name: blog-series description: docs/blog/ holds a numbered Xe-voice post series about the port; conventions + which topics are already taken metadata: node_type: memory type: project originSessionId: a7154a32-7647-441a-aff5-45ddd4ab06e6#

docs/blog/ is a numbered blog-post series narrating the C→Rust port for a public audience, written in Xe Iaso's voice. When asked to "work on another blogpost," write the next 00N-*.md.

Always use the /xe-writing:xe-writing-style skill before drafting — the user corrected me once for not loading it. Source material: [[rust-migration-plan]] (PLAN.md), the docs/superpowers/plans/ + specs/, and project memory.

Format = match the existing posts, NOT the live-xeiaso.net MDX. As of post 019 the posts live in docs/site/content/blog/ (a zola site) and use TOML +++ frontmatter (title / description / date / weight = NN) with zola @/blog/NNN-slug.md internal links — NOT the old docs/blog/ path or --- YAML title/desc/date. No character asides — the old > **Cadey** (coffee) / > **Mara** (hacker) blockquote device is retired (whole back-catalog de-asided 2026-06-29); fold technical tangents and reaction beats into one first-person prose voice, no second speaker. A standing "leave the IRCNet team alone, this is an unsanctioned experiment" disclaimer; footer --- linking PLAN.md + docs/superpowers. Hard rule from the skill that bites: no two successive paragraphs may start with the same letter (check every draft). Commit pattern: docs(blog): add 00N-<slug> ….

Each post = one topic, written for peers:

• 001-project-goals — why/goals; the verifiable-faithfulness tradeoff; Leveva name reveal ([[project-name-leveva-p10]])

• 002-strangler-fig — outside-in (Rust owns main) vs bottom-up porting order; the clean .o-drop seam

• 003-the-oracle — the differential test harness: L1 objcopy --redefine-syms cref_ trick, the tests/ link-anchor gotcha, L2 golden harness + the clock-pinning trap

• 004-variadic-trampolines — why stable Rust can call but not define an extern "C" variadic; the ~25 C sender shims (va_start→format→Rust core); per-recipient va_arg in vsendpreprep kills "format once"; "100% Rust" is a dated P8 goal

• 005-the-greenfield-exception — iauth is the ONE component rewritten from scratch (not faithfully ported), because its contract is the fd-0 text wire, not in-process ABI; the 8-fn start/work/timeout/clean module vtable collapses to one async fn run; SOCKS goto again → sequential await; STILL oracle-gated (relinked C-iauth over fd-0 socketpair, byte-identical handshake); had to reproduce the rfc931 dead-else-if popt bug bug-for-bug. Decision rule: where does the contract live? ABI → translate; text socket → rewrite + diff the wire.

• 006-the-retrospective-is-where-you-round-up — the P0-P6 halfway retrospective, framed as "a retrospective is where you round up." The un-rounded ledger of what the differential harness caught: the c_char-signedness test bug that only failed on aarch64; the clean-checkout s2s golden red because reference-C report_myservers prints an uninitialized peer sendq (3544950785030750208kB) — oracle so precise it catches the reference being nondeterministic; brief callback to the rfc931 bug-on-purpose; calculate_preference calls libc pow via FFI (not f64::powf) so a last-ULP drift can't flip the (u_int) truncation on the wire. Harder-than-planned: P5's 56 clusters over shared file-statics (can't port one m_* without its neighbors); replies[]/alphabet_id dumped from the oracle not text-extracted. Cost: P9-P12 exist to un-do the faithfulness P1-P8 built.

• 007-prove-the-structs — the P0b foundation post ([[p0b-bindgen-constraints]]): before any faithful port, prove Rust and C agree on struct layout byte-for-byte (else every port silently corrupts shared memory). Two SILENT bindgen failures: (1) bindgen defaults to C++ → chokes on class field name (class_def.h:25, struct_def.h:323) + register storage class → clang error-recovery leaves structs as opaque pub struct X { _address: u8 } blobs, build still green; fix .clang_arg("-x").clang_arg("c"); diagnose with grep -c 'pub _address: u8,'. (2) bindgen 0.70 picks forward-decl over later definition (struct_def.h:23-40 typedef struct X Y;) → opaque again; 0.72 fixes. Then the real point: "bindgen agrees with bindgen" ≠ "bindgen agrees with the real compiler" (config drift: MAXCONNECTIONS/USE_IAUTH/AFINET=AF_INET6 move fields). Drift net = ctruth.c (same flags, exports cref_sizeof/alignof/offsetof for 14 structs + aClient's 24 local-tail offsets + CLIENT_REMOTE_SIZE=offsetof(count) + MAXCONNECTIONS) + layout.rs (cargo test, red on drift). Honest holes: the 256-tables + local[] are sizeless extern[] → unreachable, asserted later at P1/P7; MAXCONNECTIONS is the cheap proxy. Throughline: build the thing that catches you before you can be wrong.

• 009-hand-both-of-them-the-same-socket — diffing I/O functions in the L1 oracle (P7w send_authports/read_authports, P7z check_client). Earlier posts diffed PURE fns; these call getpeername/getsockname/read/write so their real input is the kernel, not their args. Thesis: mocking a syscall makes both impls agree with the FIXTURE not the kernel → defeats a faithfulness oracle. Fix = hand the C cref_ original and the Rust port the SAME real fd (one connected IPv6-loopback socket for getsockname/getpeername, one AF_UNIX socketpair for pipe I/O), separate aClients (the fn mutates them), diff what comes out. Beats: the socketpair-leaves-sin6_port-untouched trap (C reads uninit stack, Rust reads zeroed → FALSE diff → use a real ::1 socket when the bytes-under-test are kernel-filled, socketpair when they're bytes YOU wrote); the World struct + GLOBALS_LOCK for cref_-twinned process globals under parallel #[test]s ([[p7-l1-shared-global-race]]); empty-conf → attach_Iline returns -2 deterministically (no fixture); the faithful 4×c_ulong over-read of a 16-byte h_addr (pad to 32 in the harness, ship the bug). Quotes verified against check_client_diff.rs/authports_diff.rs + s_bsd.c:914/871 + s_auth.c:690/740.

