serverless-ircd 0.7.0 → 0.9.0

package/apps/web/tests/render-docs.test.ts

@@ -0,0 +1,198 @@
+import {
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  readdirSync,
+  rmSync,
+  statSync,
+} from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { buildDocs, renderMarkdown, rewriteDocLinks } from '../src/render-docs';
+
+const pkgRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const docsSrc = path.resolve(pkgRoot, '..', '..', 'docs');
+
+// ============================================================================
+// renderMarkdown — GFM rendering of markdown source
+// ============================================================================
+describe('renderMarkdown', () => {
+  it('renders an ATX H1 heading as <h1>', () => {
+    const html = renderMarkdown('# Title');
+    expect(html).toMatch(/<h1[^>]*>\s*Title\s*<\/h1>/);
+  });
+
+  it('renders a fenced code block as <pre><code>', () => {
+    const md = ['```ts', 'const x = 1;', '```'].join('\n');
+    const html = renderMarkdown(md);
+    expect(html).toMatch(/<pre[^>]*><code[^>]*>/);
+  });
+
+  it('renders GFM tables', () => {
+    const md = ['| a | b |', '| --- | --- |', '| 1 | 2 |'].join('\n');
+    const html = renderMarkdown(md);
+    expect(html).toContain('<table>');
+    expect(html).toContain('<th');
+  });
+
+  it('renders inline code', () => {
+    const html = renderMarkdown('Use `npm` to install.');
+    expect(html).toContain('<code>npm</code>');
+  });
+});
+
+// ============================================================================
+// rewriteDocLinks — intra-docs link rewriting
+// ============================================================================
+describe('rewriteDocLinks', () => {
+  const known = new Set([
+    'Services',
+    'Home',
+    'ADR-Index',
+    'ADR-001-pure-reducers-and-effect-system',
+  ]);
+
+  it('rewrites a relative OtherDoc.md href to OtherDoc.html', () => {
+    const input = '<a href="./Services.md">Services</a>';
+    const out = rewriteDocLinks(input, known);
+    expect(out).toContain('href="Services.html"');
+    expect(out).not.toContain('Services.md');
+  });
+
+  it('rewrites a bare wikilink-style href (no extension) when the slug is a known doc', () => {
+    const input = '<a href="Services">Services</a>';
+    const out = rewriteDocLinks(input, known);
+    expect(out).toContain('href="Services.html"');
+  });
+
+  it('leaves unknown bare hrefs alone (could be an external path)', () => {
+    const input = '<a href="SomeUnknownPage">x</a>';
+    const out = rewriteDocLinks(input, new Set(['Services']));
+    expect(out).toContain('href="SomeUnknownPage"');
+  });
+
+  it('preserves an anchor fragment when rewriting', () => {
+    const input = '<a href="./Services.md#section">link</a>';
+    const out = rewriteDocLinks(input, known);
+    expect(out).toContain('href="Services.html#section"');
+  });
+
+  it('does not touch external (http/https) links', () => {
+    const input = '<a href="https://example.com/foo.md">external</a>';
+    const out = rewriteDocLinks(input, known);
+    expect(out).toContain('href="https://example.com/foo.md"');
+  });
+
+  it('does not touch pure-anchor (#section) links', () => {
+    const input = '<a href="#section">anchor</a>';
+    const out = rewriteDocLinks(input, known);
+    expect(out).toContain('href="#section"');
+  });
+
+  it('handles a trailing anchor on a bare wikilink-style href', () => {
+    const input = '<a href="Home#pages">Home</a>';
+    const out = rewriteDocLinks(input, known);
+    expect(out).toContain('href="Home.html#pages"');
+  });
+});
+
+// ============================================================================
+// buildDocs — end-to-end render pipeline (against the real docs/ submodule)
+// ============================================================================
+describe('buildDocs against docs/ submodule', () => {
+  let outDir: string;
+
+  beforeEach(() => {
+    outDir = mkdtempSync(path.join(os.tmpdir(), 'render-docs-'));
+  });
+
+  afterEach(() => {
+    rmSync(outDir, { recursive: true, force: true });
+  });
+
+  it('throws a clear error when the docs source directory is missing', async () => {
+    await expect(buildDocs({ srcDir: path.join(outDir, 'nope'), outDir })).rejects.toThrow(
+      /docs.*missing|missing.*docs|submodule/iu,
+    );
+  });
+
+  it('throws a clear error when the docs source directory is present but empty', async () => {
+    // Mirrors the build-script guard: an empty `docs/` checkout (submodule
+    // init'd but not populated) must fail loudly with the recovery command,
+    // not silently produce a docs section with zero pages.
