3:## Context
16:1. **Faithful mechanical port now**, then **dedicated idiomatic‑Rust passes at the very end** (after C is gone). ⚠️ **Superseded (2026‑06‑08):** decision 1 originally meant an *in‑place* idiomatic transformation of the mechanical port (the old P9–P12). The project instead forked a **parallel greenfield idiomatic daemon, `leveva`**, tested differentially against the now‑complete mechanical port. So the idiomatic end‑state is reached by *growing `leveva` to parity and deleting the mechanical port*, not by polishing it in place. See the reframed P9–P12 below.
25:## The migration model (the seam)
44:## Keystone hazards & how we neutralize them (all verified in‑tree)
59:## The 4‑layer test harness (built in P0, used every phase)
69:- **L4 — conformance.** Rescoped: (1) extract the numeric→format table from `s_err.c` `replies[]` and assert the Rust port reproduces it (an L1 test); (2) curated scripted‑client assertions on numeric **code + arg arity/semantics** from `doc/whox.md`, `doc/whoistls.txt`, `rfc2812.txt`. (There is no machine‑readable RFC oracle; `replies[]` _is_ the truth.)
73:## Phases
77:> **⚠️ Roadmap pivot (2026‑06‑08).** P9–P12 below are **reframed**. The original plan transformed the mechanical port (`ircd-common`) into idiomatic Rust *in place*. Instead the project forked a **greenfield idiomatic daemon, `leveva`** (its own crate: async tokio, `rustls` TLS, KDL config, typed identifier strings — already ~6.3k LOC of foundations). The strangler pattern now repeats one level up: **`ircd-common` (the verified‑faithful mechanical port) is the behavioral oracle for `leveva`**, exactly as the C tree was the oracle for `ircd-common`. `leveva-integration` holds the cross‑crate differential tests. The idiomatic end‑state is reached by growing `leveva` to feature parity, differentially pinned against `ircd-common`, then **deleting the mechanical port** (`ircd-common`/`ircd-rs` + the C‑era `iauth-rs` scaffolding). An oracle only needs to keep building + passing its tests — it does **not** need to be idiomatic, so the in‑place cleanup (old P9) is retired as throwaway work.
85:| **P3 — Transport & format ✅ DONE**                     | `s_err.c` (`replies[]`), `s_id.c` (UID/SID/CID), `s_numeric.c` (`do_numeric`), `send.c` **delivery core** (`send_message`/`send_queued`/`flush_*`). **Finding:** the whole `sendto_*`/`esendto_*` family is irreducibly C trampolines (variadic; `vsendpreprep` consumes `va_arg` per‑recipient) → no non‑variadic cores extractable; senders + `sendto_flog`/`logfiles`/`setup_svchans` stay C (move to P7/P8). | Faithful; `replies[]` as Rust static (dumped from the oracle so config‑gated `#if` entries resolve); exact UID/SID base‑N; `send.c` partial‑ported via `send_link.o` (`-DPORT_SEND_P3`, `dead_link` exposed). ZIP/USE_SERVICES/LOG_SERVER_CHANNELS/etc. all OFF. | **MET (L1):** zero‑diff vs `cref_` on `replies[]` (all 1000), `ltoid`/`idtol`/`sid_valid`/`cid_ok`/`check_uid`, `do_numeric` guards, `send_message` sendQ buffering + `send_queued` early returns. **L2 (post‑P3):** `do_numeric`/sender wire broadcasts + `deliver_it` write path. |
90:| **P8 — Delete the C + retire the oracle harness ✅ DONE** (per-sub-phase: [`PLAN-P8-progress.md`](PLAN-P8-progress.md) + [`docs/progress-log/p8.md`](docs/progress-log/p8.md)) | remaining C (the ~25 variadic sender trampolines + residual data globals) + `ircd-sys` C build + `ircd-golden` (L2) + `ircd-testkit`/`cref_*` archives (L1) + the frozen reference‑C tree | With all C _logic_ already Rust (P7 exit), delete the last C: replace the variadic sender trampolines with a non‑variadic Rust sender API at every call site (faithful `wire!`/`reply_one!`/`format!` first; leveva typed messages adopted alongside the IRC senders), drop the residual data globals via the data‑symbol seam (bindgen `extern` decls resolve to `#[no_mangle]` Rust defs at link), then drop **all** C compilation from `ircd-sys` (no more `cc::Build`), retire the differential harness (`cref_*`/L1 `ircd-testkit`/`ircd-golden` L2 can no longer be built once the oracle is gone), and **migrate the load‑bearing tests into `ircd-common`** as self‑contained Rust tests (own fixtures, no `cref_` oracle). **Progress (P8a–P8r — full entries in the progress logs):** **every variadic sender trampoline is now Rust** (P8a–P8m, incl. the keystones `sendto_one`/`sendto_flag`/`esendto_*`), and the five data‑global `.o`s are dropped outright (`s_auth.o` iauth globals P8n, `send.o` P8o, `s_bsd.o` `local[]`/`highest_fd`/… P8p, `ircd.o` `me`/`client`/timers/… P8q). **P8r dropped the last C‑logic TU `support.o`** — `dgets`/`make_isupport` ported to Rust + the `ipv6string`/`minus_one` data globals defined as `#[no_mangle]` statics (`snprintf_append` is dead in Rust — WHOX is field‑by‑field — so it died with the `.o`; `irc_sprintf` is deleted not ported, in P11). **Every ircd C TU is now Rust:** the link set holds only the generated `version.o` + the L1 harness's `ctruth.o`. **P8s migrated all 115 L1 `cref_` differentials into self‑contained `ircd-common` `insta` snapshot tests** (drive only the Rust port via `link_anchor()`, no oracle; soundness via the capture chain) — the suite is green + 0 warnings. **P8t ported the last *generated* C TU `version.c` to Rust** (`ircd-common/src/version.rs`): the data globals `generation`/`creation`/`pass_version`/`infotext`/`isupport` are now `#[no_mangle]` statics via the data‑symbol seam — `generation`/`creation` sourced from crate metadata at build time (`CARGO_PKG_VERSION` + an `ircd-common/build.rs` UTC build stamp), `pass_version`/`infotext` copied verbatim. `version.c.SH` generation + the `version.o` compile/archive are gone from `ircd-sys/build.rs`; `libircd_c.a` now holds **only** the L1 harness `ctruth.o`. (`creation` is now genuinely build‑time volatile, so the golden canonicalizer masks RPL_CREATED 003, matching the existing 371 Birth‑Date rule.) **P8u (FINAL) retired the oracle.** Ran the differential suite a last time green — L1 `ircd-testkit` all pass; L2 `ircd-golden` 86 pass + only the documented reference‑C‑garbage `s_serv_stats` flake (where Rust is the *correct* side) — then **dropped all C compilation** from `ircd-sys/build.rs`: the `make` object build, the `cref_*`/`ctruth.o`/`res.o` recompiles, the `libircd_c.a` archive, and the whole‑archive link + `-lz`/`-lm`/`-lcrypt` (none needed by Rust — `pow` resolves from glibc 2.29+). `build.rs` now only runs `configure` + bindgen over the C *headers* (the struct view `ircd-common` still uses until P9–P12) and expands the install‑path Makefile vars. `ircd-testkit` (L1) + `ircd-golden` (L2) are `exclude`d from the workspace (mothballed, git‑recoverable); the `ctruth.c`/`layout.rs` drift‑net is deleted. **The workspace is now 100% Rust — zero C TUs compiled.