serverless-ircd 0.4.0 → 0.6.0

package/.github/workflows/ci.yml

@@ -42,6 +42,32 @@ jobs:
           node-version: 24
           cache: pnpm
 
+      # DynamoDB Local capability for `aws-adapter` coverage.
+      #
+      # The `aws-adapter` package's vitest `globalSetup` boots a real
+      # DynamoDB Local instance so the integration suite (handlers,
+      # aws-runtime, transactions, …) can be exercised under coverage.
+      # Without it, 171 of 294 tests `describe.skipIf` away and the
+      # package drops to ~42% coverage, blowing the 90% gate.
+      #
+      # The self-hosted Gitea runner image (`ubuntu-latest`) ships with
+      # neither Docker (testcontainers' Ryuk reaper fails with "Failed
+      # to connect to Reaper" without a `docker.sock` mount or
+      # privileged mode) nor a JRE. We install a JRE here via the
+      # canonical `setup-java` action so the globalSetup's ZIP fallback
+      # can fire — this is the only strategy the runner image can
+      # support without host-level privileged-mode configuration.
+      #
+      # `DDB_LOCAL_STRATEGY=zip` is pinned on the coverage step below
+      # so the globalSetup skips the testcontainers probe entirely
+      # (otherwise it blocks for ~60s waiting for Ryuk before falling
+      # back, which is flaky and wastes CI minutes).
+      - name: Setup Java (JRE for DynamoDB Local ZIP fallback)
+        uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: '11'
+
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
@@ -52,6 +78,12 @@ jobs:
         run: pnpm typecheck
 
       - name: Test with coverage
+        # `DDB_LOCAL_STRATEGY=zip` pins the DynamoDB Local boot to the
+        # Java ZIP fallback (see the `Setup Java` step above for why).
+        # This skips the testcontainers probe so the runner does not
+        # block ~60s waiting for Ryuk before falling back.
+        env:
+          DDB_LOCAL_STRATEGY: zip
         run: pnpm coverage
 
       - name: Coverage gate (coverage-thresholds enforced per package)
@@ -90,7 +122,7 @@ jobs:
 
       - name: Upload coverage
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v3
         with:
           name: coverage
           path: |
@@ -135,7 +167,7 @@ jobs:
 
       - name: Upload mutation report
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v3
         with:
           name: mutation-report
           path: packages/irc-core/reports/mutation

package/.github/workflows/deploy-aws.yml

@@ -38,8 +38,7 @@ name: deploy-aws
 #                          behaviour).
 
 on:
-  push:
-    branches: [main]
+  # Automatic push trigger disabled; deploy only runs manually.
   workflow_dispatch:
 
 # OIDC web identity requires id-token write; contents:read for checkout.

package/.github/workflows/deploy-cf-tcp.yml

@@ -16,11 +16,7 @@ name: deploy-cf-tcp
 #   CF_TCP_ORIGIN_ADDRESS   Hostname/IP of the container origin.
 
 on:
-  push:
-    branches: [main]
-    paths:
-      - 'apps/cf-tcp-container/**'
-      - '.github/workflows/deploy-cf-tcp.yml'
+  # Automatic push trigger disabled; deploy only runs manually.
   workflow_dispatch:
 
 concurrency:

package/.github/workflows/deploy-cf.yml

@@ -25,8 +25,7 @@ name: deploy-cf
 # custom routes are wired.
 
 on:
-  push:
-    branches: [main]
+  # Automatic push trigger disabled; deploy only runs manually.
   workflow_dispatch:
 
 # Prevent two deploys racing the same DO namespace.

package/CHANGELOG.md

@@ -10,6 +10,441 @@ For the release process itself — versioning policy, pre-release checklist,
 cutting a tag, rolling back — see [`docs/release.md`](docs/release.md).
 Cross-reference `progress.md` / `tickets.md` for per-ticket detail.
 
