serverless-ircd 0.7.0 → 0.8.0

package/.github/workflows/ci.yml

@@ -29,6 +29,7 @@ jobs:
   verify:
     name: typecheck / lint / test / coverage
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -40,7 +41,6 @@ jobs:
         uses: actions/setup-node@v4
         with:
           node-version: 24
-          cache: pnpm
 
       # DynamoDB Local capability for `aws-adapter` coverage.
       #
@@ -63,7 +63,7 @@ jobs:
       # (otherwise it blocks for ~60s waiting for Ryuk before falling
       # back, which is flaky and wastes CI minutes).
       - name: Setup Java (JRE for DynamoDB Local ZIP fallback)
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v5
         with:
           distribution: temurin
           java-version: '11'
@@ -134,6 +134,7 @@ jobs:
     runs-on: ubuntu-latest
     # Stryker is the slowest single task; it is independent of the
     # typecheck/lint/coverage chain and runs in parallel.
+    timeout-minutes: 45
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -145,7 +146,6 @@ jobs:
         uses: actions/setup-node@v4
         with:
           node-version: 24
-          cache: pnpm
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile

package/.gitmodules

@@ -1,6 +1,6 @@
 [submodule "docs"]
 	path = docs
-	url = https://gitea.com/fowlmouth/ServerlessIRCd.wiki.git
+	url = https://gitea.com/ServerlessIRCd/ServerlessIRCd.wiki.git
 [submodule "apps/web/upstream"]
 	path = apps/web/upstream
 	url = https://github.com/kiwiirc/kiwiirc.git

package/CHANGELOG.md

@@ -7,24 +7,268 @@ and this project adheres to [Semantic Versioning](https://semver.org/) with
 the 0.x convention (any release may change anything).
 
 For the release process itself — versioning policy, pre-release checklist,
-cutting a tag, rolling back — see [`docs/release.md`](docs/release.md).
+cutting a tag, rolling back — see [`docs/Release-Process.md`](docs/Release-Process.md).
 Cross-reference `progress.md` / `tickets.md` for per-ticket detail.
 