** **P8v (literal end of C) deleted the C *source tree* itself + retired `ircd-sys`:** froze the generated `bindings.rs` into a committed `ircd-common/src/bindings.rs` (a self‑alias `extern crate self as ircd_sys;` keeps every `ircd_sys::bindings::*` path resolving, zero src churn) + the install‑path consts as literals, then deleted `ircd-sys`, the mothballed `ircd-testkit`/`ircd-golden` oracle crates, the `iauth-rs` C‑iauth differential, and **all** C source (`common/ ircd/ iauth/ support/ contrib/ cbuild/ configure .clang-format* clangformat.yml`). `ircd-rs` calls `ircd_common::ircd::c_ircd_main` directly. **Not one line of C remains in the repo.** | **MET. Final differential run green; oracle mothballed; `cargo build --workspace` 0 warnings links pure Rust; `cargo test --workspace` 695 pass / 0 fail (P8v; was 698 before deleting the C‑oracle tests); the `ircd-common` snapshot tests carry the reference‑C correctness forward. C source tree deleted — repo is 100% Rust at the file level.** |
92:| **P10 — `leveva` greenfield foundations 🔶 IN PROGRESS** ([`docs/progress-log/p10.md`](docs/progress-log/p10.md)) | new `leveva` crate (lib) + `leveva-integration` differential tests                                                                                                        | The idiomatic‑Rust product, built from scratch (not transformed from the port). **Done so far:** RFC 1459 case‑folding (`casemap`); typed identifier strings (`IrcStr`/`IrcString` + `Nick`/`ChanName`/`Uid`/`Sid`/`Cid`/`ServerName`/`UserName`/`HostName` validating newtypes via `ident_newtype!`); `Message`/`MessageBuilder`; the full `Numeric` reply/error enum (184 codes, discriminant = wire code); a generic safe `patricia` trie; glob `matching`; `mode`; KDL `config` (model/parse/password/privilege); `rustls`/`tokio` `tls` endpoint with hot reload; `ident`. The async boot path (`main.rs`) binds listeners + watches certs but currently drops accepted connections — no protocol layer yet. Idiomatic Rust allowed everywhere; pulls real crates (tokio/rustls/kdl/nom/clap). | `cargo test -p leveva` green + clippy clean per module; `leveva-integration` pins each greenfield reimplementation against `ircd-common` (the oracle) within their shared domain (documented divergences asserted explicitly). |
93:| **P11 — `leveva` protocol layer → feature parity 🔶 IN PROGRESS** ([`docs/progress-log/p11.md`](docs/progress-log/p11.md)) | `leveva` (client/server state machine + handlers) | The bulk of the remaining work: the connection + registration state machine, the post‑registration command handlers (JOIN/PRIVMSG/MODE/KICK/TOPIC/WHO/WHOIS/…), channels + channel/user modes, the S2S link/burst protocol (UID‑based: UNICK/NJOIN/SAVE/EOB), and `leveva-iauth` (native async auth — dnsbl/socks/webproxy/pipe/ident). Each slice is built idiomatically (owned per‑connection state, typed identifiers end‑to‑end, `Result`/`thiserror`, `format!`/typed builders — **no** `sprintf`/global `buf`), unit‑tested + boot‑golden + proptest‑fuzzed, and **differentially pinned against `ircd-common`** (or `iauth-rs` for auth) wherever a pure oracle entry point exists — structural skeleton + documented divergences, since leveva emits a clean modern burst rather than a byte copy. **Done: 309 slices** (309 = channel mode `+M` (operpeace) — a port of charybdis `extensions/chm_operpeace.c`: a `+M` channel flag that prohibits a **non-operator** from kicking an IRC **operator** out of the channel (the kick-shaped sibling of `+Y` immunity / elemental rank protection); pure fuzz seam `channel::operpeace_blocks(operpeace_set, kicker_is_oper, victim_is_oper)` = faithful charybdis `if (IsOper(source_p)) return;` + `+M && receive_immunity`, with `operpeace_enabled` the read accessor and the shared `command::{operpeace_protects, operpeace_refusal}` resolving live state (victim oper-status from the registry mirror → works for remote victims); enforced in `command/kick.rs` **and** `command/remove.rs` (a blocked kick → `482 :Cannot kick IRC operators from that channel` + a `+s` audit snotice, victim untouched) — **OKICK is unaffected** (oper-gated, always bypasses); new `ChanMode::OperPeace` letter `M` bit `0x2_0000_0000`, **oper-only to set** (like `+P`/`+L` via `permanent_set_allowed`, a non-oper `MODE +M` → 481); divergences = leveva-native (no oracle), refusal reuses `482` not charybdis's `484 ERR_ISCHANSERVICE` (leveva's 484 = ERR_RESTRICTED), oper-bit immunity not per-privilege, mode change shown to all members (no `ONLY_OPERS`); 10 lib units + `operpeace_proptest` (3 props) + `golden_operpeace`, with the isupport/registration asserts + 10 CHANMODES/MYINFO snapshots regenerated, `help/CHANNEL_MODES.md` gains the `+M` row; 308 = roleplay system — a port of charybdis `extensions/m_roleplay.c`: a `+N` (roleplay) channel flag enabling `NPC`/`NPCA`/`SCENE`(+`AMBIANCE` alias)/`FSAY`/`FACTION` commands that speak to the channel from a **fake** nickname (source `<fake>!<author>@npc.fakeuser.invalid`, the body suffixed `(<author>)` and the ident = the real author, so authorship is always recoverable); `NPC`/`NPCA` underline the fake nick, `SCENE` narrates under a fixed `=Scene=`, `FSAY`/`FACTION` give opers a clean nick (underlined NPC fallback for non-opers), and `*A` variants wrap the body as a CTCP `ACTION`; **first widened the full 32-bit channel-flags bitfield to `u64`** (`ChannelModes.flags`/`ChanMode::bit()`/`MemberStatus.bits`/default-channel-modes plumbing — `ExtendLimit` had taken the last `u32` bit) so `Roleplay` could claim `0x1_0000_0000`; pure fuzz seam `roleplay::compose` = faithful charybdis `m_displaymsg` (NICKLEN truncate → `strip_unprintable` dropping control chars `<0x20` + eating mIRC `\x03` colour runs + trimming trailing spaces → `None` if empty → `\x1F`-underline → `(author)` suffix → `\x01ACTION …\x01` 500-cap), the gate ladder reusing `display_name`/`is_member`/`roleplay_enabled`/`can_send` (`461`→`403`→`442`→`573`-`+N`-off→`573`-cant-send→`573`-empty-nick), fanning the fake PRIVMSG to **all** local members incl. the issuer and propagating `:<uid> ENCAP * ROLEPLAY <chan> <display> :<body>` (new `s2s/roleplay.rs`, re-sourced + onward-relayed split-horizon like KNOCK); leveva-native (no oracle), new numeric `573 ERR_ROLEPLAY`, six help pages; 20 command units + 5 s2s units + `roleplay_proptest` (3 props: compose total/never-panics + structural soundness + underline-only-wraps + alphanumeric-always-`Some`) + `golden_roleplay`, with the isupport asserts + 9 CHANMODES/MYINFO snapshots regenerated; 307 = combination extbans `$&` (AND) / `$|` (OR), a port of charybdis `extensions/extb_combi.c`: two extban **operator** types whose data is a comma-separated list of child