+## [0.6.0] - 2026-08-03
+
+The headline is the **IRCv3 extension sweep (Phase 12)**: ten negotiated
+caps and the user-mode-`S` TLS indicator land in one release, taking the
+negotiated capability surface from "modern baseline" to "draft-leading-
+edge". Alongside it: the **required-`serverName` config gate** (the
+last open v0.5.0 follow-up), a new **`tools/load-test`** client farm
+(Phase 7's 10k-connection harness), and the **coverage / CI unblocks**
+that lift `aws-adapter` over the 90% gate and switch `cf-adapter` /
+`cf-worker` to istanbul (clearing the v0.5.0 workerd-incompatibility
+caveat). Deploy workflows are now **manual-only** (`workflow_dispatch`).
+
+### Added — IRCv3 extensions (`@serverless-ircd/irc-core`, `@serverless-ircd/irc-server`)
+
+The ten Phase 12 cap tickets light up the remaining negotiated-cap
+surface, and the two non-cap Phase 12 tickets (ISUPPORT tokens and
+user mode `S`) round out the wire-visible advertisement. Each cap
+ships a pure reducer (where applicable), an actor route case,
+advertisement in `SUPPORTED_CAPABILITIES` (or conditional
+advertisement for `sts`), and unit + actor coverage. The
+pure-reducer / dispatch pipeline is unchanged — every cap is plumbed
+through `ctx` and emitted `Effect[]`, never performed in the handler.
+
+- **`account-notify`**: pushes `:nick ACCOUNT <name|*>`
+  to peers in shared channels (excluding the sender unless
+  `echo-message`) on SASL login / logout. Closes the
+  `account-tag` / `extended-join` / `account-notify` triple modern
+  clients render fully.
+- **`msgid`**: every PRIVMSG / NOTICE / TAGMSG fanned out
+  to a cap-enabled peer carries `@+msgid=<id>` from
+  `IdFactory.nonce()`. The nonce is **shared between the live fanout
+  and the `draft/chathistory` record** so a peer sees the same id live
+  and on replay. Legacy peers see no `msgid` tag.
+- **`standard-replies`**: a data-driven
+  `numericToStandardReply` table replaces a curated subset of bare
+  numerics (`461`, `403`, `432`, `433`, SASL failures, …) with
+  `FAIL`/`WARN`/`NOTE COMMAND code context :description` for
+  cap-enabled clients. Legacy clients still receive the unchanged
+  numeric. Numeric-only replies (MOTD lines, NAMES, …) stay on their
+  numeric form.
+- **`MONITOR`**: the modern `ISON` replacement. Implements
+  `MONITOR + nick{,nick}` / `- nick` / `C` / `L` / `S` with the
+  `730 RPL_MONONLINE` / `731 RPL_MONOFFLINE` / `732 RPL_MONLIST` /
+  `734 ERR_MONLISTFULL` numerics. Online/offline transitions push
+  `730`/`731` **asynchronously** via the Registry's nick reserve /
+  release hooks (a new `MonitorStore` port + push callback). The
+  ceiling is config-driven (`MONITOR=<n>`, default 30).
+- **`labeled-response`**: a client-sent `+label=<id>` is
+  plumbed through `ctx` and every reply caused by that message is
+  wrapped in a single `BATCH +id labeled-response … BATCH -id`. A
+  command that produces no reply emits an empty labeled batch (spec-
+  mandated). The label travels on every reducer's emitted effects,
+  so multi-reply commands accumulate under one batch.
+- **`sts`**: Strict Transport Security. The cap is
+  **conditionally advertised** — only when `ServerConfig.sts`
+  (`{ duration, port, preload? }`) is supplied. On a plaintext
+  listener a compliant client upgrades; on the TLS listener the
+  duration is still sent to lock in the policy. Defaults:
+  `duration = 30 days`, `port = 6697`.
+- **`draft/typing`**: `TAGMSG <target> +draft/typing=
+  active|paused|done` broadcasts to channel members (or routes to a
+  nick target), excluding the sender unless `echo-message`. The
+  `+draft/typing=*` client tag is whitelisted for clients without
+  `message-tags` (per the spec's client-tag exception). Broadcast
+  delivery uses **OR-semantics**: a recipient qualifies if it
+  negotiated `message-tags` **or** `draft/typing` (a new `caps` field
+  on `BroadcastEffect`).
+- **`draft/multiline`**: a cap-enabled
+  client sends `BATCH +id draft/multiline :target` + N PRIVMSG/NOTICE
