rebind on `REHASH`** (user-chosen from the matrix
above). Closes the last "deferred — needs live socket-rebind infra" note in
`control::rehash_config`. New `leveva::listeners` module, split like `control.rs`: a pure
`plan(current, desired) -> RebindPlan { open, close, keep }` over a normalized `ListenerSpec`
(keyed `(bind, port)`; same-key-identical → keep so connections survive, same-key-changed →
close+open rebind, dedup-first-wins) + `LiveListeners` registry of accept-task `AbortHandle`s
(process-global for the server, fresh-instance for tests) + an `install_rebinder`/`rehash` seam so
the binary injects the bind+spawn closure. `main.rs` factored per-listener bind+spawn into
`open_listener` (sync `std` bind → `from_std`, callable from both async boot and the sync rehash
closure), records each at boot, installs `rebind_listeners` (re-read config → plan → close removed →
bind added, best-effort). `command/rehash.rs` calls `listeners::rehash()` beside the conf/MOTD
reloads. **Divergences:** a rehash-added TLS port loads its cert but isn't added to the live cert
watcher (later cert edit needs another REHASH); `delayed` listeners stay out of the desired set.
leveva-native. Gate: 12 `listeners` units + `golden_rehash_listeners` (real binary: live add +
remove + unchanged-survives) + `listener_rebind_proptest`. **Remaining matrix:** the STATS traffic
letters (l/L/p/P/t/T/f/F), the auto-connect dial loop / default-channel-modes rehash, `account`/SASL
infra (the last S2S-notify tag), or **P12 proper**. **Ask the user.**

**Slice 138 DONE (2026-06-13): WHOIS shows the target's user modes (`379 RPL_WHOISMODES`)**
(WHO/WHOIS sweep; user asked "make WHOIS show the user modes for a user"). `WHOIS <nick>`
emits `:<srv> 379 <requester> <tnick> :is using modes +<modes>` (rendered via the existing
`UserMode::render`), placed after the `276` certfp block / before the `317`/`318` tail.
**Privacy-gated**: only the target themselves (`client.uid == rec.uid`) or an operator
(`client.modes & (Oper|LocalOp)`) sees it — a non-oper WHOISing another never sees their
modes. leveva-native (IRCnet 2.11 has no `379`); the WHOIS skeleton differential's self-WHOIS
now documents the spliced-`379` divergence (`whois_core_agrees_modulo_leveva_379`). Gate:
whois units (self/oper-visible + non-oper-hidden inverse) + `golden_whois_modes` +
`whois_modes_proptest` (render over the full UserMode bit space + privacy gate). **Prep commit:**
`leveva-integration` native_oracle ServerContext was missing the slice-136 `conn_limits` field
(pre-existing build break) → fixed first. **Remaining matrix:** the STATS traffic letters
(l/L/p/P/t/T/f/F), the auto-connect dial loop / default-channel-modes rehash, `account`/SASL
infra (the last S2S-notify tag), or **P12 proper**. **Ask the user.**

**Slice 139 DONE (2026-06-13): services account identity via `ENCAP * SU <uid> :<account>` +
WHOIS `330` / WHO `%a`** — opened the **account-notify / SASL** matrix area. **User directive:
accounts are SERVER-DRIVEN** ("service accounts should be set by a remote server broadcasting an
`ENCAP * SU <uid> :<account-name>` command") — NOT client SASL (a service logs a client in and
`SU`s it; client-side SASL is a later, larger slice). leveva keeps **no account DB of its own**.
New `ClientRecord.account: Option<String>` + `Registry::set_account` (the read SoT — UNICK already
mirrors remote users into the registry; **no `RemoteUser.account`** field — nothing reads it,
deferred to burst-re-assertion to dodge 36 construction-site churn). New `leveva/src/s2s/su.rs`
`apply_encap_su` (mirrors `setname.rs`): keyed on the **`<uid>` PARAM** (a service sets *another*
user's login, unlike SETNAME/UMODE source-keyed), present+valid trailing = login / absent+empty =
logout / invalid (`account_valid`: empty/SP/CR/LF/leading-`:`) = no-op; wired a `Some("SU")` arm
into `forward::inbound_encap` (verbatim split-horizon relay intact). `330 RPL_WHOISACCOUNT`
(leveva-native de-facto charybdis code) after 313/before 320, **not** privacy-gated; WHO/WHOX `%a`
now renders the account or `0`. leveva-native (no differential). Gate: su/registry/forward/whois/
who units + `golden_s2s_account` + `account_proptest`. **Follow-ons (the account behavior caps,
framework-vs-behavior rule, see [[leveva-ircv3-track]]): `account-notify` (push `:nick!u@h ACCOUNT
<name>`/`ACCOUNT *` to co-members on a `SU`-driven change), `account-tag` (`@account` on messages),
`extended-join` (account in JOIN), the `RemoteUser.account` mirror + burst re-assertion, and
client-side SASL.** Plan:
`docs/superpowers/plans/2026-06-13-p11-slice139-account-identity-su.md`.

