serverless-ircd 0.5.0 → 0.6.0

package/.github/workflows/ci.yml

@@ -42,6 +42,32 @@ jobs:
           node-version: 24
           cache: pnpm
 
+      # DynamoDB Local capability for `aws-adapter` coverage.
+      #
+      # The `aws-adapter` package's vitest `globalSetup` boots a real
+      # DynamoDB Local instance so the integration suite (handlers,
+      # aws-runtime, transactions, …) can be exercised under coverage.
+      # Without it, 171 of 294 tests `describe.skipIf` away and the
+      # package drops to ~42% coverage, blowing the 90% gate.
+      #
+      # The self-hosted Gitea runner image (`ubuntu-latest`) ships with
+      # neither Docker (testcontainers' Ryuk reaper fails with "Failed
+      # to connect to Reaper" without a `docker.sock` mount or
+      # privileged mode) nor a JRE. We install a JRE here via the
+      # canonical `setup-java` action so the globalSetup's ZIP fallback
+      # can fire — this is the only strategy the runner image can
+      # support without host-level privileged-mode configuration.
+      #
+      # `DDB_LOCAL_STRATEGY=zip` is pinned on the coverage step below
+      # so the globalSetup skips the testcontainers probe entirely
+      # (otherwise it blocks for ~60s waiting for Ryuk before falling
+      # back, which is flaky and wastes CI minutes).
+      - name: Setup Java (JRE for DynamoDB Local ZIP fallback)
+        uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: '11'
+
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
@@ -52,6 +78,12 @@ jobs:
         run: pnpm typecheck
 
       - name: Test with coverage
+        # `DDB_LOCAL_STRATEGY=zip` pins the DynamoDB Local boot to the
+        # Java ZIP fallback (see the `Setup Java` step above for why).
+        # This skips the testcontainers probe so the runner does not
+        # block ~60s waiting for Ryuk before falling back.
+        env:
+          DDB_LOCAL_STRATEGY: zip
         run: pnpm coverage
 
       - name: Coverage gate (coverage-thresholds enforced per package)
@@ -90,7 +122,7 @@ jobs:
 
       - name: Upload coverage
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v3
         with:
           name: coverage
           path: |
@@ -135,7 +167,7 @@ jobs:
 
       - name: Upload mutation report
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v3
         with:
           name: mutation-report
           path: packages/irc-core/reports/mutation

package/.github/workflows/deploy-aws.yml

@@ -38,8 +38,7 @@ name: deploy-aws
 #                          behaviour).
 
 on:
-  push:
-    branches: [main]
+  # Automatic push trigger disabled; deploy only runs manually.
   workflow_dispatch:
 
 # OIDC web identity requires id-token write; contents:read for checkout.

package/.github/workflows/deploy-cf-tcp.yml

@@ -16,11 +16,7 @@ name: deploy-cf-tcp
 #   CF_TCP_ORIGIN_ADDRESS   Hostname/IP of the container origin.
 
 on:
-  push:
-    branches: [main]
-    paths:
-      - 'apps/cf-tcp-container/**'
-      - '.github/workflows/deploy-cf-tcp.yml'
+  # Automatic push trigger disabled; deploy only runs manually.
   workflow_dispatch:
 
 concurrency:

package/.github/workflows/deploy-cf.yml

@@ -25,8 +25,7 @@ name: deploy-cf
 # custom routes are wired.
 
 on:
-  push:
-    branches: [main]
+  # Automatic push trigger disabled; deploy only runs manually.
   workflow_dispatch:
 
 # Prevent two deploys racing the same DO namespace.

package/CHANGELOG.md

@@ -10,6 +10,266 @@ For the release process itself — versioning policy, pre-release checklist,
 cutting a tag, rolling back — see [`docs/release.md`](docs/release.md).
 Cross-reference `progress.md` / `tickets.md` for per-ticket detail.
 
