xeiaso.net / ircd.rs
Proof of concept mechanical port of ircnet/ircd to Rust as part of a bit about C being insecure for network services
0
Fork 0

Configure Feed

Select the types of activity you want to include in your feed.

docs(leveva): record P11 slice 95 + bump the P11 PLAN.md row

PRIVMSG/NOTICE delivery skeleton differential — the first slice to *close* a
divergence (min-params 461) rather than document it. Plan + p11.md entry +
PLAN.md "Done: 94 → 95 slices" / slices-92–95 harness summary.

author
Xe Iaso date (Jun 11, 2026, 4:16 PM -0400) commit fcbaedf9 parent 3d8a328b
+158 -1
+1 -1
PLAN.md
··· 90 90 | **P8 — Delete the C + retire the oracle harness ✅ DONE** (per-sub-phase: [`PLAN-P8-progress.md`](PLAN-P8-progress.md) + [`docs/progress-log/p8.md`](docs/progress-log/p8.md)) | remaining C (the ~25 variadic sender trampolines + residual data globals) + `ircd-sys` C build + `ircd-golden` (L2) + `ircd-testkit`/`cref_*` archives (L1) + the frozen reference‑C tree | With all C _logic_ already Rust (P7 exit), delete the last C: replace the variadic sender trampolines with a non‑variadic Rust sender API at every call site (faithful `wire!`/`reply_one!`/`format!` first; leveva typed messages adopted alongside the IRC senders), drop the residual data globals via the data‑symbol seam (bindgen `extern` decls resolve to `#[no_mangle]` Rust defs at link), then drop **all** C compilation from `ircd-sys` (no more `cc::Build`), retire the differential harness (`cref_*`/L1 `ircd-testkit`/`ircd-golden` L2 can no longer be built once the oracle is gone), and **migrate the load‑bearing tests into `ircd-common`** as self‑contained Rust tests (own fixtures, no `cref_` oracle). **Progress (P8a–P8r — full entries in the progress logs):** **every variadic sender trampoline is now Rust** (P8a–P8m, incl. the keystones `sendto_one`/`sendto_flag`/`esendto_*`), and the five data‑global `.o`s are dropped outright (`s_auth.o` iauth globals P8n, `send.o` P8o, `s_bsd.o` `local[]`/`highest_fd`/… P8p, `ircd.o` `me`/`client`/timers/… P8q). **P8r dropped the last C‑logic TU `support.o`** — `dgets`/`make_isupport` ported to Rust + the `ipv6string`/`minus_one` data globals defined as `#[no_mangle]` statics (`snprintf_append` is dead in Rust — WHOX is field‑by‑field — so it died with the `.o`; `irc_sprintf` is deleted not ported, in P11). **Every ircd C TU is now Rust:** the link set holds only the generated `version.o` + the L1 harness's `ctruth.o`. **P8s migrated all 115 L1 `cref_` differentials into self‑contained `ircd-common` `insta` snapshot tests** (drive only the Rust port via `link_anchor()`, no oracle; soundness via the capture chain) — the suite is green + 0 warnings. **P8t ported the last *generated* C TU `version.c` to Rust** (`ircd-common/src/version.rs`): the data globals `generation`/`creation`/`pass_version`/`infotext`/`isupport` are now `#[no_mangle]` statics via the data‑symbol seam — `generation`/`creation` sourced from crate metadata at build time (`CARGO_PKG_VERSION` + an `ircd-common/build.rs` UTC build stamp), `pass_version`/`infotext` copied verbatim. `version.c.SH` generation + the `version.o` compile/archive are gone from `ircd-sys/build.rs`; `libircd_c.a` now holds **only** the L1 harness `ctruth.o`. (`creation` is now genuinely build‑time volatile, so the golden canonicalizer masks RPL_CREATED 003, matching the existing 371 Birth‑Date rule.) **P8u (FINAL) retired the oracle.** Ran the differential suite a last time green — L1 `ircd-testkit` all pass; L2 `ircd-golden` 86 pass + only the documented reference‑C‑garbage `s_serv_stats` flake (where Rust is the *correct* side) — then **dropped all C compilation** from `ircd-sys/build.rs`: the `make` object build, the `cref_*`/`ctruth.o`/`res.o` recompiles, the `libircd_c.a` archive, and the whole‑archive link + `-lz`/`-lm`/`-lcrypt` (none needed by Rust — `pow` resolves from glibc 2.29+). `build.rs` now only runs `configure` + bindgen over the C *headers* (the struct view `ircd-common` still uses until P9–P12) and expands the install‑path Makefile vars. `ircd-testkit` (L1) + `ircd-golden` (L2) are `exclude`d from the workspace (mothballed, git‑recoverable); the `ctruth.c`/`layout.rs` drift‑net is deleted. **The workspace is now 100% Rust — zero C TUs compiled.