• 010-you-dont-write-a-test-for-the-front-door — coverage-by-ubiquity + the trap in "it's covered". P7bb ported add_connection (s_bsd.c:1641), the universal inbound acceptor (every connection enters via read_listener's accept loop → add_connection), so it got NO new L2 golden test — all 111 golden scenarios already flow through it; a botched success path turns the whole suite red at once (free, loud regression coverage). The TRAP: ubiquity only covers the ONE branch the suite walks (the connection that succeeds); the 3 refusal paths (getpeername ENOTCONN, IsIllegal conf, clone-flood > CLONE_MAX=10) are branches no well-behaved client takes → no honest harness takes them → must be STAGED in the L1. That's why P7bb skipped L2 but not L1. The static check_clones twin (no cref_ oracle) is only visible through the public door's clone-reject (the 11th connection). Reuses 009's same-fd trick. Throughline: the most-run fn is also one of the least-tested in its BRANCHES; "it's on the hot path, it's covered" feels rigorous and isn't. Footer-links 003/008/009. All claims verified vs s_bsd.rs:1746/1810 + add_connection_diff.rs + read_listener s_bsd.c:1821.

• 011-the-dial-out-you-can-only-test-by-not-dialing — the OUTBOUND counterpart to 010, closing the I/O trilogy (009 leaves → 010 inbound front door → 011 outbound dial). P7cc ported connect_server (s_bsd.c:2516) + static connect_inet. Thesis = the MIRROR of 010: connect_server's whole point is the connect() succeeding, and that path is UNTESTABLE at L1 (needs a live listening peer + event loop = L2; and all 111 golden scenarios dial INTO the daemon, never make it dial out → the most-tested program has ZERO coverage of this fn's success path). So the L1 oracle diffs the NEGATIVE SPACE — the 3 deterministic ways it refuses to dial: find_server-hit (already present, -1 before any socket, s_bsd.c:2528), the remote-by sendto_one arm, and connect_inet's bind() failure → free_server cleanup (assert highest_fd unchanged + hash clean). Three tests for a connect fn, none of which connect. Secondary beat = the faithful-dead-code edge: DNS-resolution block at s_bsd.c:2544 guarded by !aconf->ipnum.S_ADDR is DEAD under AF_INET6 (S_ADDR=s6_addr embedded array → !&array constant-false; common/os.h:686) → ported by OMITTING it; dead code has no behavior so the oracle can't tell present from absent, but the oracle also can't PROVE it dead (no test enters the branch) — it's a reading of the macro, not a test result (honest-limit beat). Gotcha: find_server/hash_find_server's suffix-mask scan overwrites '.'→'*' in-place → faults on read-only c"..." literals (heap-alloc the keys). Footer-links 010/009/003. All claims verified vs s_bsd.c:2516/2528/2544/2726 + connect_server_diff.rs + os.h:686.

• 012-you-cant-rename-a-symbol-that-isnt-there — the class of fn the L1 oracle STRUCTURALLY can't test: file-static fns ([[l1-cref-static-symbol-limit]]). Oracle = objcopy --redefine-syms foo cref_foo, map from nm -g --defined-only (globals only) → a static has internal linkage, no external symbol, no cref_ twin without editing the C. First hit P6 (lookup_confhost, static int s_conf.c → L1 linked but undefined; non-static neighbor ipv6_convert got its diff). Two OPPOSITE outs: (a) de-static it (the ONE C edit the faithful port allows — storage-class only, comment every time; mysk P7s minted cref_mysk free) vs (b) leave it static + port a PRIVATE Rust twin (unsafe fn, no pub/#[no_mangle]) verified only transitively through its exported caller. The 4 P7 twins: set_sock_opts(s_bsd.c:1489, via inetport)/check_init(:873, via check_client+check_server_init)/check_clones(:1577, via add_connection)/connect_inet(:2680, via connect_server). Honest limit = the oracle diffs at exported-SYMBOL granularity, so a red caller-diff can't LOCALIZE to the static callee: GCC already inlined the static into its sole remaining caller C-side (PLAN P7z finding), Rust un-fused them for readability, but the diff stays whole-symbol; once the last C caller is ported the C static is guarded out entirely (no oracle at any linkage). The 010 branch-trap recurs: transitive coverage only walks the caller's tested path (check_clones age-out branch needs a 2s inter-connection gap no golden scenario waits → covered by a reading, not a test). Funny beat: the twin's static mut BACKLOG = a static inside a static (same C keyword, internal-linkage one scope out + persist-across-calls one scope in). Footer-links 003/010/008. Topic chosen by user via AskUserQuestion (vs the P5 connected-component option). Verified vs s_bsd.rs (4 twins) + ircd-testkit/build.rs (nm -g filter) + p6.md (lookup_confhost).

• 008-eat-the-file-one-function-at-a-time — the sub-file partial-port seam (the candidate flagged below, now TAKEN): how to port one function inside a .c that has to stay C for more phases. The .o is all-or-nothing at the linker, so a mid-port file exists in THREE compiled forms at once: (1) the guarded second compile s_bsd_link.o — same source + a parade of -DPORT_S_BSD_*_P7x flags, each #ifndef-guarding one function body down to a bare prototype so the still-C neighbours resolve to the Rust #[no_mangle] def; goes in the real binary via the build.rs match o { "s_bsd.o" => "s_bsd_link.o", … } redirect. (2) the full unguarded .o → renamed foo→cref_foo by ircd-testkit/build.rs (nm -g --defined-only → objcopy --redefine-syms) into libcref.a, the L1 oracle, which OUTLIVES the C binary. (3) the Rust port itself. Plus the de-static gotcha: static fns have no external symbol → can't satisfy C callers OR get a cref_ oracle, so de-static first (storage-class-only, behaviour-preserving, single-TU-no-collision — the one C edit allowed, justified in a source comment every time). Worked example = set_clean_username (P7v, s_auth.c:44-98, callers read_iauth/start_auth). Ends: file gets eaten leaf-by-leaf, then the whole apparatus evaporates into a PORTED tombstone (s_conf.c P6m). All code quotes verified against real source.