+## [0.6.0] - 2026-08-03
+
+The headline is the **IRCv3 extension sweep (Phase 12)**: ten negotiated
+caps and the user-mode-`S` TLS indicator land in one release, taking the
+negotiated capability surface from "modern baseline" to "draft-leading-
+edge". Alongside it: the **required-`serverName` config gate** (the
+last open v0.5.0 follow-up), a new **`tools/load-test`** client farm
+(Phase 7's 10k-connection harness), and the **coverage / CI unblocks**
+that lift `aws-adapter` over the 90% gate and switch `cf-adapter` /
+`cf-worker` to istanbul (clearing the v0.5.0 workerd-incompatibility
+caveat). Deploy workflows are now **manual-only** (`workflow_dispatch`).
+
+### Added — IRCv3 extensions (`@serverless-ircd/irc-core`, `@serverless-ircd/irc-server`)
+
+The ten Phase 12 cap tickets light up the remaining negotiated-cap
+surface, and the two non-cap Phase 12 tickets (ISUPPORT tokens and
+user mode `S`) round out the wire-visible advertisement. Each cap
+ships a pure reducer (where applicable), an actor route case,
+advertisement in `SUPPORTED_CAPABILITIES` (or conditional
+advertisement for `sts`), and unit + actor coverage. The
+pure-reducer / dispatch pipeline is unchanged — every cap is plumbed
+through `ctx` and emitted `Effect[]`, never performed in the handler.
+
+- **`account-notify`**: pushes `:nick ACCOUNT <name|*>`
+  to peers in shared channels (excluding the sender unless
+  `echo-message`) on SASL login / logout. Closes the
+  `account-tag` / `extended-join` / `account-notify` triple modern
+  clients render fully.
+- **`msgid`**: every PRIVMSG / NOTICE / TAGMSG fanned out
+  to a cap-enabled peer carries `@+msgid=<id>` from
+  `IdFactory.nonce()`. The nonce is **shared between the live fanout
+  and the `draft/chathistory` record** so a peer sees the same id live
+  and on replay. Legacy peers see no `msgid` tag.
+- **`standard-replies`**: a data-driven
+  `numericToStandardReply` table replaces a curated subset of bare
+  numerics (`461`, `403`, `432`, `433`, SASL failures, …) with
+  `FAIL`/`WARN`/`NOTE COMMAND code context :description` for
+  cap-enabled clients. Legacy clients still receive the unchanged
+  numeric. Numeric-only replies (MOTD lines, NAMES, …) stay on their
+  numeric form.
+- **`MONITOR`**: the modern `ISON` replacement. Implements
+  `MONITOR + nick{,nick}` / `- nick` / `C` / `L` / `S` with the
+  `730 RPL_MONONLINE` / `731 RPL_MONOFFLINE` / `732 RPL_MONLIST` /
+  `734 ERR_MONLISTFULL` numerics. Online/offline transitions push
+  `730`/`731` **asynchronously** via the Registry's nick reserve /
+  release hooks (a new `MonitorStore` port + push callback). The
+  ceiling is config-driven (`MONITOR=<n>`, default 30).
+- **`labeled-response`**: a client-sent `+label=<id>` is
+  plumbed through `ctx` and every reply caused by that message is
+  wrapped in a single `BATCH +id labeled-response … BATCH -id`. A
+  command that produces no reply emits an empty labeled batch (spec-
+  mandated). The label travels on every reducer's emitted effects,
+  so multi-reply commands accumulate under one batch.
+- **`sts`**: Strict Transport Security. The cap is
+  **conditionally advertised** — only when `ServerConfig.sts`
+  (`{ duration, port, preload? }`) is supplied. On a plaintext
+  listener a compliant client upgrades; on the TLS listener the
+  duration is still sent to lock in the policy. Defaults:
+  `duration = 30 days`, `port = 6697`.
+- **`draft/typing`**: `TAGMSG <target> +draft/typing=
+  active|paused|done` broadcasts to channel members (or routes to a
+  nick target), excluding the sender unless `echo-message`. The
+  `+draft/typing=*` client tag is whitelisted for clients without
+  `message-tags` (per the spec's client-tag exception). Broadcast
+  delivery uses **OR-semantics**: a recipient qualifies if it
+  negotiated `message-tags` **or** `draft/typing` (a new `caps` field
+  on `BroadcastEffect`).
+- **`draft/multiline`**: a cap-enabled
+  client sends `BATCH +id draft/multiline :target` + N PRIVMSG/NOTICE
+  lines + `BATCH -id`. The server concatenates per spec (with `\n`),
+  enforces a configurable byte budget (`multilineMaxBytes`, default
+  4096), and broadcasts the batched replay to multiline peers / a
+  single joined PRIVMSG (carrying `+draft/multiline`) to legacy
+  peers. **Nick-target routing**, **chathistory recording** (one
+  record per batch carrying the joined body, assigned `msgid`, and
+  the `+draft/multiline` client tag), and **tag gating** (the
+  `+draft/multiline` tag is stripped for peers without
+  `message-tags`) all land in the completion ticket.
+- **`draft/read-marker`**: persists the per-`(account,
