style: satisfy golangci-lint on the round-6 changes

nolintlint: gosec was not firing on the deferred Close.
nonamedreturns + varnamelen in collapseUserModeOps.

.dockerignore

@@ -1,80 +1,9 @@
-# .dockerignore does NOT use .gitignore semantics. Docker matches with
-# moby/patternmatcher: filepath.Match plus `**`, so `*` does not cross
-# `/` and an unprefixed pattern is anchored at the context root. Every
-# depth-independent pattern therefore needs `**/`, or `config/.env` and
-# `certs/server.key` still ship while this file reads as solved. Only
-# genuinely root-anchored entries go unprefixed. Never transplant these
-# into .gitignore, where `**/` is wrong.
-#
-# Matching is case-sensitive, so secrets use character ranges rather
-# than an ALL-CAPS twin, which would still miss `Server.Key`.
-#
-# Extend with this repo's own host-built artifacts, written anchored:
-# `/myapp`, never `**/myapp`, which also matches `cmd/myapp/` and
-# deletes the package directory from the context.
-
-# .git is sent without its config. Without a VERSION build argument the
-# stage that compiles runs `git describe --tags --always` on .git, which
-# does not need .git/config; that file can hold a credential, such as a
-# password in a remote URL or the token the CI checkout step stores there.
-# Each submodule keeps a config with the same exposure in its git directory
-# under .git/modules/, nested again for a submodule's own submodules, or in
-# its own .git directory when it keeps one.
-# KNOWN GAP: a submodule whose name has a `config` segment (`config`,
-# `deploy/config`, `config/lib`) loses its whole git directory, because
-# `**/.git/modules/**/config` also matches that segment's directory
-# under .git/modules/. Go's version stamping then fails the build;
-# nothing leaks. Name such a submodule without that segment:
-# `git submodule add --name`.
-**/.git/config
-**/.git/modules/**/config
-
-# Agent scratch: one full checkout of the repo per in-flight agent.
-# Anchored because it occurs once where agents run at the repo root.
-# KNOWN GAP: a repo running agents in subdirectories still ships
-# `services/api/.claude/` and must add its own anchored entry.
-.claude
-
-# Environment files. `*.env` covers bare `.env` and the `prod.env`
-# convention. Re-include a committed template with a negation if the
-# build needs one: `!docs/example.env`.
-**/*.[eE][nN][vV]
-**/.[eE][nN][vV].*
-**/.[eE][nN][vV][rR][cC]
-
-# Private keys and the bundles carrying them. Public certificates
-# (*.crt, *.cer) are deliberately absent: they are legitimate inputs.
-**/*.[pP][eE][mM]
-**/*.[kK][eE][yY]
-**/*.[pP]12
-**/*.[pP][fF][xX]
-**/[iI][dD]_[rR][sS][aA]
-**/[iI][dD]_[dD][sS][aA]
-**/[iI][dD]_[eE][cC][dD][sS][aA]
-**/[iI][dD]_[eE][cC][dD][sS][aA]_[sS][kK]
-**/[iI][dD]_[eE][dD]25519
-**/[iI][dD]_[eE][dD]25519_[sS][kK]
-
-# Dependencies: restored inside the image, never copied in.
-**/node_modules
-
-# OS metadata.
-**/.DS_Store
-**/Thumbs.db
-
-# Editor state: never a build input, and it churns COPY.
-**/*.swp
-**/*.swo
-**/*~
-**/*.bak
-**/.idea
-**/.vscode
-**/*.sublime-*
-
-# This repository's host-built artifacts: the binaries, and the database
-# a local run writes.
-/neoircd
-/neoirc-cli
-/data.db
-/data.db-wal
-/data.db-shm
+.git
+*.md
+!README.md
+neoircd
+neoirc-cli
+data.db
+data.db-wal
+data.db-shm
+.env

.editorconfig

@@ -10,8 +10,3 @@ insert_final_newline = true
 
 [Makefile]
 indent_style = tab
-
-# This repository's own entries, after the shared content above.
-
-[*.go]
-indent_style = tab

.gitea/workflows/check.yml

@@ -6,4 +6,4 @@ jobs:
         steps:
             # actions/checkout v4.2.2, 2026-02-22
             - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
-            - run: script/cibuild
+            - run: docker build .

.gitignore

@@ -11,48 +11,19 @@ Thumbs.db
 .vscode/
 *.sublime-*
 
-# Agent scratch (worktrees of this repo, created and destroyed by
-# in-flight tooling). Unanchored: .gitignore patterns already match at
-# every depth, so no prefix is wanted here. This is not a .dockerignore
-# entry and must not be given a `**/` prefix on the way into one.
-.claude/
-
 # Node
 node_modules/
 
-# Secrets. Unanchored like every entry above, so each matches at every
-# depth. Matching is case-sensitive on Linux, so names use character
-# ranges rather than a lowercase form that misses `Server.Key`.
-
-# Environment files. `*.env` covers bare `.env` and the `prod.env`
-# convention. Only the templates `example.env` and `sample.env` are
-# re-included below. A repository that commits any other template adds
-# its own negation after these lines, for example `!.env.example`.
-*.[eE][nN][vV]
-.[eE][nN][vV].*
-.[eE][nN][vV][rR][cC]
-!example.env
-!sample.env
-
-# Private keys and the bundles carrying them.
-*.[pP][eE][mM]
-*.[kK][eE][yY]
-*.[pP]12
-*.[pP][fF][xX]
-[iI][dD]_[rR][sS][aA]
-[iI][dD]_[dD][sS][aA]
-[iI][dD]_[eE][cC][dD][sS][aA]
-[iI][dD]_[eE][cC][dD][sS][aA]_[sS][kK]
-[iI][dD]_[eE][dD]25519
-[iI][dD]_[eE][dD]25519_[sS][kK]
-
-# This repository's own entries, after the shared content above.
+# Environment / secrets
+.env
+.env.*
+*.pem
+*.key
 
