xeiaso.net / ircd.rs
Proof of concept mechanical port of ircnet/ircd to Rust as part of a bit about C being insecure for network services
0
Fork 0

Configure Feed

Select the types of activity you want to include in your feed.

ircd.rs / docs / claude-memory / blog-series.md
27 kB

name: blog-series description: docs/blog/ holds a numbered Xe-voice post series about the port; conventions + which topics are already taken metadata: node_type: memory type: project originSessionId: a7154a32-7647-441a-aff5-45ddd4ab06e6#

docs/blog/ is a numbered blog-post series narrating the C→Rust port for a public audience, written in Xe Iaso's voice. When asked to "work on another blogpost," write the next 00N-*.md.

Always use the /xe-writing:xe-writing-style skill before drafting — the user corrected me once for not loading it. Source material: [[rust-migration-plan]] (PLAN.md), the docs/superpowers/plans/ + specs/, and project memory.

Format = match the existing posts, NOT the live-xeiaso.net MDX. Plain markdown with title/desc/date frontmatter; character asides as blockquotes > **Cadey** (coffee): … / > **Mara** (hacker): … (not <Conv> JSX, no imports); a standing "leave the IRCNet team alone, this is an unsanctioned experiment" disclaimer; footer --- linking PLAN.md + docs/superpowers. Hard rule from the skill that bites: no two successive paragraphs may start with the same letter (check every draft). Commit pattern: docs(blog): add 00N-<slug> ….

Each post = one topic, written for peers:

  • 001-project-goals — why/goals; the verifiable-faithfulness tradeoff; Leveva name reveal ([[project-name-leveva-p10]])

  • 002-strangler-fig — outside-in (Rust owns main) vs bottom-up porting order; the clean .o-drop seam

  • 003-the-oracle — the differential test harness: L1 objcopy --redefine-syms cref_ trick, the tests/ link-anchor gotcha, L2 golden harness + the clock-pinning trap

  • 004-variadic-trampolines — why stable Rust can call but not define an extern "C" variadic; the ~25 C sender shims (va_start→format→Rust core); per-recipient va_arg in vsendpreprep kills "format once"; "100% Rust" is a dated P8 goal

  • 005-the-greenfield-exception — iauth is the ONE component rewritten from scratch (not faithfully ported), because its contract is the fd-0 text wire, not in-process ABI; the 8-fn start/work/timeout/clean module vtable collapses to one async fn run; SOCKS goto again → sequential await; STILL oracle-gated (relinked C-iauth over fd-0 socketpair, byte-identical handshake); had to reproduce the rfc931 dead-else-if popt bug bug-for-bug. Decision rule: where does the contract live? ABI → translate; text socket → rewrite + diff the wire.

  • 006-the-retrospective-is-where-you-round-up — the P0-P6 halfway retrospective, framed as "a retrospective is where you round up." The un-rounded ledger of what the differential harness caught: the c_char-signedness test bug that only failed on aarch64; the clean-checkout s2s golden red because reference-C report_myservers prints an uninitialized peer sendq (3544950785030750208kB) — oracle so precise it catches the reference being nondeterministic; brief callback to the rfc931 bug-on-purpose; calculate_preference calls libc pow via FFI (not f64::powf) so a last-ULP drift can't flip the (u_int) truncation on the wire. Harder-than-planned: P5's 56 clusters over shared file-statics (can't port one m_* without its neighbors); replies[]/alphabet_id dumped from the oracle not text-extracted. Cost: P9-P12 exist to un-do the faithfulness P1-P8 built.