+    const empty = mkdirSync(path.join(outDir, 'empty-docs'), { recursive: true });
+    if (empty === undefined) {
+      throw new Error('test setup failed: could not create empty-docs dir');
+    }
+    await expect(buildDocs({ srcDir: empty, outDir })).rejects.toThrow(/empty|submodule/iu);
+  });
+
+  it('emits an index.html under the output directory', async () => {
+    await buildDocs({ srcDir: docsSrc, outDir });
+    const idx = path.join(outDir, 'index.html');
+    expect(existsSync(idx)).toBe(true);
+    expect(statSync(idx).size).toBeGreaterThan(0);
+  });
+
+  it('emits one HTML file per markdown source (non-empty output directory)', async () => {
+    const result = await buildDocs({ srcDir: docsSrc, outDir });
+    expect(result.emitted.length).toBeGreaterThanOrEqual(20);
+    for (const f of result.emitted) {
+      expect(f.endsWith('.html')).toBe(true);
+      expect(existsSync(path.join(outDir, f))).toBe(true);
+    }
+    expect(readdirSync(outDir).filter((f) => f.endsWith('.html')).length).toBe(
+      result.emitted.length,
+    );
+  });
+
+  it('renders Services.html with an <h1> and at least one <code> block', async () => {
+    await buildDocs({ srcDir: docsSrc, outDir });
+    const html = readFileSync(path.join(outDir, 'Services.html'), 'utf8');
+    expect(html).toMatch(/<h1[^>]*>/);
+    expect(html).toMatch(/<pre[^>]*><code/);
+    // The raw markdown marker should not survive rendering.
+    expect(html).not.toMatch(/^# IRC Services Reference/m);
+  });
+
+  it('emits Home as the index (index.html)', async () => {
+    await buildDocs({ srcDir: docsSrc, outDir });
+    const html = readFileSync(path.join(outDir, 'index.html'), 'utf8');
+    // Home.md's "Welcome to the Wiki." lead-in should be present.
+    expect(html).toMatch(/Welcome to the Wiki/i);
+  });
+
+  it('rewrites intra-docs links to .html in the rendered output (no .md hrefs remain)', async () => {
+    await buildDocs({ srcDir: docsSrc, outDir });
+    const files = readdirSync(outDir).filter((f) => f.endsWith('.html'));
+    expect(files.length).toBeGreaterThan(0);
+    for (const f of files) {
+      const html = readFileSync(path.join(outDir, f), 'utf8');
+      // No intra-docs .md href may remain. (External https://…/foo.md is fine.)
+      const intraMd = html.match(/href="(?!https?:|mailto:|#)[^"]*\.md[^"]*"/g) ?? [];
+      expect(intraMd).toEqual([]);
+    }
+  });
+
+  it('emits a shared stylesheet (referenced by every page)', async () => {
+    await buildDocs({ srcDir: docsSrc, outDir });
+    const files = readdirSync(outDir).filter((f) => f.endsWith('.html'));
+    // Every page links the same stylesheet.
+    for (const f of files) {
+      const html = readFileSync(path.join(outDir, f), 'utf8');
+      expect(html).toMatch(/<link[^>]+rel=["']stylesheet["']/);
+    }
+    // And the stylesheet actually exists in the output.
+    const css = readdirSync(outDir).filter((f) => f.endsWith('.css'));
+    expect(css.length).toBeGreaterThanOrEqual(1);
+  });
+
+  it('emits an ADR-Index page that links each ADR via a rewritten .html href', async () => {
+    await buildDocs({ srcDir: docsSrc, outDir });
+    const html = readFileSync(path.join(outDir, 'ADR-Index.html'), 'utf8');
+    expect(html).toMatch(/ADR-001-pure-reducers-and-effect-system\.html/);
+  });
+});

package/docs/AWS-Adapter-Architecture.md

@@ -373,8 +373,9 @@ scheme (post-v1).
         │
         │  all-or-nothing → races structurally impossible
         │
-        ▼
-   dispatch Broadcast(JOIN), 353 NAMES, 366 END-NAMES
+         ▼
+   dispatch Broadcast(JOIN), 353 NAMES, 366 END-NAMES,
+           and when a topic is set: 332 RPL_TOPIC, 333 RPL_TOPICWHOTIME
 ```
 
 A `CancellationException` from `TransactWriteItems` maps to the

package/docs/AWS-Deployment.md

@@ -530,21 +530,24 @@ namespaces).