+  channel)` last-read marker in a new `ReadMarkerStore` port,
+  propagates updates via `+draft/read-marker=<msgid>` tags, and
+  seeds a fresh connection's marker from the persisted value at
+  identify time. `CHATHISTORY BEFORE` honours the marker when no
+  explicit pivot is supplied.
+- **`draft/pre-away`**: persists the away reason in a
+  new `AwayStore` port keyed by account. On identify (or SASL login)
+  the server re-applies the away state and emits the `AWAY` line +
+  `306 RPL_NOWAWAY` as if the user had sent `AWAY :reason`
+  themselves. `AWAY` (unset) clears the persisted reason.
+- **ISUPPORT tokens for the new caps**: `005
+  RPL_ISUPPORT` now advertises `STATUSMSG=@+`, `EXTBAN=<prefix>,q`,
+  `ACCOUNTEXTBAN=a` (services-gated), `TYPING`, and `MULTILINE`.
+  `MONITOR=<n>` honours `serverConfig.monitorLimit`. Tokens are
+  config-derived where applicable.
+- **User mode `S` (TLS connected)**: the transport's
+  TLS fact is surfaced end-to-end as a read-only user mode. Set
+  once by the registration reducer from `ConnectionState.secure`;
+  emitted in `221 … +S`; rejected by `MODE nick +/-S` with `501
+  ERR_UMODEUNKNOWNFLAG`; surfaced in WHOIS via the new `276
+  RPL_WHOISSECURE`. Each adapter asserts `secure: true` where the
+  platform terminates TLS (API Gateway, CF edge, Spectrum, NLB TLS
+  listener).
+
+### Changed — Required server identity
+
+The last open v0.5.0 follow-up closes. The `irc.example.com`
+placeholder `DEFAULT_SERVER_CONFIG` is **removed** from
+`irc-core`; the shared `ServerConfigSchema` rejects a missing
+`serverName` / `networkName` so every adapter **fails fast at boot**
+with a readable, field-listing error.
+
+- **`@serverless-ircd/irc-core`**: `DEFAULT_SERVER_CONFIG` removed.
+- **`@serverless-ircd/irc-test-support`**: ships a clearly test-scoped
+  `makeTestServerConfig()` baseline (`irc.test.local`) so unit tests
+  construct a `ServerConfig` without re-introducing a production
+  default.
+- `apps/cf-worker` + `apps/cf-tcp-container`: loaders require
+  `SERVER_NAME`; `wrangler.toml` samples switched to
+  `irc.your-domain.invalid`.
+- `apps/aws-stack` + `apps/local-cli`: keep obviously-local fallbacks
+  (`irc.localhost`) documented as *"production MUST override"*;
+  `local-cli` gains `--server-name` / `--network-name` flags.
+
+### Added — Load-test harness (`@serverless-ircd/load-test`)
+
+PLAN §7 / Phase 7's 10k-connection harness. A synthetic WebSocket IRC
+client farm: opens N connections, registers (NICK/USER), joins a
+channel, and optionally chats. Captures **p50 / p95 / p99 latency per
+phase** (connect / register / join / message) plus the **drop rate**,
+and prints a markdown report to stdout (or `--report <path>`).
+
+```bash
+pnpm --filter load-test start -- \
+  --target wss://irc.staging.example.com/ \
+  --connections 10000 --concurrency 200 --ramp-ms 60000 \
+  --channel '#loadtest' --messages 3 --platform cf-staging \
+  --report reports/cf-staging-2026-08-03.md
+```
+
+The package ships its own vitest suite (config parsing, framing,
+harness, metrics, report) at ≥90% coverage; no production source in
+the irc-core / irc-server packages changed to support it.
+
+### Added — Coverage / CI unblocks
+
+- **`aws-adapter` clears the 90% gate.** The self-hosted runner image
+  ships with neither Docker nor a JRE, so the package's
+  testcontainers / Java-ZIP DynamoDB Local boot fell through to
+  strategy 3 and 171 of 294 integration tests `describe.skipIf`-ed
+  away — dropping coverage to ~42% and blowing the gate. CI now
+  installs Temurin JRE 11 via `actions/setup-java@v4` and pins
+  `DDB_LOCAL_STRATEGY=zip` on the coverage step so the ZIP fallback
+  fires deterministically. The full aws-adapter suite now runs on
+  every coverage job. New integration tests cover
+  `broadcastWallops` fan-out, `reserveNick` non-conditional error
+  propagation, `refreshChannel` empty-members / topic-preservation
+  paths, NLB header fallbacks, scan-row type guards, and
+  `CREATED_AT` overflow handling. `tools/ci-hardening` gained a
+  self-check asserting the JRE install + strategy pin remain wired.
+- **`aws-stack` coverage command repaired.** The CDK `NodejsFunction`
+  in the test synth re-bundled the Lambda asset via esbuild ~80
+  times per coverage run and OOM-ed CI before vitest could print a
+  report. A new `makeLambda()` factory switches between
+  `NodejsFunction` (production synth) and an inline-zip `Function`
+  stub (tests) via the `IRC_AWS_STACK_TEST_NO_BUNDLE` env var. The
+  stub preserves every CloudFormation shape the suite asserts on
+  while making bundling a no-op. New
+  `tests/synth-no-bundle.test.ts` + `tests/coverage-command.test.ts`