** **P8v (literal end of C) deleted the C *source tree* itself + retired `ircd-sys`:** froze the generated `bindings.rs` into a committed `ircd-common/src/bindings.rs` (a self‑alias `extern crate self as ircd_sys;` keeps every `ircd_sys::bindings::*` path resolving, zero src churn) + the install‑path consts as literals, then deleted `ircd-sys`, the mothballed `ircd-testkit`/`ircd-golden` oracle crates, the `iauth-rs` C‑iauth differential, and **all** C source (`common/ ircd/ iauth/ support/ contrib/ cbuild/ configure .clang-format* clangformat.yml`). `ircd-rs` calls `ircd_common::ircd::c_ircd_main` directly. **Not one line of C remains in the repo.** | **MET. Final differential run green; oracle mothballed; `cargo build --workspace` 0 warnings links pure Rust; `cargo test --workspace` 695 pass / 0 fail (P8v; was 698 before deleting the C‑oracle tests); the `ircd-common` snapshot tests carry the reference‑C correctness forward. C source tree deleted — repo is 100% Rust at the file level.** | 91 91 | **P9 — std‑library cleanup ❌ RETIRED (2026‑06‑08)** | — (was: whole Rust tree) | **Skipped by decision — superseded by the `leveva` greenfield.** P9 assumed an *in‑place* idiomatic transformation of the mechanical port (`MyMalloc`/`MyFree`→`Box`/`Vec`, `dbuf` freelist→owned, raw `libc`→`std`/`nix`, `[c_char;N]`→`[u8;N]`). Because the idiomatic end‑state is now a separate greenfield crate (`leveva`), `ircd-common` is throwaway code (the oracle, deleted at parity), so polishing it earns nothing. Nothing was implemented; the row is kept for provenance. | n/a — retired. | 92 92 | **P10 — `leveva` greenfield foundations 🔶 IN PROGRESS** ([`docs/progress-log/p10.md`](docs/progress-log/p10.md)) | new `leveva` crate (lib) + `leveva-integration` differential tests | The idiomatic‑Rust product, built from scratch (not transformed from the port). **Done so far:** RFC 1459 case‑folding (`casemap`); typed identifier strings (`IrcStr`/`IrcString` + `Nick`/`ChanName`/`Uid`/`Sid`/`Cid`/`ServerName`/`UserName`/`HostName` validating newtypes via `ident_newtype!`); `Message`/`MessageBuilder`; the full `Numeric` reply/error enum (184 codes, discriminant = wire code); a generic safe `patricia` trie; glob `matching`; `mode`; KDL `config` (model/parse/password/privilege); `rustls`/`tokio` `tls` endpoint with hot reload; `ident`. The async boot path (`main.rs`) binds listeners + watches certs but currently drops accepted connections — no protocol layer yet. Idiomatic Rust allowed everywhere; pulls real crates (tokio/rustls/kdl/nom/clap). | `cargo test -p leveva` green + clippy clean per module; `leveva-integration` pins each greenfield reimplementation against `ircd-common` (the oracle) within their shared domain (documented divergences asserted explicitly). | 93 - | **P11 — `leveva` protocol layer → feature parity 🔶 IN PROGRESS** ([`docs/progress-log/p11.md`](docs/progress-log/p11.md)) | `leveva` (client/server state machine + handlers) | The bulk of the remaining work: the connection + registration state machine, the post‑registration command handlers (JOIN/PRIVMSG/MODE/KICK/TOPIC/WHO/WHOIS/…), channels + channel/user modes, the S2S link/burst protocol (UID‑based: UNICK/NJOIN/SAVE/EOB), and `leveva-iauth` (native async auth — dnsbl/socks/webproxy/pipe/ident). Each slice is built idiomatically (owned per‑connection state, typed identifiers end‑to‑end, `Result`/`thiserror`, `format!