serverless-ircd 0.7.0 → 0.9.0

package/CHANGELOG.md

@@ -7,24 +7,513 @@ and this project adheres to [Semantic Versioning](https://semver.org/) with
 the 0.x convention (any release may change anything).
 
 For the release process itself — versioning policy, pre-release checklist,
-cutting a tag, rolling back — see [`docs/release.md`](docs/release.md).
+cutting a tag, rolling back — see [`docs/Release-Process.md`](docs/Release-Process.md).
 Cross-reference `progress.md` / `tickets.md` for per-ticket detail.
 
+## [0.9.0] - 2026-08-10
+
+The main change in this release is **rounding out the integrated IRC
+services surface** that landed in v0.8.0: ChanServ gains the prefix and
+roster mutation verbs operators expect (`OP` / `DEOP` / `VOICE` /
+`DEVOICE` / `KICK` / `BAN` / `UNBAN`), HostServ **auto-applies an
+assigned vhost on identify** (no per-session `HostServ ON`), HostServ
+HELP hides oper-only commands from non-opers, NickServ grows an `ID`
+alias for `IDENTIFY`, and **NickServ `INFO` no longer leaks the
+registrant's email** to non-owners. Alongside it: service **shortcut
+verbs** (`/NICKSERV`, `/NS`, `/CS`, `/HS`, `/MS`, `/OS`, …) that the
+daemon rewrites to the equivalent `PRIVMSG <Service>`, `echo-message`
+reflection of `PRIVMSG` to service nicks, and the long-missing **JOIN
+`332`/`333` topic numerics** on reconnect/rejoin (regardless of how the
+topic came to be set). A real PASS-login bug is fixed: a client that
+completes registration before sending `PASS <nick>:<password>` is now
+logged in instead of receiving a silent no-op. The AWS adapter gets
+another round of consistency hardening — every `Connections` `GetCommand`
+now uses `ConsistentRead: true`. The web client renders the `docs/` wiki
+to standalone HTML at `/docs/` and gains a client-specific "how to
+connect" section on the landing page.
+
+### Added — Services surface expansion (`@serverless-ircd/irc-core`)
+
+- **ChanServ `OP` / `DEOP` / `VOICE` / `DEVOICE` / `KICK` / `BAN` /
+  `UNBAN`**: founder-or-`AUTOOP`-level callers can grant/remove prefix
+  modes on demand, kick through ChanServ, and manage channel bans. Each
+  verb emits the corresponding `:ChanServ!ChanServ@services MODE` /
+  `KICK` broadcast and an `ApplyChannelDelta` against the channel
+  authority (the same mechanism MLOCK reasserts use), so the roster
+  and ban list update atomically with the broadcast. A target not on
+  the channel produces a NOTICE and no state change. Privilege gating
+  reuses the existing access-list check — no new store methods.
+- **HostServ auto-applies an assigned vhost on identify.** SASL
+  PLAIN/EXTERNAL, NickServ `IDENTIFY`, and PASS-auth now consult
+  `services.getVhost(account)` on a successful login: when an assigned
+  vhost exists, `applyVhost` runs immediately — `state.host` is set,
+  `state.vhostActive` is stamped, and any currently-joined
+  `chghost`-capable peers see the `CHGHOST` broadcast. At SASL/PASS-auth
+  time (pre-JOIN) there are no peers so no broadcast, but the vhost is
+  visible in the subsequent `001` welcome. Users no longer need to run
+  `HostServ ON` every session.
+- **NickServ `ID` alias for `IDENTIFY`.** `PRIVMSG NickServ :ID <pw>`
+  and `ID <nick> <pw>` behave identically to `IDENTIFY` — the alias
+  is not advertised in HELP (mirrors Atheme's hidden shorthand).
+- **Service shortcut verbs** (`@serverless-ircd/irc-server`):
+  `/NICKSERV`, `/NS`, `/CS`, `/HS`, `/MS`, `/OS` (and their long forms)
+  are rewritten at the actor to the equivalent
+  `PRIVMSG <ServiceNick> :<args>`. Clients with a dedicated
+  slash-command UX (WeeChat, HexChat, IRCCloud) now work without a
+  custom alias file. The aliases are case-insensitive and accept both
+  colon-trailing and space-joined arg shapes.
+- **`echo-message` reflection for service PRIVMSG**: a client that
+  has negotiated `echo-message` now sees its own
+  `PRIVMSG NickServ :IDENTIFY hunter2` reflected back before the
+  NickServ NOTICE reply, matching the echo behaviour for every other
+  PRIVMSG target. The echo is emitted before the reply so labeled-
+  response batches wrap both correctly.
+
+### Added — Web client (`apps/web`)
+
+- **`docs/` wiki rendered to `/docs/`.** The Gitea-wiki markdown under
+  the `docs/` submodule is now rendered to standalone HTML at
+  `apps/web/dist/docs/<slug>.html` and served by the existing
+  `[assets]` binding at `/docs/<slug>.html` (with `Home.md` →
+  `/docs/index.html`). Intra-docs Markdown links are rewritten to
+  `.html`, a shared stylesheet is emitted, and an `ADR-Index` page
+  links every ADR. Requires `git submodule update --init docs` before
+  build; the build fails loudly with the recovery command if the