+  lock both branches and assert the `pnpm coverage` run prints an
+  `All files` row.
+- **`cf-adapter` / `cf-worker` switch to istanbul coverage.** This
+  **resolves the v0.5.0 known limitation**: `@vitest/coverage-v8`
+  v4.1.x imports `node:inspector/promises`, which the
+  `@cloudflare/vitest-pool-workers` (workerd) pool cannot resolve.
+  Both packages now use `@vitest/coverage-istanbul` so `pnpm
+  coverage` loads under workerd. Edge-case suites were expanded
+  (serialize/deserialize/migrate, connection-do pure helpers,
+  `broadcastWallops` fan-out, `changeNick` shard routing,
+  ChannelDO broadcast/cache, RegistryDO `listEntries`, SASL seed
+  parsing).
+
+### Changed — Deploy workflows are now manual-only
+
+`deploy-cf.yml`, `deploy-cf-tcp.yml`, and `deploy-aws.yml` dropped
+their `push: branches: [main]` triggers and now run on
+`workflow_dispatch` only. Staging deploys are no longer fired
+automatically on every merge to `main`; a maintainer kicks them off
+by hand. The release runbook (`docs/Release-Process.md`) is the
+canonical reference either way — there was never a CI auto-deploy to
+production.
+
+### Changed — `@vitest/coverage-istanbul` peer
+
+The root lockfile (`pnpm-lock.yaml`) registers the
+`@vitest/coverage-istanbul` peer introduced by the cf-adapter /
+cf-worker coverage switch. No operator action; `pnpm install`
+resolves it.
+
+### ⚠️ Migration required
+
+- **`serverName` is now required at boot.** Operators who relied on
+  the silent `irc.example.com` placeholder must supply an explicit
+  value via their adapter's config knob:
+  - **Cloudflare Worker / TCP container**: set `SERVER_NAME` (and
+    `NETWORK_NAME` if desired) in `wrangler.toml` `[vars]` or via
+    `wrangler secret put`. The samples switched to
+    `irc.your-domain.invalid` — replace with your real hostname.
+  - **AWS**: the CDK stack's `serverName` prop / `SERVER_NAME` env
+    var. The local fallback is `irc.localhost` and is explicitly
+    documented as "production MUST override".
+  - **`local-cli`**: new `--server-name <h>` / `--network-name <n>`
+    flags (default `irc.localhost` / `LocalNet`).
+  A missing value now throws an aggregated `"Invalid server
+  config:"` error at boot listing every offending field.
+- **No persisted-state schema change.** `PERSISTED_STATE_VERSION`
+  stays `1`. The user-mode-`S` work adds a `secure` field and a
+  `userModes.tls` field to the persisted shape, but both are purely
+  **additive with `false` defaults** and the cf-adapter `migrate()`
+  path backfills them on pre-feature records. **Code rollback across
+  this release is safe.**
+- No toolchain change. Node ≥ 24 / pnpm 11 (from v0.4.0) still apply.
+
+### Known limitations
+
+- Same transport limits as v0.5.0: the **CF TCP path requires
+  Cloudflare Spectrum (Enterprise tier)** plus a stateful Container
+  origin; the **AWS TCP path** uses NLB + Lambda streaming and is
+  subject to Lambda idle-timeout / stream-duration limits. The
+  WebSocket path remains the zero-extra-deps default.
+- **mTLS (for SASL `EXTERNAL`) requires a custom domain + uploaded
+  CA/trust-store** on both platforms and is not enabled by default.
+- `STATS` ships the `u` + `l` query letters; the full RFC matrix
+  (`k`, `K`, `q`, `g`, `x`, `z`, …) is intentionally out of scope for
+  v1 — unknown letters get the charybdis-style empty body + `219`.
+- **Client compatibility sweep** (WeeChat / HexChat / IRCCloud /
+  TheLounge / matrix-IRC bridge) remains pending.
+- **Coverage hardening is partial.** `aws-adapter` and `aws-stack`
+  now clear the 90% gate, and `cf-adapter` / `cf-worker` run under
+  istanbul; the remaining packages (`cf-adapter`, `local-cli`,
+  `load-test`, `cf-tcp-container`, `tcp-ws-forwarder`,
+  `irc-test-support`) are **above the gate but below 100%** —
+  follow-ups drive each to 100%.
+- The IRC services (NickServ / ChanServ / HostServ / OperServ /
+  MemoServ) Phase 13 work is pending; `draft/read-marker` and
+  `draft/pre-away` ship with in-memory reference stores, so marker /
+  away persistence does not survive an adapter restart until a
+  services backend lands.
+- The web client Phase 14 work (vendor Kiwi IRC, serve SPA from the
+  Worker, WS Origin allowlist) is pending.
+
+### Security
+
+- None. No vulnerabilities have been reported or fixed in this
+  release. The new caps add surface area but ship no new auth path
+  (the SASL `PLAIN` / `EXTERNAL` paths and the oper gate are
+  unchanged); the required-`serverName` change rejects misconfigured
+  deploys at boot rather than advertising a placeholder identity.
+
+---
+
 ## [0.5.0] - 2026-08-02
 