**Slice 144 DONE (2026-06-13): drop the IRCnet channel types `&`/`!`/`+` — `#` only**
(user directive: "Remove &, !, and +-channels. They are an IRCNet specific thing not
needed in Leveva"). `CHANTYPES="#"`; `ident::validate_channel` accepts only a `#` first
char (others → `BadPrefix`). With `+`/`!` gone the **modeless** machinery they were the
only users of is deleted: `channel.rs::use_modes()` removed, a channel creator is always
a chanop, and the now-unreachable `KickGate::NoChanModes` / `ApplyOutcome::NoChanModes`
variants + their `477` handler arms (kick.rs/mode.rs) are gone (`Numeric::ErrNochanmodes`
stays in the table — it's a wire-code registry). The three S2S channel-sigil helpers
(`s2s/{mode,mod,relay}.rs`) narrowed `#&+!`→`#`; `relay::local_join` dropped its dead
`&`-channel non-propagation skip. **Fuzzing:** new `tests/chantypes_proptest.rs` (512
cases) — `#`-bodies parse+round-trip; **inverse**, any `&`/`!`/`+` name is `BadPrefix`
regardless of body; arbitrary bytes never panic. Docs: rewrote `help/CHANNEL_TYPES.md` +
fixed KICK/REOP_LIST help + 8 ISUPPORT golden snapshots. Plan:
`docs/superpowers/plans/2026-06-13-p11-slice144-drop-irc-net-channel-types.md`. Gate:
`cargo test -p leveva` green / clippy clean / workspace 0 warnings.

**Slice 145 DONE (2026-06-13): per-connection traffic counters → `STATS l`/`L` (211) +
`t`/`T` (249).** User chose "STATS traffic letters" (the infrastructure-heavy matrix area)
+ "add fuzzing". Built the counter infra that was the long-standing blocker: new
`leveva/src/connstats.rs` `ConnStats` (4 `AtomicU64` + connected_at, lock-free), an
`Arc<ConnStats>` shared between a connection's serve loop (the writer — counts every socket
read/write via a `count_sent` closure) and the registry `Entry` (so `STATS l` on *another*
task can read it). `Registry::try_claim_with_stats` + `link_info()` (the live finalize site
passes the session's Arc; `try_claim` keeps its sig with a default to avoid churning ~8 call
sites). `STATS l`/`L` → one `211 RPL_STATSLINKINFO` per local client (pure `link_report`;
sendq always 0 — unbounded mpsc; K=bytes/1024; local clients only); `t`/`T` → two
leveva-native `249 :Traffic …` lines from cumulative `Counters` traffic IntCounters (pure
`traffic_report`). **Still deferred (NOT traffic-blocked — different state):** `p`/`P`
(opers-online/listeners), `f`/`F` (fd table), `a`/`?`. Tests: connstats/registry/stats units
+ `golden_stats_traffic` + `stats_traffic_proptest` (5 props fuzzing the accumulator +
render over arbitrary counters) + canonicalizer 211/249-Traffic masks + golden_metrics
traffic-value mask. Plan:
`docs/superpowers/plans/2026-06-13-p11-slice145-conn-traffic-stats.md`.