  • 007-prove-the-structs — the P0b foundation post ([[p0b-bindgen-constraints]]): before any faithful port, prove Rust and C agree on struct layout byte-for-byte (else every port silently corrupts shared memory). Two SILENT bindgen failures: (1) bindgen defaults to C++ → chokes on class field name (class_def.h:25, struct_def.h:323) + register storage class → clang error-recovery leaves structs as opaque pub struct X { _address: u8 } blobs, build still green; fix .clang_arg("-x").clang_arg("c"); diagnose with grep -c 'pub _address: u8,'. (2) bindgen 0.70 picks forward-decl over later definition (struct_def.h:23-40 typedef struct X Y;) → opaque again; 0.72 fixes. Then the real point: "bindgen agrees with bindgen" ≠ "bindgen agrees with the real compiler" (config drift: MAXCONNECTIONS/USE_IAUTH/AFINET=AF_INET6 move fields). Drift net = ctruth.c (same flags, exports cref_sizeof/alignof/offsetof for 14 structs + aClient's 24 local-tail offsets + CLIENT_REMOTE_SIZE=offsetof(count) + MAXCONNECTIONS) + layout.rs (cargo test, red on drift). Honest holes: the 256-tables + local[] are sizeless extern[] → unreachable, asserted later at P1/P7; MAXCONNECTIONS is the cheap proxy. Throughline: build the thing that catches you before you can be wrong.

  • 009-hand-both-of-them-the-same-socket — diffing I/O functions in the L1 oracle (P7w send_authports/read_authports, P7z check_client). Earlier posts diffed PURE fns; these call getpeername/getsockname/read/write so their real input is the kernel, not their args. Thesis: mocking a syscall makes both impls agree with the FIXTURE not the kernel → defeats a faithfulness oracle. Fix = hand the C cref_ original and the Rust port the SAME real fd (one connected IPv6-loopback socket for getsockname/getpeername, one AF_UNIX socketpair for pipe I/O), separate aClients (the fn mutates them), diff what comes out. Beats: the socketpair-leaves-sin6_port-untouched trap (C reads uninit stack, Rust reads zeroed → FALSE diff → use a real ::1 socket when the bytes-under-test are kernel-filled, socketpair when they're bytes YOU wrote); the World struct + GLOBALS_LOCK for cref_-twinned process globals under parallel #[test]s ([[p7-l1-shared-global-race]]); empty-conf → attach_Iline returns -2 deterministically (no fixture); the faithful 4×c_ulong over-read of a 16-byte h_addr (pad to 32 in the harness, ship the bug). Quotes verified against check_client_diff.rs/authports_diff.rs + s_bsd.c:914/871 + s_auth.c:690/740.

  • 010-you-dont-write-a-test-for-the-front-door — coverage-by-ubiquity + the trap in "it's covered". P7bb ported add_connection (s_bsd.c:1641), the universal inbound acceptor (every connection enters via read_listener's accept loop → add_connection), so it got NO new L2 golden test — all 111 golden scenarios already flow through it; a botched success path turns the whole suite red at once (free, loud regression coverage). The TRAP: ubiquity only covers the ONE branch the suite walks (the connection that succeeds); the 3 refusal paths (getpeername ENOTCONN, IsIllegal conf, clone-flood > CLONE_MAX=10) are branches no well-behaved client takes → no honest harness takes them → must be STAGED in the L1. That's why P7bb skipped L2 but not L1. The static check_clones twin (no cref_ oracle) is only visible through the public door's clone-reject (the 11th connection). Reuses 009's same-fd trick. Throughline: the most-run fn is also one of the least-tested in its BRANCHES; "it's on the hot path, it's covered" feels rigorous and isn't. Footer-links 003/008/009. All claims verified vs s_bsd.rs:1746/1810 + add_connection_diff.rs + read_listener s_bsd.c:1821.

  • 011-the-dial-out-you-can-only-test-by-not-dialing — the OUTBOUND counterpart to 010, closing the I/O trilogy (009 leaves → 010 inbound front door → 011 outbound dial). P7cc ported connect_server (s_bsd.c:2516) + static connect_inet. Thesis = the MIRROR of 010: connect_server's whole point is the connect() succeeding, and that path is UNTESTABLE at L1 (needs a live listening peer + event loop = L2; and all 111 golden scenarios dial INTO the daemon, never make it dial out → the most-tested program has ZERO coverage of this fn's success path). So the L1 oracle diffs the NEGATIVE SPACE — the 3 deterministic ways it refuses to dial: find_server-hit (already present, -1 before any socket, s_bsd.c:2528), the remote-by sendto_one arm, and connect_inet's bind() failure → free_server cleanup (assert highest_fd unchanged + hash clean). Three tests for a connect fn, none of which connect. Secondary beat = the faithful-dead-code edge: DNS-resolution block at s_bsd.c:2544 guarded by !aconf->ipnum.S_ADDR is DEAD under AF_INET6 (S_ADDR=s6_addr embedded array → !&array constant-false; common/os.h:686) → ported by OMITTING it; dead code has no behavior so the oracle can't tell present from absent, but the oracle also can't PROVE it dead (no test enters the branch) — it's a reading of the macro, not a test result (honest-limit beat). Gotcha: find_server/hash_find_server's suffix-mask scan overwrites '.'→'*' in-place → faults on read-only c"..." literals (heap-alloc the keys). Footer-links 010/009/003. All claims verified vs s_bsd.c:2516/2528/2544/2726 + connect_server_diff.rs + os.h:686.