extbans (`[~]<type>[:<data>]`, no leading `$`), optionally paren-wrapped, with paren-aware comma splitting and backslash escaping — `$&` matches iff **all** children match, `$|` iff **any** does; children may nest (depth cap 5, ≤10 children/node, data ≤ `BANLEN` 195); faithful byte-walk of `eb_combi` in `extban/combi.rs` dispatching to the existing `eval_type` handlers (the C global `recursion_depth` threaded as a `depth` param — leveva runs many connections), preserving the two charybdis subtleties (a child **type** is validated for existence *always*, even when the result is short-circuited, via new `is_known_type`; a child **data** only up to the short-circuit point → combiban validity is subject-dependent); `extban_chars()` → `"&acjmorsxz|"` so `005` advertises `EXTBAN=$,&acjmorsxz|`; divergences = leveva-native (no oracle), and leveva's `$m` is **usermode** not charybdis's hostmask so host matching inside a combiban uses `$x:<nick!user@host>#*`; 11 `combi` units (AND/OR/negated/nested/paren+escaped-comma + inverses: every malformed shape Invalid, unknown-child-Invalid-even-when-short-circuited, >10-children/depth-6/>BANLEN Invalid) + `extban_combi_proptest` (6 props: total/never-panic over the structural alphabet + nested totality, AND==`all`/OR==`any` model, single-child==bare, De Morgan) + `golden_extban_combi` (`+b $&:~a,o` and `+b $|:o,z` JOIN gates biting only after OPER, + the 005 token), with the `isupport`/`elemental_extban`/`mod.rs` asserts updated and 9 EXTBAN-token snapshots regenerated; `EXTBANS.md` gains the `$&`/`$|` types + a Combination bans section; 306 = user mode `+C` (no-CTCP), a port of charybdis `extensions/umode_noctcp.c`: a self-settable umode that makes a user refuse CTCP queries (other than `ACTION`) addressed to them as a PRIVMSG, replying `531 ERR_CANNOTSENDTOUSER :+C set` — the recipient-side private-message counterpart of the channel `+C` (slice 220), reusing the fuzzed `channel::is_blocked_ctcp` classifier; pure seams `mode::is_noctcp`/`mode::noctcp_user_blocks` (the composite gate decision), enforced home-server-local on BOTH the local `command/message.rs` path and the inbound-S2S `s2s/relay::inbound_message` path (new `noctcp_reject_remote` routing `531` to the sender's uplink, the `+R` 248→249 split precedent) while the bit still propagates (slice-254 "no local-only umodes" — WHOIS shows `+C`); bit `0x80000`, numeric 531, `umode_diff`/`RENDERED`/004-literal/5-snapshot wiring per the user-mode checklist; units (mode seam, command self-settable, message gate + inverses, s2s inbound + inverses) + `golden_noctcp_umode` + `noctcp_umode_proptest` (5 props); 305 = `REHASH` hot-reloads the `webirc {}` trusted-gateway blocks (closing the slice-301 follow-on): the gateway list is carried through the `control::ConfStore` live-config chain (slices 81/83/91/.../303) and read live-or-`ctx` at `session::handle_webirc`, so an operator can add/edit/remove a trusted webchat gateway with no restart; new `control::live_webirc` global, `golden_rehash_webirc` (add→spoof→remove inverse), and the `rehash_conf_proptest` reload model extended with a generated `webirc` set; 304 = route the `user@server` alias target form (charybdis `m_alias` `find_server` branch): an `alias "<n>" { target "user@server" }` now resolves the server part to a **linked remote** server and routes `:<client-uid> PRIVMSG user@server :<text>` to its `uplink` (unknown/our-own name → `440`, then empty text → `412`); pure fuzz seam `alias::remote_privmsg_wire` (totality + clean-input round-trip proptest), plus the S2S `golden_alias` `PEER`/`GONE` cases and unit inverses; 303 = charybdis `alias {}` config blocks (services command aliases): a config `alias "<name>" { target "<t>" }` block makes `<name>` a command that rewrites `<name> <text…>` into `PRIVMSG <target> :<text…>` and delivers it through the message plane (charybdis `modules/m_alias.c` — the real, *faithful* mechanism, found by comparing against a charybdis checkout; the "configurable IDENTIFY nicks" originally scoped does not exist in charybdis, which hardcodes the nicks); pure fuzz seam `alias::{parse_target (split on first `@` → nick vs `user@server`), combined_args, reconstruct}`, new top-level `alias` block (model/parse/from_kdl) held live + REHASH-able through `ConfStore` (`live_aliases`, the slice-256 chain), dispatch hooking the existing `command/mod.rs` 421 fallback (real commands win; case-insensitive match), `command::alias::deliver_to_service_nick` shared core (target must be a present `+S` service else `440 ERR_SERVICESDOWN`; empty text → `412`; else synth `PRIVMSG` → `message::message`, so a remote service is reached by UID routing), new numeric `440`; **also folded in the slice-302 IDENTIFY faithfulness fix** the comparison surfaced — empty args → `412` (was `461`), absent/non-`+S` agent → `440` (was `401`), both via the shared core; `user@server` parsed-but-not-routed (→`440`, documented follow-on); units (alias seam 7, command 5, identify updated, config parse) + `alias_proptest` (2 props) + extended `rehash_conf_proptest` alias reload + `golden_alias` (S2S +S burst: route + `440` inverse + `421` inverse) + rewritten `golden_identify` (S2S +S NickServ/ChanServ); 302 = `IDENTIFY` services login shortcut (charybdis `extensions/m_identify.c`): the client-facing companion to the services/SASL cluster (296–299) — a registered client types `IDENTIFY [<target>] <password…>` and the server rewrites it into a `PRIVMSG` to a services pseudo-agent (`ChanServ` when the first argument is a channel — leading `#`, else `NickServ`), delivered through the ordinary message plane to a linked services server; pure fuzz seam `identify::rewrite(params) -> Option<Rewrite>` (target picked by `params[0]`'s `#`, verbatim args re-joined after the keyword, empty/empty-first → `461`), `command::identify` synthesizing the PRIVMSG and delegating to `message::message` (so the agent sees `:nick!user@host PRIVMSG NickServ :IDENTIFY …` and an unlinked-services sender gets the plane's own `401`), `HELP IDENTIFY`; leveva-native sugar — hardcoded service nicks, registered-clients-only, no state and no S2S of its own (relay/echo/`account-tag`/`server-time`/cross-server delivery are entirely the message plane's, 296–297); seam+handler units + `golden_identify` (NickServ/ChanServ routing with a PING fence) + `identify_proptest` (rewrite total + contractual); 301 = `WEBIRC` webchat-gateway client IP/host spoofing (charybdis `extensions/m_webirc.c`): a trusted gateway sends pre-registration `WEBIRC <password> <gateway> <hostname> <ip>` so the proxied connection is recorded under the **real** client's host/IP, not the gateway's — every later admission gate (D/K/X-line, config-`ban`, per-class conn