 The headline is **protocol completion**: the deferred IRC verbs land

package/README.md

@@ -6,7 +6,7 @@ platform-agnostic core, and two thin adapters run it on **Cloudflare Workers**
 
 One TypeScript codebase. Two serverless substrates.
 
-> **Status:** **v0.5.0 (preview).** The pure protocol core, the
+> **Status:** **v0.6.0 (preview).** The pure protocol core, the
 > `IrcRuntime` port + in-memory runtime, a runnable local CLI server,
 > the **Cloudflare Workers** adapter, and the **AWS** (API Gateway
 > WebSocket + Lambda + DynamoDB + CDK) adapter are all functional and
@@ -15,15 +15,25 @@ One TypeScript codebase. Two serverless substrates.
 > clients — Cloudflare via Spectrum + a Container origin, AWS via a
 > Network Load Balancer + Lambda streaming — alongside the WebSocket
 > path, plus **SASL `EXTERNAL` via mTLS** and a **Cloudflare D1-backed
-> SASL account store**. v0.5.0 completes the **protocol surface**: the
+> SASL account store**. v0.5.0 completed the **protocol surface**: the
 > deferred IRC verbs (`KILL`, `REHASH`, `LUSERS` + `STATS`, `TRACE`,
 > `WALLOPS`, `SETNAME`) all land, and the S2S (`CONNECT` / `SQUIT` /
 > `LINKS`) and obsolete RFC 2812 (`SERVICE` / `SUMMON` / `USERS`) verbs
-> are formally dropped — every standard verb a modern client expects is
-> now implemented. Remaining 0.x work: the load/compat sweep
-> (10k-connection load test + client compatibility matrix) and a
-> required-`serverName` config gate. See `CHANGELOG.md` for the
-> per-release manifests.
+> are formally dropped. **v0.6.0 lands the IRCv3 extension sweep
+> (Phase 12)** — ten caps (`account-notify`, `msgid`,
+> `standard-replies`, `MONITOR`, `labeled-response`, `sts`,
+> `draft/typing`, `draft/multiline`, `draft/read-marker`,
+> `draft/pre-away`), the ISUPPORT tokens for the new caps, and the
+> read-only user mode `S` (TLS connected) — closes the
+> required-`serverName` config gate, ships a `tools/load-test`
+> 10k-connection harness, and lifts `aws-adapter` / `aws-stack` over
+> the 90% coverage gate (CF packages moved to istanbul coverage,
+> clearing the v0.5.0 workerd-incompatibility caveat). Remaining 0.x
+> work: the client compatibility sweep (WeeChat / HexChat / IRCCloud /
+> TheLounge), IRC services (NickServ / ChanServ / HostServ /
+> OperServ / MemoServ), a web client (vendored Kiwi IRC), and driving
+> the remaining sub-100% packages to full coverage. See
+> `CHANGELOG.md` for the per-release manifests.
 
 ---
 
@@ -130,6 +140,7 @@ ServerlessIRCd/
 │   └── local-cli/         runnable WS + TCP server using in-memory-runtime
 ├── tools/
 │   ├── tcp-ws-forwarder/  local TCP↔ws/wss bridge for stock IRC clients
+│   ├── load-test/         synthetic WebSocket IRC client farm (10k conns, p50/p95/p99, drop rate)
 │   ├── ci-hardening/      coverage-gate + mutation-config validators
 │   ├── seed-aws-accounts.ts  scrypt-hash SASL PLAIN accounts into DynamoDB
 │   └── seed-cf-accounts.ts   scrypt-hash SASL PLAIN accounts into Cloudflare D1
@@ -230,6 +241,8 @@ On startup it logs a JSON line like:
 | `--tcp-port <n>`   | `<port> + 1`  | TCP port for RFC-style IRC clients.                    |
 | `--no-tcp`         |               | Disable the TCP listener (WebSocket only).             |
 | `--motd-file <p>`  | built-in      | Read MOTD lines from this file (one per line).         |
+| `--server-name <h>`| `irc.localhost` | Server hostname advertised in `001`/`005`. Production MUST override. |
+| `--network-name <n>`| `LocalNet`   | Network name advertised in `005 NETWORK=…`.            |
 | `-h, --help`       |               | Show help and exit.                                    |
 
 Pass `--host 0.0.0.0` to expose the server on all interfaces. `SIGINT` /
@@ -302,6 +315,55 @@ against any line-oriented WebSocket endpoint.
 