  • 012-you-cant-rename-a-symbol-that-isnt-there — the class of fn the L1 oracle STRUCTURALLY can't test: file-static fns ([[l1-cref-static-symbol-limit]]). Oracle = objcopy --redefine-syms foo cref_foo, map from nm -g --defined-only (globals only) → a static has internal linkage, no external symbol, no cref_ twin without editing the C. First hit P6 (lookup_confhost, static int s_conf.c → L1 linked but undefined; non-static neighbor ipv6_convert got its diff). Two OPPOSITE outs: (a) de-static it (the ONE C edit the faithful port allows — storage-class only, comment every time; mysk P7s minted cref_mysk free) vs (b) leave it static + port a PRIVATE Rust twin (unsafe fn, no pub/#[no_mangle]) verified only transitively through its exported caller. The 4 P7 twins: set_sock_opts(s_bsd.c:1489, via inetport)/check_init(:873, via check_client+check_server_init)/check_clones(:1577, via add_connection)/connect_inet(:2680, via connect_server). Honest limit = the oracle diffs at exported-SYMBOL granularity, so a red caller-diff can't LOCALIZE to the static callee: GCC already inlined the static into its sole remaining caller C-side (PLAN P7z finding), Rust un-fused them for readability, but the diff stays whole-symbol; once the last C caller is ported the C static is guarded out entirely (no oracle at any linkage). The 010 branch-trap recurs: transitive coverage only walks the caller's tested path (check_clones age-out branch needs a 2s inter-connection gap no golden scenario waits → covered by a reading, not a test). Funny beat: the twin's static mut BACKLOG = a static inside a static (same C keyword, internal-linkage one scope out + persist-across-calls one scope in). Footer-links 003/010/008. Topic chosen by user via AskUserQuestion (vs the P5 connected-component option). Verified vs s_bsd.rs (4 twins) + ircd-testkit/build.rs (nm -g filter) + p6.md (lookup_confhost).

  • 008-eat-the-file-one-function-at-a-time — the sub-file partial-port seam (the candidate flagged below, now TAKEN): how to port one function inside a .c that has to stay C for more phases. The .o is all-or-nothing at the linker, so a mid-port file exists in THREE compiled forms at once: (1) the guarded second compile s_bsd_link.o — same source + a parade of -DPORT_S_BSD_*_P7x flags, each #ifndef-guarding one function body down to a bare prototype so the still-C neighbours resolve to the Rust #[no_mangle] def; goes in the real binary via the build.rs match o { "s_bsd.o" => "s_bsd_link.o", … } redirect. (2) the full unguarded .o → renamed foo→cref_foo by ircd-testkit/build.rs (nm -g --defined-only → objcopy --redefine-syms) into libcref.a, the L1 oracle, which OUTLIVES the C binary. (3) the Rust port itself. Plus the de-static gotcha: static fns have no external symbol → can't satisfy C callers OR get a cref_ oracle, so de-static first (storage-class-only, behaviour-preserving, single-TU-no-collision — the one C edit allowed, justified in a source comment every time). Worked example = set_clean_username (P7v, s_auth.c:44-98, callers read_iauth/start_auth). Ends: file gets eaten leaf-by-leaf, then the whole apparatus evaporates into a PORTED tombstone (s_conf.c P6m). All code quotes verified against real source.