 # Build artifacts
 web/dist/
-/bin/
 /neoircd
-/neoirc-cli
+/bin/
 *.exe
 *.dll
 *.so
@@ -61,6 +32,8 @@ web/dist/
 *.out
 vendor/
 
-# Local database and logs
+# Project
 data.db
-*.log
+debug.log
+/neoirc-cli
+web/node_modules/

.golangci.yml

@@ -1,30 +1,13 @@
 version: "2"
 
-# Config schema uses the golangci-lint v2 layout (settings live under
-# linters.settings, not top-level linters-settings) so that the
-# thresholds below are actually applied by golangci-lint >= v2.
-
 run:
   timeout: 5m
   modules-download-mode: readonly
 
 linters:
   default: all
-  enable:
-    # Successor to the deprecated gomodguard. Named explicitly, rather than
-    # left to `default: all`, because it carries the module policy below.
-    - gomodguard_v2
   disable:
-    # Genuinely incompatible with project patterns
-    - exhaustruct      # Requires all struct fields
-    - exhaustruct_v5   # Requires all struct fields (successor to exhaustruct)
-    - godot            # Requires comments to end with periods
-    - wrapcheck        # Too verbose for internal packages
-    - varnamelen       # Short names like db, id are idiomatic Go
-    # Deprecated: the warning is attached to the old name, so it is
-    # silenced by disabling that name, not by enabling the successor.
-    - wsl              # Deprecated, replaced by wsl_v5
-    - gomodguard       # Deprecated, replaced by gomodguard_v2
+    - wsl  # Deprecated in v2, replaced by wsl_v5
   settings:
     lll:
       line-length: 88
@@ -35,65 +18,19 @@ linters:
       max-complexity: 15
     dupl:
       threshold: 100
+    gosec:
+      excludes:
+        - G704
     depguard:
-      # Test-support code must not be compiled into the shipped binary. A
-      # test-support package exists to hand a test privileges the program
-      # itself must never have, so a file that is not a test must not import
-      # one. Test files, and the files inside a package whose directory name
-      # ends in `test`, are where that code belongs, and are exempt.
-      #
-      # The deny list below is the one part of this file a repository is
-      # expected to extend, and the only part it may. depguard matches an
-      # import path against a list of prefixes, so it cannot be told "any path
-      # whose last segment ends in test"; a repository's own test-support
-      # packages have to be named here one at a time, by full import path,
-      # under a module path that differs from repository to repository. Add
-      # them; change nothing else.
       rules:
-        test-support:
-          list-mode: lax
-          files:
-            - "$all"
-            - "!$test"
-            - "!**/*test/**"
+        all:
           deny:
-            - pkg: net/http/httptest
-              desc: >-
-                Test-support code belongs in test files and in packages whose
-                directory name ends in test, not in the shipped binary.
-    # Only decisions already recorded in the Go package defaults are
-    # listed here. Every entry matches the module path exactly.
-    gomodguard_v2:
-      blocked:
-        - module: github.com/rs/zerolog
-          recommendations:
-            - log/slog
-          reason: "Structured logging is stdlib log/slog."
-        # One entry per pre-fork module path, because the later releases
-        # are separate paths. A prefix match would be shorter but would
-        # also reach github.com/go-redis/redismock, the test double for
-        # the successor these entries recommend.
-        - module: github.com/go-redis/redis
-          recommendations:
-            - github.com/redis/go-redis/v9
-          reason: "Pre-fork module; use the maintained go-redis v9."
-        - module: github.com/go-redis/redis/v7
-          recommendations:
-            - github.com/redis/go-redis/v9
-          reason: "Pre-fork module; use the maintained go-redis v9."
-        - module: github.com/go-redis/redis/v8
-          recommendations:
-            - github.com/redis/go-redis/v9
-          reason: "Pre-fork module; use the maintained go-redis v9."
-        - module: github.com/sergi/go-diff
-          recommendations:
-            - github.com/aymanbagabas/go-udiff
-          reason: "No unified diff output; use go-udiff."
-        - module: github.com/hexops/gotextdiff
-          recommendations:
-            - github.com/aymanbagabas/go-udiff
-          reason: "Unmaintained fork; use go-udiff."
+            - pkg: "io/ioutil"
+              desc: "Deprecated; use io and os packages."
+            - pkg: "math/rand$"
+              desc: "Use crypto/rand for security-sensitive code."
 
 issues:
+  exclude-use-default: false
   max-issues-per-linter: 0
   max-same-issues: 0

.prettierignore

@@ -1,2 +0,0 @@
-node_modules/
-yarn.lock

.prettierrc

@@ -1,4 +0,0 @@
-{
-    "tabWidth": 4,
-    "proseWrap": "always"
-}

AGENTS.md

@@ -2,12 +2,10 @@
 
 ## Before Every Commit
 
-1. **Format**: `make fmt`
-2. **Check**: `make check` — the tests and the linter, which run in Docker, and
-   the format check: all passing, zero issues
-
-Never run `go test`, `golangci-lint` or `gofmt` directly; use the `make`
-targets.
+1. **Format**: `gofmt -s -w .` and `goimports -w .`
+2. **Lint**: `golangci-lint run --config .golangci.yml ./...` — zero issues
+3. **Test**: `go test -race ./...` — all passing
+4. **Build**: `go build ./cmd/neoircd` — compiles clean
 
 No commit lands on main with lint errors, test failures, or formatting issues.
 