caps, `+x` cloak) and `WHOIS` key off the spoofed `self.host`; new `webirc {}` config block (host mask + password) + pure fuzz seam `webirc::{parse_request,spoof_host,authorize}`, `Session::handle_webirc` dispatched phase-independently (CAP/AUTHENTICATE seam), `+s` audit snotice; leveva-native single-host/no-DNS collapse of charybdis's `host`/`sockhost`, boot-read, one-spoof-per-connection (registered → `462`, bad-pw/untrusted/malformed → NOTICE no spoof); `HELP WEBIRC` topic + commented example/dist block; units + `golden_webirc` + `webirc_proptest`; 300 = IRCv3 `draft/read-marker` cap + `MARKREAD <target> [timestamp=<iso>]` command (companion to `draft/chathistory`, slice 274): a client records/queries how far it has read a target; a *set* stores `max(existing,new)` (monotonic — never regresses), echoes the **effective** value, and on a genuine advance fans the `MARKREAD` to the user's **other** capable connections (cross-device read-state sync); a *query* returns the stored `timestamp=…` or `*`; markers owned by the services **account** (synced, survives a reconnect) when logged in else the connection **UID** (dropped on `Session::release`); a statically-advertised **valueless** cap (always available), the command processed regardless of the issuer's cap (the cap gates only the cross-connection fan, per spec); new pure-fuzzed `readmarker.rs` (`parse_set_timestamp` accept-only-`timestamp=<iso>` / `format_value` / monotonic `ReadMarkers::advance` keyed account|UID), `command/markread.rs`, a `read_marker` `ClientCaps` bit + `DRAFT_READ_MARKER` SUPPORTED entry, the `forget_connection` release hook; leveva-native (the C 2.11 oracle predates IRCv3 — no differential); units (parse accept-only-`timestamp=` + INVERSE junk/`*`/empty, advance monotonic-first-set + INVERSE older/equal no-move, account-vs-UID owner isolation, `forget_connection` drops-only-that-uid + INVERSE account+sibling survive; command NEED_MORE_PARAMS/query-`*`/effective-echo/INVALID_PARAMS-changes-nothing/older-no-regress), `golden_markread` (CAP LS advertises + single-conn set/query round-trip + INVERSE older-ignored + cross-device push to a capable same-account sibling + INVERSE uncapped-same-account gets nothing), `readmarker_proptest` (2 props: `parse_set_timestamp` total + accepted-input round-trips, `advance` keeps-the-max order-independently + idempotent); 299 = learn the SASL mechanism list from the services agent (`ENCAP * MECHLIST`): the atheme-arc follow-on to 296/297/298 — leveva had hardcoded `sasl=PLAIN,EXTERNAL`; now a linked SASL services agent announces its mechanisms via `:<svcSID> ENCAP * MECHLIST :<comma-list>`, leveva learns + advertises **that** list (client-facing `sasl=` cap value + `908 RPL_SASLMECHS`) and relays whichever **advertised** mechanism a client picks — faithful charybdis **transparent relay** (leveva a dumb relay, special-casing only `EXTERNAL` for the CertFP; an unadvertised mechanism → `908`+`904`, never relayed — strictly safer than the old hardcoded gate). New pure fuzzed `sasl::parse_mechlist` (comma-split/trim/`[A-Za-z0-9._-]{1,20}`/uppercase/dedupe; `None` on all-junk → caller keeps prior list), `Mechanism` reworked `{Plain,External,Other(Box<str>)}` with `from_advertised`/`name`/`is_external` (was `from_token`/`as_str`), `PeerLinks` gained a learned-mechlist store (cleared when the last `caps.sasl` peer unlinks), new `s2s/mechlist.rs` dispatched in `forward.rs`'s interpret-and-onward-relay block (broadcast, like `SU`), `cap.rs` `apply`/`ls`/`req` `sasl_available: bool` → `sasl_mechs: Option<&str>`, atheme `leveva_mechlist_sts` + `mechlist_sts` wired; leveva-native (no oracle); `docs/s2s.md` MECHLIST subsection; units (`from_advertised` accept-only-advertised + INVERSE, `parse_mechlist` normalize/dedupe + INVERSE all-junk, mechlist store learned + INVERSE malformed-keeps-prior, links learned + cleared-on-unlink + INVERSE non-sasl-unlink-keeps, cap `sasl=<announced>` + INVERSE default), `golden_sasl` advertised-list+transparent-relay + INVERSE unadvertised-`908`/`904`, `sasl_mechlist_proptest` (2 props: never-panics/valid-tokens + idempotent); 298 = apply the SVSLOGIN-assigned identity (services vhost): the atheme-arc follow-on to 296/297 — an inbound `ENCAP <us> SVSLOGIN <cliUID> <nick> <user> <host> <account>` previously honored only `<account>`, with `<nick>`/`<user>`/`<host>` parsed but used merely cosmetically in the `900`; now the non-`*` `<user>`/`<host>` are applied as a **services vhost** on SASL login (HostServ-vhost-on-login). New pure fuzzed parser `sasl::SvsIdentity::from_fields` (`*`/empty/IRC-invalid → unchanged via `UserName`/`HostName::try_from`), `SaslEntry.identity` + `SaslSessions::{set_identity,identity}`, `remove` now returns `SaslResolution {account, identity}`; `apply_encap_svslogin` stashes the identity; `finalize_registration` drains the resolution before the cloak block and commits the vhost (overriding auto-cloak) as a **display** identity — after every host-based admission gate ran on the real `user@host`, before `local_introduce` so the `UNICK`/welcome carry it, `orighost` kept as the real connect host; the `<nick>` field is deliberately **not** applied (no pre-introduction rename primitive; real flows send `*`; SANICK forces a nick); leveva-native (no oracle); `docs/s2s.md` + atheme `leveva_svslogin_sts` comment updated; units (`SvsIdentity` filter + sessions stash/peek/drain + s2s stash + INVERSE all-`*`), `golden_sasl` vhost-applied + INVERSE star-keeps-real-host, `svslogin_identity_proptest` (2 props); 297 = emit UID targets for user messages (TS6-consistent wire): the follow-on to 296 — leveva now **emits** the recipient's **UID** (not the typed nick) in the target slot of user-directed S2S messages (PRIVMSG/NOTICE/TAGMSG), removing the source-is-UID/target-is-nick asymmetry so the wire is fully UID-consistent like TS6 (a deliberate, maintainer-approved protocol divergence); flipped two outbound emit call sites (`command/message.rs` `route_message_to_remote`, `command/tagmsg.rs` `route_tagmsg_to_remote`) to pass `uid.as_str()`, generic helpers unchanged; receive side already UID-ready (296 `resolve_user_target` + `nick_of` final-hop render + verbatim onward relay); channel/opmod/`$$`/`$#` mask targets, local echo, and client-facing nick rendering all unchanged (clients never see a raw UID); `docs/s2s.md` updated; built via an ultracode discover→implement→verify workflow, helper/command/golden tests + snapshots flipped to UID, live-verified leveva emits `:0LVAAAAAA PRIVMSG 0ATHAAAAG :HELP` while the client still sees `NOTICE probe`; 296 = UID-addressed S2S target delivery + atheme services protocol module: shipped an atheme `protocol/leveva` module (`contrib/atheme/leveva.c` — atheme's ircnet