+  submodule is missing or empty.
+- **Landing-page "how to connect" section.** The static landing page
+  gains a CSS-only tabbed picker with copy-paste connect snippets for
+  the common stock IRC clients (WeeChat, HexChat, irssi, IRCCloud),
+  replacing the previous per-client static guides. The picker covers
+  both the WebSocket path and the `irc+tls :6697` path.
+
+### Changed — PASS-based account login (`@serverless-ircd/irc-core`)
+
+- **A late `PASS <nick>:<password>` now logs the connection in.**
+  Previously, a client that completed registration (`NICK` + `USER`
+  resolving before `PASS` arrived, or any `PASS` sent after `CAP END`
+  resolved) was silently rejected — the `passReducer` short-circuited
+  at `state.registration === 'registered'` and emitted `462
+  ERR_ALREADYREGISTRED` for any post-registration `PASS`. The shared
+  verify + `applyAccountSuccess` pipeline now runs on a
+  post-registration `PASS <nick>:<password>`: on success it emits
+  `900 RPL_LOGGEDIN` + `903 RPL_SASLSUCCESS`, stamps `+r`, and runs
+  the read-marker / away / memo replay in-band, exactly like the
+  at-registration path. A bare `PASS <value>` (no colon) is a silent
+  no-op once registration has completed — a server password is
+  meaningless post-registration, and emitting `462` for it was
+  counterproductive. The pre-registration duplicate-PASS `462` (two
+  `PASS`es before `NICK`+`USER`) is preserved unchanged.
+
+### Fixed — Channel correctness (`@serverless-ircd/irc-core`)
+
+- **JOIN now emits `332 RPL_TOPIC` / `333 RPL_TOPICWHOISTIME` from any
+  source of the topic.** The previous JOIN reducer keyed topic
+  emission solely on the ChanServ KEEPTOPIC restore path (an empty
+  channel this join), so reconnecting clients after a deploy saw the
+  NAMES list but no topic — even when the topic survived the deploy
+  in storage. The emission now keys off `state.topic`, so a topic
+  restored from a KEEPTOPIC snapshot, a deploy snapshot with
+  KEEPTOPIC off, or an earlier joiner all produce the correct
+  numerics. The KEEPTOPIC restore path still maintains `state.topic`
+  for an empty channel; only the emission trigger changed.
+- **No auto-op for the first joiner of a registered channel off the
+  access list.** A registered channel that had been emptied (so its
+  roster snapshot was fresh) used to auto-op the first joiner
+  unconditionally as a "founder fallback", which let any client claim
+  `+o` by joining an empty registered channel. The fallback now only
+  fires when the joiner is identified as the founder (or is on the
+  access list); an unidentified first joiner joins without prefix
+  modes.
+
+### Fixed — AWS adapter (`@serverless-ircd/aws-adapter`)
+
+- **Strongly-consistent `Connections` reads across every handler.**
+  `$disconnect`'s `cleanupConnection` and the NLB streaming handler's
+  per-chunk row read were eventually consistent, so under DynamoDB
+  replication lag they could miss the row that was just written (or
+  updated) — dropping the first frame of a raw `:6697` connection or
+  skipping nick release + membership fanout on `$disconnect`. Every
+  `GetCommand` against the `Connections` table in `aws-adapter/src/**`
+  now sets `ConsistentRead: true`, matching the `$default` fix from
+  v0.8.0. A unit test asserts each call site carries the flag.
+- **Bounded `docker info` probe in the test global-setup.** On hosts
+  with Docker Desktop installed but not running, the macOS `docker`
+  CLI hangs indefinitely waiting for the daemon to spin up — and
+  `testcontainers` inherits that hang, stalling the whole `pnpm test`
+  run. The aws-adapter `globalSetup` now pre-probes `docker info`
+  with a 5-second exec timeout; if Docker is not reachable, it logs
+  and falls through to the Java ZIP fallback (or skip) instead of
+  hanging. No behaviour change when Docker is up.
+
+### Fixed — HostServ help leak (`@serverless-ircd/irc-core`)
+
+- **HostServ HELP hides oper-only commands from non-opers.** The
+  help/unknown NOTICE previously listed all seven HostServ commands
+  (`ON, OFF, REQUEST, SET, APPROVE, REJECT, LIST`) to every caller,
+  leaking the existence and names of oper commands. The notice
+  helpers now branch on `state.userModes.oper`: a non-oper sees only
+  `ON, OFF, REQUEST`; an oper sees the full list. The per-handler
+  oper gates are unchanged, so a non-oper who guesses an oper
+  command name still gets the existing permission-denied NOTICE.
+
+### Fixed — NickServ INFO privacy (`@serverless-ircd/irc-core`)
+
+- **NickServ `INFO` no longer leaks the registrant's email to
+  non-owners.** `handleInfo` previously returned the `Email:` line
+  unconditionally to any caller, identified or not — a remote,