CONVENTIONS.md

@@ -1,8 +1,6 @@
 # Go HTTP Server Conventions
 
-This document defines the architectural patterns, design decisions, and
-conventions for building Go HTTP servers. All new projects must follow these
-standards.
+This document defines the architectural patterns, design decisions, and conventions for building Go HTTP servers. All new projects must follow these standards.
 
 ## Table of Contents
 
@@ -86,11 +84,10 @@ project-root/
 
 ### Key Principles
 
-- **`cmd/{appname}/`**: Only the entry point. Minimal logic, just bootstrapping.
-- **`internal/`**: All application packages. Not importable by external
-  projects.
-- **One package per concern**: config, database, handlers, middleware, etc.
-- **Flat handler files**: One file per handler or logical group of handlers.
+-   **`cmd/{appname}/`**: Only the entry point. Minimal logic, just bootstrapping.
+-   **`internal/`**: All application packages. Not importable by external projects.
+-   **One package per concern**: config, database, handlers, middleware, etc.
+-   **Flat handler files**: One file per handler or logical group of handlers.
 
 ---
 
@@ -191,8 +188,7 @@ Providers are resolved automatically by fx, but conceptually follow this order:
 2. `logger.New` - Logger (depends on Globals)
 3. `config.New` - Configuration (depends on Globals, Logger)
 4. `database.New` - Database (depends on Logger, Config)
-5. `healthcheck.New` - Health check (depends on Globals, Config, Logger,
-   Database)
+5. `healthcheck.New` - Health check (depends on Globals, Config, Logger, Database)
 6. `middleware.New` - Middleware (depends on Logger, Globals, Config)
 7. `handlers.New` - Handlers (depends on Logger, Globals, Database, Healthcheck)
 8. `server.New` - Server (depends on all above)
@@ -456,11 +452,11 @@ func New(lc fx.Lifecycle, params HandlersParams) (*Handlers, error) {
 ### Closure-Based Handler Pattern
 
 For JSON route handlers, both the request and the response structures are
-defined in the scope of the method that returns the HandlerFunc. They can be
-called simply `Request` and `Response` or slightly more descriptive names.
+defined in the scope of the method that returns the HandlerFunc.  They can
+be called simply `Request` and `Response` or slightly more descriptive
+names.
 