burst skeleton + ts6 ENCAP grafts; links live, services burst, NickServ account login via `ENCAP * SU`, SASL relay) which surfaced a **critical protocol bug** — leveva's inbound S2S handlers resolved a user *target* via `registry.uid_of` (**nick-only**), so a peer/services package addressing a local client by **UID** (`:0ATH… NOTICE 0LVA… :…`) was silently **dropped**; fix = one `pub(crate) resolve_user_target` (nick-first, then `Uid::try_from` accepted only when it names a known user) routed through `inbound_message`/`inbound_tagmsg`/`inbound_numeric`/`apply_encap_redact`/`inbound_kill` (services **KILL by UID**), each keeping its `is_local_uid` guard so a remote UID is reached only by the onward relay; UID-addressed delivery now renders the client's display nick; `inbound_numeric` tightened to drop an unknown UID; built via an ultracode discover→implement→verify workflow with 15 TDD tests (inverse invariants) + live-verified `/msg NickServ HELP` returns; 295 = CYCLE: charybdis-style self-only channel refresh (`extensions/m_cycle.c`) — `CYCLE <channel>` parts and rejoins a channel **without races**, the client-convenience sibling of `PART`/`JOIN`; the load-bearing subtlety is that the real `m_cycle` does **not** leave server-side — it only sends `:source PART <chan> :Cycling`, `:source JOIN <chan>` and a fresh `353`/`366` NAMES list **to the issuing client**, changing nothing else, so the user keeps op/voice and place and cannot be locked out by `+i`/`+k`/`+l` or lose a glare (the whole point); **no new `Channels` seam** (CYCLE never mutates — it composes the read-only `display_name`/`is_member`/`names_query` accessors, the fuzz seam being the dispatch handler's observational purity), `command/cycle.rs` per-channel gate ladder (`461` no param → `403` nonexistent → `442` not-a-member → success), existence-before-membership, success honours the issuer's `multi-prefix`/`userhost-in-names` caps in the re-sent NAMES; **planning correction** — the slice-selection preview mis-described CYCLE as "re-announced to members", but a member-visible cycle would drop the cycler's ops, could destroy a sole-member channel, and would desync linked peers, so the faithful self-only behaviour shipped; divergences = leveva-native (no oracle — 2.11 has no CYCLE), self-only/observationally-pure, fixed `:Cycling` reason, local-only; `CYCLE.md` help + COMMANDS allowlist + index.md channel-commands line; 7 `command/cycle` units + `cycle_proptest` (2 props: `cycle_is_observationally_pure` reply-shape-model + state-byte-identical-before/after, `arbitrary_args_never_panic`) + `golden_cycle`; 294 = OKICK: charybdis-style operator force-kick (`extensions/m_okick.c`) — `OKICK <channel> <user> [:comment]` forcibly removes a member **without** the oper being a chanop or even a member of the channel, the oper-override sibling of `KICK` (chanop-gated) and `REMOVE` (chanop force-*part*, slice 290) and the kick-shaped member of the charybdis operator channel-intervention family (`SAJOIN`/`SAPART`/`SANICK`/`SAMODE`/`OJOIN`/`OPME`/`REMOVE`); new atomic seam `Channels::okick(name, victim) -> OkickOutcome` (single-lock, **no** chanop/membership/rank check — the override — the fuzz seam: channel-missing→`NoSuchChannel` / victim-not-member→`NotInChannel` / victim-`+Y`→`OfficialBusiness` / else remove→`Kicked{display,pre-removal-audience}`, deleting an emptied channel), `command/okick.rs` gate ladder (non-oper `481` → no/one-arg `461` → unknown nick `401` → `403` ghost channel → `441` victim-off-channel → `482` `+Y` victim → success), on success emits a **server-sourced** `:<server> KICK <chan> <victim> :<comment>` echoed to the oper (always — they need not be a member; excluded from the audience fan to avoid a duplicate) + fanned to all local members incl. the victim, relays server-sourced via new `s2s::relay::server_kick` (`:<our_sid> KICK <chan> <victim_uid>`, symmetric with the SID-prefix-aware `inbound_kick`), posts a `+s` audit snomask `<oper> used OKICK on <victim> in <chan>` (comment defaults to oper nick); divergences = leveva-native (no oracle), plain oper-bit (not a per-command privilege), **`+Y` immunity respected** (vs charybdis raw removal), oper always gets the echo even off-channel, `+s` audit not `+w` wallops (SA*/OJOIN/OPME precedent), local-only; `OKICK.md` help + COMMANDS allowlist + index.md operator line; 4 `channel::okick` units + 5 command units + `okick_proptest` (2 props: outcome-matches-state incl. rank-never-blocks + `arbitrary_args_never_panic`) + `golden_okick`; 293 = OLIST: charybdis-style operator `LIST` (`extensions/m_olist.c`) that bypasses the secret (`+s`)/private (`+p`) channel-hiding so an oper enumerates **every** channel — the read-only sibling of `LIST` and latest member of the operator diagnostic family (TESTLINE/TESTMASK/MASKTRACE/CHANTRACE/FINDFORWARDS/OPME); two new visibility-bypass `Channels` seams (`list_all` full folded sweep / `list_one_any` named-incl-hidden, the fuzz seam), `command/olist.rs` plain oper-bit gate (non-oper `481` before any sweep) emitting the same `321`/`322`/`323` numerics as LIST (no-arg → all incl. `+s`/`+p`; named → that channel revealed-or-skipped; no ELIST conditions, faithful to `mo_olist`); divergences = leveva-native (no oracle), plain oper-bit (not a per-command privilege), no `+s` audit snomask (read-only diagnostic family precedent), local-only; `OLIST.md` help + COMMANDS allowlist + index.md operator line; `list_all`/`list_one_any` units + 6 command units + `olist_proptest` (2 props: full-set-and-superset model equality + `arbitrary_args_never_panic`) + `golden_olist`; 292 = OPME: charybdis-style operator self-op of an *opless* channel (`extensions/m_opme.c`) — `OPME <channel>` grants the requesting operator `+o` **only** when the channel currently has no operators, the recovery tool for a channel whose last op left and the constrained, safety-gated sibling of `SAMODE +o`; completes the charybdis oper channel family (`SAJOIN`/`SAPART`/`SANICK`/`SAMODE`/`OJOIN`) with the recovery verb; new atomic seam `Channels::opme(name, uid) -> OpmeOutcome` (single-lock channel-missing→`NoSuchChannel` / non-member→`NotOnChannel` / has-an-op→`NotOpless` / else grant `+o`→`Opped`, the fuzz seam, no persistence — member status never persists), `command/opme.rs` gate ladder (non-oper `481` → no-arg `461` → `403`/`442`/not-opless `NOTICE`/success), on success broadcasts `:<server> MODE <chan> +o <nick>` to local members + relays server-sourced via `s2s::relay::server_channel_mode` + posts a `+s` audit snomask `<oper> used OPME on <chan>`; divergences = leveva-native (no oracle), membership-checked-before-opless (vs charybdis opless-first, so a non-member never learns op state), `+s` audit snomask not `+w` wallops (SA*/OJOIN family precedent), local-only; `OPME.md` help + COMMANDS allowlist + index.md operator line; `channel::opme` unit + 4 command units + `opme_proptest` (2 props) + `golden_opme`; 291 = FINDFORWARDS: charybdis-style reverse `+f` lookup (`extensions/m_findforwards.c`) — `FINDFORWARDS <channel>` lists every channel whose `+f` forward target (slice 242) is `<channel>`, the companion to the `+f` forwarding family (where `+f` points a *source* at a *target*, FINDFORWARDS asks the target "who points at me?"); new pure read seam `Channels::forwards_to(target)` (folds + scans the channel table, returns matching display names folded-sorted — the fuzz seam), `command/findforwards.rs` with the trace/ban-family gate ordering (`461` no-arg first → `403` nonexistent channel → `442` non-member-non-oper, the oper-bit bypass replacing charybdis's `IsOperSpy` à la CHANTRACE), output as charybdis-faithful `NOTICE` lines (chunked space-separated forwarder list + `End of forwards for <chan>`, or `No channels forward to <chan>` when empty) **not** numerics, `FINDFORWARDS.md` help + COMMANDS allowlist + index.md; leveva-native (no oracle — 2.11 has no FINDFORWARDS), local-only (a read of this server's channel table, mirroring charybdis's per-server `+f` state); `forwards_to` unit + 8 command units + `findforwards_proptest` (2 props: `forwards_to_is_exactly_the_pointing_channels` model set-equality + `arbitrary_args_never_panic`) + `golden_findforwards`; 290 = REMOVE: charybdis-style chanop force-part (`extensions/m_remove.c`) — a channel operator forcibly removes a member who, on the wire, appears to **PART** rather than be **KICK**ed (so client auto-rejoin-on-kick scripts don't fire); `command/remove.rs` reuses `Channels::kick_gate`/`kick` verbatim so it **inherits every KICK rule** (`403`/`442`/`482` chanop gate, `401`/`441`, elemental rank protection, `+Y` official-join immunity, cross-product, `461`), but emits `:victim!user@host PART <chan> :requested by <remover> [(<reason>)]` (prefix = the **victim's** own mask via `Registry::record_of`, works local+remote) echoed to the remover + delivered to all local members incl. the victim, propagated S2S as the victim's PART (`s2s::relay::local_part`) and recorded to chat-history as a PART; a normal chanop command (no oper privilege), the sibling of KICK/the SA*-force family; leveva-native (the C oracle has no REMOVE) → no differential, the "requested by" wording is leveva's; `REMOVE.md` help + COMMANDS allowlist + index.md; `golden_remove` + `remove_proptest` (2 props); 289 = XLINE/UNXLINE: charybdis realname (gecos) operator ban — the realname sibling of K-line/D-line, completing the runtime ban quartet **K/D/X/RESV**; bolt-for-bolt the DLINE plane (slice 284) with a single-token gecos matcher (`matching::matches`) instead of CIDR — `leveva::xline::{Xline,XlineStore}` (SQLite write-through + boot reload), `command/xline.rs` (461→`OperPrivilege::Xline` 481, reap local matching realnames with 465+ERROR), `s2s/xline.rs` `ENCAP * XLINE/UNXLINE` propagation + `xline_burst` re-assertion, registration X-line gate in `finalize_registration` after the K-line/config-`ban` gates, `STATS x`→`247 RPL_STATSXLINE`; **lights up the dead `xline_exempt` flag** end-to-end (`Admission`/`ClientRecord.xline_exempt` + `set_xline_exempt`, the dedicated exemption distinct from `kline-exempt`); divergences = single-token-glob mask (vs charybdis spaced gecos) + dedicated xline-exempt + leveva-native no-differential; `golden_xline` + `xline_proptest` (6 props); 288 = TESTMASK: `TESTMASK <[nick!]user@host> [<gecos>]` — a charybdis-style read-only operator diagnostic that **counts** how many connected clients match a hostmask (and optional realname glob), split into local vs remote; the population sibling of TESTLINE (285, which reports *bans*), together completing charybdis's `test*` diagnostic family. `461` param gate before the plain oper-bit gate (`481`); a malformed mask (no `@`, or empty user/host) → `NOTICE :Invalid parameters` (faithful, not a numeric); a registry sweep glob-matches `nick`/`user`/`host`(+`orighost`)/`gecos` (nick & gecos default `*`) and tallies `is_local_uid` → one `727 RPL_TESTMASKGECOS` `<lcount> <gcount> <nick>!<user>@<host> <gecos> :Local/remote clients match`; new numeric 727 (charybdis's 724 is dead — no format/caller), pure `parse_mask` fuzz seam, `TESTMASK.md` help; leveva-native, local-only (no S2S, mirroring charybdis); confirmed against cloned charybdis `m_testmask.c`/`messages.h`; 287 = CHANTRACE: `CHANTRACE <#channel>` — the channel-scoped sibling of TRACE (26)/ETRACE/MASKTRACE (286), completing the trace quartet: reports every member of a named channel in ETRACE's extended `708 RPL_ETRACEFULL` column format, folded-nick order, closing `262 RPL_TRACEEND`; gate is `461` (missing channel) → `403` (no such channel, existence before membership) → `442` unless the requester is a member **or** holds `OperPrivilege::Trace` (the operspy-equivalent bypass; leveva has no operspy `!` prefix); reuses `etrace::etrace_line`, no new numeric; `CHANTRACE.md` help; leveva-native (2.11 has no CHANTRACE), reports the **full roster incl. remote members** (unlike local-only ETRACE/MASKTRACE) but no S2S propagation, no IP-hiding (host==host, no separate IP column); 286 = MASKTRACE: `MASKTRACE <nick!user@host mask> [<gecos mask>]` — a charybdis-style mask-filtered extended trace, the sibling of TRACE (26) and ETRACE: reports every local client whose `nick!user@host` glob-matches (and optionally whose realname matches a 2nd gecos glob) in ETRACE's extended column format; `461` param gate before the `OperPrivilege::Trace` oper gate (`481`), one reused `708 RPL_ETRACEFULL` line per match in folded-nick order via `matching::HostMask` + the promoted `etrace::etrace_line`, closing with `262 RPL_TRACEEND` (no new numeric); `MASKTRACE.md` help; leveva-native (2.11 has no MASKTRACE), local-only (no S2S); 285 = TESTLINE: `TESTLINE <[nick!]user@host | ip/cidr | nick | #channel>` — a charybdis-style **read-only** operator diagnostic, the capstone of the ban family (RESV 272 / TKLINE 281 / DLINE 284): it reports which **active** ban would match a mask, laying/lifting nothing. Param gate (`461`) then a plain oper-bit gate (any oper, no per-ban privilege → `481`); a pure `probe()` classifier routes by mask shape (`user@host`→D-line-then-K-line, `#channel`→channel RESV, bare token→D-line-as-IP-then-nick-RESV) and reports the first hit in priority **D > K > R** as `725 RPL_TESTLINE` (`<type K/D/R> <minutes-remaining, 0 for permanent RESV> <ban-mask> :<reason>`), else `726 RPL_NOTESTLINE`; expiry honoured via `find_active`; new numerics 725/726, `TESTLINE.md` help; leveva-native (no oracle — 2.11 has no TESTLINE), single-best-match, no