 
 ## 8. Secrets
 
-**As of v1 the Lambda consumes no Secrets-Manager/SSM bindings.** Server
-password and oper creds are handled by later hardening work; when they
-ship, the natural homes are AWS Secrets Manager or SSM Parameter Store
-(the AWS adapter architecture doc calls both out as supporting
-services). SASL account credentials, however, **are** persisted — in the
-`Accounts` DynamoDB table (see §8.1).
+**The Lambda consumes one optional secret: `SERVER_PASSWORD`.** When
+set (as a Lambda env var, conventionally sourced from AWS Secrets
+Manager or SSM Parameter Store), every connection must supply the
+matching `PASS <value>` (or SASL-identify) before `001 RPL_WELCOME`;
+when unset/empty the gate is disabled (the default). The adapter's
+config loader reads `process.env.SERVER_PASSWORD` at cold start via
+`loadServerConfigFromLambdaEnv` and threads it through to
+`ServerConfig.serverPassword`.
 
-When secrets land, the typical pattern will be:
+The typical provisioning pattern:
 
 1. Create the secret in Secrets Manager (or a `SecureString`
    parameter in SSM).
 2. Grant the Lambda role `secretsmanager:GetSecretValue` (or
    `ssm:GetParameter`) scoped to that one secret ARN.
 3. Read it inside `buildDepsFromEnv` (cold start) — never inside the
-   per-frame hot path.
+   per-frame hot path — and expose the value to the Lambda env as
+   `SERVER_PASSWORD`.
 
 ```bash
 aws secretsmanager create-secret \
@@ -552,6 +555,16 @@ aws secretsmanager create-secret \
   --secret-string "$(openssl rand -base64 32)"
 ```
 
+**SASL short-circuit:** a connection that has authenticated an account
+via SASL (`AUTHENTICATE PLAIN` / `EXTERNAL`) is exempt from the server
+password — the reducer's gate treats `state.account !== undefined` as
+already authorised. Oper creds (`OPER_USER` / `OPER_PASSWORD`) follow
+the same secret pattern; SASL account credentials are **not** secrets —
+they are persisted in the `Accounts` DynamoDB table (see §8.1). **Never
+log `SERVER_PASSWORD`** — treat it as a shared deployment secret,
+distinct from per-account SASL credentials (which go through the hashed
+`Accounts` table).
+
 ### 8.1 SASL accounts (`Accounts` table + seed tooling)
 
 SASL PLAIN credentials live in the `Accounts` DynamoDB table as

package/docs/Cloudflare-Deployment-Guide.md

@@ -365,11 +365,11 @@ managed separately in the dashboard.
 
 ## 8. Secrets
 
-**As of v1 the Worker consumes no secret bindings.** Server password and
-oper creds land in later tickets (TICKET-046 / TICKET-047). SASL account
-credentials are **not** secrets — they are persisted as scrypt hashes in
-D1 (see §8.1 below). When server password / oper secrets ship, they will
-be set via:
+**The Worker consumes one optional secret binding: `SERVER_PASSWORD`.**
+When set, every connection must supply the matching `PASS <value>` (or
+SASL-identify) before `001 RPL_WELCOME`; when unset/empty the gate is
+disabled (the default). Configure it as a wrangler secret, never a
+plaintext `[vars]` entry:
 
 ```bash
 wrangler secret put SERVER_PASSWORD --env staging
@@ -377,10 +377,26 @@ wrangler secret put SERVER_PASSWORD --env staging
 #   NOT in wrangler.toml or the repo.
 ```
 
+Unset (`wrangler secret delete SERVER_PASSWORD`) disables the gate.
+**SASL short-circuit:** a connection that has authenticated an account
+via SASL (`AUTHENTICATE PLAIN` / `EXTERNAL`) is exempt from the
+server password — the reducer's gate treats `state.account !== undefined`
+as already authorised, so a deployment with both `SERVER_PASSWORD` and
+configured SASL accounts does not need to hand the shared password to
+identified users.
+
+Oper creds (`OPER_USER` / `OPER_PASSWORD`) are still on the roadmap;
+when they ship they will follow the same wrangler-secret pattern. SASL
+account credentials are **not** secrets — they are persisted as scrypt
+hashes in D1 (see §8.1 below).