• 013-the-function-that-launches-the-program-i-didnt-port — P7dd start_iauth (s_bsd.c:625/566), the C launcher of the GREENFIELD iauth from 005 — the seam where the two opposite strategies (rewrite-from-scratch vs translate-byte-for-byte) meet at one fd. NEW oracle puzzle (distinct from 009 kernel-input / 011 no-peer / 012 static-symbol): the fn's success is fork+execl → the child STOPS being your process (execl replaces the image with the rewritten iauth), so there's nothing in the child to diff. You diff the PARENT-SIDE SHORELINE — the L1 spawn case (start_iauth_diff.rs:152) actually forks BOTH worlds for real (child execl-fails on absent IAUTH_PATH in CI → _exit(-1)), captures only (adfd>=0, O_NONBLOCK set, iauth_spawn==1) per world, asserts they match + ==(true,true,1). Testing a fork = reaping after one: bounded WNOHANG reap_children (:65) so the test can't zombie/hang. CENTERPIECE faithfulness beat = the vfork()→fork() swap (s_bsd.rs:310): faithful DEVIATION justified (child only close-loop/dup2/execl = async-signal-safe, CoW fork identical result, Rust libc deprecates vfork as memory-unsafe) BUT the failure log still says "vfork() failed!" — kept the wrong word on purpose: syscall is BELOW the oracle's resolution (unobservable → free to change), the log string is ABOVE it (on the wire to opers → must match). "Faithful to what's observable, free below it" crystallized in one string. Honest limits: child plumbing (close-loop/dup2/exec-the-right-binary) unverified at L1 (both children vanish → L2/soak); the non-first-call burst block ("%d O\n" of live local clients, gated by the function static first) is green by SYMMETRIC ABSENCE — L1 only ever makes a first call so both worlds skip it (needs populated local[] + 2nd call = L2/soak). The 3 function statics last/first/iauth_pid → module-private ([[l1-cref-static-symbol-limit]]/012 callback). Footer-links 005/012/003. Verified vs s_bsd.c:566/625/642 + s_bsd.rs:236/310/315 + start_iauth_diff.rs:65/152.

• 014-a-daemons-first-job-is-to-stop-being-watched — P7ee daemonize (s_bsd.c:794), the boot detach glue called once from ircd.c:1152 (warning-label comment "daemonize() closes 0,1,2 -- make sure you don't have any fd open"). Sits directly above 013's start_iauth (calls it at the bottom). NEW untestability flavor, named distinct from 011: 011 was can't-AFFORD-it (success needs a live peer/event loop = infra); this is can't-SURVIVE-it — the fn's whole JOB is to make the process unobservable (fclose/close 0/1/2, fork+parent exit(0), /dev/tty+TIOCNOTTY, setpgrp), so running the detach path destroys the test harness (closes cargo's stdout/stderr, exits the parent=the test process). Fork-isolation doesn't save you either: the thing it PRODUCES is a detached process — "successfully detached" has no return/struct/errno to diff, the evidence of success is the ABSENCE of everything you'd observe with. Only differentially-safe path = the bootopt & BOOT_TTY → goto init_dgram short-circuit (=-t "foreground mode", ircd.c:1140), which skips the whole detach AND is the only path any rig takes (golden always boots -t, ircd-golden/src/lib.rs:50) → testing the config the harness lives in, not a fiction. CENTERPIECE test beat (daemonize_diff.rs:67, one case, GLOBALS_LOCK): pin BOOT_TTY|BOOT_NOIAUTH, resfd=-99 sentinel + adfd=-1, run both worlds; assert resfd CHANGED to a valid fd (init_resolver(0x1f) ran, both worlds agree) AND adfd STAYS -1 (start_iauth(0) reached but short-circuited on BOOT_NOIAUTH) — the inverse check: prove one tail call left a mark and the other correctly left none, because "nothing happened" also looks like a broken short-circuit. Secondary faithful-text beat (lighter cousin of 013's vfork-message): C calls setpgrp(0, getpid()) 2-arg but glibc setpgrp is setpgrp(void) (ignores args) → declared 2-arg in Rust to mirror the source verbatim (faithfulness for the READER, below the wire); TIOCNOTTY defined on Linux so ported straight. Honest hole: the ENTIRE detach path has ZERO differential coverage (not a missed branch — the reason the fn exists), ported by inspection-against-the-C only; real coverage = boot WITHOUT -t + check the process actually backgrounded (new session/no ctty/reparented to init) from OUTSIDE = L2/soak, logged in the plan. Closing callback to the warning-label comment. Footer-links 013/011/003. Topic auto-picked (freshest commit, continues the I/O thread); user didn't name it. Verified vs s_bsd.c:794 + s_bsd.rs:2443 + daemonize_diff.rs + ircd.c:1151/1140/889 + struct_def.h:105/111 + ircd-golden/src/lib.rs:50.