  • 013-the-function-that-launches-the-program-i-didnt-port — P7dd start_iauth (s_bsd.c:625/566), the C launcher of the GREENFIELD iauth from 005 — the seam where the two opposite strategies (rewrite-from-scratch vs translate-byte-for-byte) meet at one fd. NEW oracle puzzle (distinct from 009 kernel-input / 011 no-peer / 012 static-symbol): the fn's success is fork+execl → the child STOPS being your process (execl replaces the image with the rewritten iauth), so there's nothing in the child to diff. You diff the PARENT-SIDE SHORELINE — the L1 spawn case (start_iauth_diff.rs:152) actually forks BOTH worlds for real (child execl-fails on absent IAUTH_PATH in CI → _exit(-1)), captures only (adfd>=0, O_NONBLOCK set, iauth_spawn==1) per world, asserts they match + ==(true,true,1). Testing a fork = reaping after one: bounded WNOHANG reap_children (:65) so the test can't zombie/hang. CENTERPIECE faithfulness beat = the vfork()→fork() swap (s_bsd.rs:310): faithful DEVIATION justified (child only close-loop/dup2/execl = async-signal-safe, CoW fork identical result, Rust libc deprecates vfork as memory-unsafe) BUT the failure log still says "vfork() failed!" — kept the wrong word on purpose: syscall is BELOW the oracle's resolution (unobservable → free to change), the log string is ABOVE it (on the wire to opers → must match). "Faithful to what's observable, free below it" crystallized in one string. Honest limits: child plumbing (close-loop/dup2/exec-the-right-binary) unverified at L1 (both children vanish → L2/soak); the non-first-call burst block ("%d O\n" of live local clients, gated by the function static first) is green by SYMMETRIC ABSENCE — L1 only ever makes a first call so both worlds skip it (needs populated local[] + 2nd call = L2/soak). The 3 function statics last/first/iauth_pid → module-private ([[l1-cref-static-symbol-limit]]/012 callback). Footer-links 005/012/003. Verified vs s_bsd.c:566/625/642 + s_bsd.rs:236/310/315 + start_iauth_diff.rs:65/152.

  • 014-a-daemons-first-job-is-to-stop-being-watched — P7ee daemonize (s_bsd.c:794), the boot detach glue called once from ircd.c:1152 (warning-label comment "daemonize() closes 0,1,2 -- make sure you don't have any fd open"). Sits directly above 013's start_iauth (calls it at the bottom). NEW untestability flavor, named distinct from 011: 011 was can't-AFFORD-it (success needs a live peer/event loop = infra); this is can't-SURVIVE-it — the fn's whole JOB is to make the process unobservable (fclose/close 0/1/2, fork+parent exit(0), /dev/tty+TIOCNOTTY, setpgrp), so running the detach path destroys the test harness (closes cargo's stdout/stderr, exits the parent=the test process). Fork-isolation doesn't save you either: the thing it PRODUCES is a detached process — "successfully detached" has no return/struct/errno to diff, the evidence of success is the ABSENCE of everything you'd observe with. Only differentially-safe path = the bootopt & BOOT_TTY → goto init_dgram short-circuit (=-t "foreground mode", ircd.c:1140), which skips the whole detach AND is the only path any rig takes (golden always boots -t, ircd-golden/src/lib.rs:50) → testing the config the harness lives in, not a fiction. CENTERPIECE test beat (daemonize_diff.rs:67, one case, GLOBALS_LOCK): pin BOOT_TTY|BOOT_NOIAUTH, resfd=-99 sentinel + adfd=-1, run both worlds; assert resfd CHANGED to a valid fd (init_resolver(0x1f) ran, both worlds agree) AND adfd STAYS -1 (start_iauth(0) reached but short-circuited on BOOT_NOIAUTH) — the inverse check: prove one tail call left a mark and the other correctly left none, because "nothing happened" also looks like a broken short-circuit. Secondary faithful-text beat (lighter cousin of 013's vfork-message): C calls setpgrp(0, getpid()) 2-arg but glibc setpgrp is setpgrp(void) (ignores args) → declared 2-arg in Rust to mirror the source verbatim (faithfulness for the READER, below the wire); TIOCNOTTY defined on Linux so ported straight. Honest hole: the ENTIRE detach path has ZERO differential coverage (not a missed branch — the reason the fn exists), ported by inspection-against-the-C only; real coverage = boot WITHOUT -t + check the process actually backgrounded (new session/no ctty/reparented to init) from OUTSIDE = L2/soak, logged in the plan. Closing callback to the warning-label comment. Footer-links 013/011/003. Topic auto-picked (freshest commit, continues the I/O thread); user didn't name it. Verified vs s_bsd.c:794 + s_bsd.rs:2443 + daemonize_diff.rs + ircd.c:1151/1140/889 + struct_def.h:105/111 + ircd-golden/src/lib.rs:50.