+  unidentified user could enumerate registered nicks and harvest
+  email addresses. The `Email:` line is now gated behind
+  `state.account === rec.account` (the owner) or
+  `state.userModes.oper === true` (an oper). The owner path still
+  shows the full record; `INFO` with no target defaults to the
+  caller's own nick (owner path). The `Nick:` / `Account:` lines
+  remain visible to all callers (consistent with how a WHOIS against
+  a registered nick surfaces the account name).
+
+### Changed — Local CLI (`apps/local-cli`)
+
+- **`operCreds` plumbed through the config schema.** The local CLI's
+  `ServerConfig` now carries `operCreds` end-to-end (was wired ad-hoc
+  through constructor options); OPER auth against configured creds
+  works the same way it does in the cloud adapters. The transport
+  seams (WS / TCP) are also extracted into named helpers for
+  readability.
+
+### Changed — CI / tooling
+
+- CI workflows now explicitly checkout every submodule (`docs/`,
+  `apps/web/upstream/`) so the render-docs and Kiwi build steps run
+  deterministically on every runner, not just maintainer laptops.
+
+### ⚠️ Migration required
+
+- **No persisted-DO-state schema change.** `PERSISTED_STATE_VERSION`
+  stays `1`. The ChanServ roster commands, HostServ auto-vhost, and
+  the JOIN topic-numeric fix are runtime behaviour, not persisted DO
+  fields. **Code rollback across this release is safe.**
+- **No D1 / DynamoDB schema change.** The existing services tables
+  (`nickserv_accounts`, `chanserv_channels`, …) carry the new
+  behaviour unchanged. The `cert_subjects` column flagged for the
+  in-progress services credential consolidation is **not yet
+  present** — operators do not need to run any migration command for
+  this release.
+- **Behaviour change: late `PASS` no longer emits `462`.** A
+  post-registration `PASS <value>` used to reply
+  `462 ERR_ALREADYREGISTRED`; it is now silent. Clients that keyed
+  off the `462` to detect "you already sent PASS" will no longer see
+  it. No client is known to do this (the numeric is informational),
+  but scripted regression tests against this behaviour must be
+  updated (the in-tree `irc-test-support` scenario was updated).
+- **Behaviour change: late `PASS <nick>:<password>` now logs in.**
+  Clients that intentionally sent the colon form post-registration
+  expecting it to be ignored will now be logged in. This is the
+  intended fix; flag it in operator runbooks if the deployment was
+  relying on the silent-reject for some access-control flow.
+
+### Known limitations
+
+- **The `AccountStore` / `ServicesStore` credential drift is still
+  present.** A nick registered via NickServ `REGISTER` after the
+  worker booted still cannot authenticate via SASL PLAIN/EXTERNAL or
+  `PASS <nick>:<password>` against the *fresh* password — those paths
+  consult the SASL `AccountStore` (`accounts` table), which
+  `registerNick` does not write back to. The PASS-login fix above
+  makes the at-registration and post-registration paths symmetric,
+  but the underlying cross-store drift remains tracked for a
+  follow-up release that consolidates the credential into a single
+  store. Operators who need a NickServ-registered nick to work with
+  SASL/PASS immediately should re-seed via
+  `tools/seed-cf-accounts.ts` (D1) / `tools/seed-aws-accounts.ts`
+  (DynamoDB) with the same password.
+- Same transport limits as v0.8.0: the **CF TCP path requires
+  Cloudflare Spectrum (Enterprise tier)** plus a stateful Container
+  origin; the **AWS TCP path** uses NLB + Lambda streaming and is
+  subject to Lambda idle-timeout / stream-duration limits. The
+  WebSocket path remains the zero-extra-deps default.
+- **mTLS (for SASL `EXTERNAL`) requires a custom domain + uploaded
+  CA/trust-store** on both platforms and is not enabled by default.
+- **Client compatibility sweep** (WeeChat / HexChat / IRCCloud /
+  TheLounge / matrix-IRC bridge) remains pending.
+- **Coverage hardening is partial.** `irc-core`, `irc-server`, and
+  `in-memory-runtime` sit at 100%; `aws-adapter` and `aws-stack`
+  clear the 90% gate. The remaining packages (`cf-adapter`,
+  `local-cli`, `load-test`, `cf-tcp-container`, `tcp-ws-forwarder`,
+  `irc-test-support`, `web`) are **above the gate but below 100%** —
+  follow-ups drive each to full coverage.
+
+### Security
+
+- **NickServ `INFO` email disclosure** (Fixed above): a remote,
+  unidentified client could harvest email addresses from every
+  registered nick. The disclosure is now gated behind owner-or-oper.
+- **First-joiner op-takeover on empty registered channels** (Fixed
+  above): an unidentified client could claim `+o` by being the first