• 015-the-loop-that-runs-every-test — P7ff read_message (s_bsd.c:2091/2088), the select() event loop, body of io_loop (ircd.c:1264, called up to ~6×/pass over fdas/fdall), LAST logic in s_bsd.c. THE post on the function the L1 oracle can barely touch: its real input is the kernel (select/accept/recvfrom/exit_client), so there's exactly ONE differentially-safe path — the EMPTY LOOP (FdAry.highest=-1, udpfd/resfd/adfd=-1, delay=0 → empty fd_set → select(0,…,200ms)=0 → no dispatch → return 0; read_message_diff.rs:73, two cases incl ro=1). Two near-empty asserts for the busiest fn in the program; the test file's own doc says "Why L1 here is one case by design." CENTERPIECE INVERSION (vs 010's coverage-by-ubiquity TRAP): here ubiquity is AIRTIGHT — read_message IS io_loop, so every byte the daemon moves flows through it → the whole golden_/golden_s2s_ suite (~190 #[test]s, 2 real daemons, real bytes diffed) is its real test end-to-end. "You don't write a test for the event loop; the event loop runs every other test." Mara caveat: L2 is a great gate, lousy DEBUGGER (red = 1-of-50 suspects); the empty-loop L1 catches one thing but localizes. Secondary beats: (1) the DEAD USE_POLL half — C read_message is two event loops in a trenchcoat (#if/#else, SET_READ_EVENT/SET_WRITE_EVENT macros serve both backends), USE_POLL off → poll side never compiles → Rust ports select-only, macros evaporate to direct libc::FD_SET; ~430-line C fn → one Rust loop. Faithful-dead-code, CLEANER than 011 (compile-time #if vs 011's runtime-macro-constant-false). (2) the 8 statics (completed_connection/read_listener/read_packet/client_packet/ircd_no_fakelag/do_dns_async/polludp/check_ping) — all static, no cref_ oracle ([[l1-cref-static-symbol-limit]]/012), ported as module-private twins w/ read_message → 8 of 9 fns in the I/O-engine heart have ZERO L1 oracle, the 9th has the empty-loop case; biggest P7 port, thinnest L1 footprint. OPENS on the honest miscount in 014's closing (it said "two little static helpers"; it was EIGHT). Honest ledger: skeleton proven, all dispatch (accept/read/write/exit_client/do_dns_async/polludp/check_ping) untested-by-design → L2/soak. Closing mirrors 014's "So that's daemonize" cadence ("So that's read_message"). Footer-links 010/012/003/008/009/001. Topic was flagged in 014's closing as "the next one I'm nervous about"; user didn't name it. Verified vs s_bsd.rs:3201/3216/2500 + read_message_diff.rs + ircd.c:1264 + s_bsd.c:2091/2094/2110.

• 016-the-trampoline-with-no-riders — the INVERSE of 004 + the OPENING of P8 (delete the C). 004 explained why ~25 variadic sendto_* trampolines had to stay C and promised they die in P8 by deletion-not-translation; this is the first one out: P8a sendto_iauth (s_auth.c:120-170). THESIS = deleting a variadic isn't about the variadic — by P8 every caller is already Rust, so you move the va_start work to the call sites (where format! already lives) and the fn loses its ... → becomes pub unsafe fn sendto_iauth(line:&[u8]) (s_auth.rs:38). CLEANEST-FIRST insight (title metaphor): nm showed ZERO live C callers (all remaining C callers in #ifdef'd-out bodies) = "no riders"; all 24 callers already Rust → deleting touches only Rust sites I control → picked it first ON PURPOSE as the safe one to learn the mechanics on. Mechanics shown: the before/after sendto_iauth(c"%d U %s",fd,user)→sendto_iauth(format!("{} U {}",fd,ia_str(user)).as_bytes()); ia_str (s_auth.rs:77) = lossy C-string read, byte-faithful bc iauth pipe protocol is ASCII. FAITHFUL-BUG beat (REACHABLE-behavior-adjacent but actually unreachable): the C write loop sets p=abuf then write(adfd,abuf,len) from the BASE while advancing p+=i never used → dead cursor, would double-send on a partial write, but tiny lines on a local pipe = one write so it never fires; replicated bug-for-bug anyway (re-issue from base). ORACLE-IS-ALLOWED-TO-BE-VARIADIC beat (the funny one): I can't DEFINE an extern"C" variadic in stable Rust but the cref_ oracle is STILL C (unguarded s_auth.o) so cref_sendto_iauth(fmt,...) stays variadic — drive same line both ways (oracle vsprintf vs Rust pre-formatted bytes), 2 socketpairs, byte-diff the pipe (sendto_iauth_diff.rs). Honest holes: debug -1 E last=%u start=%x pointer line (nondeterministic→not diffed) + lost-slave hard-error branch (can't force fatal write→by-inspection). leveva-deferred note: format!-now not leveva typed Message bc this carries the iauth PIPE protocol <id> <cat> <info> not IRC msgs ([[p8-started]] decision). Ledger: 1 of ~25; keystones sendto_one(~478)/sendto_flag(~255) still per-recipient-hard per 004's vsendpreprep. Guard PORT_S_AUTH_SENDTO_IAUTH_P8a (build.rs:292). Footer-links 004/003/005. Topic auto-picked (freshest commit, opens P8); user didn't name it. Verified vs s_auth.rs:38/77 + s_auth.c:120 + sendto_iauth_diff.rs + build.rs:292 + 2026-06-07-p8a plan.

• 017-the-keystone-wasnt-the-monster — P8l sendto_one (send.c:450-468), THE keystone, the direct continuation of 016's cliffhanger; topic chosen by user via AskUserQuestion (vs the per-recipient-prefix-senders option, the "not one line of C remains" P8v finale, and the leveva-pivot option). THESIS = the keystone was mislabeled: 004+016 named sendto_one the scary one (~478 call sites + per-recipient formatting), but the per-recipient horror lives in vsendpreprep (send.c:388)/the PREFIX senders (P8e sendto_prefix_one & kin, pulled a few cuts EARLIER, e<l) — NOT in sendto_one, which is vsendto_one→vsendprep (send.c:385): format ONCE with libc vsprintf, cap 510, CRLF, one delivery → mechanically the SAME format-once shape as 016's sendto_iauth, just with 435 of them. Call-site count measures CENTRALITY not DIFFICULTY (the two-axes line). SECOND honesty beat (the "more interesting mistake") = the corrected "blocked on leveva P10 typed-Numerics" assumption: the runtime replies[] lookup (reply(ERR_X)→char* fmt at runtime) SEEMED to need typed numerics first, but vsendprep delivers via libc vsprintf (NOT custom irc_vsprintf), so a libc snprintf bridge is byte-identical for literal AND runtime sites alike → rippable NOW, P11 nicety not P8 blocker ([[p8-started]] P8l KEY CORRECTION). TWO builders one core: wire! (58 literal-pattern sites, raw-byte, no lossy String) + reply_one! (send.rs:519, ~375 runtime replies[] sites, libc snprintf into 2048 scratch → core's 510 cap) + 2 direct rlen += sendto_one sites (channel.rs read the return). Mara beat = the faithfulness is NARROW: both paths share libc, NOT "snprintf≈printf close enough" (if C had used irc_vsprintf this breaks). 435 edits = a 15-agent edit-only fan-out + central verify (Cadey: the feat was the 2 builders+the snprintf==vsprintf proof, NOT 435 hand edits; judgment is the un-parallelizable byte-safe call). Honest count beat: 004/016 guessed 478, real was 435 (logged not silently fixed). Test = sendto_one_snap.rs (migrated from cref_ differential, oracle-still-variadic like 016): literal/reply_one-string/%d %02d/NULL-%s→glibc (null)/510-trunc (600 in→512 out); + 111 golden coverage-by-ubiquity (HONEST here vs 010's trap — a bad format corrupts ~every reply at once). Closing teases the prefix-sender post + the C-oracle-switched-off finale. Footer-links 004/016/003/006/010. Verified vs send.rs:519/553 + s_user.rs:116/473 + sendto_one_snap.rs + commits a1a89ffe/d24df877/48583eaf.