  • 015-the-loop-that-runs-every-test — P7ff read_message (s_bsd.c:2091/2088), the select() event loop, body of io_loop (ircd.c:1264, called up to ~6×/pass over fdas/fdall), LAST logic in s_bsd.c. THE post on the function the L1 oracle can barely touch: its real input is the kernel (select/accept/recvfrom/exit_client), so there's exactly ONE differentially-safe path — the EMPTY LOOP (FdAry.highest=-1, udpfd/resfd/adfd=-1, delay=0 → empty fd_set → select(0,…,200ms)=0 → no dispatch → return 0; read_message_diff.rs:73, two cases incl ro=1). Two near-empty asserts for the busiest fn in the program; the test file's own doc says "Why L1 here is one case by design." CENTERPIECE INVERSION (vs 010's coverage-by-ubiquity TRAP): here ubiquity is AIRTIGHT — read_message IS io_loop, so every byte the daemon moves flows through it → the whole golden_/golden_s2s_ suite (~190 #[test]s, 2 real daemons, real bytes diffed) is its real test end-to-end. "You don't write a test for the event loop; the event loop runs every other test." Mara caveat: L2 is a great gate, lousy DEBUGGER (red = 1-of-50 suspects); the empty-loop L1 catches one thing but localizes. Secondary beats: (1) the DEAD USE_POLL half — C read_message is two event loops in a trenchcoat (#if/#else, SET_READ_EVENT/SET_WRITE_EVENT macros serve both backends), USE_POLL off → poll side never compiles → Rust ports select-only, macros evaporate to direct libc::FD_SET; ~430-line C fn → one Rust loop. Faithful-dead-code, CLEANER than 011 (compile-time #if vs 011's runtime-macro-constant-false). (2) the 8 statics (completed_connection/read_listener/read_packet/client_packet/ircd_no_fakelag/do_dns_async/polludp/check_ping) — all static, no cref_ oracle ([[l1-cref-static-symbol-limit]]/012), ported as module-private twins w/ read_message → 8 of 9 fns in the I/O-engine heart have ZERO L1 oracle, the 9th has the empty-loop case; biggest P7 port, thinnest L1 footprint. OPENS on the honest miscount in 014's closing (it said "two little static helpers"; it was EIGHT). Honest ledger: skeleton proven, all dispatch (accept/read/write/exit_client/do_dns_async/polludp/check_ping) untested-by-design → L2/soak. Closing mirrors 014's "So that's daemonize" cadence ("So that's read_message"). Footer-links 010/012/003/008/009/001. Topic was flagged in 014's closing as "the next one I'm nervous about"; user didn't name it. Verified vs s_bsd.rs:3201/3216/2500 + read_message_diff.rs + ircd.c:1264 + s_bsd.c:2091/2094/2110.