-All handlers return `http.HandlerFunc` using the closure pattern. This allows
-initialization logic to run once when the handler is created:
+All handlers return `http.HandlerFunc` using the closure pattern. This allows initialization logic to run once when the handler is created:
 
 ```go
 // internal/handlers/index.go
@@ -521,11 +517,10 @@ func (s *Handlers) decodeJSON(w http.ResponseWriter, r *http.Request, v interfac
 
 ### Handler Naming Convention
 
-- `HandleIndex()` - Main page
-- `HandleLoginGET()` / `HandleLoginPOST()` - Form handlers with HTTP method
-  suffix
-- `HandleNow()` - API endpoints
-- `HandleHealthCheck()` - System endpoints
+-   `HandleIndex()` - Main page
+-   `HandleLoginGET()` / `HandleLoginPOST()` - Form handlers with HTTP method suffix
+-   `HandleNow()` - API endpoints
+-   `HandleHealthCheck()` - System endpoints
 
 ---
 
@@ -746,8 +741,7 @@ func New(lc fx.Lifecycle, params ConfigParams) (*Config, error) {
 
 1. **Environment variables** (highest priority via `AutomaticEnv()`)
 2. **`.env` file** (loaded via `godotenv/autoload` import)
-3. **Config files**: `/etc/{appname}/{appname}.yaml`,
-   `~/.config/{appname}/{appname}.yaml`
+3. **Config files**: `/etc/{appname}/{appname}.yaml`, `~/.config/{appname}/{appname}.yaml`
 4. **Defaults** (lowest priority)
 
 ### Environment Loading

Dockerfile

@@ -8,70 +8,42 @@ COPY web/src/ src/
 COPY web/build.sh build.sh
 RUN sh build.sh
 
-# Lint phase, built alone by script/lint. The linter is invoked directly
-# rather than through `make lint`, which is itself a docker build and
-# would recurse into a daemon that does not exist in a build step.
-# golangci/golangci-lint:v2.14.0, 2026-10-06
-FROM golangci/golangci-lint@sha256:ad862ba6b3798cbe0fd9fd7408d498fd74fbd2623a92406b2fd3898faf0bf98f AS lint
+# Lint stage — fast feedback on formatting and lint issues
+# golangci/golangci-lint:v2.1.6, 2026-03-02
+FROM golangci/golangci-lint@sha256:568ee1c1c53493575fa9494e280e579ac9ca865787bafe4df3023ae59ecf299b AS lint
 WORKDIR /src
 COPY go.mod go.sum ./
 RUN go mod download
 COPY . .
-# Placeholder files so //go:embed dist/* in web/embed.go resolves
-# without waiting for the web-builder stage. The test phase does the same.
+# Create placeholder files so //go:embed dist/* in web/embed.go resolves
+# without depending on the web-builder stage (lint should fail fast)
 RUN mkdir -p web/dist && touch web/dist/index.html web/dist/style.css web/dist/app.js
-RUN golangci-lint run --config .golangci.yml ./...
+RUN make fmt-check
+RUN make lint
 
-# Test phase, built alone by script/test. -race needs cgo and so a C
-# compiler, which the Debian Go image ships and the alpine one does not.
-# -p 4 runs at most four test binaries at once: under -race each one
-# costs a few hundred MB, and the default is one per core.
-# golang:1.24.13-bookworm, 2026-10-06
-FROM golang@sha256:1a6d4452c65dea36aac2e2d606b01b4a029ec90cc1ae53890540ce6173ea77ac AS test
-WORKDIR /src
-COPY go.mod go.sum ./
-RUN go mod download
-COPY . .
-RUN mkdir -p web/dist && touch web/dist/index.html web/dist/style.css web/dist/app.js
-RUN go test -p 4 -timeout 90s -race -cover ./... || \
-    { echo "--- Rerunning with -v for details ---"; \
-      go test -p 4 -timeout 90s -race -v ./...; exit 1; }
-
-# Build stage. Nothing is wanted from either phase above; the copies
-# are what make BuildKit build them first, so this stage cannot run
-# unless lint and test passed.
+# Build stage
 # golang:1.24-alpine, 2026-02-26
 FROM golang@sha256:8bee1901f1e530bfb4a7850aa7a479d17ae3a18beb6e09064ed54cfd245b7191 AS builder
-COPY --from=lint /src/go.sum /dev/null
-COPY --from=test /src/go.sum /dev/null
-RUN apk add --no-cache git
-# A tar-stream context keeps the sender's file owners, which git refuses.
-RUN git config --system --add safe.directory /src
 WORKDIR /src
+RUN apk add --no-cache git build-base make
+
+# Force BuildKit to run the lint stage before proceeding
+COPY --from=lint /src/go.sum /dev/null
+
 COPY go.mod go.sum ./
 RUN go mod download
+
 COPY . .
 COPY --from=web-builder /web/dist/ web/dist/
 
+RUN make test
+
 # Build static binaries (no cgo needed at runtime — modernc.org/sqlite is pure Go)
-#
-# neoircd is stamped with the VERSION build arg when one is given, otherwise
-# with `git describe --tags --always` on the .git in the build context. With
-# .git present, a version that is still empty, dev or unknown fails the build:
-# git is missing or could not read the checkout.
-ARG VERSION
-RUN VERSION="${VERSION:-$(git describe --tags --always)}"; \
-    if [ -e .git ]; then \
-        case "$VERSION" in ""|dev|unknown) \
-            echo "version is '$VERSION' although .git is present" >&2; \
-            exit 1 ;; \
-        esac; \
-    fi; \
-    CGO_ENABLED=0 go build -trimpath -ldflags="-s -w -X main.Version=${VERSION}" -o /neoircd ./cmd/neoircd/
+ARG VERSION=dev
+RUN CGO_ENABLED=0 go build -trimpath -ldflags="-s -w -X main.Version=${VERSION}" -o /neoircd ./cmd/neoircd/
 RUN CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o /neoirc-cli ./cmd/neoirc-cli/
 
-# Runtime stage, and the last one: a plain `docker build .` builds this
-# stage's chain and nothing else.
+# Runtime stage
 # alpine:3.21, 2026-02-26
 FROM alpine@sha256:c3f8e73fdb79deaebaa2037150150191b9dcbfba68b4a46d70103204c53f4709
 RUN apk add --no-cache ca-certificates \

Makefile

@@ -1,25 +1,16 @@
-.PHONY: all bootstrap setup build lint fmt fmt-check test check clean run debug docker hooks ensure-web-dist
+.PHONY: all build lint fmt fmt-check test check clean run debug docker hooks ensure-web-dist
 
 BINARY := neoircd
 VERSION := $(shell git describe --tags --always --dirty 2>/dev/null || echo "dev")
-LDFLAGS := -X main.Version=$(VERSION)
-
-# The standard targets are thin shims; the implementations live in