+  to join an empty registered channel. The auto-op fallback now
+  requires founder/access-list identification.
+- No other auth path changed. The scrypt-hashed credential store,
+  server-password gate, and CSWSH defense are unchanged from v0.8.0.
+
+---
+
+## [0.8.0] - 2026-08-08
+
+The main change in this release is **integrated IRC services**: NickServ,
+ChanServ, HostServ, OperServ, and MemoServ ship as part of the daemon
+itself — there is **no separate services process and no S2S link**. The
+service nicks are reserved and routed to dedicated pure reducers backed
+by a new `ServicesStore` port, with **persistent D1 (Cloudflare) and
+DynamoDB (AWS) backends** so registrations survive redeploys. Alongside
+it: the SASL `AccountStore` and NickServ accounts are **unified** under
+one scrypt-hashed credential store, `PASS <nick>:<password>` identifies
+at registration, the `draft/read-marker` `MARKREAD` verb lands, and a
+round of **AWS adapter hardening** (O(1) admission counter, strongly-
+consistent `$default` reads, WebSocket subprotocol echo fix).
+
+### Added — Integrated IRC services (`@serverless-ircd/irc-core`, `@serverless-ircd/irc-server`)
+
+The ten services tickets add the full
+services surface. Service names are reserved nicks recognized at
+`PRIVMSG` time and routed to dedicated pure reducers when a
+`ServicesStore` is bound; when no store is bound every services command
+replies `501` and the rest of the daemon is unaffected. See
+`docs/Services.md` for the operator reference.
+
+- **`ServicesStore` port + in-memory reference impl**: a synchronous,
+  injectable store holding NickServ / ChanServ / HostServ / MemoServ /
+  OperServ / read-marker state. Reducers stay pure — all side effects
+  flow through the store port. The `ReadMarkerStore` from v0.6.0 is
+  **folded into** `ServicesStore` so read-markers, `draft/pre-away`,
+  and account state share one persistence path.
+- **NickServ** (`REGISTER` / `IDENTIFY` / `DROP` / `INFO` / `SET`):
+  registers the current nick, identifies to an account (setting the
+  read-only user mode **`+r`**, fanning `ACCOUNT` to `account-notify`
+  peers, then delivering unread MemoServ memos), and supports
+  `SET ENFORCE` — a registered nick held by a non-identified
+  connection is reclaimed on the `NICK` path (enforcement policy
+  mirrors Atheme/Anope). `IDENTIFY` falls back to SASL account
+  credentials when no NickServ row exists.
+- **ChanServ** (`REGISTER` / `DROP` / `SET` / `INFO` / `ACCESS` /
+  `LEVELS`): channel registration with a founder, the services-only
+  channel modes **`+r`** (registered), **`+R`** (block unidentified
+  join/message), and **`+M`** (moderated-identified), `ACCESS`/`LEVELS`
+  (SOP/AOP/VOP/HOP access lists), and auto-op on `JOIN` per access
+  level. The three services modes are settable only via ChanServ, not
+  via `MODE` (`472 ERR_UNKNOWNMODE` / `501`).
+- **HostServ** (`ON` / `OFF` / `REQUEST` + oper `SET` / `APPROVE` /
+  `REJECT` / `LIST`): per-account vhost with `CHGHOST` fanout to shared
+  channels. `REQUEST` enters an **oper approval queue**; opers `APPROVE`
+  to activate or `REJECT` to drop it.
+- **OperServ** (`AKILL` / `JUPE` / `UNJUPE` / `RAW`): oper-gated
+  network management. `AKILL` records an `*@host` mask, `JUPE` reserves
+  a juped nick (rejected at `NICK` with `432 ERR_ERRONEUSNICKNAME`),
+  `RAW` is the escape hatch. Wired end-to-end: `PRIVMSG OperServ :…`
+  routes to the OperServ reducer.
+- **MemoServ** (`SEND` / `LIST` / `READ` / `DEL`): per-account memos
+  with queue delivery — unread memos are replayed at identify (NickServ
+  `IDENTIFY` / SASL login / PASS-based login), the same path that
+  replays `draft/read-marker` and `draft/pre-away`.
+
+### Added — Persistent services backends (`@serverless-ircd/cf-adapter`, `@serverless-ircd/aws-adapter`)
+
+Both adapters ship write-behind persistence for the `ServicesStore` so
+registrations, channel access lists, vhosts, memos, and read-markers
+survive a redeploy/reconnect.
+
+- **Cloudflare (D1)**: `D1ServicesStore` over the shared `ACCOUNTS_DB`
+  binding (the same D1 database used for SASL accounts since v0.4.0).
+  The ten services tables **auto-provision on cold start** (`CREATE
+  TABLE IF NOT EXISTS` inside `loadD1ServicesStore`), so a fresh deploy
+  self-provisions and an existing deploy re-runs the batch as a cheap
+  no-op. `ConnectionDO` load/flush hooks wrap each frame and teardown.
+- **AWS (DynamoDB)**: `DynamoServicesStore` plus a new `Services`
+  table definition and handler wiring so NLB-stream / `$default`
+  invocations hydrate + flush services alongside the existing account