• 018-the-strangler-eats-its-own-port — THE LEVEVA PIVOT (P9 retired), topic chosen by user via AskUserQuestion (vs the prefix-senders/vsendpreprep payoff and the "not one line of C remains" P8v finale). Dated 2026-06-09 (the pivot landed 2026-06-08 14:07 in commit 53106f47, right after P8v deleted the C tree at 12:58). THESIS = the strangler pattern repeats ONE LEVEL UP: now that all C is gone, the planned in-place idiomatic cleanup (P9) is RETIRED — instead the verified-faithful 100%-Rust port (ircd-common) is demoted to the behavioral oracle for a greenfield idiomatic daemon (leveva), pinned differentially via leveva-integration, and deleted at parity (exactly the C tree's lifecycle at P8). The "why P9 earns nothing" argument: an oracle only has to keep building + passing its tests, it does NOT have to be pretty → polishing throwaway code (the crate slated for deletion) buys a nicer test fixture, nothing more. EMOTIONAL PAYOFF beat (the one that "sold me") = greenfield FLIPS the differential harness's meaning: 8 phases of faithful porting FORCED bug-for-bug reproduction (callbacks to 016's dead-p-cursor + 005's rfc931 dead-else-if), but the oracle now lets leveva be deliberately, documentedly correct — concrete example = leveva's casemap implements the REAL RFC 1459 fold (incl. Scandinavian []\~↔{}|^) while the faithful daemon's tolowertab (common/match.c) is ASCII-only; the leveva-integration differential doesn't FAIL on the divergence, it ASSERTS it. "Stopped proving 'I copied this exactly,' started proving 'I diverged here and nowhere else.'" The honest-cost section: two daemons in the workspace at once (more surface, not less) + THE BET (if leveva stalls the shipping product is the ugly raw-pointer port and P9 was the right call) — hedged by ircd-common being a fully-working byte-proven fallback until parity. P9 = tombstone-in-the-table (never implemented, by decision). Footer-links 002 (strangler re-aimed)/003 (oracle inherited)/005 (iauth = the preview greenfield). Verified vs PLAN.md P9-RETIRED/P10/P12 rows + [[leveva-pivot-p9-retired]] + p10.md (casemap divergence) + commits 53106f47/b88264f3.

• 019-oldest-wins-and-the-loser-gets-wiped — THE FIRST LEVEVA-FEATURE POST (new sub-genre, no oracle behind it), topic chosen by user via AskUserQuestion (vs the prefix-senders/vsendpreprep payoff, the native-async-iauth post, and the P8v "not one line of C" finale). Dated 2026-06-15. NOTE the blog format MOVED: posts now live in docs/site/content/blog/ and use TOML +++ frontmatter (title/description/date/weight) + zola @/blog/NNN-slug.md internal links — NOT the old --- YAML. THESIS = netsplit-merge is a real distributed-consensus problem solved with a less-than sign: each channel/user carries an immutable birth timestamp, oldest (lowest) wins, every server independently computes the SAME verdict on the SAME two integers with NO coordinator/vote/round-trip (they_win = their_ts < our_ts is literally the whole protocol; consensus is free when every node holds the same fact). Covers slices 132 (channel-ts/reconcile_channel_ts channel.rs:1345 + CHANTS over ENCAP→m_nop backward-compat), 174 (the reop-WIPE hard rule — I overruled my own slice-171 "keep +R unioned" convenience divergence; TS6 says loser drops ALL list masks +b/+e/+I AND +R; forced the EOB sweep_lost_merge_reop because wiping the loser's reop list removed the policy that says who to re-op → re-op LATER against the winner's adopted +R), 133 (user-ts/nick-collision collision::resolve collision.rs:58, oldest signon wins, younger renamed to its UID; the cross-task Envelope::ForceNick primitive bc a local client's task caches its own nick), 222 (the equal-TS SaveBoth case — a tie is unresolvable so BOTH lose, nick vacated network-wide, "mutual destruction is deterministic, a coin-flip isn't"). THE HONEST BEAT (first for the series) = NO oracle behind this — the faithful C never had timestamp-merge (it uses a nick-delay machine), so confidence comes from proptests (resolve total/consistent) + boot-golden cross-task eviction + matching decades-old TS6 design intent, NOT a byte-diff; admitted divergence = exact for 2 servers, "side" approximated by home-server for 3+. CLOSING = the brutality is the feature (ambiguity/split-brain is the real fear; a harsh-but-identical rule beats a kind-but-divergent one). Footer-links 018 (leveva-became-its-own-daemon, the oracle this works without)/003 (the differential harness it lacks here). Verified vs channel.rs:1345/845 + s2s/chants.rs:63/144/185 + s2s/collision.rs:58 + s2s/unick.rs:227 + registry.rs:45 + [[leveva-ts-and-link-fixes-131-133]]/[[leveva-ts6-reop-must-wipe]].