`/typed builders — **no** `sprintf`/global `buf`), unit‑tested + boot‑golden + proptest‑fuzzed, and **differentially pinned against `ircd-common`** (or `iauth-rs` for auth) wherever a pure oracle entry point exists — structural skeleton + documented divergences, since leveva emits a clean modern burst rather than a byte copy. **Done: 94 slices** — full per‑slice detail (scope, mechanism, divergences, gate) lives in [`docs/progress-log/p11.md`](docs/progress-log/p11.md); the standing **testing plan** is at [`docs/superpowers/specs/2026-06-10-leveva-testing-plan.md`](docs/superpowers/specs/2026-06-10-leveva-testing-plan.md). The slices span the full client command surface (registration, channels + channel/user modes, WHO/WHOIS/WHOX, OPER/STATS), the UID‑based S2S link/burst/netsplit protocol (+ keepalive, live introduction, NJOIN chunking), `leveva-iauth` (dnsbl/socks/webproxy/pipe/ident), config live‑rehash (MOTD, opers/classes, allows/I‑lines incl. CIDR masks, admin/connect/options), a channel‑mode rework (oper‑only‑join `+O`), CertFP, an ongoing **IRCv3 track** (cap‑notify, multi‑prefix, message‑tags + delivery plane, away/invite/echo/server‑time/userhost‑in‑names, MONITOR + extended‑monitor, chghost/setname, ip‑cloaking, standard‑replies, message‑redaction, no‑implicit‑names, draft/pre‑away, utf8only, WebSocket transport), and the **native cross‑daemon command‑skeleton differential** harness (slices 92–94: an in‑process `ircd-common` oracle diffed against leveva for MODE, JOIN/PART/KICK, and the read‑only WHOIS/WHO/NAMES/LIST/TOPIC query cluster). | Per‑slice: leveva boots and serves the slice; leveva golden snapshot + proptest green; the `leveva-integration` differential agrees with `ircd-common` on the shared skeleton with divergences asserted. Across the eventual matrix: registration, channels, WHO/WHOIS/WHOX, OPER/STATS, server burst, netsplit, rehash, restart; iauth end‑to‑end. | 93 + | **P11 — `leveva` protocol layer → feature parity 🔶 IN PROGRESS** ([`docs/progress-log/p11.md`](docs/progress-log/p11.md)) | `leveva` (client/server state machine + handlers) | The bulk of the remaining work: the connection + registration state machine, the post‑registration command handlers (JOIN/PRIVMSG/MODE/KICK/TOPIC/WHO/WHOIS/…), channels + channel/user modes, the S2S link/burst protocol (UID‑based: UNICK/NJOIN/SAVE/EOB), and `leveva-iauth` (native async auth — dnsbl/socks/webproxy/pipe/ident). Each slice is built idiomatically (owned per‑connection state, typed identifiers end‑to‑end, `Result`/`thiserror`, `format!`/typed builders — **no** `sprintf`/global `buf`), unit‑tested + boot‑golden + proptest‑fuzzed, and **differentially pinned against `ircd-common`** (or `iauth-rs` for auth) wherever a pure oracle entry point exists — structural skeleton + documented divergences, since leveva emits a clean modern burst rather than a byte copy. **Done: 95 slices** — full per‑slice detail (scope, mechanism, divergences, gate) lives in [`docs/progress-log/p11.md`](docs/progress-log/p11.md); the standing **testing plan** is at [`docs/superpowers/specs/2026-06-10-leveva-testing-plan.md`](docs/superpowers/specs/2026-06-10-leveva-testing-plan.md). The slices span the full client command surface (registration, channels + channel/user modes, WHO/WHOIS/WHOX, OPER/STATS), the UID‑based S2S link/burst/netsplit protocol (+ keepalive, live introduction, NJOIN chunking), `leveva-iauth` (dnsbl/socks/webproxy/pipe/ident), config live‑rehash (MOTD, opers/classes, allows/I‑lines incl. CIDR masks, admin/connect/options), a channel‑mode rework (oper‑only‑join `+O`), CertFP, an ongoing **IRCv3 track** (cap‑notify, multi‑prefix, message‑tags + delivery plane, away/invite/echo/server‑time/userhost‑in‑names, MONITOR + extended‑monitor, chghost/setname, ip‑cloaking, standard‑replies, message‑redaction, no‑implicit‑names, draft/pre‑away, utf8only, WebSocket transport), and the **native cross‑daemon command‑skeleton differential** harness (slices 92–95: an in‑process `ircd-common` oracle diffed against leveva for MODE, JOIN/PART/KICK, the read‑only WHOIS/WHO/NAMES/LIST/TOPIC query cluster, and PRIVMSG/NOTICE delivery — the last of which *closed* a divergence by making leveva emit the oracle's min‑params `461` instead of RFC `411`/`412`). | Per‑slice: leveva boots and serves the slice; leveva golden snapshot + proptest green; the `leveva-integration` differential agrees with `ircd-common` on the shared skeleton with divergences asserted. Across the eventual matrix: registration, channels, WHO/WHOIS/WHOX, OPER/STATS, server burst, netsplit, rehash, restart; iauth end‑to‑end. | 94 94 | **P12 — Retire the mechanical port; `leveva` is the product** | delete `ircd-common`/`ircd-rs` + C‑era `iauth-rs` scaffolding; workspace = `leveva` | Once `leveva` is at parity (P11 green across the matrix), run the differential suite a final time, then **delete the mechanical port** (`ircd-common`, `ircd-rs`) and fold/replace `iauth-rs` with leveva‑native auth. The `leveva-integration` oracle tests retire with their oracle; the load‑bearing characterizations carry forward as self‑contained `leveva` tests. Workspace becomes just `leveva` (+ any sub‑crates it wants). This is the literal end of the strangler — same lifecycle the C tree had at P8. | Final differential run green; `ircd-common`/`ircd-rs` deleted; `cargo test -p leveva` carries the behavioral guarantees forward; minimal `unsafe`; clean clippy. | 95 95 96 96 ---
+75
docs/progress-log/p11.md
··· 5923 5923 slice-93's 17+2 + slice-92's 14 + the 7 leaf differentials, all re-confirmed); new files 5924 5924 clippy-clean (`cargo clippy -p leveva-integration --tests`); `cargo build --workspace` 5925 5925 0 warnings. 5926 + 5927 + ## 2026-06-11 — P11 slice 95: PRIVMSG/NOTICE delivery command-skeleton differential (+ a divergence closed) 5928 + 5929 + Extended the slice-92/93/94 native cross-daemon oracle harness to the **messaging 5930 + delivery** cluster — `PRIVMSG` and `NOTICE` — the send-side companion to slice 93's 5931 + mutate-side JOIN/PART/KICK and slice 94's read-only query cluster. Unlike 92–94 (which 5932 + *documented* divergences), this slice **found one divergence and closed it** by changing 5933 + leveva to match the oracle, at the user's direction. Plan: 5934 + `docs/superpowers/plans/2026-06-11-p11-slice95-message-skeleton-differential.md`. 5935 + 5936 + ### The divergence (found by a probe, then closed) 5937 + 5938 + A throwaway probe (slice-94 discipline — ground-truth both daemons before locking 5939 + assertions) showed a broad agreeing surface with exactly one divergence cluster, around 5940 + **missing parameters**: 5941 + 5942 + | input | oracle | leveva (before) | 5943 + | --- | --- | --- | 5944 + | bare `PRIVMSG` | `461` | `411` | 5945 + | bare `NOTICE` | `461` | *(silent)* | 5946 + | `PRIVMSG nick` (no text) | `461` | `412` | 5947 + | `NOTICE nick` (no text) | `461` | *(silent)* | 5948 + | `PRIVMSG nick :` (empty text) | `461` | `412` | 5949 + 5950 + **Root cause.** The oracle's `PRIVMSG`/`NOTICE` `msgtab` rows carry **min-params = 2** 5951 + (`ircd-common/src/parse.rs:176,189`), so its parser emits `461 ERR_NEEDMOREPARAMS` *before* 5952 + `m_message` runs whenever fewer than two non-empty parameters arrive — the C handler itself 5953 + never emits the RFC `411`/`412`. (Confirmed: `PRIVMSG nick :` with an empty trailing → the 5954 + empty token does not count toward parc, so it is also a min-params shortfall → `461`.) 5955 + leveva instead implemented RFC-1459 `411`/`412`/silence inside the handler. 