-# script/ per the scripts-to-rule-them-all pattern (see the Entrypoints
-# section of README.md).
+BUILDARCH := $(shell go env GOARCH)
+LDFLAGS := -X main.Version=$(VERSION) -X main.Buildarch=$(BUILDARCH)
 
 all: check build
 
-bootstrap:
-	@script/bootstrap
-
-setup:
-	@script/setup
-
 # ensure-web-dist creates placeholder files so //go:embed dist/* in
 # web/embed.go resolves without a full Node.js build.  The real SPA is
 # built by the web-builder Docker stage; these placeholders let
-# "make build" work outside Docker.
+# "make test" and "make build" work outside Docker.
 ensure-web-dist:
 	@if [ ! -d web/dist ]; then \
 		mkdir -p web/dist && \
@@ -30,20 +21,25 @@ ensure-web-dist:
 build: ensure-web-dist
 	go build -ldflags "$(LDFLAGS)" -o bin/$(BINARY) ./cmd/neoircd
 
-test:
-	@script/test
-
-lint:
-	@script/lint
+lint: ensure-web-dist
+	golangci-lint run --config .golangci.yml ./...
 
 fmt:
-	@script/fmt
+	gofmt -s -w .
+	goimports -w .
 
 fmt-check:
-	@script/fmt-check
+	@test -z "$$(gofmt -l .)" || (echo "Files not formatted:" && gofmt -l . && exit 1)
 
-check:
-	@script/check
+test: ensure-web-dist
+	go test -timeout 30s -race -cover ./... || go test -timeout 30s -race -v ./...
+
+# check runs all validation without making changes
+# Used by CI and Docker build — fails if anything is wrong
+check: test lint fmt-check
+	@echo "==> Building..."
+	go build -ldflags "$(LDFLAGS)" -o /dev/null ./cmd/neoircd
+	@echo "==> All checks passed!"
 
 run: build
 	./bin/$(BINARY)
@@ -55,7 +51,10 @@ clean:
 	rm -rf bin/ neoircd
 
 docker:
-	@script/docker
+	docker build -t neoirc .
 
 hooks:
-	@script/install-precommit
+	@printf '#!/bin/sh\nset -e\n' > .git/hooks/pre-commit
+	@printf 'go mod tidy\ngo fmt ./...\ngit diff --exit-code -- go.mod go.sum || { echo "go mod tidy changed files; please stage and retry"; exit 1; }\n' >> .git/hooks/pre-commit
+	@printf 'make check\n' >> .git/hooks/pre-commit
+	@chmod +x .git/hooks/pre-commit

REPO_POLICIES.md

@@ -1,6 +1,6 @@
 ---
 title: Repository Policies
-last_modified: 2026-10-04
+last_modified: 2026-03-09
 ---
 
 This document covers repository structure, tooling, and workflow standards. Code
@@ -34,57 +34,10 @@ style conventions are in separate documents:
   every file before committing. There are zero exceptions to this rule.
 
 - Every repo with software must have a root `Makefile` with these targets:
-  `make bootstrap`, `make setup`, `make test`, `make lint`, `make fmt` (writes),
-  `make fmt-check` (read-only), `make check` (runs `test`, `lint`, `fmt-check`),
-  `make docker`, and `make hooks` (installs pre-commit hook). A model Makefile
-  is at `https://git.eeqj.de/sneak/prompts/raw/branch/main/Makefile`.
-
-- Repos follow the
-  [Scripts to Rule Them All](https://github.com/github/scripts-to-rule-them-all)
-  pattern: the implementation of each Makefile target lives in an executable
-  script in `script/` (`script/bootstrap`, `script/setup`, `script/test`,
-  `script/lint`, `script/fmt`, `script/fmt-check`, `script/check`,
-  `script/docker`), and the Makefile targets are thin shims that call them. The
-  scripts must be POSIX sh (`#!/bin/sh`, `set -eu`, no bashisms) so they run in
-  minimal containers (e.g. alpine images have no bash); locate the repo root
-  with `$(cd "$(dirname "$0")/.." && pwd -P)` and `cd` there before acting. From
-  the standard's canonical set we use `bootstrap`, `setup` (make the repo ready
-  for development after a fresh clone: runs `bootstrap`, then
-  `install-precommit`, plus any repo-specific initialization), `test`, and
-  `cibuild`. `script/bootstrap` installs all dependencies idempotently and
-  assumes nothing is present: base tools come from nix, apt, brew, or apk
-  (detected in that order; apt runs noninteractive). For node it uses the
-  installed node if present; otherwise it installs a PINNED node version via
-  nvm, first installing nvm itself if missing — from a hash-verified GitHub
-  release archive (never `curl | sh`), with bash installed as an explicit
-  prerequisite since nvm requires bash. yarn is then pinned via
-  `corepack prepare yarn@<version> --activate`. Never install "latest" or "lts";
-  always exact versions. `script/cibuild` runs the CI build: it changes to the
-  repo root, runs `script/bootstrap`, runs `script/check`, and builds the image
-  with the version; the Gitea workflow calls it. **`script/cibuild` runs
-  `script/bootstrap` first**, because the workflow checks out the repo and runs
-  nothing else, while `script/fmt-check` runs the formatter on the host: on a
-  pristine checkout with nothing installed the run dies there, after the
-  containerised gates have passed. **The bootstrap alone is not enough**:
-  `script/bootstrap` installs node and yarn under nvm and leaves neither on the
-  `PATH` of the shell that called it, so a bare `yarn` still exits 127. The host
-  entrypoints that need yarn — `script/fmt` and `script/fmt-check` — therefore
-  source nvm for the pinned node version before invoking it, exactly as
-  `script/bootstrap`'s own install step does. A runner carrying nothing but
-  docker and git then gets through `script/check`. Four further scripts are our
-  own extensions to the standard: `script/check` runs `script/test`,
-  `script/lint` and `script/fmt-check`; `script/precommit` is what the git
-  pre-commit hook runs, and it calls `script/check`; `script/install-precommit`
-  installs the git pre-commit hook (the `make hooks` target shims to it); and
-  `script/projectname` (literally that filename) simply outputs the project's
-  name. Scripts that need the name call `script/projectname` — e.g.
-  `script/docker` assembles its image tag from it — so those scripts stay
-  byte-identical across all repos. Repo-type-specific pre-commit extras (e.g.