+  store. Enabled when the `SERVICES_TABLE` env var / table name is
+  supplied.
+- **`PersistentServicesStore` base** (`irc-core`): the shared
+  write-behind base — mutates the inherited cache synchronously and
+  enqueues matching writes for `flush()`, so reducers stay free of IO.
+
+### Added — Unified accounts & registration login (`@serverless-ircd/irc-core`)
+
+- **Unified SASL + NickServ account store**: the SASL `AccountStore`
+  and NickServ `ServicesStore` now share one **scrypt-hashed**
+  credential shape. A NickServ registration *is* a SASL account —
+  SASL `PLAIN`'s services fallback verifies against a row created by
+  NickServ `REGISTER` without a second registration, and vice versa.
+  The plaintext password on `ServicesNickRow` is replaced with a
+  `HashedAccountCredential` (scrypt + random salt). `ingestAccountCredential`
+  adopts a pre-hashed SASL credential as a registered nick (idempotent;
+  existing records win).
+- **PASS-based account login**: a client may identify to its NickServ
+  account at registration by sending `PASS <nick>:<password>` (the same
+  literal the `SASL_ACCOUNTS` seed tooling uses). On success the
+  connection is logged in — emitting `900`/`903`, stamping `+r`, and
+  running the same read-marker / away / memo replay as SASL. A bare
+  `PASS <value>` (no colon) is always treated as a server-password
+  candidate. The shared login reduction (`applyAccountSuccess`) is
+  extracted and reused from SASL.
+- **Server-password gate with SASL short-circuit**: an optional gate
+  enforced in the registration reducer at `001` — when
+  `ServerConfig.serverPassword` is set, every connection must supply a
+  matching `PASS` (or authenticate via SASL / PASS-based account login)
+  before `RPL_WELCOME`, else `464 ERR_PASSWDMISMATCH` + disconnect.
+  Wired through all three adapters (`SERVER_PASSWORD` Worker secret /
+  Lambda env var / `--server-password` CLI flag).
+
+### Added — `draft/read-marker` `MARKREAD` verb (`@serverless-ircd/irc-core`)
+
+- The timestamp-based `MARKREAD` command from the read-marker draft
+  lands alongside the existing `+draft/read-marker=<msgid>` tag path.
+  `MARKREAD <target>` (GET) replies with the stored marker's timestamp;
+  `MARKREAD <target> <timestamp>` (SET) advances the marker, with
+  timestamp↔msgid translation against the message store. Failure modes
+  use `standard-replies` `FAIL MARKREAD …`. The mark fanout is
+  **scoped to the originator's account** (spec compliance), not
+  broadcast to every cap-enabled peer.
+
+### Added — Cloudflare adapter (`@serverless-ircd/cf-adapter`)
+
+- **Client source IP capture at WebSocket upgrade**: reads
+  `CF-Connecting-IP` (with `X-Real-IP` fallback) from the upgrade
+  request and seeds `ConnectionState.host`, so WHOIS / hostmasks carry
+  a real `@host` segment instead of an `undefined` fallback.
+- **Ghost-member pruning via alarm**: when a WebSocket `close` event is
+  lost (client drop, edge hiccup), the DO's alarm prunes the ghost
+  member from its channels on the next sweep, preventing stale roster
+  entries.
+
+### Changed — AWS adapter (`@serverless-ircd/aws-adapter`, `@serverless-ircd/aws-stack`)
+
+- **O(1) admission counter**: `$connect`'s full-table `Scan COUNT` is
+  replaced with an atomic increment/decrement on a single meta row,
+  dropping admission cost from O(connections) to O(1). Reservations
+  roll back on rejection or a failed `Put`; the sweeper and stats
+  exclude the meta row.
+- **Strongly-consistent `$default` reads + observability**: `$default`
+  now reads the `Connections` row strongly consistent (closes a
+  read-after-write `410` window), warns on a missing row, logs
+  `postToConnection` failures (previously silently swallowed), and
+  emits a summary log per invocation.
+- **`ServerName` / `NetworkName` as CFN parameters**: server identity
+  is now a CloudFormation parameter (was env-var-only), and the
+  sweeper Lambda's `loadServerConfigFromLambdaEnv` is wired with the
+  server-identity env vars it requires. `SweeperScheduleExpression`,
+  `PingCheckerScheduleExpression`, and `ApiGatewayLoggingLevel` are
+  also exposed as parameters.
+- **WebSocket subprotocol echo fixed**: API Gateway WebSocket
+  `IntegrationResponse` uses `route.response.header.*` (not
+  `method.response.header.*`, which is REST API only), so the
+  `Sec-WebSocket-Protocol` header was not being echoed back to clients.
+  AWS now correctly negotiates the IRCv3 subprotocol. Subprotocol
+  advertisement is forced text-only (`text.ircv3.net`) to match the
+  Lambda response-stream path.
+- **APIGW logging role corrected** and Biome lint/format applied.
+
+### Changed
+
+- **`MODE +o` echo on oper-up**: the connection that grants oper now