• 020-the-last-thing-the-c-did-was-be-wrong — THE P8v/P8u SWITCH-OFF FINALE (the "not one line of C remains" beat), topic chosen by user via AskUserQuestion (vs the prefix-senders/vsendpreprep payoff, the flood/fakelag clock, and an extbans leveva-feature post). Dated 2026-06-27 (a deliberate BACKFILL — events are 2026-06-08, but 018/019 already referenced "the C is gone" in passing and never showed the actual deletion; the post OWNS the circle-back in its open). THESIS = turning OFF a differential oracle is stranger than building one (003 built it; this retires it). The IRREVERSIBILITY beat = the reference is a build not a recording, so deleting the C means the LAST differential run is the last one FOREVER, its verdict frozen in git, load-bearing under every later correctness claim → ran the whole suite one final time "slowly, the way you read a contract before signing it." THE PAYOFF/TITLE beat = on that final L2 run, L1 all-pass + golden 86 pass / 1 FAIL, and the 1 fail is golden_s2s_s_serv_stats where the reference is wrong (uninitialized-sendq garbage …3544950540217614336kB sq, a different 19-digit number every run; Rust correctly emits 0kB sq) — so the reference C's LAST act in the repo was to be wrong in a way I'd deliberately chosen NOT to copy; the honest-undercut immediately after ("right 86×, wrong once on a known bug; 'last thing it did was be wrong' is me compressing it into something that sounds better than it is"). Callback to 006 (same STATS bug, there a curiosity, here an epitaph). TWO-COMMITS-NOT-ONE beat = P8u (c1f72bb6) drops all C compilation from ircd-sys/build.rs (the make/cref_/res.o/ctruth.o/libircd_c.a/whole-archive link + -lz -lm -lcrypt — the lib-drop sub-beat: none needed, pow resolves from glibc 2.29 libm-merge, the deps were the OLD program's) but leaves the C headers as bindgen input; P8v (b88264f3) freezes the generated 4953-line bindings.rs verbatim into ircd-common/src/bindings.rs + the extern crate self as ircd_sys; self-alias (zero import churn across 28 modules) + 11 install-path consts frozen as /usr/local literals, THEN deletes ircd-sys/the two oracle crates/the C-iauth differential/the entire C tree. FUNNY beat: .github/workflows/clangformat.yml (a C formatter) was the repo's ONLY CI — outlived the C by ~30s. THE HONEST DOWNGRADE (snapshots inherited): differential ran TWO independent impls (reference can't be wrong in the same direction as your bug); the 115 P8s insta snapshots run ONE impl vs a blessed fixture (INSTA_UPDATE=always blesses whatever's there) → "net has a bigger mesh now" → sufficient ONLY because (a) captured while the differential was still green = dead oracle's last testimony, and (b) faithfulness STOPPED being the goal (leveva is now allowed to diverge per 018's casemap) so a characterization snapshot is the right shape. CLOSING = an oracle is scaffolding; C→faithful-port→leveva, each oracle deleted when its replacement catches up ("same move every time, just on a longer fuse"). Footer-links 003 (the oracle switched off)/006 (the STATS bug's first appearance)/018 (what got built the moment the run came back green). Verified vs docs/progress-log/p8.md P8u/P8v entries + PLAN.md P8 row + commits c1f72bb6/b88264f3.

• 021-the-program-i-forked-then-folded-back-in — THE NATIVE-ASYNC-IAUTH POST (leveva-feature sub-genre; closes the 005→013 iauth arc), topic chosen by user via AskUserQuestion (vs the prefix-senders/vsendpreprep payoff, the fakelag clock, and an extbans post). Dated 2026-06-28. THESIS = the iauth process boundary was load-bearing on EXACTLY ONE thing — the C ircd's single-threaded select() loop couldn't afford a blocking DNS/ident/proxy probe, so the work was exiled to a child process over an fd-0 pipe (005 rewrote its insides greenfield but KEPT it a separate program; 013 ported the fork/execl launcher). leveva runs on tokio → a blocking probe is just an .await in the per-connection task → the failure mode the boundary avoided isn't in the building, so the WHOLE apparatus (pipe protocol/socketpair/launcher) is DELETED not ported. Beats: (1) the trait SHRANK from 4 methods (005's iauth-rs: name/init(InstanceConfig)/stats_lines(ModuleStats)/run) to 2 (leveva-iauth/src/module.rs:57: just name + async fn run) — init/stats_lines existed ONLY to narrate config/STATS back over the pipe; no socket → no narration → they evaporate ("what the interface looks like once it stops being a protocol"). (2) THE SEAM (the proud-of-it part): Session::feed is SYNC (NICK/USER/CAP state machine, no await), ident is async + needs only addresses (known at accept), so main.rs:632 tokio::spawns the AuthPipeline concurrently with the handshake; the serve-loop select! races a read arm vs an auth arm; registration finalizes only when BOTH gates clear (CAP END + auth verdict) via TWO STASHES (pending_complete session.rs:869 / auth_verdict) + try_finalize (session.rs:1128) which branches on PRESENCE not ARRIVAL ORDER → either order works, no fast-vs-slow-ident bug possible. (3) the ~ rule = a 4-arm match (registration.rs:388): trusted UNIX→bare / OTHER→~name / asked-no-answer→~supplied / ident-off→trust supplied. (4) HONEST-COST beat = process isolation TRADED AWAY ON PURPOSE: a separate process could leak/OOM/segfault without touching the daemon; in-process = task isolation only (panicked/cancelled task → blank verdict via v.unwrap_or_default() main.rs:778, + per-module timeout in pipeline.run) which covers panics+hangs but NOT memory-corruption/unbounded-leak — "comfortable with the trade, not free". (5) ORACLE beat (ties 019/020): the old iauth-rs WAS the C-iauth differential oracle (socketpair handshake diff), deleted at P12; parse_ident_reply was pinned byte-identical to it WHILE IT LIVED then frozen (exactly 020's snapshots-captured-while-green move); now no oracle, confidence = proptests on the pure parser + fake-identd module tests + before/after-USER seam tests; ALSO dropped the C result-cache + STATS counters (an .await the runtime overlaps makes the cache buy ~nothing; it never changed a decision). CLOSING callback to 013's fork ("I forked a child in post thirteen. This is the post where I admit I didn't need to"). Footer-links 005/013/019/020/003/PLAN. Verified vs leveva-iauth/src/{module,pipeline,ident}.rs + leveva/src/main.rs:632/776 + session.rs:869/1128 + registration.rs:388 + [[iauth-subsumed-into-leveva]].