-  `go mod tidy` verification in Go repos) belong in `script/precommit`, not in
-  the hook itself. Model scripts are at
-  `https://git.eeqj.de/sneak/prompts/raw/branch/main/script/<name>`. The README
-  must document the provided scripts in an **Entrypoints** section (see the
-  README requirements below).
+  `make test`, `make lint`, `make fmt` (writes), `make fmt-check` (read-only),
+  `make check` (prereqs: `test`, `lint`, `fmt-check`), `make docker`, and
+  `make hooks` (installs pre-commit hook). A model Makefile is at
+  `https://git.eeqj.de/sneak/prompts/raw/branch/main/Makefile`.
 
 - Always use Makefile targets (`make fmt`, `make test`, `make lint`, etc.)
   instead of invoking the underlying tools directly. The Makefile is the single
@@ -100,198 +53,15 @@ style conventions are in separate documents:
   contributor should be able to understand the entire development workflow by
   reading the Makefile.
 
-- Every repo should have a `Dockerfile`, and it carries the repo's gates: a
-  `lint` phase and a `test` phase, with the final stage depending on both so the
-  image cannot be built unless they pass. For non-server repos the final stage
-  brings up a development environment; for server repos it is the runtime image.
-  The gate phases and the build stage start from their pinned base images and
-  install what those images lack either inline, as the canonical Go `Dockerfile`
-  below does for `git`, or by running `script/bootstrap`, as the `prompts`
-  repo's own `Dockerfile` does for its yarn packages. The development
-  environment stage installs development prerequisites by running
-  `script/bootstrap` rather than duplicating its installs inline. A stage that
-  runs `script/bootstrap` COPYs `script/` and the dependency manifests
-  (`package.json` + `yarn.lock`, `go.mod` + `go.sum`, etc.) before running it.
-
-- **Linting and testing run in Docker, as phases of the `Dockerfile`.** There is
-  no separate lint file. `script/lint` and `script/test` each build one phase
-  and nothing else:
-
-    ```sh
-    docker build --no-cache --target lint -t "$(script/projectname)-lint" .
-    docker build --no-cache --target test -t "$(script/projectname)-test" .
-    ```
-
-    **A stage that is not the last one in the file is built only when the final
-    stage's chain depends on it, or when `--target` names it.** That is why the
-    two gates are always invoked by name here, and why the final stage carries a
-    `COPY --from=` of a harmless file from each of them: without that edge a
-    plain `docker build .` builds the last stage alone and exits 0 having linted
-    and tested nothing.
-
-    **Every `docker build` in `script/` is tagged**, here and in
-    `script/cibuild` and `script/docker`. An untagged build leaves a dangling
-    image behind on every invocation, on every developer host and every CI
-    runner; a tagged one replaces the previous image.
-
-    Inside a phase the tool is invoked directly — `golangci-lint`, `go test`,
-    `eslint`, `prettier` — never through `make lint` or `script/test`, which are
-    themselves a `docker build` and would recurse into a daemon that does not
-    exist in a build step. Formatting is the exception and stays on the host:
-    `script/fmt` writes the working tree, and `script/fmt-check` is its
-    read-only twin.
-
-    **No lint verdict may come from a host invocation of the linter.** On a
-    shared host golangci-lint reads a result cache keyed on file content rather
-    than location, so a second checkout of the same content is served the first
-    one's findings, and a host-global lock in `$TMPDIR` makes concurrent runs
-    exit non-zero with `parallel golangci-lint is running` — a status a caller
-    cannot tell from real findings. Both have produced wrong verdicts in this
-    org, in both directions. A container has its own cache, its own `TMPDIR` and
-    a digest-pinned binary, so neither is reachable.
-
-- **Any build that runs checks is built with `--no-cache`.** Docker invalidates
-  a `COPY` layer only when the copied content changes, so on an unchanged tree
-  the check `RUN` is served from cache, nothing executes, and the build still
-  exits 0. Every `docker build` in `script/` therefore passes `--no-cache`:
-  `script/lint`, `script/test`, `script/cibuild` and `script/docker` are the
-  four, and there is no fifth — `script/check` runs the two gate phases and
-  `script/fmt-check`, and builds no image of its own. A bare `docker build .` is
-  not evidence that anything ran: a sub-second build reporting success is a
-  cache hit, not a result. Never invalidate by pruning — `docker builder prune`
-  and friends destroy a build cache shared with every other build on the host.
-  When a check is added or changed, prove it works by planting a defect it must
-  catch and watching the run fail on it, then revert the defect. A green run
-  alone shows neither that the check ran nor that it covers what it should.
-
-- **The gate phases are separate stages, and the build stage depends on both.**
-  The lint phase is based on the `golangci/golangci-lint` image (pinned by
-  hash), so lint failures surface in seconds rather than after a full compile,
-  and the test phase is based on the Debian Go image. The canonical Go repo
-  `Dockerfile`:
-
-    ```dockerfile
-    # Lint phase
-    # golangci/golangci-lint:v2.x.x, YYYY-MM-DD
-    FROM golangci/golangci-lint@sha256:... AS lint
-    WORKDIR /src
-    COPY go.mod go.sum ./
-    RUN go mod download
-    COPY . .
-    RUN golangci-lint run --config .golangci.yml ./...
-
-    # Test phase. -race needs cgo and so a C compiler, which the Debian Go
-    # image ships and the alpine one does not.
-    # golang:1.x, YYYY-MM-DD
-    FROM golang@sha256:... AS test
-    WORKDIR /src
-    COPY go.mod go.sum ./
