Memory Index#

• leveva services aliases (slice 303) — charybdis alias{} command shortcuts + shared +S service-delivery contract (440/412); IDENTIFY 302 fixed to it; verify charybdis parity against the /tmp checkout

• leveva NO DM history — HARD RULE: user-to-user private messages MUST NOT be stored in the database; chathistory is channel-only; DM follow-on is cancelled not deferred

• leveva chathistory (slice 274) — IRCv3 draft/chathistory: SQLite (rusqlite bundled) message history, optional database{} block, all channels auto-enrolled; store/dynamic-caps/recording-at-delivery-plane/replay-on-join seams; Message gained serde

• leveva D-lines (DLINE/UNDLINE) — slice 284: charybdis IP-level operator bans, IP/CIDR sibling of the K-line family; near-clone keyed on mask; OperPrivilege::Dline; gate before K-line gate; S2S ENCAP * DLINE/burst/SQLite persistence; STATS d; +ServerContext-field-needs-~62-literals note

• leveva channel-mode wiring — checklist for adding a ChanMode + the GOTCHA that the u32 flags bitfield is FULL (slice 308 widened flags/bit()/MemberStatus to u64)

• leveva user-mode wiring — checklist for adding a umode (mode.rs enum/ALL/Display + command::mode self-settable group & umode_diff [PAIRED allowlists; slice-251 +G empty-echo bug] + 2 hardcoded 004 asserts + ~5 snapshots). SLICE 254: SEND_UMODES is now EVERY umode — leveva has NO local-only user modes (nothing to decide, auto-global); standard charybdis umode surface COMPLETE (247 +D/248-249 +R/250 +Q/252 +z/253 +S/254 +l locops+LOCOPS cmd). Enforcement (caller-id/+R accept-list) stays home-server even though bits now propagate

• Unknown chanmode letter is '>' — in leveva tests use ChanMode::try_from('>') for the guaranteed-unknown-mode assertion (charybdis's non-existent example-mode letter); never a real unused letter (a future slice can claim it)

• leveva caller-id (+g/ACCEPT) — slice 216 charybdis caller-id; CallerId store lives in Registry; +g is local-only (not in SEND_UMODES); slice 217 added remote-sender S2S gating (inbound_message runs the gate, 716/717 routed to sender's uplink); slice 218 added +G soft caller-id (co-channel bypass) via pure callerid::blocks + Channels::shares_channel — caller-id track COMPLETE, no deferrals left

• Blog series — docs/blog/ numbered Xe-voice posts about the port; use the xe-writing-style skill, match existing format, which topics are taken

• Rust migration plan — this ircd C codebase is being strangler-fig ported to Rust; locked decisions + phase order + plan-file path

• leveva prod ShadowNET per-server probe — reach one prod server directly via <servername>.alrest.xeserv.us:6667 (irc.xeserv.us load-balances); how to diagnose cross-server desyncs (LINKS/LUSERS/NAMES, bare-UID = slice-162 identity bug)

• Project name: leveva (P10) — the idiomatic-Rust end state ships as "leveva"; rename happens at Phase 10

• ircd migration hazards — verified C-side gotchas (variadics, self-pointers, layout gating, mutable msgtab) that constrain the port

• P0b bindgen constraints — bindgen MUST use -x c + v0.72 or ircd structs go opaque; layout drift-net design (P0b merged)

• P0c L1 harness constraints — ircd-testkit cref* differential harness; link-anchor for integration tests + the cref*-oracle-vs-OBJS split phase 1 must wire (P0c merged)

• P1 leaf-utils port — match.c/dbuf.c/support.c-subset ported to the new ircd-common crate; the CREF/link/support_link.o split mechanism + faithfulness gotchas (P1 merged)

• P2 data-lookup port — patricia/class/whowas/hash/list ported; the m_*-handler partial-port mechanism (whowas_link.o/hash_link.o); verified ENABLE_CIDR_LIMITS-on + MyFree-is-a-macro findings (P2 merged)

• P3 transport-format port — serr replies[]/s_id/s_numeric/send delivery-core ported; sendto* family is irreducibly C trampolines (the keystone variadic finding); send_link.o + replies[]-dumped-from-oracle gotchas (P3 merged)

• P0-L2 golden harness — ircd-golden boots ref-C + Rust ircds, diffs scripted wire output (the P5 gate); clock-pin-to-constant breaks the event loop (use real clock); DNS disabled project-wide via NO_DNS_LOOKUP