+  receives a `MODE` echo, matching the cross-connection oper-up path.
+- **NICK change broadcast fix**: nick changes now broadcast to every
+  shared-channel peer (a code path that dropped peers under certain
+  roster shapes is corrected).
+- **Server version from `package.json`**: the default `serverVersion`
+  advertised in `002`/`003` is derived from the workspace
+  `package.json` at build time (was a hardcoded placeholder when the
+  config omitted it).
+- **Web client SPA path `/app/` → `/webclient/`**: the vendored Kiwi
+  IRC SPA is now served at `/webclient/` (the `[assets]` publicPath
+  and config are repointed). Operators with custom Kiwi configs or
+  bookmarks must update to `/webclient/`.
+- **Source / issue links migrated to Gitea**; landing-page copy
+  tightened and the upstream-install guard hardened.
+
+### Changed — CI / tooling
+
+- `actions/setup-java` bumped to v5; pnpm pinned to 11.20.0. CI jobs
+  are bounded by explicit timeouts and the unreachable pnpm cache step
+  is dropped.
+
+### ⚠️ Migration required
+
+- **Cloudflare: services are enabled when `ACCOUNTS_DB` is bound.** The
+  D1 binding is the same one introduced in v0.4.0 for SASL accounts;
+  the ten services tables **self-provision on cold start** (no manual
+  `wrangler d1 execute` needed). If `ACCOUNTS_DB` is already bound,
+  services are now live after deploy — no action. If it is unset,
+  services commands reply `501` and the daemon is otherwise unchanged.
+- **AWS: new `Services` DynamoDB table + `SERVICES_TABLE`.** To enable
+  services, supply a services table name (`SERVICES_TABLE` env var /
+  CDK `servicesTableName` prop); the table is created by the CDK stack.
+  Without it, services are unbound.
+- **NickServ / SASL credentials are now scrypt-hashed at rest.** A
+  NickServ `REGISTER` creates the same hashed credential shape SASL
+  uses; the `password` column on the NickServ row is replaced by
+  `algorithm` / `salt` / `hash`. Existing seeded SASL accounts are
+  adopted as registered nicks idempotently. Operators re-seeding via
+  `tools/seed-*-accounts.ts` see no change (the tools already hashed).
+- **Web client SPA moved to `/webclient/`.** Update any bookmarks,
+  custom Kiwi configs, or `WEB_ORIGINS` entries pointing at `/app/`.
+- **No persisted-DO-state schema change.** `PERSISTED_STATE_VERSION`
+  stays `1`. The new read-only user mode `r` (registered) and the
+  services channel modes `r`/`R`/`M` are runtime state, not persisted
+  DO fields; the `ReadMarkerStore` fold moves read-markers into the
+  services backend (D1/DynamoDB), out of DO storage. **Code rollback
+  across this release is safe.**
+- No toolchain change. Node ≥ 24 / pnpm 11 (from v0.4.0) still apply.
+
+### Known limitations
+
+- **Services are not binary-compatible with Atheme or Anope.** There is
+  no S2S protocol, so an existing Atheme/Anope services process cannot
+  connect, and existing services databases cannot be imported.
+  Operators migrating from a services-aware network must re-register
+  nicks and channels. See `docs/Services.md` §12.
+- **The web client remains partial.** The Playwright headless-browser
+  e2e against the deployed staging frontend is still pending; the SPA
+  is exercised via the WS smoke (`scripts/smoke.mjs`) and the `apps/web`
+  unit / build-smoke suite. The web client remains Cloudflare-only (the
+  `[assets]` binding is a Worker feature).
+- Same transport limits as v0.7.0: the **CF TCP path requires
+  Cloudflare Spectrum (Enterprise tier)** plus a stateful Container
+  origin; the **AWS TCP path** uses NLB + Lambda streaming and is
+  subject to Lambda idle-timeout / stream-duration limits. The
+  WebSocket path remains the zero-extra-deps default.
+- **mTLS (for SASL `EXTERNAL`) requires a custom domain + uploaded
+  CA/trust-store** on both platforms and is not enabled by default.
+- **Client compatibility sweep** (WeeChat / HexChat / IRCCloud /
+  TheLounge / matrix-IRC bridge) remains pending.
+- **Coverage hardening is partial.** `aws-adapter` and `aws-stack`
+  clear the 90% gate; the remaining packages (`cf-adapter`,
+  `local-cli`, `load-test`, `cf-tcp-container`, `tcp-ws-forwarder`,
+  `irc-test-support`, `web`) are **above the gate but below 100%** —
+  follow-ups drive each to 100%.
+
+### Security
+
+- **NickServ / SASL credentials are now uniformly scrypt-hashed.** The
+  unified account store means a NickServ-registered nick and a SASL
+  account share one hashed credential — never plaintext, in memory or
+  at rest. The server-password gate and CSWSH defense are unchanged
+  from v0.7.0; no other auth path changed.
+
+---
+
 ## [0.7.0] - 2026-08-04
 