+  lines + `BATCH -id`. The server concatenates per spec (with `\n`),
+  enforces a configurable byte budget (`multilineMaxBytes`, default
+  4096), and broadcasts the batched replay to multiline peers / a
+  single joined PRIVMSG (carrying `+draft/multiline`) to legacy
+  peers. **Nick-target routing**, **chathistory recording** (one
+  record per batch carrying the joined body, assigned `msgid`, and
+  the `+draft/multiline` client tag), and **tag gating** (the
+  `+draft/multiline` tag is stripped for peers without
+  `message-tags`) all land in the completion ticket.
+- **`draft/read-marker`**: persists the per-`(account,
+  channel)` last-read marker in a new `ReadMarkerStore` port,
+  propagates updates via `+draft/read-marker=<msgid>` tags, and
+  seeds a fresh connection's marker from the persisted value at
+  identify time. `CHATHISTORY BEFORE` honours the marker when no
+  explicit pivot is supplied.
+- **`draft/pre-away`**: persists the away reason in a
+  new `AwayStore` port keyed by account. On identify (or SASL login)
+  the server re-applies the away state and emits the `AWAY` line +
+  `306 RPL_NOWAWAY` as if the user had sent `AWAY :reason`
+  themselves. `AWAY` (unset) clears the persisted reason.
+- **ISUPPORT tokens for the new caps**: `005
+  RPL_ISUPPORT` now advertises `STATUSMSG=@+`, `EXTBAN=<prefix>,q`,
+  `ACCOUNTEXTBAN=a` (services-gated), `TYPING`, and `MULTILINE`.
+  `MONITOR=<n>` honours `serverConfig.monitorLimit`. Tokens are
+  config-derived where applicable.
+- **User mode `S` (TLS connected)**: the transport's
+  TLS fact is surfaced end-to-end as a read-only user mode. Set
+  once by the registration reducer from `ConnectionState.secure`;
+  emitted in `221 … +S`; rejected by `MODE nick +/-S` with `501
+  ERR_UMODEUNKNOWNFLAG`; surfaced in WHOIS via the new `276
+  RPL_WHOISSECURE`. Each adapter asserts `secure: true` where the
+  platform terminates TLS (API Gateway, CF edge, Spectrum, NLB TLS
+  listener).
+
+### Changed — Required server identity
+
+The last open v0.5.0 follow-up closes. The `irc.example.com`
+placeholder `DEFAULT_SERVER_CONFIG` is **removed** from
+`irc-core`; the shared `ServerConfigSchema` rejects a missing
+`serverName` / `networkName` so every adapter **fails fast at boot**
+with a readable, field-listing error.
+
+- **`@serverless-ircd/irc-core`**: `DEFAULT_SERVER_CONFIG` removed.
+- **`@serverless-ircd/irc-test-support`**: ships a clearly test-scoped
+  `makeTestServerConfig()` baseline (`irc.test.local`) so unit tests
+  construct a `ServerConfig` without re-introducing a production
+  default.
+- `apps/cf-worker` + `apps/cf-tcp-container`: loaders require
+  `SERVER_NAME`; `wrangler.toml` samples switched to
+  `irc.your-domain.invalid`.
+- `apps/aws-stack` + `apps/local-cli`: keep obviously-local fallbacks
+  (`irc.localhost`) documented as *"production MUST override"*;
+  `local-cli` gains `--server-name` / `--network-name` flags.
+
+### Added — Load-test harness (`@serverless-ircd/load-test`)
+
+PLAN §7 / Phase 7's 10k-connection harness. A synthetic WebSocket IRC
+client farm: opens N connections, registers (NICK/USER), joins a
+channel, and optionally chats. Captures **p50 / p95 / p99 latency per
+phase** (connect / register / join / message) plus the **drop rate**,
+and prints a markdown report to stdout (or `--report <path>`).
+
+```bash
+pnpm --filter load-test start -- \
+  --target wss://irc.staging.example.com/ \
+  --connections 10000 --concurrency 200 --ramp-ms 60000 \
+  --channel '#loadtest' --messages 3 --platform cf-staging \
+  --report reports/cf-staging-2026-08-03.md
+```
+
+The package ships its own vitest suite (config parsing, framing,
+harness, metrics, report) at ≥90% coverage; no production source in
+the irc-core / irc-server packages changed to support it.
+
+### Added — Coverage / CI unblocks
+
+- **`aws-adapter` clears the 90% gate.** The self-hosted runner image
+  ships with neither Docker nor a JRE, so the package's
+  testcontainers / Java-ZIP DynamoDB Local boot fell through to