-    RUN go mod download
-    COPY . .
-    RUN go test -timeout 90s -race -cover ./... || \
-        { echo "--- Rerunning with -v for details ---"; \
-          go test -timeout 90s -race -v ./...; exit 1; }
-
-    # Build stage. Nothing is wanted from either phase above; the copies
-    # are what make BuildKit build them first, so this stage cannot run
-    # unless lint and test passed.
-    # golang:1.x-alpine, YYYY-MM-DD
-    FROM golang@sha256:... AS builder
-    COPY --from=lint /src/go.sum /dev/null
-    COPY --from=test /src/go.sum /dev/null
-    RUN apk add --no-cache git
-    # A tar-stream context keeps the sender's file owners, which git refuses.
-    RUN git config --system --add safe.directory /src
-    WORKDIR /src
-    COPY go.mod go.sum ./
-    RUN go mod download
-    COPY . .
-
-    # The VERSION build arg when one is given, otherwise
-    # `git describe --tags --always` on the .git in the build context. With
-    # .git present, a version that is still empty, dev or unknown fails the
-    # build: git is missing or could not read the checkout.
-    ARG VERSION
-    RUN VERSION="${VERSION:-$(git describe --tags --always)}"; \
-        if [ -e .git ]; then \
-            case "$VERSION" in ""|dev|unknown) \
-                echo "version is '$VERSION' although .git is present" >&2; \
-                exit 1 ;; \
-            esac; \
-        fi; \
-        CGO_ENABLED=0 go build -trimpath \
-            -ldflags="-s -w -X main.Version=${VERSION}" \
-            -o /app ./cmd/app/
-
-    # Runtime stage, and the last one
-    FROM alpine@sha256:...
-    COPY --from=builder /app /usr/local/bin/app
-    ENTRYPOINT ["app"]
-    ```
-
-    Key points:
-    - The lint phase uses the `golangci/golangci-lint` image directly (it has
-      both Go and the linter), so nothing needs installing.
-    - `COPY --from=<phase> /src/go.sum /dev/null` is a no-op copy whose only
-      purpose is the ordering edge. BuildKit runs stages in parallel by default,
-      and a stage nothing depends on is not built at all, so without these two
-      lines a red gate would not fail the build.
-    - Keep the runtime stage last, and if you add a stage after it, give it the
-      same two copies. A plain `docker build .` builds the last stage's chain
-      and nothing else.
-    - If the project uses `//go:embed` directives that reference build artifacts
-      (e.g. a web frontend compiled in a separate stage), the lint phase must
-      create placeholder files so the embed directives resolve. Example:
-      `RUN mkdir -p web/dist && touch web/dist/index.html web/dist/style.css`.
-    - If the project requires CGO or system libraries for linting, install them
-      in the lint phase. The `golangci/golangci-lint` image is Debian-based and
-      has no `apk`, so install with `apt-get` under the Debian package name
-      (`libvips-dev`, where alpine says `vips-dev`), and delete the package
-      lists in the same `RUN`, so the layer does not keep them:
-
-        ```dockerfile
-        RUN apt-get update \
-            && apt-get install -y --no-install-recommends libvips-dev \
-            && rm -rf /var/lib/apt/lists/*
-        ```
-
-    - `.dockerignore` lets `.git` into the build context. It keeps out every git
-      `config` at any depth (`**/.git/config`, `**/.git/modules/**/config`): the
-      repository's own, each submodule's under `.git/modules/`, and that of a
-      submodule keeping its own `.git` directory. `git describe` does not need
-      them, and each can hold a credential: a password in a remote URL, or the
-      token the CI checkout step stores there. A submodule whose name has a
-      `config` segment (`config`, `deploy/config`, `config/lib`) loses its whole
-      git directory to `**/.git/modules/**/config`, and Go's version stamping
-      then fails the build: give it a name without that segment
-      (`git submodule add --name`). The stage that compiles has `git` (the
-      Debian Go image has it; an alpine one needs `apk add --no-cache git`) and
-      takes the version from the `VERSION` build argument when one is given,
-      otherwise from `git describe --tags --always`. That gives the tag on a
-      tagged commit; on a later commit, the tag, the number of commits since it
-      and the short commit (`v1.2.3-4-gabc1234`); and the short commit when no
-      tag is reachable. The stage that compiles also marks its working directory
-      safe for git (`git config --system --add safe.directory /src`): a context
-      sent as a tar stream keeps the sender's file owners, and git refuses a
-      checkout owned by another user, so the version would come out empty.
-      `ARG VERSION` has no default, and the build fails if the context carries
-      `.git` and the version still comes out empty, `dev` or `unknown`. A plain
-      `docker build .` with no build arguments must succeed; a Dockerfile that
-      refuses an empty build argument drops that refusal and keeps the argument.
+- Every repo should have a `Dockerfile`. All Dockerfiles must run `make check`
+  as a build step so the build fails if the branch is not green. For non-server
+  repos, the Dockerfile should bring up a development environment and run
+  `make check`. For server repos, `make check` should run as an early build
+  stage before the final image is assembled.
 
 - Every repo should have a Gitea Actions workflow (`.gitea/workflows/`) that
-  runs `script/cibuild` on push, and checks out the repo as its only other step.
-  That script bootstraps, runs the gate phases, and then builds the image, so a
-  successful run means every check passed; a bare `docker build .` does not
-  carry the same guarantee, because its gate phases may come from the cache. The