 ---
 
+## Load testing (`tools/load-test`)
+
+A synthetic WebSocket IRC client farm (PLAN §7, Phase 7). It opens N
+connections to a `ws://` / `wss://` target, registers each (NICK/USER),
+joins a channel, and optionally chats. Per-phase **p50 / p95 / p99
+latency** (connect / register / join / message) and the **drop rate**
+are captured, then printed as a markdown report to stdout (and written
+to `--report <path>` when given).
+
+Build the workspace, then start a run (from the repo root):
+
+```bash
+pnpm build
+
+pnpm --filter load-test start -- \
+  --target wss://irc.staging.example.com/ \
+  --connections 10000 --concurrency 200 --ramp-ms 60000 \
+  --channel '#loadtest' --messages 3 --platform cf-staging \
+  --report reports/cf-staging-2026-08-03.md
+```
+
+The harness drives the WebSocket transport only (the serverless default);
+a TCP IRC client is not what a serverless load test exercises. Each
+connection is independent — the package ships no `@serverless-ircd/*`
+runtime dependency (only the IRC line framing shared with the
+forwarder), so it can be pointed at any WebSocket IRC endpoint.
+
+### CLI flags
+
+| Flag                    | Default     | Description                                              |
+|-------------------------|-------------|----------------------------------------------------------|
+| `--target <url>`        | (required)  | Upstream `ws://` or `wss://` URL to load test.           |
+| `--connections <n>`     | `1000`      | Total connections to open.                               |
+| `--concurrency <n>`     | `50`        | Concurrent in-flight connection attempts during ramp-up. |
+| `--ramp-ms <ms>`        | `30000`     | Ramp-up duration over which connections are opened.      |
+| `--channel <c>`         | `#loadtest` | Channel every client JOINs.                              |
+| `--messages <n>`        | `0`         | PRIVMSGs each client sends after JOIN (`0` = connect only). |
+| `--echo-message`        |             | Negotiate `echo-message` so sent PRIVMSGs round-trip.    |
+| `--platform <name>`     | `unknown`   | Label baked into the report header.                      |
+| `--report <path>`       |             | Write the markdown report to this path.                  |
+| `-h, --help`            |             | Show help and exit.                                      |
+
+`SIGINT` / `SIGTERM` cancel an in-flight run gracefully (drains live
+sockets, prints the partial report). The package ships its own vitest
+suite at ≥90% coverage (config parsing, framing, harness, metrics,
+report).
+
+---
+
 ## WebSocket transport (IRCv3 subprotocols)
 
 The WebSocket entry points (the local CLI, the Cloudflare Worker, and the
@@ -373,21 +435,23 @@ cleanly. Per-release manifests live in `CHANGELOG.md`.
 - **Phase 2** — `IrcRuntime` port, in-memory runtime, `ConnectionActor`,
   local CLI, parametrized contract suite. ✅ landed in **v0.1.0**.
 - **Phase 3** — Cloudflare adapter (ConnectionDO / ChannelDO / RegistryDO).
-  ✅ landed in **v0.1.0** (staging auto-deploy via CI; prod deploy is manual).
+  ✅ landed in **v0.1.0** (staging deploy via CI; prod deploy is manual).
 - **Phase 4** — AWS adapter (APIGW WS + Lambda + DynamoDB + CDK).
-  ✅ landed in **v0.2.0** (staging auto-deploy via CI; prod deploy is manual).
+  ✅ landed in **v0.2.0** (staging deploy via CI; prod deploy is manual).
 - **Phase 5** — Observability, security hardening, config, CI gates.
   ✅ landed across v0.2.0–v0.4.0 (logger port, server-password, cloaking,
   admission limits, coverage + mutation gates, OPER credential auth, the
-  Cloudflare config loader, and AWS max-clients admission).
+  Cloudflare config loader, and AWS max-clients admission); the
+  required-`serverName` gate closed in **v0.6.0**.
 - **Phase 6** — TLS hardening & raw TCP transport (`irc+tls :6697`).
   ✅ landed in **v0.4.0**: generalized `ConnectionActor` transport seam,
   Cloudflare Spectrum + Container origin, AWS NLB + Lambda streaming,
   mTLS → SASL `EXTERNAL`, transport-parametrized contract suite, ADR-009.
-- **Phase 7** — Load testing (10k concurrent connections per platform)
-  and client compatibility sweep (WeeChat, HexChat, IRCCloud, TheLounge).
-  ⬳ pending; the dual-transport surface it needs
-  landed in v0.4.0.
+- **Phase 7 — Load testing & compatibility sweep.** 🔄 partial as of
+  **v0.6.0**: the `tools/load-test` 10k-connection harness is in-tree;
+  the formal 10k-connection report per platform and the client
+  compatibility matrix (WeeChat / HexChat / IRCCloud / TheLounge) are
+  still pending.
 - **Phase 8 — PLAN-FIXES remediation.** ✅ landed across v0.3.0–v0.4.0
   (MessageStore wired into all three adapters, AccountStore end-to-end,
   the DynamoDB `Accounts` table decided, CF enumeration RPCs, AWS QUIT
@@ -406,6 +470,28 @@ cleanly. Per-release manifests live in `CHANGELOG.md`.
   the formal drop of the S2S (`CONNECT`/`SQUIT`/`LINKS`) and obsolete
   RFC 2812 (`SERVICE`/`SUMMON`/`USERS`) verbs. The protocol surface is
   feature-complete for modern clients.
+- **Phase 12 — IRCv3 extension sweep.** ✅ landed in **v0.6.0**: ten
+  negotiated caps (`account-notify`, `msgid`, `standard-replies`,
+  `MONITOR`, `labeled-response`, `sts`, `draft/typing`,
+  `draft/multiline`, `draft/read-marker`, `draft/pre-away`), the
+  ISUPPORT tokens for the new caps (`MONITOR`/`MULTILINE`/`TYPING`/
+  `STATUSMSG`/`EXTBAN`/`ACCOUNTEXTBAN`), the read-only user mode `S`
+  (TLS connected), and the async push fanout seam (Registry hooks →
+  `MONITOR` online/offline, `BroadcastWallops`-style caps-gated
+  delivery).
+- **Phase 13 — IRC services.** ⬳ pending: `ServicesStore` port +
+  NickServ / ChanServ / HostServ / OperServ / MemoServ. Adapter
+  backends (D1 / DynamoDB) ship alongside; until then
+  `draft/read-marker` and `draft/pre-away` use in-memory reference
+  stores and do not survive an adapter restart.
+- **Phase 14 — Web client.** ⬳ pending: vendored Kiwi IRC SPA served
+  from the Worker, WS Origin allowlist (CSWSH defense), landing page,
+  headless browser e2e.
+- **Coverage hardening.** 🔄 partial as of **v0.6.0**: `aws-adapter`
+  and `aws-stack` now clear the 90% gate (CI boots DynamoDB Local via
+  a JRE; the CDK synth no longer re-bundles under coverage), and the
+  CF packages moved to istanbul to clear the v0.5.0 workerd-incompat.
+  Follow-ups drive each remaining sub-100% package to 100%.
 