5956 + 5957 + **Closed it** by changing `leveva/src/command/message.rs::message()`: a missing/empty 5958 + **target** *or* missing/empty **text** now returns `461` via `need_more_params`, for 5959 + **both** PRIVMSG and NOTICE, **ungated by `errs`** (the `461` is parser-level, so it is not 5960 + subject to NOTICE's no-auto-reply rule — that rule still governs the handler-level 5961 + `401`/`404`/`407`). The `411`/`412` numerics remain defined (`numeric.rs`) and are still 5962 + used by the leveva-native `TAGMSG` (no oracle counterpart → out of parity scope; left 5963 + unchanged). Also fixed the now-stale `message()` doc comment (it still claimed "leveva has 5964 + no channel modes yet, so there is no `+n`/`+m` 404" — leveva *does* emit 404 now). 5965 + 5966 + ### Collateral updated for the behavior change 5967 + 5968 + - `message.rs` unit tests: `privmsg_no_target_gives_411`→`…_461`, 5969 + `privmsg_no_text_gives_412`→`…_461`, and `notice_delivers_but_never_replies` (bare / 5970 + no-text NOTICE now `461`, not silent). 5971 + - `command/mod.rs` dispatch comment; `help/NOTICE.md` (now documents the `461` that survives 5972 + the no-reply rule); `leveva/tests/privmsg_proptest.rs` (PRIVMSG replies `401|461`; the 5973 + NOTICE reply, if any, is `461`). 5974 + 5975 + ### The agreeing surface (ground-truthed, now incl. the ex-divergences at 461) 5976 + 5977 + `PRIVMSG <live nick>`→`[]`; `<ghost nick>`→`401`; `NOTICE <ghost nick>`→`[]`. Channels: 5978 + member→`[]`, ghost `PRIVMSG`→`401` / `NOTICE`→`[]`. AWAY: `PRIVMSG`→`301` / `NOTICE`→`[]`. 5979 + `+n` non-member & `+m` unvoiced member: `PRIVMSG`→`404` / `NOTICE`→`[]`. Six distinct ghost 5980 + targets → `[401×5, 407]` (dedup + the anti-spam cap agree exactly: `MAX_TARGETS == 5`, 5981 + `MAXPENALTY == 10`). Non-oper `$$` mask → falls through to nick resolution → `401`. The five 5982 + ex-divergence forms → `461` on both. 5983 + 5984 + ### Tests 5985 + 5986 + - **`message_skeleton_differential.rs`** (7 tests): the closed `461` cluster 5987 + (`missing_params_give_461_on_both`); nick targets (live/ghost × PRIVMSG/NOTICE); channel 5988 + targets (member/ghost); `+n`/`+m` → `404`; AWAY `301` (PRIVMSG-only); the six-ghost 5989 + dedup+cap `[401×5,407]`; the non-oper `$$` mask fall-through `401`. 5990 + - **`message_skeleton_proptest.rs`** (2 props): `message_skeletons_agree` (64 cases) — 5991 + random `(verb, target-shape ∈ {live, ghost-nick, ghost-chan}, text-shape ∈ {present, 5992 + empty-trailing, absent})`, oracle as the model (the closed divergence means the 5993 + missing-text shapes are *inside* the agree domain now); `arbitrary_message_bytes_never_ 5994 + panic_leveva` (512 cases) — arbitrary bytes after a random `PRIVMSG `/`NOTICE ` prefix → 5995 + leveva panic-freedom + CRLF framing. 5996 + 5997 + **Gate.** `cargo test -p leveva` green (message units + `privmsg_proptest` re-pinned); 5998 + `cargo test -p leveva-integration` green (the new differential + proptest agree with the 5999 + oracle, all slice-92/93/94 differentials re-confirmed); new files clippy-clean; `cargo 6000 + build --workspace` 0 warnings.
+82
docs/superpowers/plans/2026-06-11-p11-slice95-message-skeleton-differential.md
··· 1 + # P11 slice 95 — PRIVMSG/NOTICE delivery command-skeleton differential 2 + 3 + ## Goal 4 + 5 + Extend the slice-92/93/94 native cross-daemon oracle harness to the **messaging 6 + delivery** cluster — `PRIVMSG` and `NOTICE` — the send-side companion to slice 93's 7 + mutate-side JOIN/PART/KICK and slice 94's read-only query cluster. Diff leveva's numeric 8 + **skeleton** against the in-process `ircd-common` oracle over a curated table + a 9 + model-free fuzz, **and close the one divergence found** by making leveva match the oracle. 10 + 11 + ## The divergence (found by a probe, then closed) 12 + 13 + Ground-truthing both daemons (a throwaway probe, slice-94 discipline) showed the agreeing 14 + surface is broad, with exactly one divergence cluster around **missing parameters**: 15 + 16 + | input | oracle | leveva (before) | 17 + | --- | --- | --- | 18 + | bare `PRIVMSG` | `461` | `411` | 19 + | bare `NOTICE` | `461` | *(silent)* | 20 + | `PRIVMSG nick` (no text) | `461` | `412` | 21 + | `NOTICE nick` (no text) | `461` | *(silent)* | 22 + | `PRIVMSG nick :` (empty text) | `461` | `412` | 23 + 24 + **Root cause.