**STATUS UPDATE: P12 IS DONE (2026-06-13) — the strangler is finished, `ircd-common`/
`ircd-rs`/`iauth-rs`/`leveva-integration` are DELETED.** The description's "toward P12 /
delete ircd-common" framing is now STALE — leveva is the standalone product; future work is
plain feature slices in the P11 cadence (unit + boot-golden + proptest), NOT migration.

**Slice 146 DONE (2026-06-13): the remaining `STATS` letters `?`/`P`/`a`.** `?` → `249` per
directly-linked server (`<name> <S>S <U>U`, multi-hop counts via a sid→uplink map); `P`
(uppercase ONLY — `p` stays `*`) → `211` per live listener; `a`/`A` → `239 RPL_STATSIAUTH`
per configured auth module. The `STATS` surface is now complete; `p`/`f`/`F` + unmodeled
config-block letters stay `*` as documented divergences. `stats_topology_proptest` fuzzes the
`?` counts over arbitrary spanning trees + `golden_stats::stats_topology_queries`.

**Slice 147 DONE (2026-06-13): per-connection SendQ accounting + Max-SendQ backpressure kill**
(user chose it from a 4-way fork; "add fuzzing"). The unbounded mailbox is now bounded by a
per-class `sendq` ceiling (else `DEFAULT_SENDQ` = 1 MiB) — `ConnStats` (the slice-145 Arc)
gained `sendq`/`sendq_peak`/`sendq_dead` + `sendq_admit/force_add/drain`; the registry's 4
client-delivery sites account on enqueue, `serve_client` drains on dequeue; over-ceiling →
one terminal `ERROR :Closing Link: <host> (Max SendQ exceeded)` eject then drop the rest
(KILL/SAVE bypass). `try_claim` (remote/test, no draining loop) passes `sendq_max = 0` =
account-only. `STATS l` renders the live depth (was hardcoded 0). The write-side twin of the
slice-118 recvq cap. **Finding: every test fixture's cosmetic `sendq 1000` was unenforceably
tiny** — bumped all to the shipped example's `512000` (surfaced+fixed a `golden_s2s_mass_burst_drop`
overrun). Unit + `sendq_proptest` (3 model-lockstep props); no boot-golden (kill is
socket-timing-dependent). **Prep commit:** slice-146's `?`/`P`/`a` were never added to
`stats_proptest::is_recognized` → latent RNG-flaky; fixed first.

**Slice 148 DONE (2026-06-13): SendQ follow-ons — bounded socket writes + server-link SendQ
accounting** (user chose "SendQ follow-ons" from a 4-way fork; "add fuzzing"). The two items
slice 147 deferred. **Part A — bounded writes:** new `leveva::netio` (`WRITE_TIMEOUT` = 60 s +
`write_bounded`/`flush_bounded`, `tokio::time::timeout` over `write_all`/`flush`); both serve
loops (`serve_client`, `serve_linked_peer`) route every steady-state write/flush through them,
so a fully-wedged socket (peer not reading → `write_all` parks the whole `select!` task → the
ping branch is unreachable) is now force-closed at the deadline instead of leaking the fd/task.
**Part B — server-link SendQ:** `PeerLink` gained `stats: Arc<ConnStats>` (in `PeerLink::new`,
sig unchanged); `LinkEntry` gained `stats`/`sendq_max` + a private `enqueue` (slice-147
admit/overflow/drop policy, overflow → one `ERROR :Closing Link: <sid> (Max SendQ exceeded)`
eject → `squit_subtree`); the 4 `PeerLinks` send methods (route/route_tag_only/broadcast/
broadcast_tag_only) route through it, accounting the **egress** (post tag-strip) length;
`PeerLinks::link` → account-only wrapper, new `link_with_stats` is the live path
(`main.rs:serve_linked_peer` passes `link.stats.clone()` + `DEFAULT_SERVER_SENDQ` = 8 MiB,
drains per dequeued frame). Divergences: ceiling is the constant not the connect-block class
(per-connect resolution = follow-on; first-class pick would wrongly give a server the 512 KB
users ceiling); registry-routed remote-user frames carry their own account-only stats (drain is
saturating, so harmless). Tests: 3 netio units + `netio_proptest` (2); 5 links units +
`s2s_sendq_proptest` (2 model-lockstep). Added `tokio` `test-util` dev-dep for `start_paused`.
No boot-golden (timing-dependent), as slice 147. Plan:
`docs/superpowers/plans/2026-06-13-p11-slice148-sendq-followons.md`.