+  strategy 3 and 171 of 294 integration tests `describe.skipIf`-ed
+  away — dropping coverage to ~42% and blowing the gate. CI now
+  installs Temurin JRE 11 via `actions/setup-java@v4` and pins
+  `DDB_LOCAL_STRATEGY=zip` on the coverage step so the ZIP fallback
+  fires deterministically. The full aws-adapter suite now runs on
+  every coverage job. New integration tests cover
+  `broadcastWallops` fan-out, `reserveNick` non-conditional error
+  propagation, `refreshChannel` empty-members / topic-preservation
+  paths, NLB header fallbacks, scan-row type guards, and
+  `CREATED_AT` overflow handling. `tools/ci-hardening` gained a
+  self-check asserting the JRE install + strategy pin remain wired.
+- **`aws-stack` coverage command repaired.** The CDK `NodejsFunction`
+  in the test synth re-bundled the Lambda asset via esbuild ~80
+  times per coverage run and OOM-ed CI before vitest could print a
+  report. A new `makeLambda()` factory switches between
+  `NodejsFunction` (production synth) and an inline-zip `Function`
+  stub (tests) via the `IRC_AWS_STACK_TEST_NO_BUNDLE` env var. The
+  stub preserves every CloudFormation shape the suite asserts on
+  while making bundling a no-op. New
+  `tests/synth-no-bundle.test.ts` + `tests/coverage-command.test.ts`
+  lock both branches and assert the `pnpm coverage` run prints an
+  `All files` row.
+- **`cf-adapter` / `cf-worker` switch to istanbul coverage.** This
+  **resolves the v0.5.0 known limitation**: `@vitest/coverage-v8`
+  v4.1.x imports `node:inspector/promises`, which the
+  `@cloudflare/vitest-pool-workers` (workerd) pool cannot resolve.
+  Both packages now use `@vitest/coverage-istanbul` so `pnpm
+  coverage` loads under workerd. Edge-case suites were expanded
+  (serialize/deserialize/migrate, connection-do pure helpers,
+  `broadcastWallops` fan-out, `changeNick` shard routing,
+  ChannelDO broadcast/cache, RegistryDO `listEntries`, SASL seed
+  parsing).
+
+### Changed — Deploy workflows are now manual-only
+
+`deploy-cf.yml`, `deploy-cf-tcp.yml`, and `deploy-aws.yml` dropped
+their `push: branches: [main]` triggers and now run on
+`workflow_dispatch` only. Staging deploys are no longer fired
+automatically on every merge to `main`; a maintainer kicks them off
+by hand. The release runbook (`docs/Release-Process.md`) is the
+canonical reference either way — there was never a CI auto-deploy to
+production.
+
+### Changed — `@vitest/coverage-istanbul` peer
+
+The root lockfile (`pnpm-lock.yaml`) registers the
+`@vitest/coverage-istanbul` peer introduced by the cf-adapter /
+cf-worker coverage switch. No operator action; `pnpm install`
+resolves it.
+
+### ⚠️ Migration required
+
+- **`serverName` is now required at boot.** Operators who relied on
+  the silent `irc.example.com` placeholder must supply an explicit
+  value via their adapter's config knob:
+  - **Cloudflare Worker / TCP container**: set `SERVER_NAME` (and
+    `NETWORK_NAME` if desired) in `wrangler.toml` `[vars]` or via
+    `wrangler secret put`. The samples switched to
+    `irc.your-domain.invalid` — replace with your real hostname.
+  - **AWS**: the CDK stack's `serverName` prop / `SERVER_NAME` env
+    var. The local fallback is `irc.localhost` and is explicitly
+    documented as "production MUST override".
+  - **`local-cli`**: new `--server-name <h>` / `--network-name <n>`
+    flags (default `irc.localhost` / `LocalNet`).
+  A missing value now throws an aggregated `"Invalid server
+  config:"` error at boot listing every offending field.
+- **No persisted-state schema change.** `PERSISTED_STATE_VERSION`
+  stays `1`. The user-mode-`S` work adds a `secure` field and a
+  `userModes.tls` field to the persisted shape, but both are purely
+  **additive with `false` defaults** and the cf-adapter `migrate()`
+  path backfills them on pre-feature records. **Code rollback across
+  this release is safe.**
+- No toolchain change. Node ≥ 24 / pnpm 11 (from v0.4.0) still apply.
+
+### Known limitations