+## [0.8.0] - 2026-08-08
+
+The main change in this release is **integrated IRC services**: NickServ,
+ChanServ, HostServ, OperServ, and MemoServ ship as part of the daemon
+itself — there is **no separate services process and no S2S link**. The
+service nicks are reserved and routed to dedicated pure reducers backed
+by a new `ServicesStore` port, with **persistent D1 (Cloudflare) and
+DynamoDB (AWS) backends** so registrations survive redeploys. Alongside
+it: the SASL `AccountStore` and NickServ accounts are **unified** under
+one scrypt-hashed credential store, `PASS <nick>:<password>` identifies
+at registration, the `draft/read-marker` `MARKREAD` verb lands, and a
+round of **AWS adapter hardening** (O(1) admission counter, strongly-
+consistent `$default` reads, WebSocket subprotocol echo fix).
+
+### Added — Integrated IRC services (`@serverless-ircd/irc-core`, `@serverless-ircd/irc-server`)
+
+The ten services tickets add the full
+services surface. Service names are reserved nicks recognized at
+`PRIVMSG` time and routed to dedicated pure reducers when a
+`ServicesStore` is bound; when no store is bound every services command
+replies `501` and the rest of the daemon is unaffected. See
+`docs/Services.md` for the operator reference.
+
+- **`ServicesStore` port + in-memory reference impl**: a synchronous,
+  injectable store holding NickServ / ChanServ / HostServ / MemoServ /
+  OperServ / read-marker state. Reducers stay pure — all side effects
+  flow through the store port. The `ReadMarkerStore` from v0.6.0 is
+  **folded into** `ServicesStore` so read-markers, `draft/pre-away`,
+  and account state share one persistence path.
+- **NickServ** (`REGISTER` / `IDENTIFY` / `DROP` / `INFO` / `SET`):
+  registers the current nick, identifies to an account (setting the
+  read-only user mode **`+r`**, fanning `ACCOUNT` to `account-notify`
+  peers, then delivering unread MemoServ memos), and supports
+  `SET ENFORCE` — a registered nick held by a non-identified
+  connection is reclaimed on the `NICK` path (enforcement policy
+  mirrors Atheme/Anope). `IDENTIFY` falls back to SASL account
+  credentials when no NickServ row exists.
+- **ChanServ** (`REGISTER` / `DROP` / `SET` / `INFO` / `ACCESS` /
+  `LEVELS`): channel registration with a founder, the services-only
+  channel modes **`+r`** (registered), **`+R`** (block unidentified
+  join/message), and **`+M`** (moderated-identified), `ACCESS`/`LEVELS`
+  (SOP/AOP/VOP/HOP access lists), and auto-op on `JOIN` per access
+  level. The three services modes are settable only via ChanServ, not
+  via `MODE` (`472 ERR_UNKNOWNMODE` / `501`).
+- **HostServ** (`ON` / `OFF` / `REQUEST` + oper `SET` / `APPROVE` /
+  `REJECT` / `LIST`): per-account vhost with `CHGHOST` fanout to shared
+  channels. `REQUEST` enters an **oper approval queue**; opers `APPROVE`
+  to activate or `REJECT` to drop it.
+- **OperServ** (`AKILL` / `JUPE` / `UNJUPE` / `RAW`): oper-gated
+  network management. `AKILL` records an `*@host` mask, `JUPE` reserves
+  a juped nick (rejected at `NICK` with `432 ERR_ERRONEUSNICKNAME`),
+  `RAW` is the escape hatch. Wired end-to-end: `PRIVMSG OperServ :…`
+  routes to the OperServ reducer.
+- **MemoServ** (`SEND` / `LIST` / `READ` / `DEL`): per-account memos
+  with queue delivery — unread memos are replayed at identify (NickServ
+  `IDENTIFY` / SASL login / PASS-based login), the same path that
+  replays `draft/read-marker` and `draft/pre-away`.
+
+### Added — Persistent services backends (`@serverless-ircd/cf-adapter`, `@serverless-ircd/aws-adapter`)
+
+Both adapters ship write-behind persistence for the `ServicesStore` so
+registrations, channel access lists, vhosts, memos, and read-markers
+survive a redeploy/reconnect.
+
+- **Cloudflare (D1)**: `D1ServicesStore` over the shared `ACCOUNTS_DB`
+  binding (the same D1 database used for SASL accounts since v0.4.0).
+  The ten services tables **auto-provision on cold start** (`CREATE
+  TABLE IF NOT EXISTS` inside `loadD1ServicesStore`), so a fresh deploy
+  self-provisions and an existing deploy re-runs the batch as a cheap
+  no-op. `ConnectionDO` load/flush hooks wrap each frame and teardown.
+- **AWS (DynamoDB)**: `DynamoServicesStore` plus a new `Services`
+  table definition and handler wiring so NLB-stream / `$default`
+  invocations hydrate + flush services alongside the existing account
+  store. Enabled when the `SERVICES_TABLE` env var / table name is
+  supplied.
+- **`PersistentServicesStore` base** (`irc-core`): the shared
+  write-behind base — mutates the inherited cache synchronously and