 ---
 
@@ -416,6 +502,8 @@ cleanly. Per-release manifests live in `CHANGELOG.md`.
 channel), `TOPIC`, `KICK`, `INVITE`, `NAMES`, `LIST`, `WHO`, `WHOIS`,
 `WHOWAS`, `MOTD`, `AWAY`, `OPER` (credential auth → `o` user mode), the
 query verbs `VERSION`, `TIME`, `ADMIN`, `INFO`, `USERHOST`, `ISON`, the
+modern-online-presence verb `MONITOR` (`+`/`-`/`C`/`L`/`S` with the
+`730`/`731`/`732`/`734` numerics and async online/offline push), the
 network-statistics verbs `LUSERS` and `STATS` (`u` uptime + `l` link-info
 letters; unknown letters get the charybdis-style empty body), the
 routing-diagnostic verb `TRACE` (oper-gated per-connection detail), the
@@ -429,15 +517,31 @@ v0.5.0 — they return `421 ERR_UNKNOWNCOMMAND`, and their reserved
 numerics have been removed. S2S linking is a PLAN non-goal.)
 
 **Channel modes:** `o v b i k l t n m s p`.
-**User modes:** `i`, `o` (local only), `w`, `s`.
+**User modes:** `i`, `o` (local only), `w`, `s`, and the read-only `S`
+(TLS connected — set by the transport at registration, surfaced in WHOIS
+via `276 RPL_WHOISSECURE`, not settable via `MODE`).
 
 **IRCv3 extensions (negotiated via `CAP`):** `message-tags` (incl. the
-`TAGMSG` command), `server-time`, `account-tag`, `echo-message`, `batch`,
+`TAGMSG` command), `server-time`, `account-tag`, `account-notify`
+(pushes `ACCOUNT` on SASL login/logout), `echo-message`, `batch`,
 `sasl` (`PLAIN` always; `EXTERNAL` via mTLS when a client-cert trust store
-is bound),
-`multi-prefix`, `away-notify`, `chghost`, `invite-notify`, `extended-join`,
-`draft/chathistory`, `safelist`. Case-insensitive nick/channel comparison
-uses **RFC 1459** case-mapping (advertised via `005 CASEMAPPING=rfc1459`).
+is bound), `multi-prefix`, `away-notify`, `chghost`, `invite-notify`,
+`extended-join`, `msgid` (`@+msgid=<id>` on every PRIVMSG/NOTICE/TAGMSG,
+shared between live and `draft/chathistory` replay), `standard-replies`
+(`FAIL`/`WARN`/`NOTE` replacements for a curated numeric subset),
+`MONITOR=<n>` (config-driven ceiling, default 30), `labeled-response`
+(`+label=<id>` → `BATCH +id labeled-response … BATCH -id` wrapping),
+`sts` (Strict Transport Security — conditionally advertised with
+`duration`/`port`/optional `preload` from `ServerConfig` when configured,
+so compliant clients upgrade from plaintext to TLS and pin the secure
+listener), `draft/chathistory`, `safelist`, `draft/typing` (typing-indicator
+broadcast), `draft/multiline=<n>` (multi-line `BATCH`, default 4096-byte
+budget), `draft/read-marker` (per-account persisted last-read), and
+`draft/pre-away` (per-account persisted away reason, replayed at
+identify). Case-insensitive nick/channel comparison uses **RFC 1459**
+case-mapping (advertised via `005 CASEMAPPING=rfc1459`). The new
+`MONITOR` / `MULTILINE` / `TYPING` / `STATUSMSG` / `EXTBAN` /
+`ACCOUNTEXTBAN` ISUPPORT tokens are advertised from `ServerConfig`.
 