+
+- Same transport limits as v0.5.0: the **CF TCP path requires
+  Cloudflare Spectrum (Enterprise tier)** plus a stateful Container
+  origin; the **AWS TCP path** uses NLB + Lambda streaming and is
+  subject to Lambda idle-timeout / stream-duration limits. The
+  WebSocket path remains the zero-extra-deps default.
+- **mTLS (for SASL `EXTERNAL`) requires a custom domain + uploaded
+  CA/trust-store** on both platforms and is not enabled by default.
+- `STATS` ships the `u` + `l` query letters; the full RFC matrix
+  (`k`, `K`, `q`, `g`, `x`, `z`, …) is intentionally out of scope for
+  v1 — unknown letters get the charybdis-style empty body + `219`.
+- **Client compatibility sweep** (WeeChat / HexChat / IRCCloud /
+  TheLounge / matrix-IRC bridge) remains pending.
+- **Coverage hardening is partial.** `aws-adapter` and `aws-stack`
+  now clear the 90% gate, and `cf-adapter` / `cf-worker` run under
+  istanbul; the remaining packages (`cf-adapter`, `local-cli`,
+  `load-test`, `cf-tcp-container`, `tcp-ws-forwarder`,
+  `irc-test-support`) are **above the gate but below 100%** —
+  follow-ups drive each to 100%.
+- The IRC services (NickServ / ChanServ / HostServ / OperServ /
+  MemoServ) Phase 13 work is pending; `draft/read-marker` and
+  `draft/pre-away` ship with in-memory reference stores, so marker /
+  away persistence does not survive an adapter restart until a
+  services backend lands.
+- The web client Phase 14 work (vendor Kiwi IRC, serve SPA from the
+  Worker, WS Origin allowlist) is pending.
+
+### Security
+
+- None. No vulnerabilities have been reported or fixed in this
+  release. The new caps add surface area but ship no new auth path
+  (the SASL `PLAIN` / `EXTERNAL` paths and the oper gate are
+  unchanged); the required-`serverName` change rejects misconfigured
+  deploys at boot rather than advertising a placeholder identity.
+
+---
+
+## [0.5.0] - 2026-08-02
+
+The headline is **protocol completion**: the deferred IRC verbs land
+(Phase 11), and the S2S / obsolete RFC 2812 verbs are **formally
+dropped** rather than left "deferred". With this release every standard
+IRC verb a modern client expects is implemented — the only remaining
+`421 ERR_UNKNOWNCOMMAND` paths are the deliberately-unimplemented S2S
+and obsolete verbs. The roadmap's 0.x protocol surface is complete;
+what remains is the load/compat sweep (10k-connection load test +
+client compatibility matrix) and the required-`serverName` config gate.
+
+### Added — Deferred IRC verbs (`@serverless-ircd/irc-core`, `@serverless-ircd/irc-server`)
+
+Six Phase 11 tickets light up the remaining command surface. Each ships
+a pure reducer, an actor route case (no more `421`), new numerics in
+`protocol/numerics.ts`, and unit + actor coverage. (The remaining two
+Phase 11 tickets are drops — see below.)
+
+- **`KILL`** (oper-gated force-disconnect): `KILL <nick>
+  <comment>` resolves the target via the nick registry + a live
+  connection fetch (mirroring WHOIS), checks the oper gate (`481
+  ERR_NOPRIVILEGES`), and emits a `Disconnect` effect carrying the
+  classic `Killed (<oper> (<comment>))` reason. Peer `QUIT` fanout in
+  the target's shared channels happens via the runtime's existing
+  `disconnect` path. Missing params → `461`; unknown nick → `401`; an
+  oper may `KILL` themselves (RFC-permitted).
+  **Platform asymmetry:** on Cloudflare the `disconnect` RPC closes the
+  target DO's socket immediately; on AWS a `$default` Lambda invocation
+  cannot close a *remote* APIGW WebSocket, so the target's
+  live socket only closes on its next `$disconnect` / sweeper cycle —
+  the QUIT fanout to peers still fires. The reducer is identical; the
+  difference is the bound runtime's `disconnect` semantics.
+- **`REHASH`** (oper-gated config reload): emits `382
+  RPL_REHASHING :<source>` and re-fetches `ServerConfig` from the
+  adapter's bound source via a new `IrcRuntime.reloadConfig()` port
+  method. The refreshed value swaps into the actor's live config