I-line arm, **local-only** (no S2S, mirroring charybdis); 284 = D-lines: `DLINE <duration> <ip/cidr> [:reason]` / `UNDLINE <ip/cidr>` — charybdis-style IP-level operator bans, the IP/CIDR sibling of the temporary K-line family (281–283); new `DlineStore` (mirrors `KlineStore`, CIDR-aware `host_component_matches`, same `database {}` SQLite write-through + boot reload), `OperPrivilege::Dline` (bit `0x400000`), registration gate **before** the K-line gate matching the pre-cloak connect IP (`465`+`ERROR`+REJ snomask, exemption reuses `kline-exempt`), local reap by `orighost`, S2S `ENCAP * DLINE`/`UNDLINE` propagation + burst re-assertion (slice-281 KLINE shape), `STATS d` → `250 RPL_STATSDLINE`, `DLINE.md`/`UNDLINE.md` help; leveva-native, no oracle differential; 283 = SQLite persistence for permanent (`+P`) channels — a `+P` channel (slice 244, survives empty) now also survives a **restart**, persisting to the same `database {}` SQLite file that backs chat-history (274) and K-lines/reservations (282): its identity + `created_at` TS + full `ChannelModes` + topic write through to a `channel` table (JSON `modes`/`topic` columns, the serde codec chat-history uses) on every durable mutation, via the single `Channels::reconcile_persist` chokepoint (upsert when `+P`, **delete on `-P`**) hooked into all eight durable-state mutators — `apply_modes`/`apply_modes_oper`/`apply_modes_as_server` (MODE incl. the `+P`/`-P` toggle, key, limit, all `+b/+e/+I/+R` lists), `reset_flag_state`/`wipe_list_masks` (CHANTS-merge), `set_topic`/`set_topic_as_server` (TOPIC), and `create_permanent_from_burst` (an empty `+P` channel learned from a peer burst persists so it outlives *this* server's restart too, mirroring 282's inbound-S2S persist); recreated **empty** at boot (members/INVITE-tokens/join-throttle counters never persist — an empty `+P` channel is exactly what 244/269 make valid), with `created_at` carried so TS6 merge arbitration is stable post-reboot; a `persisted: HashSet` of folded keys makes a `reconcile_persist` on a never-persisted (non-`+P`) channel a pure in-memory miss — **no disk write per MODE on an ordinary channel** — and the two leaf locks (`db`/`persisted`) are never held simultaneously so there is no lock-order hazard with the held `by_name` guard; a `new()`/no-`database{}` table stays in-memory only (every persistence path a no-op); `ChannelModes`/`Topic` gained `#[derive(Serialize, Deserialize)]`; `from_config` opens the table against `cfg.database.path` (log + fall back to in-memory on error, never fatal), exactly the 282 klines/resvs shape; 282 = SQLite persistence for K-lines + reservations — operator-laid `TKLINE` bans and `RESV` reservations (lost on restart before) now persist to the **same `database {}` SQLite file** that backs chat-history (slice 274), so they survive a reboot: each `KlineStore`/`ResvStore` gains an optional write-through connection (`open(path)` creates a `kline`/`resv` table + loads existing rows; `add`/`remove`/`prune` mirror to it; a `new()`/no-`database{}` store stays in-memory only, every persistence path a no-op), the in-memory `Vec` staying the hot-path authority; K-lines drop `expires <= now` rows on load + prune; only **runtime** (`conf == false`) reservations persist (config `resv {}` re-derives from `ircd.kdl`, so `seed_config` bypasses persistence and a `REHASH` never drops a learned reservation); `COLLATE NOCASE` primary keys make a case-differing re-add upsert not duplicate; open/write errors log and fall back to in-memory (never fatal); inbound S2S `apply_encap_kline`/`apply_encap_resv` persist what a server learns from the network too (all via `add`); 281 = S2S `KLINE`/`UNKLINE` propagation — the K-line analogue of slice 280: a `TKLINE`/`UNTKLINE` (leveva's temporary K-line family, there is no separate permanent `KLINE`) now propagates network-wide as `ENCAP * KLINE <duration> <user> <host> :<reason>`/`ENCAP * UNKLINE <user> <host>` (server-prefixed, leveva-native, the **remaining** seconds on the wire so each server re-clocks `expires = now + duration` against its own clock — no absolute-timestamp skew), wired into `command/tkline.rs` after the param/privilege/format gates; every server applies the ban to its own `KlineStore` (gating future registrations) **and reaps its own local matching clients** via the now-`is_local_uid`-guarded `reap_matching` helper (which also fixed a latent over-reap of remote users in the local `TKLINE`); `kline-exempt` clients are spared; `UNKLINE` lifts the gate only (never un-kills) and propagates unconditionally; re-asserted to a freshly-linked peer by `s2s/burst.rs::kline_burst` (active bans only, with remaining time; expired bursts nothing); new `s2s/kline.rs` modelled on `s2s/resv.rs`, ENCAP dispatch in `s2s/forward.rs`; 280 = S2S `RESV`/`UNRESV` propagation — an operator-laid nick/channel reservation (and its lift) now propagates network-wide as `ENCAP * RESV`/`UNRESV` (server-prefixed, kind re-derived from the mask prefix on inbound apply), wired into `command/resv.rs` after the param/privilege gates (a `461`/`481` reject propagates nothing; `UNRESV` propagates unconditionally), applied + split-horizon-relayed by `s2s/forward.rs`, and re-asserted to a freshly-linked peer via `s2s/burst.rs::resv_burst` (runtime `conf == false` reservations only — config `resv {}` blocks stay per-server local policy); closes the slice-272/273 S2S-propagation follow-on, mirroring the METADATA/KNOCK ENCAP carriers; 279 = remote-originated JOIN/PART/QUIT membership events are now recorded into chat-history — the membership-event parallel to slice 276 (which did PRIVMSG/NOTICE): a **live** `NJOIN` (`s2s/njoin.rs`, never a burst — bursts are bulk state-sync), a bare `JOIN`/`PART` (`s2s/relay.rs`), and a **discrete** remote `QUIT`/`KILL` (`s2s/squit.rs::quit_one_remote_user`, *not* a netsplit mass teardown) each record an event keyed by a locally-minted msgid + clock, gated on `has_local_member` (only a local member can `CHATHISTORY` it; a pure hub stores nothing); an unmirrored `NJOIN`-only ghost has no mask so its QUIT is skipped; replay/query side unchanged (slice 274 already gates these behind `draft/event-playback`); 278 = `+R` auto-reop is now enforced for **local** members only — the `enforce_reop` chokepoint gained an explicit `is_local_uid` filter, so a `+R` mask matching a `UNICK`-introduced remote user's `nick!user@host` no longer wrongly ops it locally and relays a `+o` we have no authority to emit (the locality guarantee previously rested on the false premise that remote members lack a registry record); 277 = netsplit batches are no longer duplicated to `batch`-capable clients under concurrent teardown — when a dying peer is detected on two paths