**Slice 154 DONE (2026-06-14): the last STATS state letters `f`/`F` + `p` — STATS SURFACE
COMPLETE.** `f`/`F` = the oracle `report_fd` fd/connection table: pure `command::stats::fd_report`
→ one `211` per registered connection over a new richer `registry::connections() -> Vec<ConnInfo>`
(uid/nick/user/host/last_activity, sibling of `link_info`), **oper-gated on `OperPrivilege::Trace`**
(the oracle's `ACL_TRACE`+`MyConnect`; denied → no body + `219 *`, NOT `481`). Renders only the
tokio-available analogues — the connection UID stands in for the raw fd, local-listener/remote
socket addresses dropped-not-faked, idle from `last_activity`. `p` (lowercase; uppercase `P` stays
listeners) = recognized-but-always-empty like `K` (leveva has no `aCPing`/`calculate_preference`
preference-pinging → never any `246`). The gate rides a new `stats_fd_ok: bool` param threaded
through the shared `command::query_answer`/`stats` (local dispatch passes `has_privilege(Trace)`;
the S2S `hunt_server` query path passes `false` — a remote requester is never a local-fd oper).
leveva-native (no differential). Fuzz: `fd_stats_proptest` (256 cases: trace-oper body count +
idle≥0 + the inverse non-oper-always-`*` gate). **Only the unmodeled config-block letters
(`b`/`h`/`q`/`s`/`v`/`d`/`r`/`x`) now stay `*`** — there are no more STATS state letters to add.

**Slice 155 DONE (2026-06-14): IRCv3 `labeled-response` (+ the `batch` framing dependency)** —
echo a command's inbound `@label` back on its **direct reply** (0→`ACK`, 1→tagged-in-place,
≥2→`labeled-response` BATCH). Pure `leveva::labeled::wrap` over the `command::dispatch` reply vector
at the `session` seam; both `labeled-response`+`batch` advertised (gate = `labeled_response`, batch
wired-but-not-read so a future batch slice adds more types). Direct-reply path only (async mailbox
echo/fan-out out of scope). leveva-native. See [[leveva-ircv3-track]] for the full entry. **Pitfall:
I hallucinated the spec doc — the user had the real ircv3.net text and replaced it; implementation
was already correct against it (incl. the PONG→ACK + WHOIS-batch examples).**

**NEXT = ask the user** among: **SASL** (the IRCv3 keystone — client auth INTO the slice-139
account SoT), a dedicated **batch** slice (more batch types — the framing + `batch` cap now exist
from slice 155), further SendQ hardening (a dedicated writer task / per-connect server `sendq`
resolution / accounting the registry-routed remote-user sub-path on the peer's ceiling), or other
IRCv3 caps. **STATS is fully done (slice 154); labeled-response done (155) — do NOT re-offer
them.** Excluded set unchanged (SET/CLOSE/SUMMON/SERVICE).

This builds on the slice 31–34 S2S foundation: the `leveva/src/s2s/` modtree
(handshake/burst/unick/njoin/mode/save/eob/squit/relay/links) and the `Network` mirror in
`ServerContext`. Each S2S slice follows the established P11 cadence — unit + boot golden +
proptest; **no `leveva-integration` differential** (the oracle S2S handlers are impure,
global-buffer, so there's no pure entry point to pin against), as with every recent slice.

**Excluded — do NOT pick these:** `SET` ([[set-not-required-leveva]]), `CLOSE`
([[close-not-required-leveva]]), `SUMMON` ([[summon-utmp-not-required]]),
`SERVICE`/`SQUERY`/`SERVLIST` ([[leveva-service-is-client-services]]); and the oper-debug
stats rows `HAZH`/`DNS` are low-value C-internal-stats — ask first.

Related: [[leveva-pivot-p9-retired]] (its stale "next concrete step" = the registration
machine is long done), [[leveva-command-folder]], [[leveva-s2s-port-based-routing]].