+  reference so subsequent commands observe it (rotated oper passwords,
+  new MOTD source, etc.). On reload failure the previous config stays
+  in effect and a graceful error-suffixed `382` follows — the oper is
+  **not** disconnected (a bad store read must never sever a live link).
+  Already-open connections keep their negotiated caps and registration;
+  transport/TLS reload requires a redeploy.
+- **`LUSERS` + `STATS`** (network statistics): backed by a
+  new async `ServerStats` port (`getStats(): Promise<ServerStatsSnapshot>`)
+  and an `InMemoryStats` reference impl. `LUSERS` emits the full
+  `251`–`255` sequence (only the non-zero counts, per RFC) plus the
+  optional `265` / `266` local/global counts. `STATS <query>` supports
+  the `u` (uptime, `242 RPL_STATSUPTIME`) and `l` (link info,
+  `211 RPL_STATSLINKINFO`) letters; unknown letters get the
+  charybdis-style empty body terminated by `219 RPL_ENDOFSTATS`. A
+  `<server>` argument that does not match the local server (case-
+  insensitive) yields `402 ERR_NOSUCHSERVER` (single-server network —
+  S2S aggregation is a PLAN non-goal). The `computeStatsSnapshot`
+  helper centralizes the oper/invisible/unknown classification so each
+  adapter's backend only has to gather raw counts.
+- **`TRACE`** (routing diagnostics): in a single-server
+  serverless IRCd `TRACE` collapses to a local-server line + the
+  `262 RPL_ENDOFTRACE` terminator. Per-connection `204
+  RPL_TRACEOPERATOR` / `205 RPL_TRACEUSER` detail is **oper-gated** —
+  non-opers see only the server line + `262` (no enumeration of `+i`
+  users they don't share a channel with). `TRACE <server>` where
+  `<server>` is not the local server → `402`.
+- **`WALLOPS`** (oper broadcast): `WALLOPS :<message>` is
+  oper-only to send (modern ircd convention — non-oper → `481`);
+  delivery fans out to every connection whose `+w` user mode is set via
+  a new `BroadcastWallops` effect interpreted by the runtime's
+  `broadcastWallops` method (global cross-connection fanout, not
+  channel-scoped). The originator is always excluded (skip-self,
+  matching NOTICE/PRIVMSG semantics). Empty message → `461`. The `+w`
+  user mode was already accepted by `MODE` and advertised in `004
+  RPL_MYINFO`; this lights up the consumer.
+- **`SETNAME`** (realname change): `SETNAME :<realname>`
+  updates `state.realname` so a subsequent `WHOIS` reflects the new
+  value in `311 RPL_WHOISUSER`. No broadcast is emitted in v1 (there
+  is no standard IRCv3 cap for relaying a realname change — a
+  `draft/setname` relay is a documented follow-up). Empty/missing
+  realname → `461`; the registration-time realname length cap applies.
+
+### Changed — S2S & obsolete verbs formally dropped (`@serverless-ircd/irc-core`)
+
+The remaining two Phase 11 tickets convert the "deferred" framing into
+an explicit **drop**. There is no behaviour change on the wire — the verbs
+already returned `421 ERR_UNKNOWNCOMMAND` — but the framing, comments,
+and reserved numerics are cleaned up so the codebase no longer carries
+dead scaffolding.
+
+- **S2S verbs** (`CONNECT`, `SQUIT`, `LINKS`): dropped as a PLAN
+  non-goal (single-server serverless IRCd; no mesh to connect, split,
+  or list). The now-unused numerics `RPL_LINKS (364)`,
+  `RPL_ENDOFLINKS (365)`, and `ERR_CANTKILLSERVER (483)` are removed
+  from `numerics.ts` and its auto-derived `numericToName` reverse map.
+  `ERR_NOSUCHSERVER (402)` is retained — `LUSERS` / `STATS` / `TRACE`
+  use it for remote-server gating.
+- **Obsolete RFC 2812 verbs** (`SERVICE`, `SUMMON`, `USERS`): dropped
+  (never widely implemented; no modern client uses them). The now-unused
+  numerics `RPL_YOURESERVICE (383)`, `ERR_NOSUCHSERVICE (408)`,
+  `ERR_SUMMONDISABLED (445)`, and `ERR_USERSDISABLED (446)` are removed.
+- The `actor.ts` default-branch triage comment was rewritten: the
+  six verbs are documented as **deliberately unimplemented** rather
+  than "deferred".
+- Source-level regression guards
+  (`packages/irc-core/tests/dropped-s2s-and-obsolete-verbs.test.ts`)