+  enqueues matching writes for `flush()`, so reducers stay free of IO.
+
+### Added — Unified accounts & registration login (`@serverless-ircd/irc-core`)
+
+- **Unified SASL + NickServ account store**: the SASL `AccountStore`
+  and NickServ `ServicesStore` now share one **scrypt-hashed**
+  credential shape. A NickServ registration *is* a SASL account —
+  SASL `PLAIN`'s services fallback verifies against a row created by
+  NickServ `REGISTER` without a second registration, and vice versa.
+  The plaintext password on `ServicesNickRow` is replaced with a
+  `HashedAccountCredential` (scrypt + random salt). `ingestAccountCredential`
+  adopts a pre-hashed SASL credential as a registered nick (idempotent;
+  existing records win).
+- **PASS-based account login**: a client may identify to its NickServ
+  account at registration by sending `PASS <nick>:<password>` (the same
+  literal the `SASL_ACCOUNTS` seed tooling uses). On success the
+  connection is logged in — emitting `900`/`903`, stamping `+r`, and
+  running the same read-marker / away / memo replay as SASL. A bare
+  `PASS <value>` (no colon) is always treated as a server-password
+  candidate. The shared login reduction (`applyAccountSuccess`) is
+  extracted and reused from SASL.
+- **Server-password gate with SASL short-circuit**: an optional gate
+  enforced in the registration reducer at `001` — when
+  `ServerConfig.serverPassword` is set, every connection must supply a
+  matching `PASS` (or authenticate via SASL / PASS-based account login)
+  before `RPL_WELCOME`, else `464 ERR_PASSWDMISMATCH` + disconnect.
+  Wired through all three adapters (`SERVER_PASSWORD` Worker secret /
+  Lambda env var / `--server-password` CLI flag).
+
+### Added — `draft/read-marker` `MARKREAD` verb (`@serverless-ircd/irc-core`)
+
+- The timestamp-based `MARKREAD` command from the read-marker draft
+  lands alongside the existing `+draft/read-marker=<msgid>` tag path.
+  `MARKREAD <target>` (GET) replies with the stored marker's timestamp;
+  `MARKREAD <target> <timestamp>` (SET) advances the marker, with
+  timestamp↔msgid translation against the message store. Failure modes
+  use `standard-replies` `FAIL MARKREAD …`. The mark fanout is
+  **scoped to the originator's account** (spec compliance), not
+  broadcast to every cap-enabled peer.
+
+### Added — Cloudflare adapter (`@serverless-ircd/cf-adapter`)
+
+- **Client source IP capture at WebSocket upgrade**: reads
+  `CF-Connecting-IP` (with `X-Real-IP` fallback) from the upgrade
+  request and seeds `ConnectionState.host`, so WHOIS / hostmasks carry
+  a real `@host` segment instead of an `undefined` fallback.
+- **Ghost-member pruning via alarm**: when a WebSocket `close` event is
+  lost (client drop, edge hiccup), the DO's alarm prunes the ghost
+  member from its channels on the next sweep, preventing stale roster
+  entries.
+
+### Changed — AWS adapter (`@serverless-ircd/aws-adapter`, `@serverless-ircd/aws-stack`)
+
+- **O(1) admission counter**: `$connect`'s full-table `Scan COUNT` is
+  replaced with an atomic increment/decrement on a single meta row,
+  dropping admission cost from O(connections) to O(1). Reservations
+  roll back on rejection or a failed `Put`; the sweeper and stats
+  exclude the meta row.
+- **Strongly-consistent `$default` reads + observability**: `$default`
+  now reads the `Connections` row strongly consistent (closes a
+  read-after-write `410` window), warns on a missing row, logs
+  `postToConnection` failures (previously silently swallowed), and
+  emits a summary log per invocation.
+- **`ServerName` / `NetworkName` as CFN parameters**: server identity
+  is now a CloudFormation parameter (was env-var-only), and the
+  sweeper Lambda's `loadServerConfigFromLambdaEnv` is wired with the
+  server-identity env vars it requires. `SweeperScheduleExpression`,
+  `PingCheckerScheduleExpression`, and `ApiGatewayLoggingLevel` are
+  also exposed as parameters.
+- **WebSocket subprotocol echo fixed**: API Gateway WebSocket
+  `IntegrationResponse` uses `route.response.header.*` (not
+  `method.response.header.*`, which is REST API only), so the
+  `Sec-WebSocket-Protocol` header was not being echoed back to clients.
+  AWS now correctly negotiates the IRCv3 subprotocol. Subprotocol
+  advertisement is forced text-only (`text.ircv3.net`) to match the
+  Lambda response-stream path.
+- **APIGW logging role corrected** and Biome lint/format applied.
+
+### Changed
+
+- **`MODE +o` echo on oper-up**: the connection that grants oper now
+  receives a `MODE` echo, matching the cross-connection oper-up path.