 **Transport:** deployed stacks (Cloudflare Workers, AWS API Gateway) speak
 WebSocket text frames by default (one IRC message per frame, with tolerance
@@ -457,9 +561,15 @@ bridges a stock TCP client to a deployed WebSocket endpoint.
   gates), v0.3.0 (OPER, TAGMSG, RFC 1459 case-mapping, real MOTD,
   ChannelRegistryDO, SASL account persistence), v0.4.0 (dual transport
   `irc+tls :6697`, SASL `EXTERNAL`/mTLS, WHOWAS + remaining verbs, D1 account
-  store, Node 24/pnpm 11), and v0.5.0 (deferred IRC verbs `KILL` / `REHASH`
+  store, Node 24/pnpm 11), v0.5.0 (deferred IRC verbs `KILL` / `REHASH`
   / `LUSERS` + `STATS` / `TRACE` / `WALLOPS` / `SETNAME`, plus the formal
-  drop of the S2S and obsolete RFC 2812 verbs).
+  drop of the S2S and obsolete RFC 2812 verbs), and **v0.6.0** (the IRCv3
+  extension sweep — `account-notify`, `msgid`, `standard-replies`,
+  `MONITOR`, `labeled-response`, `sts`, `draft/typing`, `draft/multiline`,
+  `draft/read-marker`, `draft/pre-away`, plus user mode `S`; the
+  required-`serverName` gate; `tools/load-test`; aws-adapter / aws-stack
+  coverage unblocks; CF packages moved to istanbul; deploys now
+  manual-only).
 - `docs/Cloudflare-TCP-Deployment.md` and `docs/AWS-TCP-Deployment.md` —
   end-to-end guides for the `:6697` TCP+TLS variants (Spectrum/Container on
   CF, NLB + Lambda streaming on AWS), including mTLS trust-store setup.

package/apps/aws-stack/README.md

@@ -60,6 +60,39 @@ export AWS_DEFAULT_REGION=us-east-1
 LOCALSTACK=1 pnpm test
 ```
 
+## Test-mode bundle stub (why coverage does not re-bundle)
+
+The stack ships four `NodejsFunction` constructs (the wss `IrcHandler`,
+`IrcSweeper`, `IrcPingChecker`, and the optional NLB `IrcNlbHandler`).
+Each one invokes esbuild at synth time to bundle the shared handler
+entry. Repeated across the ~80 synth assertions in `tests/stack.test.ts`,
+that meant the bundler ran **dozens to hundreds of times per coverage
+invocation**, exhausting CI memory before vitest could print its
+coverage table — the failure mode presented as a wall of
+`Bundling asset TestStack/IrcHandler/Code/Stage…` lines followed by
+`[ELIFECYCLE] Command failed with exit code N` and no report.
+
+The fix is a single env-var toggle consumed by `makeLambda()` in
+`src/aws-stack.ts`:
+
+| Env var                           | Effect on the synth                                                   |
+|-----------------------------------|-----------------------------------------------------------------------|
+| `IRC_AWS_STACK_TEST_NO_BUNDLE=1`  | Every Lambda is emitted as an inline `Code.fromInline('void 0')` zip; esbuild is not invoked at all. CloudFormation shape (runtime, env vars, IAM grants, route wiring, …) is identical to the production synth. |
+| _(unset)_                         | Production path: every Lambda is a real `NodejsFunction` whose asset is esbuild-bundled at synth time. This is what `cdk synth` / `cdk deploy` run. |
+
+`tests/vitest.setup.ts` sets the flag once per test file so the entire
+`pnpm test` / `pnpm coverage` run stays on the stub path. Production
+synth (`bin/aws.ts` via the CDK CLI) never loads vitest, so it cannot
+accidentally inherit the flag.
+
+A small `tests/synth-no-bundle.test.ts` locks both paths in place: it
+asserts the stub emits `Code: { ZipFile }` when the flag is set, and
+exercises the production `NodejsFunction` return once (with the flag
+explicitly unset) so the production branch stays covered. The
+end-to-end guard lives in `tests/coverage-command.test.ts`, which
+spawns `pnpm --filter @serverless-ircd/aws-stack coverage` in a
+subprocess and asserts the report prints an `All files` row.
+
 ## Stack outputs
 
 | Output         | Description                                                        |

package/apps/aws-stack/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serverless-ircd/aws-stack",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "private": true,
   "description": "AWS CDK v2 stack: API Gateway v2 WebSocket API, Lambda, DynamoDB tables, least-privilege IAM",
   "license": "BSD-3-Clause",