+  and a behaviour guard in `actor.test.ts` (the verbs still emit
+  `421`) pin the drop so the numerics or the "deferred" framing cannot
+  creep back in.
+
+### Added — Runtime ports for the new verbs
+
+- **`ServerStats` port** (`packages/irc-core/src/ports.ts`): async
+  `getStats()` returning `ServerStatsSnapshot` (users / invisible /
+  opers / unknown / channels / servers / local+global conn counts /
+  uptime anchor). Asynchronous because the aggregation crosses every
+  connection and channel — it cannot be pre-loaded into a synchronous
+  view the way MOTD or a credential table can. Each adapter implements
+  it against its authoritative store; `InMemoryStats` is the reference
+  impl. The `computeStatsSnapshot` helper holds the shared
+  classification logic (oper / invisible / unknown).
+- **`reloadConfig()` on `IrcRuntime`** (`packages/irc-server/src/runtime.ts`):
+  request/response port method the `REHASH` route calls to re-fetch
+  `ServerConfig` from the adapter's bound source (CF: KV/secret env;
+  AWS: Secrets Manager/SSM env; local-cli: the config file/options).
+  Modelled as a runtime method rather than a fire-and-forget effect
+  because the refreshed value must come back to the actor.
+
+### ⚠️ Migration required
+
+- **For adapter authors wiring the new ports.** `ServerStats` and
+  `reloadConfig` are optional at the type level (the actor falls back
+  to a zero-count snapshot when no `ServerStats` is bound, and
+  `REHASH` still emits `382` even if `reloadConfig` rejects — the
+  previous config is retained). To surface real counts and live
+  reloads, each adapter wires its own backend. No Durable-Object
+  persisted-state schema change (`PERSISTED_STATE_VERSION` stays `1`);
+  code rollback across this release is safe.
+- No toolchain change. Node ≥ 24 / pnpm 11 (from v0.4.0) still apply.
+
+### Known limitations
+
+- Same as v0.4.0's transport limits: the **CF TCP path requires
+  Cloudflare Spectrum (Enterprise tier)** plus a stateful Container
+  origin; the **AWS TCP path** uses NLB + Lambda streaming and is
+  subject to Lambda idle-timeout / stream-duration limits. The
+  WebSocket path remains the zero-extra-deps default.
+- **mTLS (for SASL `EXTERNAL`) requires a custom domain + uploaded
+  CA/trust-store** on both platforms and is not enabled by default.
+- `serverName` still defaults to the `irc.example.com` placeholder when
+  an adapter config omits it (pending).
+- `STATS` ships the `u` + `l` query letters; the full RFC matrix
+  (`k`, `K`, `q`, `g`, `x`, `z`, …) is intentionally out of scope for
+  v1 — unknown letters get the charybdis-style empty body + `219`.
+- Load testing (10k concurrent connections) and the client
+  compatibility sweep (WeeChat / HexChat / IRCCloud / TheLounge)
+  remain pending.
+- **Local coverage instrumentation on the Cloudflare-backed packages
+  (`@serverless-ircd/cf-adapter`, `@serverless-ircd/cf-worker`) is
+  incompatible with the current vitest toolchain.** `@vitest/coverage-v8`
+  v4.1.x imports `node:inspector/promises`, which the
+  `@cloudflare/vitest-pool-workers` (workerd) test pool cannot resolve.
+  The packages' test suites themselves pass (cf-adapter 185/185,
+  cf-worker 3/3); only `pnpm coverage` fails to load the coverage
+  module under the workerd pool. This is a documented [vitest-pool-workers
+  known issue](https://developers.cloudflare.com/workers/testing/vitest-integration/known-issues/#module-resolution)
+  and is expected to resolve with an upstream `@vitest/coverage-v8` or
+  pool-workers release. No production code is affected; CI behavior
+  depends on its installed versions.
+
+### Security
+
+- None. No vulnerabilities have been reported or fixed in this release.
+  The dropped S2S / obsolete verbs and their reserved numerics carried
+  no reachable code path; their removal reduces surface area but fixes
+  no defect.
+
+---
+
 ## [0.4.0] - 2026-07-31
 
 The headline is **dual transport**: both adapters now speak a real