+- **NICK change broadcast fix**: nick changes now broadcast to every
+  shared-channel peer (a code path that dropped peers under certain
+  roster shapes is corrected).
+- **Server version from `package.json`**: the default `serverVersion`
+  advertised in `002`/`003` is derived from the workspace
+  `package.json` at build time (was a hardcoded placeholder when the
+  config omitted it).
+- **Web client SPA path `/app/` → `/webclient/`**: the vendored Kiwi
+  IRC SPA is now served at `/webclient/` (the `[assets]` publicPath
+  and config are repointed). Operators with custom Kiwi configs or
+  bookmarks must update to `/webclient/`.
+- **Source / issue links migrated to Gitea**; landing-page copy
+  tightened and the upstream-install guard hardened.
+
+### Changed — CI / tooling
+
+- `actions/setup-java` bumped to v5; pnpm pinned to 11.20.0. CI jobs
+  are bounded by explicit timeouts and the unreachable pnpm cache step
+  is dropped.
+
+### ⚠️ Migration required
+
+- **Cloudflare: services are enabled when `ACCOUNTS_DB` is bound.** The
+  D1 binding is the same one introduced in v0.4.0 for SASL accounts;
+  the ten services tables **self-provision on cold start** (no manual
+  `wrangler d1 execute` needed). If `ACCOUNTS_DB` is already bound,
+  services are now live after deploy — no action. If it is unset,
+  services commands reply `501` and the daemon is otherwise unchanged.
+- **AWS: new `Services` DynamoDB table + `SERVICES_TABLE`.** To enable
+  services, supply a services table name (`SERVICES_TABLE` env var /
+  CDK `servicesTableName` prop); the table is created by the CDK stack.
+  Without it, services are unbound.
+- **NickServ / SASL credentials are now scrypt-hashed at rest.** A
+  NickServ `REGISTER` creates the same hashed credential shape SASL
+  uses; the `password` column on the NickServ row is replaced by
+  `algorithm` / `salt` / `hash`. Existing seeded SASL accounts are
+  adopted as registered nicks idempotently. Operators re-seeding via
+  `tools/seed-*-accounts.ts` see no change (the tools already hashed).
+- **Web client SPA moved to `/webclient/`.** Update any bookmarks,
+  custom Kiwi configs, or `WEB_ORIGINS` entries pointing at `/app/`.
+- **No persisted-DO-state schema change.** `PERSISTED_STATE_VERSION`
+  stays `1`. The new read-only user mode `r` (registered) and the
+  services channel modes `r`/`R`/`M` are runtime state, not persisted
+  DO fields; the `ReadMarkerStore` fold moves read-markers into the
+  services backend (D1/DynamoDB), out of DO storage. **Code rollback
+  across this release is safe.**
+- No toolchain change. Node ≥ 24 / pnpm 11 (from v0.4.0) still apply.
+
+### Known limitations
+
+- **Services are not binary-compatible with Atheme or Anope.** There is
+  no S2S protocol, so an existing Atheme/Anope services process cannot
+  connect, and existing services databases cannot be imported.
+  Operators migrating from a services-aware network must re-register
+  nicks and channels. See `docs/Services.md` §12.
+- **The web client remains partial.** The Playwright headless-browser
+  e2e against the deployed staging frontend is still pending; the SPA
+  is exercised via the WS smoke (`scripts/smoke.mjs`) and the `apps/web`
+  unit / build-smoke suite. The web client remains Cloudflare-only (the
+  `[assets]` binding is a Worker feature).
+- Same transport limits as v0.7.0: the **CF TCP path requires
+  Cloudflare Spectrum (Enterprise tier)** plus a stateful Container
+  origin; the **AWS TCP path** uses NLB + Lambda streaming and is
+  subject to Lambda idle-timeout / stream-duration limits. The
+  WebSocket path remains the zero-extra-deps default.
+- **mTLS (for SASL `EXTERNAL`) requires a custom domain + uploaded
+  CA/trust-store** on both platforms and is not enabled by default.
+- **Client compatibility sweep** (WeeChat / HexChat / IRCCloud /
+  TheLounge / matrix-IRC bridge) remains pending.
+- **Coverage hardening is partial.** `aws-adapter` and `aws-stack`
+  clear the 90% gate; the remaining packages (`cf-adapter`,
+  `local-cli`, `load-test`, `cf-tcp-container`, `tcp-ws-forwarder`,
+  `irc-test-support`, `web`) are **above the gate but below 100%** —
+  follow-ups drive each to 100%.
+
+### Security
+
+- **NickServ / SASL credentials are now uniformly scrypt-hashed.** The
+  unified account store means a NickServ-registered nick and a SASL
+  account share one hashed credential — never plaintext, in memory or
+  at rest. The server-password gate and CSWSH defense are unchanged
+  from v0.7.0; no other auth path changed.
+
+---
+
 ## [0.7.0] - 2026-08-04
 