** The oracle's `PRIVMSG`/`NOTICE` `msgtab` rows carry `min-params = 2` 25 + (`ircd-common/src/parse.rs:176,189`), so its parser emits `461 ERR_NEEDMOREPARAMS` 26 + *before* `m_message` runs whenever fewer than two non-empty parameters arrive — the C 27 + handler itself never emits the RFC `411`/`412`. leveva instead implemented RFC-1459 28 + `411`/`412`/silence inside the handler. 29 + 30 + **Decision (per the user): make leveva behave the same way.** leveva's `message()` now 31 + emits `461` for a missing/empty target *or* missing/empty text, for **both** PRIVMSG and 32 + NOTICE — the `461` is parser-level, so it is *not* gated by `errs` (NOTICE's no-auto-reply 33 + rule still governs the handler-level `401`/`404`/`407`). The `411`/`412` numerics remain 34 + defined (`numeric.rs`) and are still used by the leveva-native `TAGMSG` (no oracle 35 + counterpart, out of parity scope). 36 + 37 + ## The agreeing surface (ground-truthed, now including the ex-divergences) 38 + 39 + - `PRIVMSG <live nick>` → `[]`; `PRIVMSG <ghost nick>` → `401`; `NOTICE <ghost nick>` → `[]`. 40 + - `PRIVMSG <member channel>` → `[]`; `PRIVMSG <ghost channel>` → `401`; `NOTICE <ghost 41 + channel>` → `[]`. 42 + - `PRIVMSG <away user>` → `301`; `NOTICE <away user>` → `[]`. 43 + - `+n` channel, non-member: `PRIVMSG` → `404`, `NOTICE` → `[]`. `+m` channel, unvoiced 44 + member: `PRIVMSG` → `404`. 45 + - multi-target dedup + anti-spam cap: `PRIVMSG a,b,c,d,e,f` (6 distinct ghosts) → 46 + `[401,401,401,401,401,407]` on both (`MAX_TARGETS == 5`, `MAXPENALTY == 10`). 47 + - non-oper `$$`/`$#` mask target → falls through to nick resolution → `401`. 48 + - the five ex-divergence forms above → `461` on both. 49 + 50 + ## Mechanism 51 + 52 + Reuses the slice-92/93/94 harness verbatim (`OracleWorld`/`OracleClient`/`LevevaWorld`/ 53 + `LevevaClient`, `oracle_lock()`, `numeric_codes`) — **no harness code changes** (the 54 + slice-93 fixture CIDR-cap loosening already covers the op-plus-partner scenarios). The 55 + skeleton excludes the non-numeric PRIVMSG/NOTICE delivery wire by construction (a 56 + delivered message is `:src PRIVMSG …`, not a 3-digit numeric). 57 + 58 + ## Implementation steps 59 + 60 + 1. **(done)** Change `leveva/src/command/message.rs::message()`: replace the 61 + `411`/`412`/silence returns with `461` via `need_more_params`, ungated by `errs`; fix 62 + the stale doc comment (also drop the stale "no channel modes yet → no 404" line). 63 + 2. **(done)** Update the unit tests: `privmsg_no_target_gives_411` → `…_461`, 64 + `privmsg_no_text_gives_412` → `…_461`, and `notice_delivers_but_never_replies` (bare 65 + NOTICE / no-text NOTICE now `461`). 66 + 3. **(done)** Update the collateral: the `mod.rs` dispatch comment, `help/NOTICE.md`, and 67 + `leveva/tests/privmsg_proptest.rs` (PRIVMSG replies `401|461`; NOTICE reply, if any, 68 + `461`). 69 + 4. Add `leveva-integration/tests/message_skeleton_differential.rs` — the curated table, 70 + asserting **agreement** across the whole surface above (the ex-divergences now agree at 71 + `461`, asserted as such). 72 + 5. Add `leveva-integration/tests/message_skeleton_proptest.rs` — two props: 73 + `message_skeletons_agree` (random `(verb, target-shape, text-shape)` over the proven 74 + surface, oracle as the model) and `arbitrary_message_bytes_never_panic_leveva`. 75 + 6. Record the slice (p11.md heredoc + PLAN.md row bump 94→95 + memory) and commit. 76 + 77 + ## Test gate 78 + 79 + `cargo test -p leveva` green (message units + privmsg_proptest); `cargo test -p 80 + leveva-integration` green (the new differential + proptest agree with the oracle, plus all 81 + slice-92/93/94 differentials re-confirmed); new files clippy-clean; `cargo build 82 + --workspace` 0 warnings.