-The headline is the **web client (Phase 14)**: a vendored **Kiwi IRC**
+The main change in this release is the **web client**: a vendored **Kiwi IRC**
 SPA served at `/app/` and a static project landing page served at `/`
 directly by the Cloudflare Worker, with **Cross-Site WebSocket
 Hijacking (CSWSH) defense** wired into the WS upgrade path. The browser
-opens a native `wss://` straight to the existing IRC-over-WebSocket
-endpoint — no proxy, gateway, or transport adaptation in the hot path.
+opens a native `wss://` directly to the IRC-over-WebSocket
+endpoint — no proxy, gateway, or transport adaptation in the request path.
 Alongside it: a round of **test hardening** (mutation-killing tests for
 `irc-core`'s parser / batch / numerics, and CF-harness / scenario fixes
 for slow transports).
 
 ### Added — Web client (`@serverless-ircd/web`, `@serverless-ircd/cf-worker`)
 
-Six Phase 14 tickets light up the project's browser surface. The Worker
+Six tickets add the project's browser surface. The Worker
 becomes the single origin for the landing page, the SPA, **and** the
 WebSocket. Same-origin by default — which is what makes the CSWSH
 defense almost zero-config.
@@ -67,7 +556,7 @@ defense almost zero-config.
   with a `200 OK` (the WS endpoint and the landing page share path
   `/`; only the Worker can tell them apart).
 - **Static landing page** (`apps/web/landing/index.html`): framework-
-  free HTML + inline CSS, no JavaScript. The project's front door —
+  free HTML + inline CSS, no JavaScript. The project's entry page —
   explains what ServerlessIRCd is, links to `/app/` (the IRC client),
   the docs, and the source repo. The build copies it verbatim to
   `dist/index.html`. Renders without JS; responsive; the build-smoke
@@ -182,7 +671,7 @@ contributor can deploy a staging SPA following only this doc.
 
 ### Known limitations
 
-- **Phase 14 is partial.** The Playwright headless-browser e2e
+- **The web client is partial.** The Playwright headless-browser e2e
   against the deployed staging frontend remains pending
   — the SPA is exercised via the existing WS smoke
   (`scripts/smoke.mjs`) and the new `apps/web` unit / build-smoke
@@ -206,7 +695,7 @@ contributor can deploy a staging SPA following only this doc.
   (`cf-adapter`, `local-cli`, `load-test`, `cf-tcp-container`,
   `tcp-ws-forwarder`, `irc-test-support`, and now `web`) are **above
   the gate but below 100%** — follow-ups drive each to 100%.
-- The IRC services Phase 13 work (NickServ / ChanServ / HostServ /
+- The IRC services work (NickServ / ChanServ / HostServ /
   OperServ / MemoServ) is pending; `draft/read-marker` and
   `draft/pre-away` ship with in-memory reference stores, so marker /
   away persistence does not survive an adapter restart until a
@@ -226,20 +715,20 @@ contributor can deploy a staging SPA following only this doc.
 
 ## [0.6.0] - 2026-08-03
 
-The headline is the **IRCv3 extension sweep (Phase 12)**: ten negotiated
+The main change in this release is the **IRCv3 extension sweep**: ten negotiated
 caps and the user-mode-`S` TLS indicator land in one release, taking the
 negotiated capability surface from "modern baseline" to "draft-leading-
 edge". Alongside it: the **required-`serverName` config gate** (the
-last open v0.5.0 follow-up), a new **`tools/load-test`** client farm
-(Phase 7's 10k-connection harness), and the **coverage / CI unblocks**
+last open v0.5.0 follow-up), a new **`tools/load-test`** client pool
+(the 10k-connection harness), and the **coverage / CI unblocks**
 that lift `aws-adapter` over the 90% gate and switch `cf-adapter` /
 `cf-worker` to istanbul (clearing the v0.5.0 workerd-incompatibility
 caveat). Deploy workflows are now **manual-only** (`workflow_dispatch`).
 
 ### Added — IRCv3 extensions (`@serverless-ircd/irc-core`, `@serverless-ircd/irc-server`)
 
-The ten Phase 12 cap tickets light up the remaining negotiated-cap
-surface, and the two non-cap Phase 12 tickets (ISUPPORT tokens and
+The ten cap tickets add the remaining negotiated-cap
+surface, and the two non-cap tickets (ISUPPORT tokens and
 user mode `S`) round out the wire-visible advertisement. Each cap
 ships a pure reducer (where applicable), an actor route case,
 advertisement in `SUPPORTED_CAPABILITIES` (or conditional
@@ -349,10 +838,10 @@ with a readable, field-listing error.
 