-The headline is the **web client (Phase 14)**: a vendored **Kiwi IRC**
+The main change in this release is the **web client**: a vendored **Kiwi IRC**
 SPA served at `/app/` and a static project landing page served at `/`
 directly by the Cloudflare Worker, with **Cross-Site WebSocket
 Hijacking (CSWSH) defense** wired into the WS upgrade path. The browser
-opens a native `wss://` straight to the existing IRC-over-WebSocket
-endpoint — no proxy, gateway, or transport adaptation in the hot path.
+opens a native `wss://` directly to the IRC-over-WebSocket
+endpoint — no proxy, gateway, or transport adaptation in the request path.
 Alongside it: a round of **test hardening** (mutation-killing tests for
 `irc-core`'s parser / batch / numerics, and CF-harness / scenario fixes
 for slow transports).
 
 ### Added — Web client (`@serverless-ircd/web`, `@serverless-ircd/cf-worker`)
 
-Six Phase 14 tickets light up the project's browser surface. The Worker
+Six tickets add the project's browser surface. The Worker
 becomes the single origin for the landing page, the SPA, **and** the
 WebSocket. Same-origin by default — which is what makes the CSWSH
 defense almost zero-config.
@@ -67,7 +311,7 @@ defense almost zero-config.
   with a `200 OK` (the WS endpoint and the landing page share path
   `/`; only the Worker can tell them apart).
 - **Static landing page** (`apps/web/landing/index.html`): framework-
-  free HTML + inline CSS, no JavaScript. The project's front door —
+  free HTML + inline CSS, no JavaScript. The project's entry page —
   explains what ServerlessIRCd is, links to `/app/` (the IRC client),
   the docs, and the source repo. The build copies it verbatim to
   `dist/index.html`. Renders without JS; responsive; the build-smoke
@@ -182,7 +426,7 @@ contributor can deploy a staging SPA following only this doc.
 
 ### Known limitations
 
-- **Phase 14 is partial.** The Playwright headless-browser e2e
+- **The web client is partial.** The Playwright headless-browser e2e
   against the deployed staging frontend remains pending
   — the SPA is exercised via the existing WS smoke
   (`scripts/smoke.mjs`) and the new `apps/web` unit / build-smoke
@@ -206,7 +450,7 @@ contributor can deploy a staging SPA following only this doc.
   (`cf-adapter`, `local-cli`, `load-test`, `cf-tcp-container`,
   `tcp-ws-forwarder`, `irc-test-support`, and now `web`) are **above
   the gate but below 100%** — follow-ups drive each to 100%.
-- The IRC services Phase 13 work (NickServ / ChanServ / HostServ /
+- The IRC services work (NickServ / ChanServ / HostServ /
   OperServ / MemoServ) is pending; `draft/read-marker` and
   `draft/pre-away` ship with in-memory reference stores, so marker /
   away persistence does not survive an adapter restart until a
@@ -226,20 +470,20 @@ contributor can deploy a staging SPA following only this doc.
 
 ## [0.6.0] - 2026-08-03
 
-The headline is the **IRCv3 extension sweep (Phase 12)**: ten negotiated
+The main change in this release is the **IRCv3 extension sweep**: ten negotiated
 caps and the user-mode-`S` TLS indicator land in one release, taking the
 negotiated capability surface from "modern baseline" to "draft-leading-
 edge". Alongside it: the **required-`serverName` config gate** (the
-last open v0.5.0 follow-up), a new **`tools/load-test`** client farm
-(Phase 7's 10k-connection harness), and the **coverage / CI unblocks**
+last open v0.5.0 follow-up), a new **`tools/load-test`** client pool
+(the 10k-connection harness), and the **coverage / CI unblocks**
 that lift `aws-adapter` over the 90% gate and switch `cf-adapter` /
 `cf-worker` to istanbul (clearing the v0.5.0 workerd-incompatibility
 caveat). Deploy workflows are now **manual-only** (`workflow_dispatch`).
 
 ### Added — IRCv3 extensions (`@serverless-ircd/irc-core`, `@serverless-ircd/irc-server`)
 
-The ten Phase 12 cap tickets light up the remaining negotiated-cap
-surface, and the two non-cap Phase 12 tickets (ISUPPORT tokens and
+The ten cap tickets add the remaining negotiated-cap
+surface, and the two non-cap tickets (ISUPPORT tokens and
 user mode `S`) round out the wire-visible advertisement. Each cap
 ships a pure reducer (where applicable), an actor route case,
 advertisement in `SUPPORTED_CAPABILITIES` (or conditional
@@ -349,10 +593,10 @@ with a readable, field-listing error.
 