  • 016-the-trampoline-with-no-riders — the INVERSE of 004 + the OPENING of P8 (delete the C). 004 explained why ~25 variadic sendto_* trampolines had to stay C and promised they die in P8 by deletion-not-translation; this is the first one out: P8a sendto_iauth (s_auth.c:120-170). THESIS = deleting a variadic isn't about the variadic — by P8 every caller is already Rust, so you move the va_start work to the call sites (where format! already lives) and the fn loses its ... → becomes pub unsafe fn sendto_iauth(line:&[u8]) (s_auth.rs:38). CLEANEST-FIRST insight (title metaphor): nm showed ZERO live C callers (all remaining C callers in #ifdef'd-out bodies) = "no riders"; all 24 callers already Rust → deleting touches only Rust sites I control → picked it first ON PURPOSE as the safe one to learn the mechanics on. Mechanics shown: the before/after sendto_iauth(c"%d U %s",fd,user)→sendto_iauth(format!("{} U {}",fd,ia_str(user)).as_bytes()); ia_str (s_auth.rs:77) = lossy C-string read, byte-faithful bc iauth pipe protocol is ASCII. FAITHFUL-BUG beat (REACHABLE-behavior-adjacent but actually unreachable): the C write loop sets p=abuf then write(adfd,abuf,len) from the BASE while advancing p+=i never used → dead cursor, would double-send on a partial write, but tiny lines on a local pipe = one write so it never fires; replicated bug-for-bug anyway (re-issue from base). ORACLE-IS-ALLOWED-TO-BE-VARIADIC beat (the funny one): I can't DEFINE an extern"C" variadic in stable Rust but the cref_ oracle is STILL C (unguarded s_auth.o) so cref_sendto_iauth(fmt,...) stays variadic — drive same line both ways (oracle vsprintf vs Rust pre-formatted bytes), 2 socketpairs, byte-diff the pipe (sendto_iauth_diff.rs). Honest holes: debug -1 E last=%u start=%x pointer line (nondeterministic→not diffed) + lost-slave hard-error branch (can't force fatal write→by-inspection). leveva-deferred note: format!-now not leveva typed Message bc this carries the iauth PIPE protocol <id> <cat> <info> not IRC msgs ([[p8-started]] decision). Ledger: 1 of ~25; keystones sendto_one(~478)/sendto_flag(~255) still per-recipient-hard per 004's vsendpreprep. Guard PORT_S_AUTH_SENDTO_IAUTH_P8a (build.rs:292). Footer-links 004/003/005. Topic auto-picked (freshest commit, opens P8); user didn't name it. Verified vs s_auth.rs:38/77 + s_auth.c:120 + sendto_iauth_diff.rs + build.rs:292 + 2026-06-07-p8a plan.

  • 017-the-keystone-wasnt-the-monster — P8l sendto_one (send.c:450-468), THE keystone, the direct continuation of 016's cliffhanger; topic chosen by user via AskUserQuestion (vs the per-recipient-prefix-senders option, the "not one line of C remains" P8v finale, and the leveva-pivot option). THESIS = the keystone was mislabeled: 004+016 named sendto_one the scary one (~478 call sites + per-recipient formatting), but the per-recipient horror lives in vsendpreprep (send.c:388)/the PREFIX senders (P8e sendto_prefix_one & kin, pulled a few cuts EARLIER, e<l) — NOT in sendto_one, which is vsendto_one→vsendprep (send.c:385): format ONCE with libc vsprintf, cap 510, CRLF, one delivery → mechanically the SAME format-once shape as 016's sendto_iauth, just with 435 of them. Call-site count measures CENTRALITY not DIFFICULTY (the two-axes line). SECOND honesty beat (the "more interesting mistake") = the corrected "blocked on leveva P10 typed-Numerics" assumption: the runtime replies[] lookup (reply(ERR_X)→char* fmt at runtime) SEEMED to need typed numerics first, but vsendprep delivers via libc vsprintf (NOT custom irc_vsprintf), so a libc snprintf bridge is byte-identical for literal AND runtime sites alike → rippable NOW, P11 nicety not P8 blocker ([[p8-started]] P8l KEY CORRECTION). TWO builders one core: wire! (58 literal-pattern sites, raw-byte, no lossy String) + reply_one! (send.rs:519, ~375 runtime replies[] sites, libc snprintf into 2048 scratch → core's 510 cap) + 2 direct rlen += sendto_one sites (channel.rs read the return). Mara beat = the faithfulness is NARROW: both paths share libc, NOT "snprintf≈printf close enough" (if C had used irc_vsprintf this breaks). 435 edits = a 15-agent edit-only fan-out + central verify (Cadey: the feat was the 2 builders+the snprintf==vsprintf proof, NOT 435 hand edits; judgment is the un-parallelizable byte-safe call). Honest count beat: 004/016 guessed 478, real was 435 (logged not silently fixed). Test = sendto_one_snap.rs (migrated from cref_ differential, oracle-still-variadic like 016): literal/reply_one-string/%d %02d/NULL-%s→glibc (null)/510-trunc (600 in→512 out); + 111 golden coverage-by-ubiquity (HONEST here vs 010's trap — a bad format corrupts ~every reply at once). Closing teases the prefix-sender post + the C-oracle-switched-off finale. Footer-links 004/016/003/006/010. Verified vs send.rs:519/553 + s_user.rs:116/473 + sendto_one_snap.rs + commits a1a89ffe/d24df877/48583eaf.