 ### Added — Load-test harness (`@serverless-ircd/load-test`)
 
-PLAN §7 / Phase 7's 10k-connection harness. A synthetic WebSocket IRC
-client farm: opens N connections, registers (NICK/USER), joins a
+The PLAN §7 10k-connection harness. A synthetic WebSocket IRC
+client pool: opens N connections, registers (NICK/USER), joins a
 channel, and optionally chats. Captures **p50 / p95 / p99 latency per
-phase** (connect / register / join / message) plus the **drop rate**,
+stage** (connect / register / join / message) plus the **drop rate**,
 and prints a markdown report to stdout (or `--report <path>`).
 
 ```bash
@@ -467,11 +956,11 @@ resolves it.
   `irc-test-support`) are **above the gate but below 100%** —
   follow-ups drive each to 100%.
 - The IRC services (NickServ / ChanServ / HostServ / OperServ /
-  MemoServ) Phase 13 work is pending; `draft/read-marker` and
+  MemoServ) work is pending; `draft/read-marker` and
   `draft/pre-away` ship with in-memory reference stores, so marker /
   away persistence does not survive an adapter restart until a
   services backend lands.
-- The web client Phase 14 work (vendor Kiwi IRC, serve SPA from the
+- The web client work (vendor Kiwi IRC, serve SPA from the
   Worker, WS Origin allowlist) is pending.
 
 ### Security
@@ -486,8 +975,8 @@ resolves it.
 
 ## [0.5.0] - 2026-08-02
 
-The headline is **protocol completion**: the deferred IRC verbs land
-(Phase 11), and the S2S / obsolete RFC 2812 verbs are **formally
+The main change in this release is **protocol completion**: the deferred IRC verbs land,
+and the S2S / obsolete RFC 2812 verbs are **formally
 dropped** rather than left "deferred". With this release every standard
 IRC verb a modern client expects is implemented — the only remaining
 `421 ERR_UNKNOWNCOMMAND` paths are the deliberately-unimplemented S2S
@@ -497,10 +986,10 @@ client compatibility matrix) and the required-`serverName` config gate.
 
 ### Added — Deferred IRC verbs (`@serverless-ircd/irc-core`, `@serverless-ircd/irc-server`)
 
-Six Phase 11 tickets light up the remaining command surface. Each ships
+Six tickets add the remaining command surface. Each ships
 a pure reducer, an actor route case (no more `421`), new numerics in
 `protocol/numerics.ts`, and unit + actor coverage. (The remaining two
-Phase 11 tickets are drops — see below.)
+tickets are drops — see below.)
 
 - **`KILL`** (oper-gated force-disconnect): `KILL <nick>
   <comment>` resolves the target via the nick registry + a live
@@ -554,7 +1043,7 @@ Phase 11 tickets are drops — see below.)
   channel-scoped). The originator is always excluded (skip-self,
   matching NOTICE/PRIVMSG semantics). Empty message → `461`. The `+w`
   user mode was already accepted by `MODE` and advertised in `004
-  RPL_MYINFO`; this lights up the consumer.
+  RPL_MYINFO`; this enables the consumer.
 - **`SETNAME`** (realname change): `SETNAME :<realname>`
   updates `state.realname` so a subsequent `WHOIS` reflects the new
   value in `311 RPL_WHOISUSER`. No broadcast is emitted in v1 (there
@@ -564,7 +1053,7 @@ Phase 11 tickets are drops — see below.)
 
 ### Changed — S2S & obsolete verbs formally dropped (`@serverless-ircd/irc-core`)
 
-The remaining two Phase 11 tickets convert the "deferred" framing into
+The remaining two tickets convert the "deferred" framing into
 an explicit **drop**. There is no behaviour change on the wire — the verbs
 already returned `421 ERR_UNKNOWNCOMMAND` — but the framing, comments,
 and reserved numerics are cleaned up so the codebase no longer carries
@@ -661,13 +1150,13 @@ dead scaffolding.
 
 ## [0.4.0] - 2026-07-31
 
-The headline is **dual transport**: both adapters now speak a real
+The main change in this release is **dual transport**: both adapters now speak a real
 `irc+tls :6697` (TLS-over-TCP) surface for stock IRC clients in
 production — not just the local CLI — alongside the WebSocket path. This
 lands **SASL `EXTERNAL` via mTLS**, the **remaining standard IRC verbs**
 (WHOWAS, VERSION, TIME, ADMIN, INFO, USERHOST, ISON), a **Cloudflare
 D1-backed SASL account store**, config-driven server identity, and a
-**Node 24 / pnpm 11** toolchain. Phase 7 (TLS hardening & raw TCP) is
+**Node 24 / pnpm 11** toolchain. TLS hardening & raw TCP is
 complete.
 
 ### Added — Dual transport: WebSocket + `irc+tls :6697`
@@ -737,7 +1226,7 @@ pipeline is unchanged.
 
 - The `002` / `003` / `004` registration replies now reflect
   `ServerConfig.serverVersion` / `createdAt` — the hardcoded
-  `'0.1.0'` / `'Phase 1'` placeholders are gone. A build step
+  `'0.1.0'` version / placeholder strings are gone. A build step
   (`scripts/generate-build-info.mjs`) bakes the package version and a
   build timestamp into `RPL_CREATED` (`003`) when the config omits them.
 
@@ -1005,7 +1494,7 @@ AWS are now both deployable.
 ### Added — Shared test harness (`@serverless-ircd/irc-test-support`)
 
 - New workspace package owning the parametrized IRC scenario suite
-  (`runIrcScenarios`, 31 Phase 2 scenarios) and the
+  (`runIrcScenarios`, 31 scenarios) and the
   `IrcHarnessFactory` / `IrcHarness` / `ClientHarness` seam each
   adapter implements. Ships the reference `inMemoryHarnessFactory`.
   cf-adapter and aws-adapter integration tests both consume it, so the
@@ -1036,7 +1525,7 @@ AWS are now both deployable.
   end-to-end rather than advertised-only.
 - The local CLI now binds a **second RFC-style TCP listener** by default
   (`--tcp-port`, default `<port> + 1`) alongside the WebSocket listener,
-  so stock IRC clients can dial in directly without the forwarder.
+  so stock IRC clients can connect directly without the forwarder.
   Pass `--no-tcp` for WebSocket-only. `--motd-file` loads the MOTD from
   disk.