 ### Added — Load-test harness (`@serverless-ircd/load-test`)
 
-PLAN §7 / Phase 7's 10k-connection harness. A synthetic WebSocket IRC
-client farm: opens N connections, registers (NICK/USER), joins a
+The PLAN §7 10k-connection harness. A synthetic WebSocket IRC
+client pool: opens N connections, registers (NICK/USER), joins a
 channel, and optionally chats. Captures **p50 / p95 / p99 latency per
-phase** (connect / register / join / message) plus the **drop rate**,
+stage** (connect / register / join / message) plus the **drop rate**,
 and prints a markdown report to stdout (or `--report <path>`).
 
 ```bash
@@ -467,11 +711,11 @@ resolves it.
   `irc-test-support`) are **above the gate but below 100%** —
   follow-ups drive each to 100%.
 - The IRC services (NickServ / ChanServ / HostServ / OperServ /
-  MemoServ) Phase 13 work is pending; `draft/read-marker` and
+  MemoServ) work is pending; `draft/read-marker` and
   `draft/pre-away` ship with in-memory reference stores, so marker /
   away persistence does not survive an adapter restart until a
   services backend lands.
-- The web client Phase 14 work (vendor Kiwi IRC, serve SPA from the
+- The web client work (vendor Kiwi IRC, serve SPA from the
   Worker, WS Origin allowlist) is pending.
 
 ### Security
@@ -486,8 +730,8 @@ resolves it.
 
 ## [0.5.0] - 2026-08-02
 
-The headline is **protocol completion**: the deferred IRC verbs land
-(Phase 11), and the S2S / obsolete RFC 2812 verbs are **formally
+The main change in this release is **protocol completion**: the deferred IRC verbs land,
+and the S2S / obsolete RFC 2812 verbs are **formally
 dropped** rather than left "deferred". With this release every standard
 IRC verb a modern client expects is implemented — the only remaining
 `421 ERR_UNKNOWNCOMMAND` paths are the deliberately-unimplemented S2S
@@ -497,10 +741,10 @@ client compatibility matrix) and the required-`serverName` config gate.
 
 ### Added — Deferred IRC verbs (`@serverless-ircd/irc-core`, `@serverless-ircd/irc-server`)
 
-Six Phase 11 tickets light up the remaining command surface. Each ships
+Six tickets add the remaining command surface. Each ships
 a pure reducer, an actor route case (no more `421`), new numerics in
 `protocol/numerics.ts`, and unit + actor coverage. (The remaining two
-Phase 11 tickets are drops — see below.)
+tickets are drops — see below.)
 
 - **`KILL`** (oper-gated force-disconnect): `KILL <nick>
   <comment>` resolves the target via the nick registry + a live
@@ -554,7 +798,7 @@ Phase 11 tickets are drops — see below.)
   channel-scoped). The originator is always excluded (skip-self,
   matching NOTICE/PRIVMSG semantics). Empty message → `461`. The `+w`
   user mode was already accepted by `MODE` and advertised in `004
-  RPL_MYINFO`; this lights up the consumer.
+  RPL_MYINFO`; this enables the consumer.
 - **`SETNAME`** (realname change): `SETNAME :<realname>`
   updates `state.realname` so a subsequent `WHOIS` reflects the new
   value in `311 RPL_WHOISUSER`. No broadcast is emitted in v1 (there
@@ -564,7 +808,7 @@ Phase 11 tickets are drops — see below.)
 
 ### Changed — S2S & obsolete verbs formally dropped (`@serverless-ircd/irc-core`)
 
-The remaining two Phase 11 tickets convert the "deferred" framing into
+The remaining two tickets convert the "deferred" framing into
 an explicit **drop**. There is no behaviour change on the wire — the verbs
 already returned `421 ERR_UNKNOWNCOMMAND` — but the framing, comments,
 and reserved numerics are cleaned up so the codebase no longer carries
@@ -661,13 +905,13 @@ dead scaffolding.
 
 ## [0.4.0] - 2026-07-31
 
-The headline is **dual transport**: both adapters now speak a real
+The main change in this release is **dual transport**: both adapters now speak a real
 `irc+tls :6697` (TLS-over-TCP) surface for stock IRC clients in
 production — not just the local CLI — alongside the WebSocket path. This
 lands **SASL `EXTERNAL` via mTLS**, the **remaining standard IRC verbs**
 (WHOWAS, VERSION, TIME, ADMIN, INFO, USERHOST, ISON), a **Cloudflare
 D1-backed SASL account store**, config-driven server identity, and a
-**Node 24 / pnpm 11** toolchain. Phase 7 (TLS hardening & raw TCP) is
+**Node 24 / pnpm 11** toolchain. TLS hardening & raw TCP is
 complete.
 
 ### Added — Dual transport: WebSocket + `irc+tls :6697`
@@ -737,7 +981,7 @@ pipeline is unchanged.
 
 - The `002` / `003` / `004` registration replies now reflect
   `ServerConfig.serverVersion` / `createdAt` — the hardcoded
-  `'0.1.0'` / `'Phase 1'` placeholders are gone. A build step
+  `'0.1.0'` version / placeholder strings are gone. A build step
   (`scripts/generate-build-info.mjs`) bakes the package version and a
   build timestamp into `RPL_CREATED` (`003`) when the config omits them.
 
@@ -1005,7 +1249,7 @@ AWS are now both deployable.
 ### Added — Shared test harness (`@serverless-ircd/irc-test-support`)
 
 - New workspace package owning the parametrized IRC scenario suite
-  (`runIrcScenarios`, 31 Phase 2 scenarios) and the
+  (`runIrcScenarios`, 31 scenarios) and the
   `IrcHarnessFactory` / `IrcHarness` / `ClientHarness` seam each
   adapter implements. Ships the reference `inMemoryHarnessFactory`.
   cf-adapter and aws-adapter integration tests both consume it, so the
@@ -1036,7 +1280,7 @@ AWS are now both deployable.
   end-to-end rather than advertised-only.
 - The local CLI now binds a **second RFC-style TCP listener** by default
   (`--tcp-port`, default `<port> + 1`) alongside the WebSocket listener,
-  so stock IRC clients can dial in directly without the forwarder.
+  so stock IRC clients can connect directly without the forwarder.
   Pass `--no-tcp` for WebSocket-only. `--motd-file` loads the MOTD from
   disk.