at once (abrupt socket drop + a sibling's inbound `SQUIT`, in separate tasks), the `NJOIN`-only ghost-member sweep raced (`co_members` then `remove_everywhere`, no single-shot gate) and double-relayed a casualty's `QUIT`; new atomic `Channels::detach_member` fuses recipient-gather + removal in one critical section so only the first teardown to reach a member relays it (the loser gets `None`), mirroring the already-atomic `remove_behind_sid` mirror drain; new `s2s_netsplit_concurrency_proptest` fuzz; 276 = remote-originated channel messages are now recorded into chat-history — the S2S relay's inbound channel fan (`s2s::relay::inbound_message`) records the delivered line on this server too, keyed by the carried network msgid (slice 130) + `@time` (slice 134), gated on this server having a local member of the channel (only a local member can `CHATHISTORY` it; no whole-network accumulation on a hub); the `+z` op-redirect/non-channel branches never record, mirroring the local plane; closes the slice-274 gap where `CHATHISTORY` held only locally-sent lines; 275 = IRCv3 `message-redaction` now deletes from chat-history — an accepted channel `REDACT <chan> <msgid>` deletes the slice-274 stored line (`History::delete_by_msgid`, keyed `(target, msgid)`) so `CHATHISTORY` can never replay it; wired in both the local `CanSend::Ok` path and inbound `ENCAP * REDACT`, per-server; mirrors recording — a `+z` op-moderated/"shown to ops" attempt is never recorded so never deleted; authorization stays a stateless relay; 274 = IRCv3 `draft/chathistory` — SQLite-backed (`rusqlite`, bundled) channel message history behind an optional `ircd.kdl` `database {}` block; all channels auto-enrolled (PRIVMSG/NOTICE + JOIN/PART/QUIT recorded at the delivery plane), joining clients auto-replayed `replay-lines` recent lines unless they negotiated `draft/chathistory` (then exempt, per spec), full `CHATHISTORY LATEST/BEFORE/AFTER/BETWEEN/AROUND/TARGETS` (timestamp=/msgid= selectors) framed as a `chathistory` batch, `draft/chathistory`+`draft/event-playback` dynamic caps + `CHATHISTORY`/`MSGREFTYPES` ISUPPORT, age-based `retention-days` prune ticker; `Message` gained serde; 273 = registration-time nick `RESV` enforcement — a connection may no longer *register* directly as a reserved nick, only the post-registration `NICK`/JOIN were gated before; refuse `432` + reopen registration, mirroring the `433` nick-in-use path; 272 = charybdis `RESV`/`UNRESV` nick/channel reservation — JOIN→`437`/NICK→`432` gates, opers exempt, new `OperPrivilege::Resv`; defaults declared in `resv {}` config blocks, boot-seeded + REHASH-re-seeded keeping runtime `RESV`s). The slices span the full client command surface (registration; channels + the complete channel-mode surface; WHO/WHOIS/WHOX; OPER/STATS; and the query/util commands incl. OPERWALL/LOCOPS/USERIP); the UID-based S2S link/burst/netsplit protocol (keepalive, live introduction, NJOIN chunking, TS merge arbitration); `leveva-iauth` (dnsbl/socks/webproxy/pipe/ident); config live-rehash across every block; CertFP; the **IRCv3 cap track** (message-tags/server-time/msgid/account/bot/oper/echo/labeled-response/CAP, `draft/metadata-2`, caller-id `+g`/`+G`, the **STS/TLS** sub-track); elemental channel modes + extbans; KNOCK; command-rate flood protection (fakelag); the **complete charybdis channel-mode set** (`+C/+c/+S/+j/+z/+T/+g/+r/+f/+Q/+F/+P/+L`, with `+L` the last standard one) and **user-mode set** (`+D/+R/+Q/+G/+z/+S/+l`, plus the product decision that leveva has no local-only umodes — `SEND_UMODES` is every umode); and the `+s` server-notice **snomask** (a charybdis category mask with a producer wired for every category — the matrix is complete). Most const limits (`max-penalty`/`max-bans`/`service-string`/`default-snomask`/…) have been promoted to REHASH-able `options { … }` knobs. **Full per-slice detail (scope, mechanism, divergences, gate) for every slice lives in [`docs/progress-log/p11.md`](docs/progress-log/p11.md); the standing testing plan is [`docs/superpowers/specs/2026-06-10-leveva-testing-plan.md`](docs/superpowers/specs/2026-06-10-leveva-testing-plan.md). This row stays thin.** |  Per‑slice: leveva boots and serves the slice; leveva golden snapshot + proptest green; the `leveva-integration` differential agrees with `ircd-common` on the shared skeleton with divergences asserted. Across the eventual matrix: registration, channels, WHO/WHOIS/WHOX, OPER/STATS, server burst, netsplit, rehash, restart; iauth end‑to‑end. |
94:| **P12 — Retire the mechanical port; `leveva` is the product ✅ DONE (2026‑06‑13)** ([`docs/progress-log/p12.md`](docs/progress-log/p12.md)) | deleted `ircd-common`/`ircd-rs` + C‑era `iauth-rs` + `leveva-integration` + the mechanical port's deployment rigging; workspace = `leveva` + `leveva-iauth` | Ran the differential suite a **final time green** (`cargo test -p leveva-integration`, skeleton‑identical to the oracle), then **deleted the mechanical port** (`ircd-common`, `ircd-rs`), its C‑era auth scaffolding (`iauth-rs`, long since subsumed by the native `leveva-iauth`), and the oracle differential crate (`leveva-integration`). The oracle tests retired with their oracle — the load‑bearing behavior was already carried by leveva's self‑contained 212‑file golden + proptest suite (verified: leveva/leveva-iauth have zero Cargo/`use` dep on the deleted crates). Also stripped the mechanical port's **deployment rigging** (`docker/Dockerfile.ircd`, the `ircd` bake target, the entire `docs/k8s/` example network) and updated the README to describe the finished strangler. This is the literal end of the strangler — same lifecycle the C tree had at P8. | **MET. Final differential run green; `ircd-common`/`ircd-rs`/`iauth-rs`/`leveva-integration` deleted; `cargo build --workspace` 0 warnings; `cargo clippy --workspace --tests` clean; `cargo test -p leveva -p leveva-iauth` green — the behavioral guarantees carry forward. The workspace is now `leveva` + `leveva-iauth`.** |
98:## Progress log
111:- [P10 — Rename to `leveva` + typed identifier strings](docs/progress-log/p10.md)
112:- [P11 — leveva protocol layer → feature parity](docs/progress-log/p11.md)
113:- [P12 — Retire the mechanical port; leveva is the product](docs/progress-log/p12.md)
118:## Key decisions & open risks
120:- **"100% Rust" is P8, not P7.** ~25 trivial C variadic trampolines persist through the faithful port (stable Rust can't define variadic `extern "C"`). They are the *last* C deleted — P8 replaces them with a non‑variadic Rust sender API at every call site (the full `format!`‑based cleanup of string formatting then completes in P11). (Alternative: nightly `c_variadic` — not recommended; pins the toolchain.)
129:## Verification (end‑to‑end)