+
 Secrets are visible to the Worker as plain `env.SECRET_NAME` bindings,
 but their values are never written to disk, the bundle, or the
 dashboard's variable listing. To rotate, run `wrangler secret put`
-again; to remove, `wrangler secret delete <NAME>`.
+again; to remove, `wrangler secret delete <NAME>`. **Never log
+`SERVER_PASSWORD`** — treat it as a shared deployment secret, distinct
+from per-account SASL credentials (which go through the hashed D1
+store).
 
 **Never** put credentials, API tokens, or password hashes in
 `wrangler.toml`, in `[vars]`, or in committed files. The

package/docs/PlanExtensions.md

@@ -253,9 +253,30 @@ connection is not identified as. The dispatch layer resolves it against
 Already-present seams the services reuse:
 
 - `AccountStore.verify('PLAIN', ...)` (TICKET-026 ✅) → a successful
-  NickServ `IDENTIFY` and a SASL PLAIN login both reduce to "this
-  connection is now account X", setting the `+r` user mode and
-  emitting `ACCOUNT` to `account-notify`-capable peers.
+  NickServ `IDENTIFY`, a SASL PLAIN login, and a PASS-based account login
+  (TICKET-152 ✅) all reduce to "this connection is now account X". The
+  shared `applyAccountSuccess(state, ctx, account)` helper stamps the
+  account, sets the `+r` user mode, restores per-account state (read
+  markers, persisted away, queued memos), and emits `900 RPL_LOGGEDIN` +
+  `903 RPL_SASLSUCCESS` plus the `ACCOUNT` broadcast to
+  `account-notify`-capable peers.
+- **PASS-based account auth (TICKET-152 ✅)** — a third account-login
+  entry point alongside SASL and NickServ `IDENTIFY`. A client that sends
+  `NICK <nick>` then `PASS <nick>:<password>` (then `USER`) is identified
+  to `ctx.accounts` at registration completion without speaking SASL. The
+  `<nick>:<password>` literal matches the `SASL_ACCOUNTS` seed format. The
+  payload nick (left of the first `:`) is the account name and MUST equal
+  `state.nick` at registration completion. Order of precedence at
+  registration is: (1) already identified (SASL/PASS-auth) → gate
+  satisfied; (2) `<nick>:<password>` verifies against `ctx.accounts` →
+  account set; (3) bare `PASS` matches `serverPassword` → gate satisfied;
+  (4) else `464 ERR_PASSWDMISMATCH` + disconnect. A bare `PASS <value>`
+  (no colon) is always a server-password candidate, never an account
+  credential; when `ctx.accounts` is unbound the `<nick>:<password>` form
+  is ignored and behaviour collapses to the server-password gate. Like
+  SASL, PASS-auth runs through `applyAccountSuccess` and therefore stamps
+  `+r`; a failed verify reveals nothing — unknown nick and wrong password
+  are indistinguishable (a fixed dummy verify equalises the failure path).
 - `MessageStore` (TICKET-063 ✅) → MemoServ's `SEND` is a record into
   a per-account memo queue; delivery is a fanout at identify time.
 - `clock` / `IdFactory` ports → memo ids, enforcement grace timers.
@@ -464,6 +485,52 @@ follows strict TDD (Red → Green → Refactor) per `CLAUDE.md` /
   `seedReadMarkers`; `CHATHISTORY BEFORE` with no pivot falls back to the
   connection's marker. TICKET-122 should fold this store into the unified
   services `UserStore` when it lands.
+- **Divergence vs. spec compliance (TICKET-150 follow-up, shipped):**
+  TICKET-118 shipped **channel-wide** mark TAGMSG fanout for pragmatic parity
+  with the `draft/typing` precedent — every `message-tags` OR
+  `draft/read-marker` peer in the channel received the mark. The ircv3
+  `draft/read-marker` spec, however, mandates that a read marker **MUST NOT be
+  disclosed to other users**: a client's own mark is private to its account.
+  The Phase 14 follow-up (account-scoped `draft/read-marker` fanout) restored
+  spec compliance with two behaviour changes:
+
+  1. **Identified originator → account-scoped fanout.** The
+     `tagmsgChannelReducer` now annotates the mark `TAGMSG` Broadcast effect
+     with the originator's `account`. The dispatch layer's cap-aware
+     `broadcast()` restricts the recipient set to channel members
+     authenticated as that same account (RFC 1459 case-folded comparison),
+     still honouring `except` (originator skip) and the OR-semantics `caps`
+     filter (`message-tags` OR `draft/read-marker`). Other accounts in the
+     channel never receive the mark; the originator's other live sessions on
+     the same account (multi-device sync, when they share the channel)
+     receive it. `filterClientTags` and its `+draft/read-marker` whitelist
+     are unchanged — only the *recipient set* changes.