Pick an unused topic for the next one. Most recent = 017 (sendto_one, P8l — the keystone-wasnt-the-monster; per-recipient horror is in the PREFIX senders not here; wire!+reply_one! two-builders; corrected the leveva-P10-blocked assumption; 15-agent fan-out). NOTE: the blog now lags the code badly — per [[p8-started]] P8 is COMPLETE (all trampolines a–m + data globals n–r + version.c t + test-migration s done) and [[leveva-pivot-p9-retired]] P9 is RETIRED with the project pivoted to greenfield leveva (P10/P11 in progress: registration state machine, PRIVMSG/mailbox). Big un-taken beats now available: (1) the prefix senders / vsendpreprep per-recipient :nick!user@host collapse (P8e prep_preprep) — the LITERAL payoff of 016+017's recurring cliffhanger, explicitly teased in 017's close ("deserve their own post"); STRONGEST next candidate. (2) "not one line of C remains" — the P8v finale (whole C tree deleted, ircd-sys gone, bindings.rs frozen into ircd-common, oracle mothballed, 115 diffs→insta snapshots). (3) the leveva pivot — P9 retired, ircd-common demoted to oracle for a greenfield rewrite, strangler-one-level-up. Earlier history below.

Old-most-recent note (016): 016 (sendto_iauth, P8a — the FIRST variadic trampoline deleted; inverse of 004, opens P8; "no riders" = nm-zero-C-callers cleanest-first; move-the-va_start-to-the-callsite mechanic + ia_str; faithful dead-p-cursor bug; oracle-stays-variadic-because-it's-still-C test; leveva-deferred for the iauth pipe protocol). The P8 keystones (sendto_one/sendto_flag, per-recipient va_arg in vsendpreprep — the hard ones 004+016 both flag) are the obvious next blog beats AS THEY LAND (not yet ported as of 2026-06-07). Earlier: 015 (read_message, P7ff — the event-loop spine; ONE empty-loop L1 case for the busiest fn + the L2-ubiquity-is-airtight-here inversion vs 010's trap; dead-USE_POLL-half + 8-statics-no-oracle beats; opened on 014's eight-not-two miscount). 009→010→011 was the I/O trilogy; 012 = coverage-limits at symbol granularity; 013 closed the 005 iauth loop (the launcher); 014 = the boot detach that CALLS start_iauth; 015 = the loop those boot fns hand control to. s_bsd.c now has NO logic left — only data globals (local[]/highest_fd/timeofday/fd arrays), a later-phase/P9 problem. P7 itself continues past read_message: P7gg try_connections, P7hh check_pings, P7ii delayed_kills, P7jj setup_me (all io_loop/timer/boot fns in ircd.c, landed by 2026-06-06) — candidate cluster for a future "the timer sweeps around the loop" post if one wants an io_loop-companion to 015. Still open beyond that: the variadic-trampoline family (flagged for 004, may have been folded in — check); the 56-cluster connected-component finding from P5 (touched in 006/008, runner-up for 012 — "the unit of migration isn't the function"); "faithful to the bugs" bug-for-bug reproduction (offered for 009, NOT picked — best examples spent in 005/006; the faithful-DEAD-CODE sibling is spent in 011/015, so a future bug-for-bug post must stick to REACHABLE-behavior bugs). The full process is in the project skill create-blogpost (.claude/skills/create-blogpost/SKILL.md).