• 022-a-ban-that-asks-a-question — THE EXTBANS POST (leveva-feature sub-genre; composability angle), topic chosen by user via AskUserQuestion (vs the prefix-senders/vsendpreprep payoff, the flood/fakelag clock, and a chathistory+no-DM-history post). Dated 2026-06-29 (weight 22; sits just after 021's 06-28; blog still lags the code — these slices landed 2026-06-14..20). TOML +++ frontmatter, zola @/blog/NNN-slug.md links. THESIS = a plain ban is a string (a nick!user@host glob, a fact written down once and compared forever); an extban ($[~]<type>[:data], leading $) is a question the server asks fresh every time ($a:bob=logged-in-as-bob, $~z=not-on-TLS, $o=oper, $c:#staff=in-#staff-right-now) — a predicate evaluated against you whose answer can differ at join vs ten minutes later. Once a ban is a question not a fact, THREE free things become deliberate decisions (the frontmatter's "three things"): (1) the third Verdict Invalid (extban/mod.rs:40) = "this isn't a coherent question" — a property of the MASK not the subject ($q unknown type, $c w/ no chan); load-bearing in negation (mod.rs:266: ~ flips Match↔NoMatch but Invalid-stays-Invalid-even-negated, so $~q never matches anyone instead of banning the whole internet — a real security hole if you collapse Invalid into NoMatch) AND in add-time validity. (2) WHEN to ask — JOIN gate only was quietly broken (a $a:troll set after the troll joined did nothing); slice 214 added the speech plane (can_send channel.rs:1713 → CanSend::Banned → 404, same Subject+LiveChannels eval as check_join), so a dynamic extban re-evaluates on EVERY message; voice+ bypasses both +m and the ban. (3) which questions are unsafe to INVERT into an exception — $r realname (realname.rs:26: if mode_type.is_exception() return Invalid) bc a spoofable gecos as a +e key = skeleton key; $c (channel.rs) refuses a +s/+p referent (ChannelPresence::NonPublic → Invalid) bc answering would leak private membership — a 2-valued ban has nowhere to put "I refuse to answer this". COMPOSABILITY climax = $&(AND)/$|(OR) combinators (combi.rs:51, $&:a,~z, depth cap 5 / 10 nodes / BANLEN 195) + the faithful subject-dependent-validity quirk (child type always checked, child data only to short-circuit → validity depends on who you ask; left weird on purpose). The LiveChannels adapter (channel.rs:68) resolves $c/$j over the already-locked map w/ a Cell depth-1 guard (charybdis uses a static; leveva is multi-connection). HONEST beats: NO oracle (IRCnet 2.11 never had extbans → ported from Elemental-IRCd extensions/extb_*.c by READING, C quoted in each handler's doc comment, confidence = units+proptests not a byte-diff; ties 018-021); built the 9 leaf handlers via an ultracode workflow (one agent per extb_*.c), combinators by hand (the one place handlers must know each other). DIVERGENCES owned (the "I changed the alphabet" section): leveva $m=usermode (charybdis m=hostmask/u=usermode), NO plain-hostmask extban (use $x:n!u@h#*); NO $q quiet list (+q=owner per [[leveva-elemental-channel-modes]], mute plane is +b-driven). Footer-links 003 (oracle this never had)/018 (earned the right to diverge). Verified vs extban/mod.rs:40/133/193/266 + extban/{account,channel,realname,combi}.rs + channel.rs:68/1400/1499/1689/1713 + isupport.rs:110 (EXTBAN=$,&acjmorsxz|) + command/mode.rs:90 (Invalid-extban NOTICE) + [[leveva-extbans]].

• 023-the-handshake-you-ship-empty-on-purpose — THE IRCv3 CAP-NEGOTIATION FRAMEWORK POST (leveva-feature sub-genre), topic chosen by user via AskUserQuestion (vs the prefix-senders/vsendpreprep payoff, the flood/fakelag clock, and a chathistory+no-DM-history post). Dated 2026-06-30 (weight 23; one-per-day after 022's 06-29; blog still lags the code — CAP framework landed slice 48, 2026-06-09). TOML +++, zola @/blog/NNN-slug.md. THESIS = CAP is the ONE corner of IRC that negotiates instead of assuming — old IRC has no version field, unknown commands just get 421; CAP is the handshake (BEFORE registration finishes — negotiating flag slams a brake until CAP END) where client+server agree which extensions are live. The spine = the locked scope rule (with the user, [[leveva-ircv3-track]]): the negotiation mechanism and each capability's behavior are SEPARATE slices; slice 48 shipped the framework + cap-notify ONLY (the one cap the framework itself honors), every behavior cap (multi-prefix/server-time/…) is its own later slice. Beats: (1) CapState = 3 fields (version Option that NEVER downgrades — cur.max(v) at cap.rs:605, bc 302 is the threshold unlocking values/multiline/implicit-cap-notify so a downgrade would strip negotiated features; enabled BTreeSet; negotiating brake). (2) the registration-suspend brake feeds post 21's two-gate finalize — try_finalize bails on self.cap.is_negotiating() (session.rs:1129); CAP END is the OTHER gate next to the auth verdict (direct 021 callback). (3) REQ is all-or-nothing = a prepare-then-commit transaction (validate every token into a planned scratch vec, NAK the whole set on any unknown, only then mutate enabled; cap.rs:686); admitted the first version enabled-as-it-walked-then-rolled-back (strictly worse). (4) PAYOFF = ClientCaps (cap.rs:339) is 25 bool fields, one per behavior cap; adding the 26th = add a SUPPORTED row + a bool + a client_caps() copy line + read client.caps.x in one handler, touching the negotiation code nothing — the empty switchboard pays off. (5) HONEST WART (the "my clean abstraction grew warts" beat): the design was "every cap is a static SUPPORTED table row" — TRUE for ~20, a LIE for 3 (sasl needs a linked services agent, chathistory needs an open history DB, sts is per-socket plaintext-vs-TLS) → those are injected at LS-render time not in the const table (cap.rs:623); left the 3 holes visible w/ comments rather than burying them. (6) NO ORACLE (ties 018–022): IRCnet 2.11 had no CAP (charybdis/IRCv3-era), so confidence = pure-fn units + proptest (never-panics/never-half-commits) + a boot-golden socket handshake, NOT a byte-diff. CLOSING ties to the opening hook (assume-vs-ask; "neither has to pretend the other is its own age"). Footer-links 003 (oracle this lacks)/018 (earned the right to build what the C never knew)/021 (the other half of the registration gate CAP END opens). Verified vs cap.rs:239/339/443/605/623/686 + session.rs:730/749/1129 + [[leveva-ircv3-track]].