+  2. **Unidentified originator → no fanout (session-local).** An
+     unidentified connection (no account) emits **no** Broadcast for a read-
+     marker mark. Its mark stays session-local (the in-memory
+     `lastReadMarkers` still advances; persistence is a no-op without an
+     account, unchanged from TICKET-118). The originator's own client still
+     observes its mark via the `echo-message` self-echo. This matches the
+     spec's privacy default: a read marker never reaches *other* users, and
+     an unidentified connection has no account to share a mark with.
+
+  **Recipient-resolution primitive ("or equivalent" index).** The ticket's
+  description floated an `AccountConnections` index on the runtime. The
+  shipped implementation takes the spec-permitted "(or equivalent)" path:
+  there is **no separate index structure**. The recipient set is resolved at
+  dispatch time by walking the channel roster and consulting each member's
+  live `ConnectionState.account` via the existing `getConnectionInfo` port
+  method (the same per-recipient resolution already used for cap gating).
+  This is always fresh by construction — disconnected connections leave the
+  roster, and account changes are live references — so the staleness
+  concerns an explicit index would need (re-sync on `ACCOUNT`/SASL/
+  disconnect) do not apply. Global cross-channel account fanout (reaching an
+  account's sessions that are *not* in the marked channel) is a documented
+  follow-up, not needed for spec privacy: the mark is channel-specific, and
+  the persistence layer (`ServicesStore.setLastReadMarker`) already syncs a
+  session's marker on reconnect/rejoin via `seedReadMarkers`. 100% coverage
+  on the account-scoped fanout + dispatch filter (irc-core and irc-server
+  both enforce a 100% gate).
 
 #### TICKET-119 — IRCv3 `draft/pre-away` (persist away status)
 - **Phase:** 12
@@ -613,6 +680,49 @@ follows strict TDD (Red → Green → Refactor) per `CLAUDE.md` /
 - **TDD Outline:** Red on REGISTER→`+r`; green; then `+R`/`+M`;
   then KEEPTOPIC; then MLOCK.
 
+  Implementation notes (post-land):
+  - Three new boolean channel modes added to `ChannelModes`:
+    `registered` (`+r`), `blockUnidentified` (`+R`), `moderatedIdent`
+    (`+M`). They appear in the `324 RPL_CHANNELMODEIS` reply when set,
+    but `channelModeReducer` rejects `+r`/`+R`/`+M` via `MODE` with `472
+    ERR_UNKNOWNMODE` — only ChanServ may toggle them via
+    `ApplyChannelDelta` effects.
+  - `519 ERR_ALLMUSTREGISTER` added to `Numerics` for the `+R` JOIN gate.
+  - `ServicesStore` extended: `getChannel`, `setChannelFounder`,
+    `setChannelMlock`/`getChannelMlock`, `setChannelRestricted`,
+    `setChannelKeepTopic`, `setChannelTopic`/`getChannelTopic`. The
+    `RegisteredChannel` record now carries `mlock` / `restricted` /
+    `keepTopic` / `topic?`. The in-memory store returns defensive
+    copies (callers cannot mutate the store by editing returned
+    records).
+  - `chanservReducer` (new, `commands/chanserv.ts`) handles
+    `PRIVMSG ChanServ :<command>`. Subcommands: `REGISTER`, `DROP`,
+    `INFO`, `SET FOUNDER/MLOCK/RESTRICTED/KEEPTOPIC`. Channel
+    mutations are emitted as `ApplyChannelDelta` effects so the actor
+    applies them to the authoritative `ChannelState`.
+  - `SET RESTRICTED ON|OFF` toggles the `+R` channel mode (and stores
+    the preference). `SET KEEPTOPIC ON|OFF` toggles topic persistence
+    and drops any previously-stored snapshot when turned off.
+  - JOIN reducer consults services on the first join after empty-recreate
+    to restore a KEEPTOPIC snapshot (emits `332`/`333` to the joiner).
+    `+R` JOIN gate rejects unidentified clients with `519`.
+  - TOPIC reducer persists the snapshot on every change (set or clear)
+    when KEEPTOPIC is on.