• Work on master directly — commit straight to master in this repo; never propose branches/worktrees or ask about branch strategy

• P5 S2S golden harness — ircd-golden Peer/boot_s2s for testing server-reachable handler paths + the determinism findings (sequential UIDs, SID format, standalone-refuses-links)

• Commit one test per commit — each test change gets its own commit explaining why; infra/port fixes committed separately first

• Test fake-lag disabled — golden/L2 tests disable ircd fake-lag via IRCD_TEST_CONFIG (ircd_no_fakelag in s_bsd.c); why scripted multi-command tests need it

• Run only edited tests — don't run the full cargo test suite; run only the test binaries you touched (full suite is slow)

• P5 s2s stats flake — TWO STATS golden tests (golden_s2s_s_serv_stats + golden_s_misc stats_t) fail on clean HEAD via reference-C garbage; not regressions

• s_user_umode_diff broken — FIXED 2026-06-04 (c_char-rot buffers → [0 as c_char; 64]); back in the P5 gate

• support irc_memcmp host-gated — FIXED 2026-06-04: support_diff link-failed (cref_irc_memcmp) because irc_memcmp is gated behind MEMCMP_BROKEN (off on aarch64); gated the L1 case on a have_cref_irc_memcmp cfg

• PLAN.md rows stay thin — never accumulate per-sub-phase detail in PLAN.md table rows; put it in PLAN-P-progress.md + docs/progress-log/

• L1 cref static-symbol limit — static C fns have no cref_ oracle symbol → can't be L1-diffed; also every L1 test needs link_reference_archives()

• P-IAUTH state — P5+P6 done; iauth-rs all 5 modules + handshake differential done; what's left; the relink/fd-0-socketpair differential-gate mechanism + C iauth.conf gotchas

• P7 complete — P7 (I/O core + event loop + glue) DONE 2026-06-07 (P7oo ported c_ircd_main, the last C logic); all C logic now Rust, only data globals + ~25 variadic trampolines remain; next = P8 (delete C + retire oracle)

• P8 COMPLETE — P8 DONE 2026-06-08 (P8u final): workspace is 100% Rust, zero C TUs compiled. Deleted the last C (variadic trampolines P8a–P8m; data globals P8n–P8r; version.c P8t), migrated all 115 L1 diffs to ircd-common insta snapshots (P8s), then P8u dropped ALL C compilation from ircd-sys/build.rs (make/cref_/ctruth.o/libircd_c.a/whole-archive + -lz -lm -lcrypt — none needed) keeping only configure+bindgen-over-headers+install-path-vars, and mothballed the oracle (ircd-testkit/ircd-golden excluded from workspace; ctruth.c/layout.rs deleted). Final differential run green. Gate: cargo test --workspace 698 pass/0 fail/125 binaries, 0 warnings. Next = leveva (P9 RETIRED — see leveva-pivot-p9-retired).

• Roadmap pivot: P9 retired, leveva is the destination — 2026-06-08 in-place cleanup dropped; ircd-common = oracle for greenfield leveva, deleted at parity; reframed P9–P12; next = leveva connection/registration state machine

• P12 COMPLETE — strangler finished — P12 DONE 2026-06-13: mechanical port + oracle + deployment rigging deleted; workspace is now leveva + leveva-iauth ONLY; the migration is finished. No more differential testing — future leveva work is standalone feature work, not migration slices.

• ircd-common snapshot tests — the L1 tests are now insta snapshot characterization tests in ircd-common/tests/*_snap.rs (no cref oracle); link_anchor + determinism rules for adding/editing them

• P7 L1 shared-global race — P7 L1 tests touching me/cref_me/local[]/highest_fd must serialize on a mutex (cargo runs #[test]s in parallel)

• SUMMON/utmp not required — summon + utmp_open/read/close in s_bsd.c are config-gated off (ENABLE_SUMMON/USERS_SHOWS_UTMP undef) → not compiled, nothing to port

• Boot-level golden harness — self-contained end-to-end net in ircd-rs/tests/ (boots real ircd, insta-snapshots wire output); the IRCD_TEST_CONFIG seam; replaces the deleted C-oracle ircd-golden

• leveva command/ folder — leveva post-registration handlers are one-per-file in leveva/src/command/; how to add a new client handler slice; S2S handlers get their own modtree (deferred)

• s_conf oline snap flake — ircd-common oline snapshots race under parallel --workspace load; re-run the binary alone, not a regression

• Help files per command — leveva HELP serves embedded leveva/help/.md pages (rust-embed); adding a command requires adding its help page (test-enforced both directions)

• CLOSE not required (leveva) — user ruled CLOSE out of scope for leveva (P11); OperPrivilege::Close stays dormant, don't build it

• leveva S2S port-based routing — leveva routes client/server by the listener's server-only flag, not the handshake; a server must link on a server-only port (deliberate, don't change)

• SERVICE NEVER implemented (leveva) — HARD RULE: never plan/scope/build SERVICE/SQUERY/SERVLIST in leveva; let them fall through to 421; like CLOSE, permanently out of scope

• SET not required (leveva) — user ruled SET (m_set runtime tunables) out of scope for leveva (P11); OperPrivilege::Set stays dormant, don't build it

• leveva S2S + auth complete; parity matrix started — S2S + auth + full client surface done; parity matrix toward P12 UNDERWAY: slice 45 (channel-lifecycle inverses) DONE; next matrix area = ask user (registration / WHO-WHOIS / STATS-completion / burst-netsplit)

• iauth subsumed into leveva — P11 slice 39+: iauth becomes a native async leveva-iauth subcrate (no child process/pipe); hickory-dns for DNS; the sync-feed/async-ident registration seam + username ~ rule

• leveva prometheus metrics — P11 slice 42: server counters are a prometheus Registry in leveva/src/metrics.rs, per-ServerContext NOT the global default (test isolation, deliberate); STATS m/z read it

• leveva IRCv3 track — P11 slice 48 opened an IRCv3 track: CAP negotiation framework in cap.rs; the framework-vs-behavior scope rule (each behavior cap is its own later slice, added to SUPPORTED); leveva-native = no differential

• leveva message-tags seams — the code map for the message-tags delivery plane (TAGMSG/client-only tag relay/417, slice 58 done); the ClientRecord.caps gate + the thin-follow-on attach pattern

• leveva slice recording + TDD discipline — how to record a P11 slice (plan file + p11.md heredoc append + PLAN.md row bump); write failing test FIRST + always test inverse invariants

• ircd-common native boot + testing plan — ircd-common/src/boot.rs: clap entrypoint (run()) + embedded in-process boot() (Server handle, stop flag) so the oracle daemon links into a test binary natively; c_ircd_main left untouched; the standing leveva testing plan + P11 verdict location

• leveva channel-mode rework (slice 77) — ripped out channel +a/+r, kept +R/auto-reop, repurposed +O from uniqop to oper-only-join (520); don't re-add the dead modes or confuse +O with the NJOIN @@ uniqop decode

• leveva S2S introduce fix + leak audit (slice 86) — post-link UNICK introduction was missing (burst-only) → raw-UID JOIN/PRIVMSG + dropped-from-NAMES; the relay burst-vs-live asymmetry rule; real-RSS leak audit method + finding (no unbounded leak; half-open reap is 180s at default ping-freq)

• leveva native oracle harness (slices 92–102) — in-process ircd-common oracle in leveva-integration for live command-skeleton differentials; the oracle_lock/read_until rules; slices 96–99 closed JOIN 0 / WHOIS 317 / MODE +l / 253; 100–101 lookup+server-info; 102 = S2S burst+netsplit verb-skeleton diff (2nd link-accepting Prot::Off oracle + leveva subprocess + verb_skeleton extractor); THE STANDING RULE: oracle-supports-but-leveva-doesn't = bug, close don't document

• hunt_server proptest hazard — VERSION/TIME/ADMIN/INFO/USERS/MOTD/STATS/LINKS/TRACE 402 on an unknown hunt ; proptests feeding arbitrary args to them must model matches(target,SERVER)→local-else-402 or they fail stochastically (slice 113 fixed five stale ones)

• leveva UTF-8-only parse boundary — UTF-8-only enforced at Message::parse_bytes (the single byte→Message gate), not the framing layer; never add a lossy client byte path (P11 slice 120)

• leveva LINELEN=2048 graphemes — non-tag lines up to 2048 graphemes (not 512 bytes); cap lives in to_wire, framer ceiling = tags+LINELEN*64, chunkers/S2S stay byte-conservative (P11 slice 121)

• leveva S2S notify propagation — the P11 area closing IRCv3 "single-server-local" divergences; AWAY (122)+INVITE (123)+MONITOR-live (124)+REDACT (125)+capability-foundation (126)+REDACT→ENCAP (127)+msgid (130)+server-time (134)+bot/oper (135)+account (156) done; 128/129 went elsewhere; area COMPLETE + late addenda: 177 = METADATA SET/CLEAR propagation (ENCAP * METADATA, modelled on SU; new s2s/metadata.rs); 178-180 WALLOPS/KILL/metrics; 182 SANICK + 183 SAJOIN/SAPART S2S (SA* oper-override family now S2S-complete — ENCAP * SA* to the home server, its local force machinery's relay propagates)

• leveva outgoing auto-connect — P11 slice 128: the try_connections counterpart; pure autoconnect::AutoConnect::due (master + autoconnect + connect-freq cooldown ladder) + main.rs ticker reusing the CONNECT outbound-link plane

• leveva S2S peer caps — S2S capability negotiation (slice 126): the CAPAB-via-ENCAP burst verb + egress tag-filter; how to gate any IRCv3 tag per-peer; bare-unknown-verb-SQUITs-the-oracle lesson (extension verbs MUST ride ENCAP)

• leveva live-join NJOIN — P11 slice 129: live joins propagate as :<sid> NJOIN (op in member token), NOT :<uid> JOIN (the oracle drops bare server JOIN); inbound handle_njoin is burst-vs-live aware; fixed UIDs-not-nicks + chanop-not-synced interop bug; msgid follow-on now slice 130

• leveva msgid S2S propagation — P11 slice 130: the message-ids @msgid server tag is network-stable (introducing server mints, relay carries it through + never re-mints), gated on slice-126 CAPAB egress; see the s2s-notify-propagation memory

• leveva netburst joins broadcast to clients — FIX 2026-06-13: handle_njoin now fans JOIN+MODE to local members during the BURST too (newly-added only), not just live — a healed split shows the netjoin flood instead of silent merge

• leveva channel-merge works — split-then-merge of two independent same-name channels preserves both members + op on HEAD; couldn't repro "remote member missing" post-129; two-node port-lock is process-local (use unique ports per test binary)

• leveva LINK_VERSION 021- staleness — recurring pre-existing red: PASS-greeting tests/snapshots go stale vs server::LINK_VERSION (021- prefix); fix as a separate prep commit, git-stash to confirm pre-existing

• leveva S2S handshake diagnostics — read_link_handshake now surfaces a peer's ERROR refusal + EOF/port hints + a 30s idle timeout (was a blind "did not complete"); a connect{} to a client port like 6667 is the classic cause

• leveva TS + link fixes (slices 131-133) — connect-dedup (LinkingSet, no re-dial mid-handshake glare) + server-intro broadcast (announce_linked_peer to siblings); channel-ts/user-ts CAPAB tokens carry timestamps as ENCAP-wrapped unix-NANOSECONDS, oldest wins (deop younger chanops / evict younger nick to its UID); the USERTS-before-UNICK buffering + the cross-task Envelope::ForceNick primitive

• leveva elemental channel modes (slice 158) — leveva-native owner/admin/halfop ~&@%+/qaohv; the rank hierarchy (threshold/min-rank/protection) + MemberStatus-is-a-bitmask shape; creator stays op (no ChanServ)

• leveva extbans (slice 164) — charybdis-style $a/$o/$z/$r/$x/$s/$c/$j/$m extbans in leveva/src/extban/; the framework seam, JOIN + speech-plane enforcement (slice 214 added the PRIVMSG ban mute via CanSend::Banned), LiveChannels ChannelView, add-time validity (172); no +q quiet list (q=owner)

• leveva OJOIN official-join — P11 slice 165: InspIRCd-style +Y membership mode (sigil !, rank 128); OJOIN grants +Yo, absolute kick-immunity, self-removal-only; extends [[leveva-elemental-channel-modes]]

• TS6 reop MUST wipe — HARD RULE: on a CHANTS merge loss the loser's +R reop list is wiped with +b/+e/+I; never defer/exclude reop lists (overrules slice-171's union divergence); fire reop at EOB after winner's +R adopted

• leveva REHASH matrix — what hot-reloads on REHASH (opers/classes/allows/MOTD/admin/connect/listeners/default-user+channel-modes/flood-kill-ahead/auto-connect/connection-accept+split-min/max-penalty/knock-delay+knock-delay-channel); the live-or-ctx ConfStore idiom + how to add a new reloadable block; as of slice 210 NO throttle threshold or options field remains boot-immutable

• leveva S2S TLS links — S2S links run over TLS both directions (inbound server-only TLS listener + outbound connect{} tls flag → tls::connect_outbound); accept-any cert, auth by PASS not PKI; the boot_two_configs runtime-config test seam (P11 slice 176)

• leveva SASL chunking proptest flake — RESOLVED (slice 181): the bare-+ data chunk colliding with the IRCv3 empty-payload sentinel; unrepresentable by design (don't try to "fix" the chunker) — closed via contract docs + base64-domain fuzz + a precise-boundary proptest

• leveva slices 178-180 (WALLOPS/KILL/metrics S2S) — 2026-06-15 ultracode workflow closed three more single-server-local gaps: WALLOPS + KILL S2S propagation (first-class verbs, away.rs model) + S2S server-link traffic metrics; recorded in the s2s-notify-propagation memory's "Slices 178-180" section

• leveva server notices (+s) — slice 184: re-introduced the +s (FLAGS_SERVNOTICE) umode + snotice::server_notice fan (oper-gated, local-only/excluded-from-SEND_UMODES); wired KILL+REHASH; the inbound-S2S-KILL + SA* notices are documented follow-ons

• leveva config ban (K-line) enforcement — slice 191: config.bans was parsed-but-silently-dead; now enforced at registration via kline::config_ban_match (host + optional gecos/realname), gated by kline_exempt, hot-reloaded by REHASH; why no-resolve/xline-exempt stay deferred by design (leveva is IP-only; gecos'd ban subsumes X-lines)

• leveva +r restricted enforcement — slices 193–196: the +r (IRCnet FLAGS_RESTRICT) connection is enforced (was set-but-cosmetic) — a restricted user can become neither IRC operator (OPER→484) nor channel operator (no creator-op; 194: no third-party MODE +o, halfop+, voice OK; 195: never auto-reopped by ANY trigger via the enforce_reop chokepoint) and cannot change nick (196: NICK→484, RFC 2812 §3.1.7, family complete); mode::is_restricted seam

• leveva KNOCK (slices 198–200, 209) — leveva-native charybdis-style KNOCK to a +i/+k/+l channel (710/711); shares the JOIN check_join gate; S2S propagation done (199, ENCAP * KNOCK); per-channel 712 flood throttle done (200, knock_throttle::KnockThrottle, local-path only); per-user throttle done (209, knock_delay 300s, second knock_user_throttle keyed by UID, cooling/arm peek-then-arm split); family complete; 210 = both knock_delay/knock_delay_channel are now REHASH-able options { knock-delay / knock-delay-channel } knobs (0 disables)

• leveva flood penalty (slices 201–208, COMPLETE) — command-rate flood protection (the IRCnet "fakelag" penalty clock), deferred since the start; flood::FloodClock (idle-decay, Excess Flood kill), armed by the serve loop NOT Session::new (heartbeat opt-in precedent — synthetic-burst tests don't trip it unless they call enable_flood_protection()); lit up the dead can-flood/no-penalty privileges; 202 = per-command cost table (command_penalty: PONG exempt, WHO/LIST/etc +4, JOIN/KNOCK/INVITE +2); 203 = pre-registration guard (charge the same clock in the Registering phase too, after QUIT/before CAP); 204 = options { flood-kill-ahead N } config knob (REHASH-reloadable via ConfStore, parser rejects 0, NO ServerContext field — flood is serve-loop-armed); 208 = the fakelag delay/smoothing half (MAX_PENALTY=10 const; serve loop sleep_until-parks the read arm when the clock is past the threshold, output arms stay live; delay_secs/flood_delay_secs, charge unchanged) — family now COMPLETE; 210 = MAX_PENALTY is now a REHASH-able options { max-penalty } knob (default 10, 0=aggressive smoothing) — no flood threshold remains a const

• leveva +C no-CTCP + flag-mode wiring — slice 220 +C (charybdis MODE_NOCTCP, PRIVMSG-only, distributed enforcement); THE GOTCHA: adding a channel flag mode needs BOTH ChanMode (mode.rs) AND command::mode::supported_flag (the second allowlist) or the MODE command 472s; channel::is_blocked_ctcp + Channels::blocks_ctcp seam; family extended with +T no-NOTICE (239) and +g free-invite (240, charybdis MODE_FREEINVITE — any member may INVITE; gate channel::free_invite_allows in Channels::invite; g is the channel letter, disjoint from user-mode +g CallerId) and +r registered-only join (241, charybdis MODE_REGONLY — hard JOIN gate via channel::regonly_blocks in check_join, 477 reusing ErrNochanmodes; reclaiming the ripped-out reop letter r hit the unknown-chanmode-letter-is-gt hazard); slice 242 +f channel forwarding (charybdis MODE_FORWARD — 2nd param mode after +j; forwardable JOIN reject → 470 single-hop redirect; seams channel::forwardable/valid_forward_target; bit 0x10000 low gap; live-MODE replicates but NOT bursted); slice 243 +Q/+F forward-target control (charybdis MODE_DISFORWARD/MODE_FREETARGET — flag bits 0x1000/0x2000; +F lifts the op-on-target +f set-gate slice 242 deferred → 482/403, +Q refuses incoming forwards; seam channel::forward_set_verdict; +f forwarding family COMPLETE, no follow-ons); slice 244 +P permanent channel (charybdis MODE_PERMANENT/chm_staff — first oper-only chan mode + first lifecycle mode; +P channel survives empty; oper-gate channel::permanent_set_allowed → 481 before 482; lifecycle seam channel::destroy_when_empty at part/kick/remove_everywhere; the creator-op fix = join keys op on created not members.is_empty(); bit 0x80000); slice 245 +L large ban list (charybdis MODE_EXLIMIT/chm_staff — the LAST missing standard charybdis chan mode, now COMPLETE; 2nd oper-only flag, bit 0x1 the last free u32 bit; raises the +b/+e/+I per-list cap 100→500 via seams channel::list_limit/list_is_full/is_ban_family, +R uncapped; full list → 478; generalized the oper-gate via ChanMode::is_oper_only; ApplyOutcome::Applied gained a full field; S2S burst NOT capped); slice 246 promoted those caps to REHASH-able options { max-bans / max-bans-large } knobs (the const→knob trajectory MAX_PENALTY took 208→210): list_limit/list_is_full now take caller-supplied caps, apply_changes reads control::live_max_bans().unwrap_or(MAX_LIST_DEFAULT) (+large) so unseeded store=tests fall back to the 100/500 consts; full Options/parser/ConfBlocks/ConfStore/main/example+dist-kdl plumbing; 0 legal (no entries), caps parsed independently (inversion = admin footgun); golden_maxbans_config proves config→live→enforcement end-to-end)

• golden read_until timeout flake — FIXED — FIXED 2026-06-17 (commit 7718cdc1): read_until now waits to a 30s overall deadline instead of bailing on the first per-read timeout, so the load-induced partial-buffer "no NNN" panic is gone; a load read_until panic now means a real bug, not this flake (deterministic fakelag-parking failures were separate, fixed slice 238)

• leveva stale deferral comments — many "out of scope"/"deferred" doc comments in leveva src are STALE (feature landed in a later slice, comment never updated); verify against code first — confirmed stale: connlimit max_global_* (done slice 150), kill inbound-S2S notice (185), wss +Z (213+227); slice 229 closed metadata SYNC (774 ruled a deliberate divergence) → the draft/metadata-2 track is now COMPLETE, no metadata follow-ons remain

• leveva +z op-moderation — +z (charybdis MODE_OPMODERATE): a +n/+m/+b-blocked message on a +z channel redirects to ops not 404; slices 235 (PRIVMSG/NOTICE local), 236 (TAGMSG/REDACT local), 237 (PRIVMSG/NOTICE S2S via the @<chan> statusmsg op-redirect seam), 238 (TAGMSG/REDACT S2S on that same seam) — track COMPLETE, no follow-on

• leveva teardown atomic-claim — HARD INVARIANT: S2S casualty sweeps must claim-then-relay atomically or concurrent teardowns double-deliver QUITs; slice 277 added Channels::detach_member (mirror path already gated by remove_behind_sid); netsplit-batch-dup fix + s2s_netsplit_concurrency_proptest

• leveva proptest model staleness — STATS-selector / flood-penalty proptests re-encode command tables; a slice that grows a table must update the model or it flakes on random seeds (run FULL suite)