Pick an unused topic for the next one. Most recent = 023 (the CAP-negotiation framework; the one corner of IRC that negotiates instead of assumes; the locked mechanism-vs-behavior scope rule; CapState's never-downgrade version + the registration brake feeding 021's two-gate finalize; all-or-nothing REQ as a transaction; the 25-field ClientCaps payoff; the 3-holes-in-the-static-table wart; no oracle). PRIOR most recent = 022 (extbans; a ban that asks a question; string→predicate; the third Verdict Invalid; JOIN+speech-plane enforcement; questions unsafe to invert into an exception; $&/$| composition; no oracle; the $m/no-$q divergences). PRIOR most recent = 021 (native-async iauth; the process boundary was load-bearing on the C single-threaded loop; tokio deletes it; the concurrent-spawn/two-stash seam; isolation traded for an .await; no oracle). PRIOR most recent = 020 (the P8v switch-off finale; turning the oracle OFF; the final run's 1 red was the reference's own bug; the differential→snapshot honest downgrade). PRIOR most recent = 019 (the first leveva-feature post, netsplit-merge consensus = a less-than sign + the loser gets wiped; no oracle behind it). PRIOR most recent = 018 (the leveva pivot / P9 retired — strangler one level up; the port IS the oracle now; casemap-divergence = finally-allowed-to-be-correct payoff; the bet). STILL UN-TAKEN big beats: (1) the prefix senders / vsendpreprep per-recipient :nick!user@host collapse (P8e prep_preprep) — the LITERAL payoff teased in 016+017 AND in 017's close, still the strongest pure-mechanics candidate. (2) "not one line of C remains" — the P8v finale TAKEN by 020 (the oracle switch-off). (3) a leveva feature-work post now that P11/P12 are done (e.g. the IRCv3 cap track, elemental channel modes/extbans, the charybdis-port slices, native async iauth) — the migration is FINISHED so leveva posts would be standalone-product posts, a new sub-genre for the series. NOTE: the blog now lags the code badly — per [[p8-started]] P8 is COMPLETE (all trampolines a–m + data globals n–r + version.c t + test-migration s done) and [[leveva-pivot-p9-retired]] P9 is RETIRED with the project pivoted to greenfield leveva (P10/P11 in progress: registration state machine, PRIVMSG/mailbox). Big un-taken beats now available: (1) the prefix senders / vsendpreprep per-recipient :nick!user@host collapse (P8e prep_preprep) — the LITERAL payoff of 016+017's recurring cliffhanger, explicitly teased in 017's close ("deserve their own post"); STRONGEST next candidate. (2) "not one line of C remains" — the P8v finale TAKEN by 020. (3) the leveva pivot TAKEN by 018. The leveva feature-work sub-genre (019 opened it) has many open beats: flood/fakelag clock, extbans TAKEN by 022, elemental channel modes (~&@%+), OJOIN, KNOCK, the IRCv3 CAP track, native async iauth TAKEN by 021, chathistory/SQLite, S2S TS6 link machinery. Earlier history below.

Old-most-recent note (016): 016 (sendto_iauth, P8a — the FIRST variadic trampoline deleted; inverse of 004, opens P8; "no riders" = nm-zero-C-callers cleanest-first; move-the-va_start-to-the-callsite mechanic + ia_str; faithful dead-p-cursor bug; oracle-stays-variadic-because-it's-still-C test; leveva-deferred for the iauth pipe protocol). The P8 keystones (sendto_one/sendto_flag, per-recipient va_arg in vsendpreprep — the hard ones 004+016 both flag) are the obvious next blog beats AS THEY LAND (not yet ported as of 2026-06-07). Earlier: 015 (read_message, P7ff — the event-loop spine; ONE empty-loop L1 case for the busiest fn + the L2-ubiquity-is-airtight-here inversion vs 010's trap; dead-USE_POLL-half + 8-statics-no-oracle beats; opened on 014's eight-not-two miscount). 009→010→011 was the I/O trilogy; 012 = coverage-limits at symbol granularity; 013 closed the 005 iauth loop (the launcher); 014 = the boot detach that CALLS start_iauth; 015 = the loop those boot fns hand control to. s_bsd.c now has NO logic left — only data globals (local[]/highest_fd/timeofday/fd arrays), a later-phase/P9 problem. P7 itself continues past read_message: P7gg try_connections, P7hh check_pings, P7ii delayed_kills, P7jj setup_me (all io_loop/timer/boot fns in ircd.c, landed by 2026-06-06) — candidate cluster for a future "the timer sweeps around the loop" post if one wants an io_loop-companion to 015. Still open beyond that: the variadic-trampoline family (flagged for 004, may have been folded in — check); the 56-cluster connected-component finding from P5 (touched in 006/008, runner-up for 012 — "the unit of migration isn't the function"); "faithful to the bugs" bug-for-bug reproduction (offered for 009, NOT picked — best examples spent in 005/006; the faithful-DEAD-CODE sibling is spent in 011/015, so a future bug-for-bug post must stick to REACHABLE-behavior bugs). The full process is in the project skill create-blogpost (.claude/skills/create-blogpost/SKILL.md).