+  - PRIVMSG/NOTICE channel reducers enforce `+M` (op/voice/identified
+    pass) and `+R` (identified pass) with `404`; NOTICE is silent.
+  - `channelModeReducer` reapplies MLOCK after every applied MODE: any
+    positively-locked boolean mode that ended up unset (whether by this
+    MODE or by prior state) is re-asserted via a ChanServ-emitted
+    `ApplyChannelDelta` + `Broadcast` (`:ChanServ!ChanServ@services
+    MODE #chan +…`). Defence in depth — services-only modes (`+r`) are
+    also defended, so the registered mark survives even if a future
+    code path applies an `ApplyChannelDelta` clearing it.
+  - Actor routes `PRIVMSG ChanServ` (case-insensitive) to
+    `reducers.chanserv`; NOTICE and unbound-services cases fall through
+    to the normal user-target reducer (RFC: NOTICE is silent).
+  - 100% coverage on `chanserv.ts`, `mode.ts` (reapply branch), and the
+    new join/privmsg/topic branches.
+
 #### TICKET-126 — ChanServ: ACCESS / LEVELS (SOP/AOP/VOP/HOP)
 - **Phase:** 13
 - **Points:** 5

package/docs/Release-Process.md

@@ -15,8 +15,8 @@ opening a PR that bumps versions and updates `CHANGELOG.md`; the
 maintainer team cuts the tag.
 
 Cross-reference: `README.md` (Roadmap), `progress.md` / `tickets.md`
-(release content), `docs/deployment-cf.md` (prod deploy step §6),
-`.github/workflows/ci.yml`, `.github/workflows/deploy-cf.yml`.
+(release content), `docs/Cloudflare-Deployment-Guide.md` (prod deploy
+step §6), `.github/workflows/ci.yml`, `.github/workflows/deploy-cf.yml`.
 
 ---
 
@@ -37,7 +37,7 @@ this repo itself) should pin exact versions.
 
 ### 1.1 Workspace version lock
 
-All eight `package.json` files (root + 7 workspace packages) carry the
+All fifteen `package.json` files (root + 14 workspace packages) carry the
 **same** version string. They are bumped together in the release
 commit. The pre-release checklist in §4 enforces this.
 
@@ -132,17 +132,20 @@ node apps/cf-worker/scripts/smoke.mjs \
 If any box fails, **stop**. Fix forward on `main` and restart the
 checklist — do not tag over a broken tip.
 
-### 4.1 What is explicitly out of scope for a 0.x release
+### 4.1 What is explicitly out of scope for the 0.x line
 
-- AWS adapter (TICKET-039 through TICKET-044).
-- SASL authentication (TICKET-026).
-- Flood control (TICKET-028).
-- Server password / rate limits / cloaking (TICKET-046).
-- Config loader (TICKET-047).
+Items still pending in `progress.md` that are **not** blockers for a
+given release — they ship when ready and are called out under "Known
+limitations" in the GitHub Release body:
 
-These belong in a later 0.x release. Their absence is **not** a
-blocker and should be called out under "Known limitations" in the
-GitHub Release body.
+- Client compatibility sweep (WeeChat / HexChat / IRCCloud / TheLounge /
+  matrix-IRC bridge) — `progress.md` TICKET-050.
+- Playwright headless-browser e2e for the web client — TICKET-138.
+- Driving the sub-100% packages to full coverage — TICKET-143 through
+  TICKET-148.
+
+Their absence is **not** a blocker. If a release intentionally defers an
+in-progress ticket, name it under "Known limitations".
 
 ---
 
@@ -184,7 +187,7 @@ understand what changed and what they need to do.
 
 ## 6. Bumping versions
 
-There are eight `package.json` files. They must end up at the same
+There are fifteen `package.json` files. They must end up at the same
 version:
 
 ```
@@ -192,10 +195,17 @@ version:
 packages/irc-core/package.json
 packages/irc-server/package.json
 packages/in-memory-runtime/package.json
+packages/irc-test-support/package.json
 packages/cf-adapter/package.json
+packages/aws-adapter/package.json
 apps/local-cli/package.json
 apps/cf-worker/package.json
+apps/cf-tcp-container/package.json
+apps/aws-stack/package.json
+apps/web/package.json
 tools/tcp-ws-forwarder/package.json
+tools/load-test/package.json
+tools/ci-hardening/package.json
 ```
 
 To cut `v0.X.Y`: