fix: correct CHANMODES ISUPPORT classification and deduplicate MintChannelHashcash

- Move H from Type B to Type C in CHANMODES ISUPPORT string (H takes a parameter only when set, not when unset) - Refactor MintChannelHashcash to delegate to hashcash.BodyHash() and hashcash.MintChannelStamp() instead of reimplementing them
feat: per-channel hashcash proof-of-work for PRIVMSG anti-spam
2026-03-17 02:52:09 -07:00 · 2026-03-17 02:37:14 -07:00
20 changed files with 1458 additions and 1244 deletions
--- a/README.md
+++ b/README.md
@@ -113,9 +113,8 @@ mechanisms or stuffing data into CTCP.
 Everything else is IRC. `PRIVMSG`, `JOIN`, `PART`, `NICK`, `TOPIC`, `MODE`,
 `KICK`, `353`, `433` — same commands, same semantics. Channels start with `#`.
 Joining a nonexistent channel creates it. Channels disappear when empty. Nicks
-are unique per server. Identity starts with a key — a nick is a display name.
+are unique per server. There are no accounts — identity is a key, a nick is a
-Accounts are optional: you can create an anonymous session instantly, or
+display name.
 register with a password for multi-client access to a single session.
 ### On the resemblance to JSON-RPC
@@ -149,45 +148,16 @@ not arbitrary choices — each one follows from the project's core thesis that
 IRC's command model is correct and only the transport and session management
 need to change.
-### Identity & Sessions — Dual Authentication Model
+### Identity & Sessions — No Accounts
-The server supports two authentication paths: **anonymous sessions** for
+There are no accounts, no registration, no passwords. Identity is a signing
-instant access, and **optional account registration** for multi-client access.
+key; a nick is just a display name. The two are decoupled.
 #### Anonymous Sessions (No Account Required)
 The simplest entry point. No registration, no passwords.
 - **Session creation**: client sends `POST /api/v1/session` with a desired
  nick → server assigns an **auth token** (64 hex characters of
  cryptographically random bytes) and returns the user ID, nick, and token.
 - The auth token implicitly identifies the client. Clients present it via
  `Authorization: Bearer <token>`.
 - Anonymous sessions are ephemeral — when the session expires or the user
  QUITs, the nick is released and there is no way to reclaim it.
 #### Registered Accounts (Optional)
 For users who want multi-client access (multiple devices sharing one session):
 - **Registration**: client sends `POST /api/v1/register` with a nick and
  password (minimum 8 characters) → server creates a session with the
  password hashed via bcrypt, and returns the user ID, nick, and auth token.
 - **Login**: client sends `POST /api/v1/login` with nick and password →
  server verifies the password against the stored bcrypt hash and creates a
  new client token for the existing session. This enables multi-client
  access: logging in from a new device adds a client to the existing session
  rather than creating a new one, so channel memberships and message queues
  are shared. Note: login only works while the session still exists — if all
  clients have logged out or the user has sent QUIT, the session is deleted
  and the registration is lost.
 - Registered accounts cannot be logged into via `POST /api/v1/session` —
  that endpoint is for anonymous sessions only.
 - Anonymous sessions (created via `/session`) cannot be logged into via
  `/login` because they have no password set.
 #### Common Properties (Both Paths)
 - Nicks are changeable via the `NICK` command; the server-assigned user ID is
  the stable identity.
 - Server-assigned IDs — clients do not choose their own IDs.
@@ -195,17 +165,11 @@ For users who want multi-client access (multiple devices sharing one session):
  in the token, no client-side decode. The server is the sole authority on
  token validity.
-**Rationale:** IRC has no accounts. You connect, pick a nick, and talk.
+**Rationale:** IRC has no accounts. You connect, pick a nick, and talk. Adding
-Anonymous sessions preserve that simplicity — instant access, zero friction.
+registration, email verification, or OAuth would solve a problem nobody asked
-But some users want to access the same session from multiple devices without
+about and add complexity that drives away casual users. Identity verification
-a bouncer. Optional registration with password enables multi-client login
+is handled at the message layer via cryptographic signatures (see
-without adding friction for casual users: if you don't want an account,
+[Security Model](#security-model)), not at the session layer.
 don't create one. Note: in the current implementation, both anonymous and
 registered sessions are deleted when the last client disconnects (QUIT or
 logout); registration does not make a session survive all-client
 removal. Identity verification at the message layer via cryptographic
 signatures (see [Security Model](#security-model)) remains independent
 of account registration.
 ### Nick Semantics
@@ -243,12 +207,12 @@ User Session
 └── Client C (token_c, queue_c)
 ```
-**Multi-client via login:** The `POST /api/v1/login` endpoint adds a new
+**Current MVP note:** The current implementation creates a new user (with new
-client to an existing registered session, enabling true multi-client support
+nick) per `POST /api/v1/session` call. True multi-client (multiple tokens
-(multiple tokens sharing one nick/session with independent message queues).
+sharing one nick/session) is supported by the schema (`client_queues` is keyed
-Anonymous sessions created via `POST /api/v1/session` always create a new
+by user_id, and multiple tokens can point to the same user) but the session
-user with a new nick. A future endpoint to "add a client to an existing
+creation endpoint does not yet support "add a client to an existing session."
-anonymous session" is planned but not yet implemented.
+This will be added post-MVP.
 **Rationale:** The fundamental IRC mobile problem is that you can't have your
 phone and laptop connected simultaneously without a bouncer. Server-side
@@ -363,8 +327,8 @@ needs to revoke a token, change the expiry model, or add/remove claims, JWT
 clients may break or behave incorrectly.
 Opaque tokens are simpler:
- Server generates 32 random bytes → hex-encodes → stores SHA-256 hash
+- Server generates 32 random bytes → hex-encodes → stores hash
- Client presents the raw token; server hashes and looks it up
+- Client presents the token; server looks it up
 - Revocation is a database delete
 - No clock skew issues, no algorithm confusion, no "none" algorithm attacks
 - Token format can change without breaking clients
@@ -391,8 +355,6 @@ The entire read/write loop for a client is two endpoints. Everything else
 ### Session Lifecycle
 #### Anonymous Session
 ```
 ┌─ Client ──────────────────────────────────────────────────┐
 │                                                            │
@@ -423,30 +385,6 @@ The entire read/write loop for a client is two endpoints. Everything else
 └────────────────────────────────────────────────────────────┘
 ```
 #### Registered Account
 ```
 ┌─ Client ──────────────────────────────────────────────────┐
 │                                                            │
 │  1. POST /api/v1/register                                  │
 │     {"nick":"alice", "password":"s3cret!!"}                │
 │     → {"id":1, "nick":"alice", "token":"a1b2c3..."}       │
 │     (Session created with bcrypt-hashed password)          │
 │                                                            │
 │  ... use the API normally (JOIN, PRIVMSG, poll, etc.) ...  │
 │                                                            │
 │  (From another device, while session is still active)      │
 │                                                            │
 │  2. POST /api/v1/login                                     │
 │     {"nick":"alice", "password":"s3cret!!"}                │
 │     → {"id":1, "nick":"alice", "token":"d4e5f6..."}       │
 │     (New client added to existing session — channels       │
 │      and message queues are preserved. If all clients      │
 │      have logged out, session no longer exists.)           │
 │                                                            │
 └────────────────────────────────────────────────────────────┘
 ```
 ### Queue Architecture
 ```
@@ -523,7 +461,7 @@ the same JSON envelope:
 | `params`  | array of strings    | Sometimes | Sometimes | Additional IRC-style positional parameters. Used by commands like `MODE`, `KICK`, and numeric replies like `353` (NAMES). |
 | `body`    | array or object     | Usually   | Usually   | Structured message body. For text messages: array of strings (one per line). For structured data (e.g., `PUBKEY`): JSON object. **Never a raw string.** |
 | `ts`      | string (ISO 8601)   | Ignored   | Always    | Server-assigned timestamp in RFC 3339 / ISO 8601 format with nanosecond precision. Example: `"2026-02-10T20:00:00.000000000Z"`. Always UTC. |
-| `meta`    | object              | Optional  | If present | Extensible metadata. Used for cryptographic signatures (`meta.sig`, `meta.alg`), content hashes, or any client-defined key/value pairs. Server relays `meta` verbatim — it does not interpret or validate it. |
+| `meta`    | object              | Optional  | If present | Extensible metadata. Used for cryptographic signatures (`meta.sig`, `meta.alg`), hashcash proof-of-work (`meta.hashcash`), content hashes, or any client-defined key/value pairs. Server relays `meta` verbatim except for `hashcash` which is validated on channels with `+H` mode. |
 **Important invariants:**
@@ -1012,13 +950,14 @@ carries IRC-style parameters (e.g., channel name, target nick).
 Inspired by IRC, simplified:
-| Mode | Name         | Meaning |
+| Mode | Name           | Meaning |
-|------|--------------|---------|
+|------|----------------|---------|
-| `+i` | Invite-only  | Only invited users can join |
+| `+i` | Invite-only    | Only invited users can join |
-| `+m` | Moderated    | Only voiced (`+v`) users and operators (`+o`) can send |
+| `+m` | Moderated      | Only voiced (`+v`) users and operators (`+o`) can send |
-| `+s` | Secret       | Channel hidden from LIST response |
+| `+s` | Secret         | Channel hidden from LIST response |
-| `+t` | Topic lock   | Only operators can change the topic |
+| `+t` | Topic lock     | Only operators can change the topic |
-| `+n` | No external  | Only channel members can send messages to the channel |
+| `+n` | No external    | Only channel members can send messages to the channel |
 | `+H` | Hashcash       | Requires proof-of-work for PRIVMSG (parameter: bits, e.g. `+H 20`) |
 **User channel modes (set per-user per-channel):**
@@ -1029,6 +968,56 @@ Inspired by IRC, simplified:
 **Status:** Channel modes are defined but not yet enforced. The `modes` column
 exists in the channels table but the server does not check modes on actions.
 Exception: `+H` (hashcash) is fully enforced — see below.
 ### Per-Channel Hashcash (Anti-Spam)
 Channels can require hashcash proof-of-work for every `PRIVMSG`. This is an
 anti-spam mechanism: channel operators set a difficulty level, and clients must
 compute a proof-of-work stamp bound to the specific channel and message before
 sending.
 **Setting the requirement:**
 ```
 MODE #channel +H <bits>    — require <bits> leading zero bits (1-40)
 MODE #channel -H           — disable hashcash requirement
 ```
 **Stamp format:** `1:bits:YYMMDD:channel:bodyhash:counter`
 - `bits` — difficulty (leading zero bits in SHA-256 hash of the stamp)
 - `YYMMDD` — current date (prevents old token reuse)
 - `channel` — channel name (prevents cross-channel reuse)
 - `bodyhash` — hex-encoded SHA-256 of the message body (binds stamp to message)
 - `counter` — hex nonce
 **Sending a message to a hashcash-protected channel:**
 Include the hashcash stamp in the `meta` field:
 ```json
 {
  "command": "PRIVMSG",
  "to": "#general",
  "body": ["hello world"],
  "meta": {
    "hashcash": "1:20:260317:#general:a1b2c3...bodyhash:1f4a"
  }
 }
 ```
 **Server validation:** The server checks that the stamp is well-formed, meets
 the required difficulty, is bound to the correct channel and message body, has a
 recent date, and has not been previously used. Spent stamps are cached for 1
 year to prevent replay attacks.
 **Error responses:** If the channel requires hashcash and the stamp is missing,
 invalid, or replayed, the server returns `ERR_CANNOTSENDTOCHAN (404)` with a
 descriptive reason.
 **Client minting:** The CLI provides `MintChannelHashcash(bits, channel, body)`
 to compute stamps. Higher bit counts take exponentially longer to compute.
 ---
@@ -1096,105 +1085,6 @@ TOKEN=$(curl -s -X POST http://localhost:8080/api/v1/session \
 echo $TOKEN
 ```
 ### POST /api/v1/register — Register Account
 Create a new user session with a password. The password is hashed
 with bcrypt and stored server-side. The password enables login from
 additional clients via `POST /api/v1/login` while the session
 remains active.
 **Request Body:**
 ```json
 {"nick": "alice", "password": "mypassword"}
 ```
 | Field      | Type   | Required | Constraints |
 |------------|--------|----------|-------------|
 | `nick`     | string | Yes      | 1–32 characters, must be unique on the server |
 | `password` | string | Yes      | Minimum 8 characters |
 **Response:** `201 Created`
 ```json
 {
  "id": 1,
  "nick": "alice",
  "token": "494ba9fc0f2242873fc5c285dd4a24fc3844ba5e67789a17e69b6fe5f8c132e3"
 }
 ```
 | Field   | Type    | Description |
 |---------|---------|-------------|
 | `id`    | integer | Server-assigned user ID |
 | `nick`  | string  | Confirmed nick |
 | `token` | string  | 64-character hex auth token |
 **Errors:**
 | Status | Error | When |
 |--------|-------|------|
 | 400    | `invalid nick format` | Nick doesn't match allowed format |
 | 400    | `password must be at least 8 characters` | Password too short |
 | 409    | `nick already taken` | Another active session holds this nick |
 **curl example:**
 ```bash
 TOKEN=$(curl -s -X POST http://localhost:8080/api/v1/register \
  -H 'Content-Type: application/json' \
  -d '{"nick":"alice","password":"mypassword"}' | jq -r .token)
 echo $TOKEN
 ```
 ### POST /api/v1/login — Login to Account
 Authenticate with a previously registered nick and password. Creates a new
 client token for the existing session, preserving channel memberships and
 message queues. This is how multi-client access works for registered accounts:
 each login adds a new client to the session.
 On successful login, the server enqueues MOTD messages and synthetic channel
 state (JOIN + TOPIC + NAMES for each channel the session belongs to) into the
 new client's queue, so the client can immediately restore its UI state.
 **Request Body:**
 ```json
 {"nick": "alice", "password": "mypassword"}
 ```
 | Field      | Type   | Required | Constraints |
 |------------|--------|----------|-------------|
 | `nick`     | string | Yes      | Must match a registered account |
 | `password` | string | Yes      | Must match the account's password |
 **Response:** `200 OK`
 ```json
 {
  "id": 1,
  "nick": "alice",
  "token": "7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f"
 }
 ```
 | Field   | Type    | Description |
 |---------|---------|-------------|
 | `id`    | integer | Session ID (same as when registered) |
 | `nick`  | string  | Current nick |
 | `token` | string  | New 64-character hex auth token for this client |
 **Errors:**
 | Status | Error | When |
 |--------|-------|------|
 | 400    | `nick and password required` | Missing nick or password |
 | 401    | `invalid credentials` | Wrong password, nick not found, or account has no password |
 **curl example:**
 ```bash
 TOKEN=$(curl -s -X POST http://localhost:8080/api/v1/login \
  -H 'Content-Type: application/json' \
  -d '{"nick":"alice","password":"mypassword"}' | jq -r .token)
 echo $TOKEN
 ```
 ### GET /api/v1/state — Get Session State
 Return the current user's session state.
@@ -1560,40 +1450,13 @@ Return server metadata. No authentication required.
 ### GET /.well-known/healthcheck.json — Health Check
-Standard health check endpoint. No authentication required. Returns server
+Standard health check endpoint. No authentication required.
 health status and runtime statistics.
 **Response:** `200 OK`
 ```json
-{
+{"status": "ok"}
  "status": "ok",
  "now": "2024-01-15T12:00:00.000000000Z",
  "uptimeSeconds": 3600,
  "uptimeHuman": "1h0m0s",
  "version": "0.1.0",
  "appname": "neoirc",
  "maintenanceMode": false,
  "sessions": 42,
  "clients": 85,
  "queuedLines": 128,
  "channels": 7,
  "connectionsSinceBoot": 200,
  "sessionsSinceBoot": 150,
  "messagesSinceBoot": 5000
 }
 ```
 | Field                  | Description                                       |
 | ---------------------- | ------------------------------------------------- |
 | `sessions`             | Current number of active sessions                 |
 | `clients`              | Current number of connected clients               |
 | `queuedLines`          | Total entries in client output queues              |
 | `channels`             | Current number of channels                        |
 | `connectionsSinceBoot` | Total client connections since server start        |
 | `sessionsSinceBoot`    | Total sessions created since server start          |
 | `messagesSinceBoot`    | Total PRIVMSG/NOTICE messages sent since server start |
 ---
 ## Message Flow
@@ -1778,16 +1641,9 @@ authenticity.
 ### Authentication
 - **Session auth**: Opaque bearer tokens (64 hex chars = 256 bits of entropy).
-  Tokens are hashed (SHA-256) before storage and validated on every request.
+  Tokens are stored in the database and validated on every request.
- **Anonymous sessions**: `POST /api/v1/session` requires only a nick. No
+- **No passwords**: Session creation requires only a nick. The token is the
-  password, instant access. The token is the sole credential.
+  sole credential.
 - **Registered accounts**: `POST /api/v1/register` accepts a nick and password
  (minimum 8 characters). The password is hashed with bcrypt at the default
  cost factor and stored alongside the session. `POST /api/v1/login`
  authenticates against the stored hash and issues a new client token.
 - **Password security**: Passwords are never stored in plain text. bcrypt
  handles salting and key stretching automatically. Anonymous sessions have
  an empty `password_hash` and cannot be logged into via `/login`.
 - **Token security**: Tokens should be treated like session cookies. Transmit
  only over HTTPS in production. If a token is compromised, the attacker has
  full access to the session until QUIT or expiry.
@@ -1935,26 +1791,13 @@ The database schema is managed via embedded SQL migration files in
 **Current tables:**
-#### `sessions`
+#### `users`
 | Column         | Type     | Description |
 |----------------|----------|-------------|
 | `id`           | INTEGER  | Primary key (auto-increment) |
 | `uuid`         | TEXT     | Unique session UUID |
 | `nick`         | TEXT     | Unique nick |
 | `password_hash`| TEXT     | bcrypt hash (empty string for anonymous sessions) |
 | `signing_key`  | TEXT     | Public signing key (empty string if unset) |
 | `away_message` | TEXT     | Away message (empty string if not away) |
 | `created_at`   | DATETIME | Session creation time |
 | `last_seen`    | DATETIME | Last API request time |
 #### `clients`
 | Column      | Type     | Description |
 |-------------|----------|-------------|
 | `id`        | INTEGER  | Primary key (auto-increment) |
-| `uuid`      | TEXT     | Unique client UUID |
+| `nick`      | TEXT     | Unique nick |
-| `session_id`| INTEGER  | FK → sessions.id (cascade delete) |
+| `token`     | TEXT     | Unique auth token (64 hex chars) |
-| `token`     | TEXT     | Unique auth token (SHA-256 hash of 64 hex chars) |
+| `created_at`| DATETIME | Session creation time |
 | `created_at`| DATETIME | Client creation time |
 | `last_seen` | DATETIME | Last API request time |
 #### `channels`
@@ -2011,19 +1854,10 @@ skew issues) and simpler than UUIDs (integer comparison vs. string comparison).
 - **Client output queue entries**: Pruned automatically when older than
  `QUEUE_MAX_AGE` (default 30 days).
 - **Channels**: Deleted when the last member leaves (ephemeral).
- **Sessions**: Both anonymous and registered sessions are deleted on `QUIT`
+- **Users/sessions**: Deleted on `QUIT` or `POST /api/v1/logout`. Idle
-  or when the last client logs out (`POST /api/v1/logout` with no remaining
+  sessions are automatically expired after `SESSION_IDLE_TIMEOUT` (default
-  clients triggers session cleanup). There is no distinction between session
+  30 days) — the server runs a background cleanup loop that parts idle users
-  types in the cleanup path — `handleQuit` and `cleanupUser` both call
+  from all channels, broadcasts QUIT, and releases their nicks.
  `DeleteSession` unconditionally. Idle sessions are automatically expired
  after `SESSION_IDLE_TIMEOUT`
  (default 30 days) — the server runs a background cleanup loop that parts
  idle users from all channels, broadcasts QUIT, and releases their nicks.
 - **Clients**: Individual client tokens are deleted on `POST /api/v1/logout`.
  A session can have multiple clients; removing one doesn't affect others.
  However, when the last client is removed (via logout), the entire session
  is deleted — the user is parted from all channels, QUIT is broadcast, and
  the nick is released.
 ---
@@ -2051,8 +1885,6 @@ directory is also loaded automatically via
 | `METRICS_USERNAME` | string  | `""`                                 | Basic auth username for `/metrics` endpoint. If empty, metrics endpoint is disabled. |
 | `METRICS_PASSWORD` | string  | `""`                                 | Basic auth password for `/metrics` endpoint |
 | `NEOIRC_HASHCASH_BITS` | int | `20`                               | Required hashcash proof-of-work difficulty (leading zero bits in SHA-256) for session creation. Set to `0` to disable. |
 | `LOGIN_RATE_LIMIT` | float   | `1`                                  | Allowed login attempts per second per IP address. |
 | `LOGIN_RATE_BURST`  | int    | `5`                                  | Maximum burst of login attempts per IP before rate limiting kicks in. |
 | `MAINTENANCE_MODE` | bool    | `false`                              | Maintenance mode flag (reserved) |
 ### Example `.env` file
@@ -2174,21 +2006,11 @@ A complete client needs only four HTTP calls:
 ### Step-by-Step with curl
 ```bash
-# 1a. Create an anonymous session (no account)
+# 1. Create a session
 export TOKEN=$(curl -s -X POST http://localhost:8080/api/v1/session \
  -H 'Content-Type: application/json' \
  -d '{"nick":"testuser"}' | jq -r .token)
 # 1b. Or register an account (multi-client support)
 export TOKEN=$(curl -s -X POST http://localhost:8080/api/v1/register \
  -H 'Content-Type: application/json' \
  -d '{"nick":"testuser","password":"mypassword"}' | jq -r .token)
 # 1c. Or login to an existing account
 export TOKEN=$(curl -s -X POST http://localhost:8080/api/v1/login \
  -H 'Content-Type: application/json' \
  -d '{"nick":"testuser","password":"mypassword"}' | jq -r .token)
 # 2. Join a channel
 curl -s -X POST http://localhost:8080/api/v1/messages \
  -H "Authorization: Bearer $TOKEN" \
@@ -2321,11 +2143,9 @@ Clients should handle these message commands from the queue:
 ### Error Handling
- **HTTP 401**: Token expired or invalid. Re-create session (anonymous) or
+- **HTTP 401**: Token expired or invalid. Re-create session.
  re-login (registered account).
 - **HTTP 404**: Channel or user not found.
- **HTTP 409**: Nick already taken (on session creation, registration, or
+- **HTTP 409**: Nick already taken (on session creation or NICK change).
  NICK change).
 - **HTTP 400**: Malformed request. Check the `error` field in the response.
 - **Network errors**: Back off exponentially (1s, 2s, 4s, ..., max 30s).
@@ -2342,10 +2162,8 @@ Clients should handle these message commands from the queue:
 4. **DM tab logic**: When you receive a PRIVMSG where `to` is not a channel
   (no `#` prefix), the DM tab should be keyed by the **other** user's nick:
   if `from` is you, use `to`; if `from` is someone else, use `from`.
-5. **Reconnection**: If the poll loop fails with 401, the token is invalid.
+5. **Reconnection**: If the poll loop fails with 401, the session is gone.
-   For anonymous sessions, create a new session. For registered accounts,
+   Create a new session. If it fails with a network error, retry with backoff.
   log in again via `POST /api/v1/login` to get a fresh token on the same
   session. If it fails with a network error, retry with backoff.
 ---
@@ -2457,49 +2275,6 @@ creating one session pays once and keeps their session.
 - **Language-agnostic**: SHA-256 is available in every programming language.
  The proof computation is trivially implementable in any client.
 ### Login Rate Limiting
 The login endpoint (`POST /api/v1/login`) has per-IP rate limiting to prevent
 brute-force password attacks. This uses a token-bucket algorithm
 (`golang.org/x/time/rate`) with configurable rate and burst.
 | Environment Variable | Default | Description |
 |---------------------|---------|-------------|
 | `LOGIN_RATE_LIMIT`  | `1`     | Allowed login attempts per second per IP |
 | `LOGIN_RATE_BURST`  | `5`     | Maximum burst of login attempts per IP |
 When the limit is exceeded, the server returns **429 Too Many Requests** with a
 `Retry-After: 1` header. Stale per-IP entries are automatically cleaned up
 every 10 minutes.
 > **⚠️ Security: Reverse Proxy Required for Production Use**
 >
 > The rate limiter extracts the client IP by checking the `X-Forwarded-For`
 > header first, then `X-Real-IP`, and finally falling back to the TCP
 > `RemoteAddr`. Both `X-Forwarded-For` and `X-Real-IP` are **client-controlled
 > request headers** — any client can set them to arbitrary values.
 >
 > Without a properly configured reverse proxy in front of this server:
 >
 > - An attacker can **bypass rate limiting entirely** by rotating
 >   `X-Forwarded-For` values on each request (each value is treated as a
 >   distinct IP).
 > - An attacker can **deny service to a specific user** by spoofing that user's
 >   IP in the `X-Forwarded-For` header, exhausting their rate limit bucket.
 >
 > **Recommendation:** Always deploy behind a reverse proxy (e.g. nginx, Caddy,
 > Traefik) that strips or overwrites incoming `X-Forwarded-For` and `X-Real-IP`
 > headers with the actual client IP. If running without a reverse proxy, be
 > aware that the rate limiting provides no meaningful protection against a
 > targeted attack.
 **Why rate limits here but not on session creation?** Session creation is
 protected by hashcash proof-of-work (stateless, no IP tracking needed). Login
 involves bcrypt password verification against a registered account — a
 fundamentally different threat model where an attacker targets a specific
 account. Per-IP rate limiting is appropriate here because the cost of a wrong
 guess is borne by the server (bcrypt), not the client.
 ---
 ## Roadmap
@@ -2608,8 +2383,6 @@ neoirc/
 │   │   └── healthcheck.go  # Health check handler
 │   ├── healthcheck/        # Health check logic
 │   │   └── healthcheck.go
 │   ├── stats/              # Runtime statistics (atomic counters)
 │   │   └── stats.go
 │   ├── logger/             # slog-based logging
 │   │   └── logger.go
 │   ├── middleware/          # HTTP middleware (logging, CORS, metrics, auth)
@@ -2661,13 +2434,9 @@ neoirc/
   build a working IRC-style TUI client against this API in an afternoon, the
   API is too complex.
-2. **Accounts optional** — anonymous sessions are instant: pick a nick and
+2. **No accounts** — identity is a signing key, nick is a display name. No
-   talk. No registration, no email verification. The cost of entry is a
+   registration, no passwords, no email verification. Session creation is
-   hashcash proof, not bureaucracy. For users who want multi-client access
+   instant. The cost of entry is a hashcash proof, not bureaucracy.
   (multiple devices sharing one session), optional account registration
   with password is available — but never required. Identity
   verification at the message layer uses cryptographic signing,
   independent of account status.
 3. **IRC semantics over HTTP** — command names and numeric codes from
   RFC 1459/2812. If you've built an IRC client or bot, you already know the
--- a/cmd/neoircd/main.go
+++ b/cmd/neoircd/main.go
@@ -10,7 +10,6 @@ import (
 	"git.eeqj.de/sneak/neoirc/internal/logger"
 	"git.eeqj.de/sneak/neoirc/internal/middleware"
 	"git.eeqj.de/sneak/neoirc/internal/server"
 	"git.eeqj.de/sneak/neoirc/internal/stats"
 	"go.uber.org/fx"
 )
@@ -36,7 +35,6 @@ func main() {
 			server.New,
 			middleware.New,
 			healthcheck.New,
 			stats.New,
 		),
 		fx.Invoke(func(*server.Server) {}),
 	).Run()
--- a/go.mod
+++ b/go.mod
@@ -16,7 +16,6 @@ require (
 	github.com/spf13/viper v1.21.0
 	go.uber.org/fx v1.24.0
 	golang.org/x/crypto v0.48.0
 	golang.org/x/time v0.6.0
 	modernc.org/sqlite v1.45.0
 )
--- a/go.sum
+++ b/go.sum
@@ -151,8 +151,6 @@ golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.34.0 h1:oL/Qq0Kdaqxa1KbNeMKwQq0reLCCaFtqu2eNuSeNHbk=
 golang.org/x/text v0.34.0/go.mod h1:homfLqTYRFyVYemLBFl5GgL/DWEiH5wcsQ5gSh1yziA=
 golang.org/x/time v0.6.0 h1:eTDhh4ZXt5Qf0augr54TN6suAUudPcawVZeIAPU7D4U=
 golang.org/x/time v0.6.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
--- a/internal/cli/api/hashcash.go
+++ b/internal/cli/api/hashcash.go
@@ -7,6 +7,8 @@ import (
 	"fmt"
 	"math/big"
 	"time"
 	"git.eeqj.de/sneak/neoirc/internal/hashcash"
 )
 const (
@@ -37,6 +39,23 @@ func MintHashcash(bits int, resource string) string {
 	}
 }
 // MintChannelHashcash computes a hashcash stamp bound to
 // a specific channel and message body. The stamp format
 // is 1:bits:YYMMDD:channel:bodyhash:counter where
 // bodyhash is the hex-encoded SHA-256 of the message
 // body bytes. Delegates to the internal/hashcash package.
 func MintChannelHashcash(
 	bits int,
 	channel string,
 	body []byte,
 ) string {
 	bodyHash := hashcash.BodyHash(body)
 	return hashcash.MintChannelStamp(
 		bits, channel, bodyHash,
 	)
 }
 // hasLeadingZeroBits checks if hash has at least numBits
 // leading zero bits.
 func hasLeadingZeroBits(
--- a/internal/config/config.go
+++ b/internal/config/config.go
@@ -46,8 +46,6 @@ type Config struct {
 	FederationKey      string
 	SessionIdleTimeout string
 	HashcashBits       int
 	LoginRateLimit     float64
 	LoginRateBurst     int
 	params             *Params
 	log                *slog.Logger
 }
@@ -80,8 +78,6 @@ func New(
 	viper.SetDefault("FEDERATION_KEY", "")
 	viper.SetDefault("SESSION_IDLE_TIMEOUT", "720h")
 	viper.SetDefault("NEOIRC_HASHCASH_BITS", "20")
 	viper.SetDefault("LOGIN_RATE_LIMIT", "1")
 	viper.SetDefault("LOGIN_RATE_BURST", "5")
 	err := viper.ReadInConfig()
 	if err != nil {
@@ -108,8 +104,6 @@ func New(
 		FederationKey:      viper.GetString("FEDERATION_KEY"),
 		SessionIdleTimeout: viper.GetString("SESSION_IDLE_TIMEOUT"),
 		HashcashBits:       viper.GetInt("NEOIRC_HASHCASH_BITS"),
 		LoginRateLimit:     viper.GetFloat64("LOGIN_RATE_LIMIT"),
 		LoginRateBurst:     viper.GetInt("LOGIN_RATE_BURST"),
 		log:                log,
 		params:             &params,
 	}
--- a/internal/db/queries.go
+++ b/internal/db/queries.go
@@ -1267,41 +1267,109 @@ func (database *Database) PruneOldMessages(
 	return deleted, nil
 }
-// GetClientCount returns the total number of clients.
+// GetChannelHashcashBits returns the hashcash difficulty
-func (database *Database) GetClientCount(
+// requirement for a channel. Returns 0 if not set.
 func (database *Database) GetChannelHashcashBits(
 	ctx context.Context,
-) (int64, error) {
+	channelID int64,
-	var count int64
+) (int, error) {
 	var bits int
 	err := database.conn.QueryRowContext(
 		ctx,
-		"SELECT COUNT(*) FROM clients",
+		"SELECT hashcash_bits FROM channels WHERE id = ?",
-	).Scan(&count)
+		channelID,
 	).Scan(&bits)
 	if err != nil {
 		return 0, fmt.Errorf(
-			"get client count: %w", err,
+			"get channel hashcash bits: %w", err,
 		)
 	}
-	return count, nil
+	return bits, nil
 }
-// GetQueueEntryCount returns the total number of entries
+// SetChannelHashcashBits sets the hashcash difficulty
-// in the client output queues.
+// requirement for a channel. A value of 0 disables the
-func (database *Database) GetQueueEntryCount(
+// requirement.
 func (database *Database) SetChannelHashcashBits(
 	ctx context.Context,
-) (int64, error) {
+	channelID int64,
-	var count int64
+	bits int,
-
+) error {
-	err := database.conn.QueryRowContext(
+	_, err := database.conn.ExecContext(ctx,
-		ctx,
+		`UPDATE channels
-		"SELECT COUNT(*) FROM client_queues",
+		 SET hashcash_bits = ?, updated_at = ?
-	).Scan(&count)
+		 WHERE id = ?`,
 		bits, time.Now(), channelID)
 	if err != nil {
-		return 0, fmt.Errorf(
+		return fmt.Errorf(
-			"get queue entry count: %w", err,
+			"set channel hashcash bits: %w", err,
 		)
 	}
-	return count, nil
+	return nil
 }
 // RecordSpentHashcash stores a spent hashcash stamp hash
 // for replay prevention.
 func (database *Database) RecordSpentHashcash(
 	ctx context.Context,
 	stampHash string,
 ) error {
 	_, err := database.conn.ExecContext(ctx,
 		`INSERT OR IGNORE INTO spent_hashcash
 		 (stamp_hash, created_at)
 		 VALUES (?, ?)`,
 		stampHash, time.Now())
 	if err != nil {
 		return fmt.Errorf(
 			"record spent hashcash: %w", err,
 		)
 	}
 	return nil
 }
 // IsHashcashSpent checks whether a hashcash stamp hash
 // has already been used.
 func (database *Database) IsHashcashSpent(
 	ctx context.Context,
 	stampHash string,
 ) (bool, error) {
 	var count int
 	err := database.conn.QueryRowContext(ctx,
 		`SELECT COUNT(*) FROM spent_hashcash
 		 WHERE stamp_hash = ?`,
 		stampHash,
 	).Scan(&count)
 	if err != nil {
 		return false, fmt.Errorf(
 			"check spent hashcash: %w", err,
 		)
 	}
 	return count > 0, nil
 }
 // PruneSpentHashcash deletes spent hashcash tokens older
 // than the cutoff and returns the number of rows removed.
 func (database *Database) PruneSpentHashcash(
 	ctx context.Context,
 	cutoff time.Time,
 ) (int64, error) {
 	res, err := database.conn.ExecContext(ctx,
 		"DELETE FROM spent_hashcash WHERE created_at < ?",
 		cutoff,
 	)
 	if err != nil {
 		return 0, fmt.Errorf(
 			"prune spent hashcash: %w", err,
 		)
 	}
 	deleted, _ := res.RowsAffected()
 	return deleted, nil
 }
--- a/internal/db/schema/001_initial.sql
+++ b/internal/db/schema/001_initial.sql
@@ -33,6 +33,7 @@ CREATE TABLE IF NOT EXISTS channels (
    topic TEXT NOT NULL DEFAULT '',
    topic_set_by TEXT NOT NULL DEFAULT '',
    topic_set_at DATETIME,
    hashcash_bits INTEGER NOT NULL DEFAULT 0,
    created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
    updated_at DATETIME DEFAULT CURRENT_TIMESTAMP
 );
@@ -61,6 +62,14 @@ CREATE TABLE IF NOT EXISTS messages (
 CREATE INDEX IF NOT EXISTS idx_messages_to_id ON messages(msg_to, id);
 CREATE INDEX IF NOT EXISTS idx_messages_created ON messages(created_at);
 -- Spent hashcash tokens for replay prevention (1-year TTL)
 CREATE TABLE IF NOT EXISTS spent_hashcash (
    id INTEGER PRIMARY KEY AUTOINCREMENT,
    stamp_hash TEXT NOT NULL UNIQUE,
    created_at DATETIME DEFAULT CURRENT_TIMESTAMP
 );
 CREATE INDEX IF NOT EXISTS idx_spent_hashcash_created ON spent_hashcash(created_at);
 -- Per-client message queues for fan-out delivery
 CREATE TABLE IF NOT EXISTS client_queues (
    id INTEGER PRIMARY KEY AUTOINCREMENT,
--- a/internal/handlers/api.go
+++ b/internal/handlers/api.go
@@ -3,6 +3,7 @@ package handlers
 import (
 	"context"
 	"encoding/json"
 	"errors"
 	"fmt"
 	"net/http"
 	"regexp"
@@ -11,10 +12,16 @@ import (
 	"time"
 	"git.eeqj.de/sneak/neoirc/internal/db"
 	"git.eeqj.de/sneak/neoirc/internal/hashcash"
 	"git.eeqj.de/sneak/neoirc/pkg/irc"
 	"github.com/go-chi/chi/v5"
 )
 var (
 	errHashcashRequired = errors.New("hashcash required")
 	errHashcashReused   = errors.New("hashcash reused")
 )
 var validNickRe = regexp.MustCompile(
 	`^[a-zA-Z_][a-zA-Z0-9_\-\[\]\\^{}|` + "`" + `]{0,31}$`,
 )
@@ -88,10 +95,11 @@ func (hdlr *Handlers) fanOut(
 	request *http.Request,
 	command, from, target string,
 	body json.RawMessage,
 	meta json.RawMessage,
 	sessionIDs []int64,
 ) (string, error) {
 	dbID, msgUUID, err := hdlr.params.Database.InsertMessage(
-		request.Context(), command, from, target, nil, body, nil,
+		request.Context(), command, from, target, nil, body, meta,
 	)
 	if err != nil {
 		return "", fmt.Errorf("insert message: %w", err)
@@ -117,10 +125,11 @@ func (hdlr *Handlers) fanOutSilent(
 	request *http.Request,
 	command, from, target string,
 	body json.RawMessage,
 	meta json.RawMessage,
 	sessionIDs []int64,
 ) error {
 	_, err := hdlr.fanOut(
-		request, command, from, target, body, sessionIDs,
+		request, command, from, target, body, meta, sessionIDs,
 	)
 	return err
@@ -212,9 +221,6 @@ func (hdlr *Handlers) handleCreateSession(
 		return
 	}
 	hdlr.stats.IncrSessions()
 	hdlr.stats.IncrConnections()
 	hdlr.deliverMOTD(request, clientID, sessionID, payload.Nick)
 	hdlr.respondJSON(writer, request, map[string]any{
@@ -294,7 +300,7 @@ func (hdlr *Handlers) deliverWelcome(
 		[]string{
 			"CHANTYPES=#",
 			"NICKLEN=32",
-			"CHANMODES=,,," + "imnst",
+			"CHANMODES=,,H," + "imnst",
 			"NETWORK=neoirc",
 			"CASEMAPPING=ascii",
 		},
@@ -825,7 +831,7 @@ func (hdlr *Handlers) HandleSendCommand() http.HandlerFunc {
 			writer, request,
 			sessionID, clientID, nick,
 			payload.Command, payload.To,
-			payload.Body, bodyLines,
+			payload.Body, payload.Meta, bodyLines,
 		)
 	}
 }
@@ -836,6 +842,7 @@ func (hdlr *Handlers) dispatchCommand(
 	sessionID, clientID int64,
 	nick, command, target string,
 	body json.RawMessage,
 	meta json.RawMessage,
 	bodyLines func() []string,
 ) {
 	switch command {
@@ -848,7 +855,7 @@ func (hdlr *Handlers) dispatchCommand(
 		hdlr.handlePrivmsg(
 			writer, request,
 			sessionID, clientID, nick,
-			command, target, body, bodyLines,
+			command, target, body, meta, bodyLines,
 		)
 	case irc.CmdJoin:
 		hdlr.handleJoin(
@@ -949,6 +956,7 @@ func (hdlr *Handlers) handlePrivmsg(
 	sessionID, clientID int64,
 	nick, command, target string,
 	body json.RawMessage,
 	meta json.RawMessage,
 	bodyLines func() []string,
 ) {
 	if target == "" {
@@ -980,13 +988,11 @@ func (hdlr *Handlers) handlePrivmsg(
 		return
 	}
 	hdlr.stats.IncrMessages()
 	if strings.HasPrefix(target, "#") {
 		hdlr.handleChannelMsg(
 			writer, request,
 			sessionID, clientID, nick,
-			command, target, body,
+			command, target, body, meta,
 		)
 		return
@@ -995,7 +1001,7 @@ func (hdlr *Handlers) handlePrivmsg(
 	hdlr.handleDirectMsg(
 		writer, request,
 		sessionID, clientID, nick,
-		command, target, body,
+		command, target, body, meta,
 	)
 }
@@ -1026,6 +1032,7 @@ func (hdlr *Handlers) handleChannelMsg(
 	sessionID, clientID int64,
 	nick, command, target string,
 	body json.RawMessage,
 	meta json.RawMessage,
 ) {
 	chID, err := hdlr.params.Database.GetChannelByName(
 		request.Context(), target,
@@ -1066,9 +1073,172 @@ func (hdlr *Handlers) handleChannelMsg(
 		return
 	}
-	hdlr.sendChannelMsg(
+	hashcashErr := hdlr.validateChannelHashcash(
-		writer, request, command, nick, target, body, chID,
+		request, clientID, sessionID,
 		writer, nick, target, body, meta, chID,
 	)
 	if hashcashErr != nil {
 		return
 	}
 	hdlr.sendChannelMsg(
 		writer, request, command, nick, target,
 		body, meta, chID,
 	)
 }
 // validateChannelHashcash checks whether the channel
 // requires hashcash proof-of-work for messages and
 // validates the stamp from the message meta field.
 // Returns nil on success or if the channel has no
 // hashcash requirement. On failure, it sends the
 // appropriate IRC error and returns a non-nil error.
 func (hdlr *Handlers) validateChannelHashcash(
 	request *http.Request,
 	clientID, sessionID int64,
 	writer http.ResponseWriter,
 	nick, target string,
 	body json.RawMessage,
 	meta json.RawMessage,
 	chID int64,
 ) error {
 	ctx := request.Context()
 	bits, bitsErr := hdlr.params.Database.GetChannelHashcashBits(
 		ctx, chID,
 	)
 	if bitsErr != nil {
 		hdlr.log.Error(
 			"get channel hashcash bits", "error", bitsErr,
 		)
 		hdlr.respondError(
 			writer, request,
 			"internal error",
 			http.StatusInternalServerError,
 		)
 		return fmt.Errorf("channel hashcash bits: %w", bitsErr)
 	}
 	if bits <= 0 {
 		return nil
 	}
 	stamp := hdlr.extractHashcashFromMeta(meta)
 	if stamp == "" {
 		hdlr.respondIRCError(
 			writer, request, clientID, sessionID,
 			irc.ErrCannotSendToChan, nick, []string{target},
 			"Channel requires hashcash proof-of-work",
 		)
 		return errHashcashRequired
 	}
 	return hdlr.verifyChannelStamp(
 		request, writer,
 		clientID, sessionID,
 		nick, target, body, stamp, bits,
 	)
 }
 // verifyChannelStamp validates a channel hashcash stamp
 // and checks for replay attacks.
 func (hdlr *Handlers) verifyChannelStamp(
 	request *http.Request,
 	writer http.ResponseWriter,
 	clientID, sessionID int64,
 	nick, target string,
 	body json.RawMessage,
 	stamp string,
 	bits int,
 ) error {
 	ctx := request.Context()
 	bodyHashStr := hashcash.BodyHash(body)
 	valErr := hdlr.channelHashcash.ValidateStamp(
 		stamp, bits, target, bodyHashStr,
 	)
 	if valErr != nil {
 		hdlr.respondIRCError(
 			writer, request, clientID, sessionID,
 			irc.ErrCannotSendToChan, nick, []string{target},
 			"Invalid hashcash: "+valErr.Error(),
 		)
 		return fmt.Errorf("channel hashcash: %w", valErr)
 	}
 	stampKey := hashcash.StampHash(stamp)
 	spent, spentErr := hdlr.params.Database.IsHashcashSpent(
 		ctx, stampKey,
 	)
 	if spentErr != nil {
 		hdlr.log.Error(
 			"check spent hashcash", "error", spentErr,
 		)
 		hdlr.respondError(
 			writer, request,
 			"internal error",
 			http.StatusInternalServerError,
 		)
 		return fmt.Errorf("check spent hashcash: %w", spentErr)
 	}
 	if spent {
 		hdlr.respondIRCError(
 			writer, request, clientID, sessionID,
 			irc.ErrCannotSendToChan, nick, []string{target},
 			"Hashcash stamp already used",
 		)
 		return errHashcashReused
 	}
 	recordErr := hdlr.params.Database.RecordSpentHashcash(
 		ctx, stampKey,
 	)
 	if recordErr != nil {
 		hdlr.log.Error(
 			"record spent hashcash", "error", recordErr,
 		)
 	}
 	return nil
 }
 // extractHashcashFromMeta parses the meta JSON and
 // returns the hashcash stamp string, or empty string
 // if not present.
 func (hdlr *Handlers) extractHashcashFromMeta(
 	meta json.RawMessage,
 ) string {
 	if len(meta) == 0 {
 		return ""
 	}
 	var metaMap map[string]json.RawMessage
 	err := json.Unmarshal(meta, &metaMap)
 	if err != nil {
 		return ""
 	}
 	raw, ok := metaMap["hashcash"]
 	if !ok {
 		return ""
 	}
 	var stamp string
 	err = json.Unmarshal(raw, &stamp)
 	if err != nil {
 		return ""
 	}
 	return stamp
 }
 func (hdlr *Handlers) sendChannelMsg(
@@ -1076,6 +1246,7 @@ func (hdlr *Handlers) sendChannelMsg(
 	request *http.Request,
 	command, nick, target string,
 	body json.RawMessage,
 	meta json.RawMessage,
 	chID int64,
 ) {
 	memberIDs, err := hdlr.params.Database.GetChannelMemberIDs(
@@ -1095,7 +1266,7 @@ func (hdlr *Handlers) sendChannelMsg(
 	}
 	msgUUID, err := hdlr.fanOut(
-		request, command, nick, target, body, memberIDs,
+		request, command, nick, target, body, meta, memberIDs,
 	)
 	if err != nil {
 		hdlr.log.Error("send message failed", "error", err)
@@ -1119,6 +1290,7 @@ func (hdlr *Handlers) handleDirectMsg(
 	sessionID, clientID int64,
 	nick, command, target string,
 	body json.RawMessage,
 	meta json.RawMessage,
 ) {
 	targetSID, err := hdlr.params.Database.GetSessionByNick(
 		request.Context(), target,
@@ -1143,7 +1315,7 @@ func (hdlr *Handlers) handleDirectMsg(
 	}
 	msgUUID, err := hdlr.fanOut(
-		request, command, nick, target, body, recipients,
+		request, command, nick, target, body, meta, recipients,
 	)
 	if err != nil {
 		hdlr.log.Error("send dm failed", "error", err)
@@ -1254,7 +1426,7 @@ func (hdlr *Handlers) executeJoin(
 	)
 	_ = hdlr.fanOutSilent(
-		request, irc.CmdJoin, nick, channel, nil, memberIDs,
+		request, irc.CmdJoin, nick, channel, nil, nil, memberIDs,
 	)
 	hdlr.deliverJoinNumerics(
@@ -1424,7 +1596,7 @@ func (hdlr *Handlers) handlePart(
 	)
 	_ = hdlr.fanOutSilent(
-		request, irc.CmdPart, nick, channel, body, memberIDs,
+		request, irc.CmdPart, nick, channel, body, nil, memberIDs,
 	)
 	err = hdlr.params.Database.PartChannel(
@@ -1641,32 +1813,6 @@ func (hdlr *Handlers) handleTopic(
 		return
 	}
 	isMember, err := hdlr.params.Database.IsChannelMember(
 		request.Context(), chID, sessionID,
 	)
 	if err != nil {
 		hdlr.log.Error(
 			"check membership failed", "error", err,
 		)
 		hdlr.respondError(
 			writer, request,
 			"internal error",
 			http.StatusInternalServerError,
 		)
 		return
 	}
 	if !isMember {
 		hdlr.respondIRCError(
 			writer, request, clientID, sessionID,
 			irc.ErrNotOnChannel, nick, []string{channel},
 			"You're not on that channel",
 		)
 		return
 	}
 	hdlr.executeTopic(
 		writer, request,
 		sessionID, clientID, nick,
@@ -1704,7 +1850,7 @@ func (hdlr *Handlers) executeTopic(
 	)
 	_ = hdlr.fanOutSilent(
-		request, irc.CmdTopic, nick, channel, body, memberIDs,
+		request, irc.CmdTopic, nick, channel, body, nil, memberIDs,
 	)
 	hdlr.enqueueNumeric(
@@ -1867,11 +2013,10 @@ func (hdlr *Handlers) handleMode(
 		return
 	}
 	_ = bodyLines
 	hdlr.handleChannelMode(
 		writer, request,
 		sessionID, clientID, nick, channel,
 		bodyLines,
 	)
 }
@@ -1880,6 +2025,7 @@ func (hdlr *Handlers) handleChannelMode(
 	request *http.Request,
 	sessionID, clientID int64,
 	nick, channel string,
 	bodyLines func() []string,
 ) {
 	ctx := request.Context()
@@ -1896,10 +2042,47 @@ func (hdlr *Handlers) handleChannelMode(
 		return
 	}
 	lines := bodyLines()
 	if len(lines) > 0 {
 		hdlr.applyChannelMode(
 			writer, request,
 			sessionID, clientID, nick,
 			channel, chID, lines,
 		)
 		return
 	}
 	hdlr.queryChannelMode(
 		writer, request,
 		sessionID, clientID, nick, channel, chID,
 	)
 }
 // queryChannelMode sends RPL_CHANNELMODEIS and
 // RPL_CREATIONTIME for a channel. Includes +H if
 // the channel has a hashcash requirement.
 func (hdlr *Handlers) queryChannelMode(
 	writer http.ResponseWriter,
 	request *http.Request,
 	sessionID, clientID int64,
 	nick, channel string,
 	chID int64,
 ) {
 	ctx := request.Context()
 	modeStr := "+n"
 	bits, bitsErr := hdlr.params.Database.
 		GetChannelHashcashBits(ctx, chID)
 	if bitsErr == nil && bits > 0 {
 		modeStr = fmt.Sprintf("+nH %d", bits)
 	}
 	// 324 RPL_CHANNELMODEIS
 	hdlr.enqueueNumeric(
 		ctx, clientID, irc.RplChannelModeIs, nick,
-		[]string{channel, "+n"}, "",
+		[]string{channel, modeStr}, "",
 	)
 	// 329 RPL_CREATIONTIME
@@ -1924,6 +2107,156 @@ func (hdlr *Handlers) handleChannelMode(
 		http.StatusOK)
 }
 // applyChannelMode handles setting channel modes.
 // Currently supports +H/-H for hashcash bits.
 func (hdlr *Handlers) applyChannelMode(
 	writer http.ResponseWriter,
 	request *http.Request,
 	sessionID, clientID int64,
 	nick, channel string,
 	chID int64,
 	modeArgs []string,
 ) {
 	ctx := request.Context()
 	modeStr := modeArgs[0]
 	switch modeStr {
 	case "+H":
 		hdlr.setHashcashMode(
 			writer, request,
 			sessionID, clientID, nick,
 			channel, chID, modeArgs,
 		)
 	case "-H":
 		hdlr.clearHashcashMode(
 			writer, request,
 			sessionID, clientID, nick,
 			channel, chID,
 		)
 	default:
 		// Unknown or unsupported mode change.
 		hdlr.enqueueNumeric(
 			ctx, clientID, irc.ErrUnknownMode, nick,
 			[]string{modeStr},
 			"is unknown mode char to me",
 		)
 		hdlr.broker.Notify(sessionID)
 		hdlr.respondJSON(writer, request,
 			map[string]string{"status": "error"},
 			http.StatusOK)
 	}
 }
 const (
 	// minHashcashBits is the minimum allowed hashcash
 	// difficulty for channels.
 	minHashcashBits = 1
 	// maxHashcashBits is the maximum allowed hashcash
 	// difficulty for channels.
 	maxHashcashBits = 40
 )
 // setHashcashMode handles MODE #channel +H <bits>.
 func (hdlr *Handlers) setHashcashMode(
 	writer http.ResponseWriter,
 	request *http.Request,
 	sessionID, clientID int64,
 	nick, channel string,
 	chID int64,
 	modeArgs []string,
 ) {
 	ctx := request.Context()
 	if len(modeArgs) < 2 { //nolint:mnd // +H requires a bits arg
 		hdlr.respondIRCError(
 			writer, request, clientID, sessionID,
 			irc.ErrNeedMoreParams, nick, []string{irc.CmdMode},
 			"Not enough parameters (+H requires bits)",
 		)
 		return
 	}
 	bits, err := strconv.Atoi(modeArgs[1])
 	if err != nil || bits < minHashcashBits ||
 		bits > maxHashcashBits {
 		hdlr.respondIRCError(
 			writer, request, clientID, sessionID,
 			irc.ErrUnknownMode, nick, []string{"+H"},
 			fmt.Sprintf(
 				"Invalid hashcash bits (must be %d-%d)",
 				minHashcashBits, maxHashcashBits,
 			),
 		)
 		return
 	}
 	err = hdlr.params.Database.SetChannelHashcashBits(
 		ctx, chID, bits,
 	)
 	if err != nil {
 		hdlr.log.Error(
 			"set channel hashcash bits", "error", err,
 		)
 		hdlr.respondError(
 			writer, request,
 			"internal error",
 			http.StatusInternalServerError,
 		)
 		return
 	}
 	hdlr.enqueueNumeric(
 		ctx, clientID, irc.RplChannelModeIs, nick,
 		[]string{
 			channel,
 			fmt.Sprintf("+H %d", bits),
 		}, "",
 	)
 	hdlr.broker.Notify(sessionID)
 	hdlr.respondJSON(writer, request,
 		map[string]string{"status": "ok"},
 		http.StatusOK)
 }
 // clearHashcashMode handles MODE #channel -H.
 func (hdlr *Handlers) clearHashcashMode(
 	writer http.ResponseWriter,
 	request *http.Request,
 	sessionID, clientID int64,
 	nick, channel string,
 	chID int64,
 ) {
 	ctx := request.Context()
 	err := hdlr.params.Database.SetChannelHashcashBits(
 		ctx, chID, 0,
 	)
 	if err != nil {
 		hdlr.log.Error(
 			"clear channel hashcash bits", "error", err,
 		)
 		hdlr.respondError(
 			writer, request,
 			"internal error",
 			http.StatusInternalServerError,
 		)
 		return
 	}
 	hdlr.enqueueNumeric(
 		ctx, clientID, irc.RplChannelModeIs, nick,
 		[]string{channel, "+n"}, "",
 	)
 	hdlr.broker.Notify(sessionID)
 	hdlr.respondJSON(writer, request,
 		map[string]string{"status": "ok"},
 		http.StatusOK)
 }
 // handleNames sends NAMES reply for a channel.
 func (hdlr *Handlers) handleNames(
 	writer http.ResponseWriter,
--- a/internal/handlers/api_test.go
+++ b/internal/handlers/api_test.go
@@ -22,11 +22,11 @@ import (
 	"git.eeqj.de/sneak/neoirc/internal/db"
 	"git.eeqj.de/sneak/neoirc/internal/globals"
 	"git.eeqj.de/sneak/neoirc/internal/handlers"
 	"git.eeqj.de/sneak/neoirc/internal/hashcash"
 	"git.eeqj.de/sneak/neoirc/internal/healthcheck"
 	"git.eeqj.de/sneak/neoirc/internal/logger"
 	"git.eeqj.de/sneak/neoirc/internal/middleware"
 	"git.eeqj.de/sneak/neoirc/internal/server"
 	"git.eeqj.de/sneak/neoirc/internal/stats"
 	"go.uber.org/fx"
 	"go.uber.org/fx/fxtest"
 )
@@ -91,7 +91,6 @@ func newTestServer(
 				return cfg, nil
 			},
 			newTestDB,
 			stats.New,
 			newTestHealthcheck,
 			newTestMiddleware,
 			newTestHandlers,
@@ -146,14 +145,12 @@ func newTestHealthcheck(
 	cfg *config.Config,
 	log *logger.Logger,
 	database *db.Database,
 	tracker *stats.Tracker,
 ) (*healthcheck.Healthcheck, error) {
 	hcheck, err := healthcheck.New(lifecycle, healthcheck.Params{ //nolint:exhaustruct
 		Globals:  globs,
 		Config:   cfg,
 		Logger:   log,
 		Database: database,
 		Stats:    tracker,
 	})
 	if err != nil {
 		return nil, fmt.Errorf("test healthcheck: %w", err)
@@ -187,7 +184,6 @@ func newTestHandlers(
 	cfg *config.Config,
 	database *db.Database,
 	hcheck *healthcheck.Healthcheck,
 	tracker *stats.Tracker,
 ) (*handlers.Handlers, error) {
 	hdlr, err := handlers.New(lifecycle, handlers.Params{ //nolint:exhaustruct
 		Logger:      log,
@@ -195,7 +191,6 @@ func newTestHandlers(
 		Config:      cfg,
 		Database:    database,
 		Healthcheck: hcheck,
 		Stats:       tracker,
 	})
 	if err != nil {
 		return nil, fmt.Errorf("test handlers: %w", err)
@@ -1140,42 +1135,6 @@ func TestTopicMissingBody(t *testing.T) {
 	}
 }
 func TestTopicNonMember(t *testing.T) {
 	tserver := newTestServer(t)
 	aliceToken := tserver.createSession("alice_topic")
 	bobToken := tserver.createSession("bob_topic")
 	// Only alice joins the channel.
 	tserver.sendCommand(aliceToken, map[string]any{
 		commandKey: joinCmd, toKey: "#topicpriv",
 	})
 	// Drain bob's initial messages.
 	_, lastID := tserver.pollMessages(bobToken, 0)
 	// Bob tries to set topic without joining.
 	status, _ := tserver.sendCommand(
 		bobToken,
 		map[string]any{
 			commandKey: "TOPIC",
 			toKey:      "#topicpriv",
 			bodyKey:    []string{"Hijacked topic"},
 		},
 	)
 	if status != http.StatusOK {
 		t.Fatalf("expected 200, got %d", status)
 	}
 	msgs, _ := tserver.pollMessages(bobToken, lastID)
 	if !findNumeric(msgs, "442") {
 		t.Fatalf(
 			"expected ERR_NOTONCHANNEL (442), got %v",
 			msgs,
 		)
 	}
 }
 func TestPing(t *testing.T) {
 	tserver := newTestServer(t)
 	token := tserver.createSession("ping_user")
@@ -1699,133 +1658,6 @@ func TestHealthcheck(t *testing.T) {
 	}
 }
 func TestHealthcheckRuntimeStatsFields(t *testing.T) {
 	tserver := newTestServer(t)
 	resp, err := doRequest(
 		t,
 		http.MethodGet,
 		tserver.url("/.well-known/healthcheck.json"),
 		nil,
 	)
 	if err != nil {
 		t.Fatal(err)
 	}
 	defer func() { _ = resp.Body.Close() }()
 	if resp.StatusCode != http.StatusOK {
 		t.Fatalf(
 			"expected 200, got %d", resp.StatusCode,
 		)
 	}
 	var result map[string]any
 	decErr := json.NewDecoder(resp.Body).Decode(&result)
 	if decErr != nil {
 		t.Fatalf("decode healthcheck: %v", decErr)
 	}
 	requiredFields := []string{
 		"sessions", "clients", "queuedLines",
 		"channels", "connectionsSinceBoot",
 		"sessionsSinceBoot", "messagesSinceBoot",
 	}
 	for _, field := range requiredFields {
 		if _, ok := result[field]; !ok {
 			t.Errorf(
 				"missing field %q in healthcheck", field,
 			)
 		}
 	}
 }
 func TestHealthcheckRuntimeStatsValues(t *testing.T) {
 	tserver := newTestServer(t)
 	token := tserver.createSession("statsuser")
 	tserver.sendCommand(token, map[string]any{
 		commandKey: joinCmd, toKey: "#statschan",
 	})
 	tserver.sendCommand(token, map[string]any{
 		commandKey: privmsgCmd,
 		toKey:      "#statschan",
 		bodyKey:    []string{"hello stats"},
 	})
 	result := tserver.fetchHealthcheck(t)
 	assertFieldGTE(t, result, "sessions", 1)
 	assertFieldGTE(t, result, "clients", 1)
 	assertFieldGTE(t, result, "channels", 1)
 	assertFieldGTE(t, result, "queuedLines", 0)
 	assertFieldGTE(t, result, "sessionsSinceBoot", 1)
 	assertFieldGTE(t, result, "connectionsSinceBoot", 1)
 	assertFieldGTE(t, result, "messagesSinceBoot", 1)
 }
 func (tserver *testServer) fetchHealthcheck(
 	t *testing.T,
 ) map[string]any {
 	t.Helper()
 	resp, err := doRequest(
 		t,
 		http.MethodGet,
 		tserver.url("/.well-known/healthcheck.json"),
 		nil,
 	)
 	if err != nil {
 		t.Fatal(err)
 	}
 	defer func() { _ = resp.Body.Close() }()
 	if resp.StatusCode != http.StatusOK {
 		t.Fatalf(
 			"expected 200, got %d", resp.StatusCode,
 		)
 	}
 	var result map[string]any
 	decErr := json.NewDecoder(resp.Body).Decode(&result)
 	if decErr != nil {
 		t.Fatalf("decode healthcheck: %v", decErr)
 	}
 	return result
 }
 func assertFieldGTE(
 	t *testing.T,
 	result map[string]any,
 	field string,
 	minimum float64,
 ) {
 	t.Helper()
 	val, ok := result[field].(float64)
 	if !ok {
 		t.Errorf(
 			"field %q: not a number (got %T)",
 			field, result[field],
 		)
 		return
 	}
 	if val < minimum {
 		t.Errorf(
 			"expected %s >= %v, got %v",
 			field, minimum, val,
 		)
 	}
 }
 func TestRegisterValid(t *testing.T) {
 	tserver := newTestServer(t)
@@ -2130,121 +1962,6 @@ func TestSessionStillWorks(t *testing.T) {
 	}
 }
 func TestLoginRateLimitExceeded(t *testing.T) {
 	tserver := newTestServer(t)
 	// Exhaust the burst (default: 5 per IP) using
 	// nonexistent users. These fail fast (no bcrypt),
 	// preventing token replenishment between requests.
 	for range 5 {
 		loginBody, mErr := json.Marshal(
 			map[string]string{
 				"nick":     "nosuchuser",
 				"password": "doesnotmatter",
 			},
 		)
 		if mErr != nil {
 			t.Fatal(mErr)
 		}
 		loginResp, rErr := doRequest(
 			t,
 			http.MethodPost,
 			tserver.url("/api/v1/login"),
 			bytes.NewReader(loginBody),
 		)
 		if rErr != nil {
 			t.Fatal(rErr)
 		}
 		_ = loginResp.Body.Close()
 	}
 	// The next request should be rate-limited.
 	loginBody, err := json.Marshal(map[string]string{
 		"nick": "nosuchuser", "password": "doesnotmatter",
 	})
 	if err != nil {
 		t.Fatal(err)
 	}
 	resp, err := doRequest(
 		t,
 		http.MethodPost,
 		tserver.url("/api/v1/login"),
 		bytes.NewReader(loginBody),
 	)
 	if err != nil {
 		t.Fatal(err)
 	}
 	defer func() { _ = resp.Body.Close() }()
 	if resp.StatusCode != http.StatusTooManyRequests {
 		t.Fatalf(
 			"expected 429, got %d",
 			resp.StatusCode,
 		)
 	}
 	retryAfter := resp.Header.Get("Retry-After")
 	if retryAfter == "" {
 		t.Fatal("expected Retry-After header")
 	}
 }
 func TestLoginRateLimitAllowsNormalUse(t *testing.T) {
 	tserver := newTestServer(t)
 	// Register a user.
 	regBody, err := json.Marshal(map[string]string{
 		"nick": "normaluser", "password": "password123",
 	})
 	if err != nil {
 		t.Fatal(err)
 	}
 	resp, err := doRequest(
 		t,
 		http.MethodPost,
 		tserver.url("/api/v1/register"),
 		bytes.NewReader(regBody),
 	)
 	if err != nil {
 		t.Fatal(err)
 	}
 	_ = resp.Body.Close()
 	// A single login should succeed without rate limiting.
 	loginBody, err := json.Marshal(map[string]string{
 		"nick": "normaluser", "password": "password123",
 	})
 	if err != nil {
 		t.Fatal(err)
 	}
 	resp2, err := doRequest(
 		t,
 		http.MethodPost,
 		tserver.url("/api/v1/login"),
 		bytes.NewReader(loginBody),
 	)
 	if err != nil {
 		t.Fatal(err)
 	}
 	defer func() { _ = resp2.Body.Close() }()
 	if resp2.StatusCode != http.StatusOK {
 		respBody, _ := io.ReadAll(resp2.Body)
 		t.Fatalf(
 			"expected 200, got %d: %s",
 			resp2.StatusCode, respBody,
 		)
 	}
 }
 func TestNickBroadcastToChannels(t *testing.T) {
 	tserver := newTestServer(t)
 	aliceToken := tserver.createSession("nick_a")
@@ -2272,3 +1989,397 @@ func TestNickBroadcastToChannels(t *testing.T) {
 		)
 	}
 }
 // --- Channel Hashcash Tests ---
 const (
 	metaKey     = "meta"
 	modeCmd     = "MODE"
 	hashcashKey = "hashcash"
 )
 func mintTestChannelHashcash(
 	tb testing.TB,
 	bits int,
 	channel string,
 	body json.RawMessage,
 ) string {
 	tb.Helper()
 	bodyHash := hashcash.BodyHash(body)
 	return hashcash.MintChannelStamp(bits, channel, bodyHash)
 }
 func TestChannelHashcashSetMode(t *testing.T) {
 	tserver := newTestServer(t)
 	token := tserver.createSession("hcmode_user")
 	tserver.sendCommand(token, map[string]any{
 		commandKey: joinCmd, toKey: "#hctest",
 	})
 	_, lastID := tserver.pollMessages(token, 0)
 	// Set hashcash bits to 2 via MODE +H.
 	status, _ := tserver.sendCommand(
 		token,
 		map[string]any{
 			commandKey: modeCmd,
 			toKey:      "#hctest",
 			bodyKey:    []string{"+H", "2"},
 		},
 	)
 	if status != http.StatusOK {
 		t.Fatalf("expected 200, got %d", status)
 	}
 	msgs, _ := tserver.pollMessages(token, lastID)
 	// Should get RPL_CHANNELMODEIS (324) confirming +H.
 	if !findNumeric(msgs, "324") {
 		t.Fatalf(
 			"expected RPL_CHANNELMODEIS (324), got %v",
 			msgs,
 		)
 	}
 }
 func TestChannelHashcashQueryMode(t *testing.T) {
 	tserver := newTestServer(t)
 	token := tserver.createSession("hcquery_user")
 	tserver.sendCommand(token, map[string]any{
 		commandKey: joinCmd, toKey: "#hcquery",
 	})
 	// Set hashcash bits.
 	tserver.sendCommand(token, map[string]any{
 		commandKey: modeCmd,
 		toKey:      "#hcquery",
 		bodyKey:    []string{"+H", "5"},
 	})
 	_, lastID := tserver.pollMessages(token, 0)
 	// Query mode — should show +nH.
 	tserver.sendCommand(token, map[string]any{
 		commandKey: modeCmd,
 		toKey:      "#hcquery",
 	})
 	msgs, _ := tserver.pollMessages(token, lastID)
 	found := false
 	for _, msg := range msgs {
 		code, ok := msg["code"].(float64)
 		if ok && int(code) == 324 {
 			found = true
 		}
 	}
 	if !found {
 		t.Fatalf(
 			"expected RPL_CHANNELMODEIS (324), got %v",
 			msgs,
 		)
 	}
 }
 func TestChannelHashcashClearMode(t *testing.T) {
 	tserver := newTestServer(t)
 	token := tserver.createSession("hcclear_user")
 	tserver.sendCommand(token, map[string]any{
 		commandKey: joinCmd, toKey: "#hcclear",
 	})
 	// Set hashcash bits.
 	tserver.sendCommand(token, map[string]any{
 		commandKey: modeCmd,
 		toKey:      "#hcclear",
 		bodyKey:    []string{"+H", "5"},
 	})
 	// Clear hashcash bits.
 	status, _ := tserver.sendCommand(token, map[string]any{
 		commandKey: modeCmd,
 		toKey:      "#hcclear",
 		bodyKey:    []string{"-H"},
 	})
 	if status != http.StatusOK {
 		t.Fatalf("expected 200, got %d", status)
 	}
 	// Now message should succeed without hashcash.
 	status, result := tserver.sendCommand(
 		token,
 		map[string]any{
 			commandKey: privmsgCmd,
 			toKey:      "#hcclear",
 			bodyKey:    []string{"test message"},
 		},
 	)
 	if status != http.StatusOK {
 		t.Fatalf(
 			"expected 200, got %d: %v", status, result,
 		)
 	}
 }
 func TestChannelHashcashRejectNoStamp(t *testing.T) {
 	tserver := newTestServer(t)
 	token := tserver.createSession("hcreject_user")
 	tserver.sendCommand(token, map[string]any{
 		commandKey: joinCmd, toKey: "#hcreject",
 	})
 	// Set hashcash requirement.
 	tserver.sendCommand(token, map[string]any{
 		commandKey: modeCmd,
 		toKey:      "#hcreject",
 		bodyKey:    []string{"+H", "2"},
 	})
 	_, lastID := tserver.pollMessages(token, 0)
 	// Send message without hashcash — should fail.
 	status, _ := tserver.sendCommand(
 		token,
 		map[string]any{
 			commandKey: privmsgCmd,
 			toKey:      "#hcreject",
 			bodyKey:    []string{"spam message"},
 		},
 	)
 	if status != http.StatusOK {
 		t.Fatalf("expected 200, got %d", status)
 	}
 	msgs, _ := tserver.pollMessages(token, lastID)
 	// Should get ERR_CANNOTSENDTOCHAN (404).
 	if !findNumeric(msgs, "404") {
 		t.Fatalf(
 			"expected ERR_CANNOTSENDTOCHAN (404), got %v",
 			msgs,
 		)
 	}
 }
 func TestChannelHashcashAcceptValidStamp(t *testing.T) {
 	tserver := newTestServer(t)
 	token := tserver.createSession("hcaccept_user")
 	tserver.sendCommand(token, map[string]any{
 		commandKey: joinCmd, toKey: "#hcaccept",
 	})
 	// Set hashcash requirement (2 bits = fast to mint).
 	tserver.sendCommand(token, map[string]any{
 		commandKey: modeCmd,
 		toKey:      "#hcaccept",
 		bodyKey:    []string{"+H", "2"},
 	})
 	_, lastID := tserver.pollMessages(token, 0)
 	// Mint a valid hashcash stamp.
 	msgBody, marshalErr := json.Marshal(
 		[]string{"hello world"},
 	)
 	if marshalErr != nil {
 		t.Fatal(marshalErr)
 	}
 	stamp := mintTestChannelHashcash(
 		t, 2, "#hcaccept", msgBody,
 	)
 	// Send message with valid hashcash.
 	status, result := tserver.sendCommand(
 		token,
 		map[string]any{
 			commandKey: privmsgCmd,
 			toKey:      "#hcaccept",
 			bodyKey:    []string{"hello world"},
 			metaKey: map[string]any{
 				hashcashKey: stamp,
 			},
 		},
 	)
 	if status != http.StatusOK {
 		t.Fatalf(
 			"expected 200, got %d: %v", status, result,
 		)
 	}
 	if result["id"] == nil || result["id"] == "" {
 		t.Fatal("expected message id for valid hashcash")
 	}
 	// Verify the message was delivered.
 	msgs, _ := tserver.pollMessages(token, lastID)
 	if !findMessage(msgs, privmsgCmd, "hcaccept_user") {
 		t.Fatalf(
 			"message not received: %v", msgs,
 		)
 	}
 }
 func TestChannelHashcashRejectReplayedStamp(t *testing.T) {
 	tserver := newTestServer(t)
 	token := tserver.createSession("hcreplay_user")
 	tserver.sendCommand(token, map[string]any{
 		commandKey: joinCmd, toKey: "#hcreplay",
 	})
 	// Set hashcash requirement.
 	tserver.sendCommand(token, map[string]any{
 		commandKey: modeCmd,
 		toKey:      "#hcreplay",
 		bodyKey:    []string{"+H", "2"},
 	})
 	_, _ = tserver.pollMessages(token, 0)
 	// Mint and send once — should succeed.
 	msgBody, marshalErr := json.Marshal(
 		[]string{"unique msg"},
 	)
 	if marshalErr != nil {
 		t.Fatal(marshalErr)
 	}
 	stamp := mintTestChannelHashcash(
 		t, 2, "#hcreplay", msgBody,
 	)
 	status, _ := tserver.sendCommand(
 		token,
 		map[string]any{
 			commandKey: privmsgCmd,
 			toKey:      "#hcreplay",
 			bodyKey:    []string{"unique msg"},
 			metaKey: map[string]any{
 				hashcashKey: stamp,
 			},
 		},
 	)
 	if status != http.StatusOK {
 		t.Fatalf("expected 200, got %d", status)
 	}
 	_, lastID := tserver.pollMessages(token, 0)
 	// Replay the same stamp — should fail.
 	status, _ = tserver.sendCommand(
 		token,
 		map[string]any{
 			commandKey: privmsgCmd,
 			toKey:      "#hcreplay",
 			bodyKey:    []string{"unique msg"},
 			metaKey: map[string]any{
 				hashcashKey: stamp,
 			},
 		},
 	)
 	if status != http.StatusOK {
 		t.Fatalf("expected 200, got %d", status)
 	}
 	msgs, _ := tserver.pollMessages(token, lastID)
 	// Should get ERR_CANNOTSENDTOCHAN (404).
 	if !findNumeric(msgs, "404") {
 		t.Fatalf(
 			"expected replay rejection (404), got %v",
 			msgs,
 		)
 	}
 }
 func TestChannelHashcashNoRequirementWorks(t *testing.T) {
 	tserver := newTestServer(t)
 	token := tserver.createSession("hcnone_user")
 	tserver.sendCommand(token, map[string]any{
 		commandKey: joinCmd, toKey: "#nohashcash",
 	})
 	// No hashcash set — message should work.
 	status, result := tserver.sendCommand(
 		token,
 		map[string]any{
 			commandKey: privmsgCmd,
 			toKey:      "#nohashcash",
 			bodyKey:    []string{"free message"},
 		},
 	)
 	if status != http.StatusOK {
 		t.Fatalf(
 			"expected 200, got %d: %v", status, result,
 		)
 	}
 	if result["id"] == nil || result["id"] == "" {
 		t.Fatal("expected message id")
 	}
 }
 func TestChannelHashcashInvalidBitsRange(t *testing.T) {
 	tserver := newTestServer(t)
 	token := tserver.createSession("hcbits_user")
 	tserver.sendCommand(token, map[string]any{
 		commandKey: joinCmd, toKey: "#hcbits",
 	})
 	_, lastID := tserver.pollMessages(token, 0)
 	// Try to set bits to 0 — should fail.
 	tserver.sendCommand(token, map[string]any{
 		commandKey: modeCmd,
 		toKey:      "#hcbits",
 		bodyKey:    []string{"+H", "0"},
 	})
 	msgs, _ := tserver.pollMessages(token, lastID)
 	if !findNumeric(msgs, "472") {
 		t.Fatalf(
 			"expected ERR_UNKNOWNMODE (472), got %v",
 			msgs,
 		)
 	}
 }
 func TestChannelHashcashMissingBitsArg(t *testing.T) {
 	tserver := newTestServer(t)
 	token := tserver.createSession("hcnoarg_user")
 	tserver.sendCommand(token, map[string]any{
 		commandKey: joinCmd, toKey: "#hcnoarg",
 	})
 	_, lastID := tserver.pollMessages(token, 0)
 	// Try to set +H without bits argument.
 	tserver.sendCommand(token, map[string]any{
 		commandKey: modeCmd,
 		toKey:      "#hcnoarg",
 		bodyKey:    []string{"+H"},
 	})
 	msgs, _ := tserver.pollMessages(token, lastID)
 	if !findNumeric(msgs, "461") {
 		t.Fatalf(
 			"expected ERR_NEEDMOREPARAMS (461), got %v",
 			msgs,
 		)
 	}
 }
--- a/internal/handlers/auth.go
+++ b/internal/handlers/auth.go
@@ -2,7 +2,6 @@ package handlers
 import (
 	"encoding/json"
 	"net"
 	"net/http"
 	"strings"
@@ -11,33 +10,6 @@ import (
 const minPasswordLength = 8
 // clientIP extracts the client IP address from the request.
 // It checks X-Forwarded-For and X-Real-IP headers before
 // falling back to RemoteAddr.
 func clientIP(request *http.Request) string {
 	if forwarded := request.Header.Get("X-Forwarded-For"); forwarded != "" {
 		// X-Forwarded-For may contain a comma-separated list;
 		// the first entry is the original client.
 		parts := strings.SplitN(forwarded, ",", 2) //nolint:mnd // split into two parts
 		ip := strings.TrimSpace(parts[0])
 		if ip != "" {
 			return ip
 		}
 	}
 	if realIP := request.Header.Get("X-Real-IP"); realIP != "" {
 		return strings.TrimSpace(realIP)
 	}
 	host, _, err := net.SplitHostPort(request.RemoteAddr)
 	if err != nil {
 		return request.RemoteAddr
 	}
 	return host
 }
 // HandleRegister creates a new user with a password.
 func (hdlr *Handlers) HandleRegister() http.HandlerFunc {
 	return func(
@@ -110,9 +82,6 @@ func (hdlr *Handlers) handleRegister(
 		return
 	}
 	hdlr.stats.IncrSessions()
 	hdlr.stats.IncrConnections()
 	hdlr.deliverMOTD(request, clientID, sessionID, payload.Nick)
 	hdlr.respondJSON(writer, request, map[string]any{
@@ -165,21 +134,6 @@ func (hdlr *Handlers) handleLogin(
 	writer http.ResponseWriter,
 	request *http.Request,
 ) {
 	ip := clientIP(request)
 	if !hdlr.loginLimiter.Allow(ip) {
 		writer.Header().Set(
 			"Retry-After", "1",
 		)
 		hdlr.respondError(
 			writer, request,
 			"too many login attempts, try again later",
 			http.StatusTooManyRequests,
 		)
 		return
 	}
 	type loginRequest struct {
 		Nick     string `json:"nick"`
 		Password string `json:"password"`
@@ -226,8 +180,6 @@ func (hdlr *Handlers) handleLogin(
 		return
 	}
 	hdlr.stats.IncrConnections()
 	hdlr.deliverMOTD(
 		request, clientID, sessionID, payload.Nick,
 	)
--- a/internal/handlers/handlers.go
+++ b/internal/handlers/handlers.go
@@ -16,8 +16,6 @@ import (
 	"git.eeqj.de/sneak/neoirc/internal/hashcash"
 	"git.eeqj.de/sneak/neoirc/internal/healthcheck"
 	"git.eeqj.de/sneak/neoirc/internal/logger"
 	"git.eeqj.de/sneak/neoirc/internal/ratelimit"
 	"git.eeqj.de/sneak/neoirc/internal/stats"
 	"go.uber.org/fx"
 )
@@ -32,21 +30,24 @@ type Params struct {
 	Config      *config.Config
 	Database    *db.Database
 	Healthcheck *healthcheck.Healthcheck
 	Stats       *stats.Tracker
 }
 const defaultIdleTimeout = 30 * 24 * time.Hour
 // spentHashcashTTL is how long spent hashcash tokens are
 // retained for replay prevention. Per issue requirements,
 // this is 1 year.
 const spentHashcashTTL = 365 * 24 * time.Hour
 // Handlers manages HTTP request handling.
 type Handlers struct {
-	params        *Params
+	params          *Params
-	log           *slog.Logger
+	log             *slog.Logger
-	hc            *healthcheck.Healthcheck
+	hc              *healthcheck.Healthcheck
-	broker        *broker.Broker
+	broker          *broker.Broker
-	hashcashVal   *hashcash.Validator
+	hashcashVal     *hashcash.Validator
-	loginLimiter  *ratelimit.Limiter
+	channelHashcash *hashcash.ChannelValidator
-	stats         *stats.Tracker
+	cancelCleanup   context.CancelFunc
 	cancelCleanup context.CancelFunc
 }
 // New creates a new Handlers instance.
@@ -59,24 +60,13 @@ func New(
 		resource = "neoirc"
 	}
 	loginRate := params.Config.LoginRateLimit
 	if loginRate <= 0 {
 		loginRate = ratelimit.DefaultRate
 	}
 	loginBurst := params.Config.LoginRateBurst
 	if loginBurst <= 0 {
 		loginBurst = ratelimit.DefaultBurst
 	}
 	hdlr := &Handlers{ //nolint:exhaustruct // cancelCleanup set in startCleanup
-		params:       &params,
+		params:          &params,
-		log:          params.Logger.Get(),
+		log:             params.Logger.Get(),
-		hc:           params.Healthcheck,
+		hc:              params.Healthcheck,
-		broker:       broker.New(),
+		broker:          broker.New(),
-		hashcashVal:  hashcash.NewValidator(resource),
+		hashcashVal:     hashcash.NewValidator(resource),
-		loginLimiter: ratelimit.New(loginRate, loginBurst),
+		channelHashcash: hashcash.NewChannelValidator(),
 		stats:        params.Stats,
 	}
 	lifecycle.Append(fx.Hook{
@@ -168,10 +158,6 @@ func (hdlr *Handlers) stopCleanup() {
 	if hdlr.cancelCleanup != nil {
 		hdlr.cancelCleanup()
 	}
 	if hdlr.loginLimiter != nil {
 		hdlr.loginLimiter.Stop()
 	}
 }
 func (hdlr *Handlers) cleanupLoop(ctx context.Context) {
@@ -302,4 +288,20 @@ func (hdlr *Handlers) pruneQueuesAndMessages(
 			)
 		}
 	}
 	// Prune spent hashcash tokens older than 1 year.
 	hashcashCutoff := time.Now().Add(-spentHashcashTTL)
 	pruned, err := hdlr.params.Database.
 		PruneSpentHashcash(ctx, hashcashCutoff)
 	if err != nil {
 		hdlr.log.Error(
 			"spent hashcash pruning failed", "error", err,
 		)
 	} else if pruned > 0 {
 		hdlr.log.Info(
 			"pruned spent hashcash tokens",
 			"deleted", pruned,
 		)
 	}
 }
--- a/internal/handlers/healthcheck.go
+++ b/internal/handlers/healthcheck.go
@@ -12,7 +12,7 @@ func (hdlr *Handlers) HandleHealthCheck() http.HandlerFunc {
 		writer http.ResponseWriter,
 		request *http.Request,
 	) {
-		resp := hdlr.hc.Healthcheck(request.Context())
+		resp := hdlr.hc.Healthcheck()
 		hdlr.respondJSON(writer, request, resp, httpStatusOK)
 	}
 }
--- a/internal/hashcash/channel.go
+++ b/internal/hashcash/channel.go
@@ -0,0 +1,186 @@
 package hashcash
 import (
 	"crypto/sha256"
 	"encoding/hex"
 	"errors"
 	"fmt"
 	"strconv"
 	"strings"
 	"time"
 )
 var (
 	errBodyHashMismatch = errors.New(
 		"body hash mismatch",
 	)
 	errBodyHashMissing = errors.New(
 		"body hash missing",
 	)
 )
 // ChannelValidator checks hashcash stamps for
 // per-channel PRIVMSG validation. It verifies that
 // stamps are bound to a specific channel and message
 // body. Replay prevention is handled externally via
 // the database spent_hashcash table for persistence
 // across server restarts (1-year TTL).
 type ChannelValidator struct{}
 // NewChannelValidator creates a ChannelValidator.
 func NewChannelValidator() *ChannelValidator {
 	return &ChannelValidator{}
 }
 // BodyHash computes the hex-encoded SHA-256 hash of a
 // message body for use in hashcash stamp validation.
 func BodyHash(body []byte) string {
 	hash := sha256.Sum256(body)
 	return hex.EncodeToString(hash[:])
 }
 // ValidateStamp checks a channel hashcash stamp. It
 // verifies the stamp format, difficulty, date, channel
 // binding, body hash binding, and proof-of-work. Replay
 // detection is NOT performed here — callers must check
 // the spent_hashcash table separately.
 //
 // Stamp format: 1:bits:YYMMDD:channel:bodyhash:counter.
 func (cv *ChannelValidator) ValidateStamp(
 	stamp string,
 	requiredBits int,
 	channel string,
 	bodyHash string,
 ) error {
 	if requiredBits <= 0 {
 		return nil
 	}
 	parts := strings.Split(stamp, ":")
 	if len(parts) != stampFields {
 		return fmt.Errorf(
 			"%w: expected %d, got %d",
 			errInvalidFields, stampFields, len(parts),
 		)
 	}
 	version := parts[0]
 	bitsStr := parts[1]
 	dateStr := parts[2]
 	resource := parts[3]
 	stampBodyHash := parts[4]
 	headerErr := validateChannelHeader(
 		version, bitsStr, resource,
 		requiredBits, channel,
 	)
 	if headerErr != nil {
 		return headerErr
 	}
 	stampTime, parseErr := parseStampDate(dateStr)
 	if parseErr != nil {
 		return parseErr
 	}
 	timeErr := validateTime(stampTime)
 	if timeErr != nil {
 		return timeErr
 	}
 	bodyErr := validateBodyHash(
 		stampBodyHash, bodyHash,
 	)
 	if bodyErr != nil {
 		return bodyErr
 	}
 	return validateProof(stamp, requiredBits)
 }
 // StampHash returns a deterministic hash of a stamp
 // string for use as a spent-token key.
 func StampHash(stamp string) string {
 	hash := sha256.Sum256([]byte(stamp))
 	return hex.EncodeToString(hash[:])
 }
 func validateChannelHeader(
 	version, bitsStr, resource string,
 	requiredBits int,
 	channel string,
 ) error {
 	if version != stampVersion {
 		return fmt.Errorf(
 			"%w: %s", errBadVersion, version,
 		)
 	}
 	claimedBits, err := strconv.Atoi(bitsStr)
 	if err != nil || claimedBits < requiredBits {
 		return fmt.Errorf(
 			"%w: need %d bits",
 			errInsufficientBits, requiredBits,
 		)
 	}
 	if resource != channel {
 		return fmt.Errorf(
 			"%w: got %q, want %q",
 			errWrongResource, resource, channel,
 		)
 	}
 	return nil
 }
 func validateBodyHash(
 	stampBodyHash, expectedBodyHash string,
 ) error {
 	if stampBodyHash == "" {
 		return errBodyHashMissing
 	}
 	if stampBodyHash != expectedBodyHash {
 		return fmt.Errorf(
 			"%w: got %q, want %q",
 			errBodyHashMismatch,
 			stampBodyHash, expectedBodyHash,
 		)
 	}
 	return nil
 }
 // MintChannelStamp computes a channel hashcash stamp
 // with the given difficulty, channel name, and body hash.
 // This is intended for clients to generate stamps before
 // sending PRIVMSG to hashcash-protected channels.
 //
 // Stamp format: 1:bits:YYMMDD:channel:bodyhash:counter.
 func MintChannelStamp(
 	bits int,
 	channel string,
 	bodyHash string,
 ) string {
 	date := time.Now().UTC().Format(dateFormatShort)
 	prefix := fmt.Sprintf(
 		"1:%d:%s:%s:%s:",
 		bits, date, channel, bodyHash,
 	)
 	counter := uint64(0)
 	for {
 		stamp := prefix + strconv.FormatUint(counter, 16)
 		hash := sha256.Sum256([]byte(stamp))
 		if hasLeadingZeroBits(hash[:], bits) {
 			return stamp
 		}
 		counter++
 	}
 }
--- a/internal/hashcash/channel_test.go
+++ b/internal/hashcash/channel_test.go
@@ -0,0 +1,244 @@
 package hashcash_test
 import (
 	"crypto/sha256"
 	"encoding/hex"
 	"testing"
 	"git.eeqj.de/sneak/neoirc/internal/hashcash"
 )
 const (
 	testChannel  = "#general"
 	testBodyText = `["hello world"]`
 )
 func testBodyHash() string {
 	hash := sha256.Sum256([]byte(testBodyText))
 	return hex.EncodeToString(hash[:])
 }
 func TestChannelValidateHappyPath(t *testing.T) {
 	t.Parallel()
 	validator := hashcash.NewChannelValidator()
 	bodyHash := testBodyHash()
 	stamp := hashcash.MintChannelStamp(
 		testBits, testChannel, bodyHash,
 	)
 	err := validator.ValidateStamp(
 		stamp, testBits, testChannel, bodyHash,
 	)
 	if err != nil {
 		t.Fatalf("valid channel stamp rejected: %v", err)
 	}
 }
 func TestChannelValidateWrongChannel(t *testing.T) {
 	t.Parallel()
 	validator := hashcash.NewChannelValidator()
 	bodyHash := testBodyHash()
 	stamp := hashcash.MintChannelStamp(
 		testBits, testChannel, bodyHash,
 	)
 	err := validator.ValidateStamp(
 		stamp, testBits, "#other", bodyHash,
 	)
 	if err == nil {
 		t.Fatal("expected channel mismatch error")
 	}
 }
 func TestChannelValidateWrongBodyHash(t *testing.T) {
 	t.Parallel()
 	validator := hashcash.NewChannelValidator()
 	bodyHash := testBodyHash()
 	stamp := hashcash.MintChannelStamp(
 		testBits, testChannel, bodyHash,
 	)
 	wrongHash := sha256.Sum256([]byte("different body"))
 	wrongBodyHash := hex.EncodeToString(wrongHash[:])
 	err := validator.ValidateStamp(
 		stamp, testBits, testChannel, wrongBodyHash,
 	)
 	if err == nil {
 		t.Fatal("expected body hash mismatch error")
 	}
 }
 func TestChannelValidateInsufficientBits(t *testing.T) {
 	t.Parallel()
 	validator := hashcash.NewChannelValidator()
 	bodyHash := testBodyHash()
 	// Mint with 2 bits but require 4.
 	stamp := hashcash.MintChannelStamp(
 		testBits, testChannel, bodyHash,
 	)
 	err := validator.ValidateStamp(
 		stamp, 4, testChannel, bodyHash,
 	)
 	if err == nil {
 		t.Fatal("expected insufficient bits error")
 	}
 }
 func TestChannelValidateZeroBitsSkips(t *testing.T) {
 	t.Parallel()
 	validator := hashcash.NewChannelValidator()
 	err := validator.ValidateStamp(
 		"garbage", 0, "#ch", "abc",
 	)
 	if err != nil {
 		t.Fatalf("zero bits should skip: %v", err)
 	}
 }
 func TestChannelValidateBadFormat(t *testing.T) {
 	t.Parallel()
 	validator := hashcash.NewChannelValidator()
 	err := validator.ValidateStamp(
 		"not:valid", testBits, testChannel, "abc",
 	)
 	if err == nil {
 		t.Fatal("expected bad format error")
 	}
 }
 func TestChannelValidateBadVersion(t *testing.T) {
 	t.Parallel()
 	validator := hashcash.NewChannelValidator()
 	bodyHash := testBodyHash()
 	stamp := "2:2:260317:#general:" + bodyHash + ":counter"
 	err := validator.ValidateStamp(
 		stamp, testBits, testChannel, bodyHash,
 	)
 	if err == nil {
 		t.Fatal("expected bad version error")
 	}
 }
 func TestChannelValidateExpiredStamp(t *testing.T) {
 	t.Parallel()
 	validator := hashcash.NewChannelValidator()
 	bodyHash := testBodyHash()
 	// Mint with a very old date by manually constructing.
 	stamp := mintStampWithDate(
 		t, testBits, testChannel, "200101",
 	)
 	err := validator.ValidateStamp(
 		stamp, testBits, testChannel, bodyHash,
 	)
 	if err == nil {
 		t.Fatal("expected expired stamp error")
 	}
 }
 func TestChannelValidateMissingBodyHash(t *testing.T) {
 	t.Parallel()
 	validator := hashcash.NewChannelValidator()
 	bodyHash := testBodyHash()
 	// Construct a stamp with empty body hash field.
 	stamp := mintStampWithDate(
 		t, testBits, testChannel, todayDate(),
 	)
 	// This uses the session-style stamp which has empty
 	// ext field — body hash is missing.
 	err := validator.ValidateStamp(
 		stamp, testBits, testChannel, bodyHash,
 	)
 	if err == nil {
 		t.Fatal("expected missing body hash error")
 	}
 }
 func TestBodyHash(t *testing.T) {
 	t.Parallel()
 	body := []byte(`["hello world"]`)
 	bodyHash := hashcash.BodyHash(body)
 	if len(bodyHash) != 64 {
 		t.Fatalf(
 			"expected 64-char hex hash, got %d",
 			len(bodyHash),
 		)
 	}
 	// Same input should produce same hash.
 	bodyHash2 := hashcash.BodyHash(body)
 	if bodyHash != bodyHash2 {
 		t.Fatal("body hash not deterministic")
 	}
 	// Different input should produce different hash.
 	bodyHash3 := hashcash.BodyHash([]byte("different"))
 	if bodyHash == bodyHash3 {
 		t.Fatal("different inputs produced same hash")
 	}
 }
 func TestStampHash(t *testing.T) {
 	t.Parallel()
 	hash1 := hashcash.StampHash("stamp1")
 	hash2 := hashcash.StampHash("stamp2")
 	if hash1 == hash2 {
 		t.Fatal("different stamps produced same hash")
 	}
 	// Same input should be deterministic.
 	hash1b := hashcash.StampHash("stamp1")
 	if hash1 != hash1b {
 		t.Fatal("stamp hash not deterministic")
 	}
 }
 func TestMintChannelStamp(t *testing.T) {
 	t.Parallel()
 	bodyHash := testBodyHash()
 	stamp := hashcash.MintChannelStamp(
 		testBits, testChannel, bodyHash,
 	)
 	if stamp == "" {
 		t.Fatal("expected non-empty stamp")
 	}
 	// Validate the minted stamp.
 	validator := hashcash.NewChannelValidator()
 	err := validator.ValidateStamp(
 		stamp, testBits, testChannel, bodyHash,
 	)
 	if err != nil {
 		t.Fatalf("minted stamp failed validation: %v", err)
 	}
 }
--- a/internal/healthcheck/healthcheck.go
+++ b/internal/healthcheck/healthcheck.go
@@ -10,7 +10,6 @@ import (
 	"git.eeqj.de/sneak/neoirc/internal/db"
 	"git.eeqj.de/sneak/neoirc/internal/globals"
 	"git.eeqj.de/sneak/neoirc/internal/logger"
 	"git.eeqj.de/sneak/neoirc/internal/stats"
 	"go.uber.org/fx"
 )
@@ -22,7 +21,6 @@ type Params struct {
 	Config   *config.Config
 	Logger   *logger.Logger
 	Database *db.Database
 	Stats    *stats.Tracker
 }
 // Healthcheck tracks server uptime and provides health status.
@@ -66,22 +64,11 @@ type Response struct {
 	Version       string `json:"version"`
 	Appname       string `json:"appname"`
 	Maintenance   bool   `json:"maintenanceMode"`
 	// Runtime statistics.
 	Sessions             int64 `json:"sessions"`
 	Clients              int64 `json:"clients"`
 	QueuedLines          int64 `json:"queuedLines"`
 	Channels             int64 `json:"channels"`
 	ConnectionsSinceBoot int64 `json:"connectionsSinceBoot"`
 	SessionsSinceBoot    int64 `json:"sessionsSinceBoot"`
 	MessagesSinceBoot    int64 `json:"messagesSinceBoot"`
 }
 // Healthcheck returns the current health status of the server.
-func (hcheck *Healthcheck) Healthcheck(
+func (hcheck *Healthcheck) Healthcheck() *Response {
-	ctx context.Context,
+	return &Response{
 ) *Response {
 	resp := &Response{
 		Status:        "ok",
 		Now:           time.Now().UTC().Format(time.RFC3339Nano),
 		UptimeSeconds: int64(hcheck.uptime().Seconds()),
@@ -89,64 +76,6 @@ func (hcheck *Healthcheck) Healthcheck(
 		Appname:       hcheck.params.Globals.Appname,
 		Version:       hcheck.params.Globals.Version,
 		Maintenance:   hcheck.params.Config.MaintenanceMode,
 		Sessions:             0,
 		Clients:              0,
 		QueuedLines:          0,
 		Channels:             0,
 		ConnectionsSinceBoot: hcheck.params.Stats.ConnectionsSinceBoot(),
 		SessionsSinceBoot:    hcheck.params.Stats.SessionsSinceBoot(),
 		MessagesSinceBoot:    hcheck.params.Stats.MessagesSinceBoot(),
 	}
 	hcheck.populateDBStats(ctx, resp)
 	return resp
 }
 // populateDBStats fills in database-derived counters.
 func (hcheck *Healthcheck) populateDBStats(
 	ctx context.Context,
 	resp *Response,
 ) {
 	sessions, err := hcheck.params.Database.GetUserCount(ctx)
 	if err != nil {
 		hcheck.log.Error(
 			"healthcheck: session count failed",
 			"error", err,
 		)
 	} else {
 		resp.Sessions = sessions
 	}
 	clients, err := hcheck.params.Database.GetClientCount(ctx)
 	if err != nil {
 		hcheck.log.Error(
 			"healthcheck: client count failed",
 			"error", err,
 		)
 	} else {
 		resp.Clients = clients
 	}
 	queued, err := hcheck.params.Database.GetQueueEntryCount(ctx)
 	if err != nil {
 		hcheck.log.Error(
 			"healthcheck: queue entry count failed",
 			"error", err,
 		)
 	} else {
 		resp.QueuedLines = queued
 	}
 	channels, err := hcheck.params.Database.GetChannelCount(ctx)
 	if err != nil {
 		hcheck.log.Error(
 			"healthcheck: channel count failed",
 			"error", err,
 		)
 	} else {
 		resp.Channels = channels
 	}
 }
--- a/internal/ratelimit/ratelimit.go
+++ b/internal/ratelimit/ratelimit.go
@@ -1,122 +0,0 @@
 // Package ratelimit provides per-IP rate limiting for HTTP endpoints.
 package ratelimit
 import (
 	"sync"
 	"time"
 	"golang.org/x/time/rate"
 )
 const (
 	// DefaultRate is the default number of allowed requests per second.
 	DefaultRate = 1.0
 	// DefaultBurst is the default maximum burst size.
 	DefaultBurst = 5
 	// DefaultSweepInterval controls how often stale entries are pruned.
 	DefaultSweepInterval = 10 * time.Minute
 	// DefaultEntryTTL is how long an unused entry lives before eviction.
 	DefaultEntryTTL = 15 * time.Minute
 )
 // entry tracks a per-IP rate limiter and when it was last used.
 type entry struct {
 	limiter  *rate.Limiter
 	lastSeen time.Time
 }
 // Limiter manages per-key rate limiters with automatic cleanup
 // of stale entries.
 type Limiter struct {
 	mu       sync.Mutex
 	entries  map[string]*entry
 	rate     rate.Limit
 	burst    int
 	entryTTL time.Duration
 	stopCh   chan struct{}
 }
 // New creates a new per-key rate Limiter.
 // The ratePerSec parameter sets how many requests per second are
 // allowed per key.  The burst parameter sets the maximum number of
 // requests that can be made in a single burst.
 func New(ratePerSec float64, burst int) *Limiter {
 	limiter := &Limiter{
 		mu:       sync.Mutex{},
 		entries:  make(map[string]*entry),
 		rate:     rate.Limit(ratePerSec),
 		burst:    burst,
 		entryTTL: DefaultEntryTTL,
 		stopCh:   make(chan struct{}),
 	}
 	go limiter.sweepLoop()
 	return limiter
 }
 // Allow reports whether a request from the given key should be
 // allowed.  It consumes one token from the key's rate limiter.
 func (l *Limiter) Allow(key string) bool {
 	l.mu.Lock()
 	ent, exists := l.entries[key]
 	if !exists {
 		ent = &entry{
 			limiter:  rate.NewLimiter(l.rate, l.burst),
 			lastSeen: time.Now(),
 		}
 		l.entries[key] = ent
 	} else {
 		ent.lastSeen = time.Now()
 	}
 	l.mu.Unlock()
 	return ent.limiter.Allow()
 }
 // Stop terminates the background sweep goroutine.
 func (l *Limiter) Stop() {
 	close(l.stopCh)
 }
 // Len returns the number of tracked keys (for testing).
 func (l *Limiter) Len() int {
 	l.mu.Lock()
 	defer l.mu.Unlock()
 	return len(l.entries)
 }
 // sweepLoop periodically removes entries that haven't been seen
 // within the TTL.
 func (l *Limiter) sweepLoop() {
 	ticker := time.NewTicker(DefaultSweepInterval)
 	defer ticker.Stop()
 	for {
 		select {
 		case <-ticker.C:
 			l.sweep()
 		case <-l.stopCh:
 			return
 		}
 	}
 }
 // sweep removes stale entries.
 func (l *Limiter) sweep() {
 	l.mu.Lock()
 	defer l.mu.Unlock()
 	cutoff := time.Now().Add(-l.entryTTL)
 	for key, ent := range l.entries {
 		if ent.lastSeen.Before(cutoff) {
 			delete(l.entries, key)
 		}
 	}
 }
--- a/internal/ratelimit/ratelimit_test.go
+++ b/internal/ratelimit/ratelimit_test.go
@@ -1,106 +0,0 @@
 package ratelimit_test
 import (
 	"testing"
 	"git.eeqj.de/sneak/neoirc/internal/ratelimit"
 )
 func TestNewCreatesLimiter(t *testing.T) {
 	t.Parallel()
 	limiter := ratelimit.New(1.0, 5)
 	defer limiter.Stop()
 	if limiter == nil {
 		t.Fatal("expected non-nil limiter")
 	}
 }
 func TestAllowWithinBurst(t *testing.T) {
 	t.Parallel()
 	limiter := ratelimit.New(1.0, 3)
 	defer limiter.Stop()
 	for i := range 3 {
 		if !limiter.Allow("192.168.1.1") {
 			t.Fatalf(
 				"request %d should be allowed within burst",
 				i+1,
 			)
 		}
 	}
 }
 func TestAllowExceedsBurst(t *testing.T) {
 	t.Parallel()
 	// Rate of 0 means no token replenishment, only burst.
 	limiter := ratelimit.New(0, 3)
 	defer limiter.Stop()
 	for range 3 {
 		limiter.Allow("10.0.0.1")
 	}
 	if limiter.Allow("10.0.0.1") {
 		t.Fatal("fourth request should be denied after burst exhausted")
 	}
 }
 func TestAllowSeparateKeys(t *testing.T) {
 	t.Parallel()
 	// Rate of 0, burst of 1 — only one request per key.
 	limiter := ratelimit.New(0, 1)
 	defer limiter.Stop()
 	if !limiter.Allow("10.0.0.1") {
 		t.Fatal("first request for key A should be allowed")
 	}
 	if !limiter.Allow("10.0.0.2") {
 		t.Fatal("first request for key B should be allowed")
 	}
 	if limiter.Allow("10.0.0.1") {
 		t.Fatal("second request for key A should be denied")
 	}
 	if limiter.Allow("10.0.0.2") {
 		t.Fatal("second request for key B should be denied")
 	}
 }
 func TestLenTracksKeys(t *testing.T) {
 	t.Parallel()
 	limiter := ratelimit.New(1.0, 5)
 	defer limiter.Stop()
 	if limiter.Len() != 0 {
 		t.Fatalf("expected 0 entries, got %d", limiter.Len())
 	}
 	limiter.Allow("10.0.0.1")
 	limiter.Allow("10.0.0.2")
 	if limiter.Len() != 2 {
 		t.Fatalf("expected 2 entries, got %d", limiter.Len())
 	}
 	// Same key again should not increase count.
 	limiter.Allow("10.0.0.1")
 	if limiter.Len() != 2 {
 		t.Fatalf("expected 2 entries, got %d", limiter.Len())
 	}
 }
 func TestStopDoesNotPanic(t *testing.T) {
 	t.Parallel()
 	limiter := ratelimit.New(1.0, 5)
 	limiter.Stop()
 }
--- a/internal/stats/stats.go
+++ b/internal/stats/stats.go
@@ -1,52 +0,0 @@
 // Package stats tracks runtime statistics since server boot.
 package stats
 import (
 	"sync/atomic"
 )
 // Tracker holds atomic counters for runtime statistics
 // that accumulate since the server started.
 type Tracker struct {
 	connectionsSinceBoot atomic.Int64
 	sessionsSinceBoot    atomic.Int64
 	messagesSinceBoot    atomic.Int64
 }
 // New creates a new Tracker with all counters at zero.
 func New() *Tracker {
 	return &Tracker{} //nolint:exhaustruct // atomic fields have zero-value defaults
 }
 // IncrConnections increments the total connection count.
 func (t *Tracker) IncrConnections() {
 	t.connectionsSinceBoot.Add(1)
 }
 // IncrSessions increments the total session count.
 func (t *Tracker) IncrSessions() {
 	t.sessionsSinceBoot.Add(1)
 }
 // IncrMessages increments the total PRIVMSG/NOTICE count.
 func (t *Tracker) IncrMessages() {
 	t.messagesSinceBoot.Add(1)
 }
 // ConnectionsSinceBoot returns the total number of
 // client connections since boot.
 func (t *Tracker) ConnectionsSinceBoot() int64 {
 	return t.connectionsSinceBoot.Load()
 }
 // SessionsSinceBoot returns the total number of sessions
 // created since boot.
 func (t *Tracker) SessionsSinceBoot() int64 {
 	return t.sessionsSinceBoot.Load()
 }
 // MessagesSinceBoot returns the total number of
 // PRIVMSG/NOTICE messages sent since boot.
 func (t *Tracker) MessagesSinceBoot() int64 {
 	return t.messagesSinceBoot.Load()
 }
--- a/internal/stats/stats_test.go
+++ b/internal/stats/stats_test.go
@@ -1,117 +0,0 @@
 package stats_test
 import (
 	"testing"
 	"git.eeqj.de/sneak/neoirc/internal/stats"
 )
 func TestNew(t *testing.T) {
 	t.Parallel()
 	tracker := stats.New()
 	if tracker == nil {
 		t.Fatal("expected non-nil tracker")
 	}
 	if tracker.ConnectionsSinceBoot() != 0 {
 		t.Errorf(
 			"expected 0 connections, got %d",
 			tracker.ConnectionsSinceBoot(),
 		)
 	}
 	if tracker.SessionsSinceBoot() != 0 {
 		t.Errorf(
 			"expected 0 sessions, got %d",
 			tracker.SessionsSinceBoot(),
 		)
 	}
 	if tracker.MessagesSinceBoot() != 0 {
 		t.Errorf(
 			"expected 0 messages, got %d",
 			tracker.MessagesSinceBoot(),
 		)
 	}
 }
 func TestIncrConnections(t *testing.T) {
 	t.Parallel()
 	tracker := stats.New()
 	tracker.IncrConnections()
 	tracker.IncrConnections()
 	tracker.IncrConnections()
 	got := tracker.ConnectionsSinceBoot()
 	if got != 3 {
 		t.Errorf(
 			"expected 3 connections, got %d", got,
 		)
 	}
 }
 func TestIncrSessions(t *testing.T) {
 	t.Parallel()
 	tracker := stats.New()
 	tracker.IncrSessions()
 	tracker.IncrSessions()
 	got := tracker.SessionsSinceBoot()
 	if got != 2 {
 		t.Errorf(
 			"expected 2 sessions, got %d", got,
 		)
 	}
 }
 func TestIncrMessages(t *testing.T) {
 	t.Parallel()
 	tracker := stats.New()
 	tracker.IncrMessages()
 	got := tracker.MessagesSinceBoot()
 	if got != 1 {
 		t.Errorf(
 			"expected 1 message, got %d", got,
 		)
 	}
 }
 func TestCountersAreIndependent(t *testing.T) {
 	t.Parallel()
 	tracker := stats.New()
 	tracker.IncrConnections()
 	tracker.IncrSessions()
 	tracker.IncrMessages()
 	tracker.IncrMessages()
 	if tracker.ConnectionsSinceBoot() != 1 {
 		t.Errorf(
 			"expected 1 connection, got %d",
 			tracker.ConnectionsSinceBoot(),
 		)
 	}
 	if tracker.SessionsSinceBoot() != 1 {
 		t.Errorf(
 			"expected 1 session, got %d",
 			tracker.SessionsSinceBoot(),
 		)
 	}
 	if tracker.MessagesSinceBoot() != 2 {
 		t.Errorf(
 			"expected 2 messages, got %d",
 			tracker.MessagesSinceBoot(),
 		)
 	}
 }