-  image build is uncached and so runs the gate phases a second time. That is the
-  price of the rule above, and it is worth paying: the image that ships is built
-  from a run of its own gates rather than from a cache entry. A separate
-  workflow limited to `main` by a `branches` list under `on: push` cannot be
-  checked by review: to try a change to it, add the feature branch to that list
-  and push, then remove the branch from the list again before merging. Keep any
-  job in it that publishes behind `if: github.ref_name == 'main'`, so the run
-  from the feature branch publishes nothing.
+  runs `docker build .` on push. Since the Dockerfile already runs `make check`,
+  a successful build implies all checks pass.
 
 - Use platform-standard formatters: `black` for Python, `prettier` for
   JS/CSS/Markdown/HTML, `go fmt` for Go. Always use default configuration with
@@ -299,11 +69,9 @@ style conventions are in separate documents:
   Markdown (hard-wrap at 80 columns). Documentation and writing repos (Markdown,
   HTML, CSS) should also have `.prettierrc` and `.prettierignore`.
 
-- Pre-commit hook: runs `script/precommit`, which calls `script/check`. If local
-  testing is not possible in the repo, `script/precommit` may skip `script/test`
-  and run only `script/lint` and `script/fmt-check`. The hook is installed by
-  `script/install-precommit`; the Makefile must provide a `make hooks` target
-  that shims to it.
+- Pre-commit hook: `make check` if local testing is possible, otherwise
+  `make lint && make fmt-check`. The Makefile should provide a `make hooks`
+  target to install the pre-commit hook.
 
 - All repos with software must have tests that run via the platform-standard
   test framework (`go test`, `pytest`, `jest`/`vitest`, etc.). If no meaningful
@@ -311,66 +79,8 @@ style conventions are in separate documents:
   module under test to verify it compiles/parses. There is no excuse for
   `make test` to be a no-op.
 
-- `make test` must complete in under 60 seconds. That is the hard cap, and a
-  suite that exceeds it fails. Under 20 seconds is the target. A suite between
-  20 and 60 seconds is still green, but the overage must be filed as an
-  improvement bug against that repo. Add a 90-second timeout to the test
-  invocation (`go test -timeout 90s`). The backstop deliberately sits above the
-  hard cap so that it catches a genuinely hung test rather than a merely slow
-  one.
-
-- **The test command should use the conditional verbose rerun pattern.** Run
-  tests without `-v` (verbose) first. If tests fail, automatically rerun with
-  `-v` to show full output. This keeps CI logs and `docker build` output clean
-  on success (just package/suite summaries) while providing full diagnostic
-  detail on failure (every test case, every assertion). The command lives in the
-  `test` phase of the `Dockerfile`, since `script/test` builds that phase; the
-  Makefile form below is the same pattern for any repo-local invocation:
-
-    ```makefile
-    test:
-    	@<test-command> || \
-    		{ echo "--- Rerunning with -v for details ---"; \
-    		  <test-command-with-v>; exit 1; }
-    ```
-
-    Go example:
-
-    ```makefile
-    test:
-    	@go test -count=1 -timeout 90s -race -cover ./... || \
-    		{ echo "--- Rerunning with -v for details ---"; \
-    		  go test -count=1 -timeout 90s -race -v ./...; exit 1; }
-    ```
-
-    `-count=1` is required on both invocations: it defeats Go's test _result_
-    cache, so neither run can report a stored pass in place of running the
-    tests. It leaves the build cache alone, so it costs the runtime of the suite
-    and no recompilation.
-
-    That cache is Go's own, separate from Docker's layer cache. Go stores a
-    passing result in its cache directory (`GOCACHE`), and when the same tests
-    run again on unchanged code it prints that result, marked `(cached)`,
-    without running them. That matters on a developer's machine, where this
-    target runs and the directory lasts from one run to the next. The `test`
-    phase of the `Dockerfile` needs no `-count=1`: its base image holds no
-    result for this repo's tests and nothing before its `go test` step runs a
-    test, so there is nothing to replay. `--no-cache` (above) is what makes that
-    step run on an unchanged tree.
-
-    Python example:
-
-    ```makefile
-    test:
-    	@python -m pytest || \
-    		{ echo "--- Rerunning with -v for details ---"; \
-    		  python -m pytest -v; exit 1; }
-    ```
-
-    The `exit 1` ensures the target always fails after a rerun — the first run
-    already proved the tests are broken, so the build must not pass even if a
-    flaky test happens to succeed on the second attempt. The rerun exists solely
-    for diagnostic output.
+- `make test` must complete in under 20 seconds. Add a 30-second timeout in the
+  Makefile.
 
 - Docker builds must complete in under 5 minutes.
 
@@ -383,84 +93,10 @@ style conventions are in separate documents:
   must be in `.gitignore`. No exceptions.
 
 - `.gitignore` should be comprehensive from the start: OS files (`.DS_Store`),
-  editor files (`.swp`, `*~`), in-repo agent scratch directories (`.claude/`),
-  language build artifacts, and `node_modules/`. Fetch the standard `.gitignore`
-  from `https://git.eeqj.de/sneak/prompts/raw/branch/main/.gitignore` when
-  setting up a new repo. These patterns are written to `.gitignore`'s own
-  semantics, in which an unanchored pattern already matches at every depth; they
-  are not a `.dockerignore` and must not be transplanted into one unmodified.
-
-- **`.dockerignore` does not use `.gitignore` semantics, and copying patterns
-  across unmodified leaves secrets in the build context.** Docker matches with
-  `moby/patternmatcher`: `filepath.Match` semantics plus a `**` extension, so
-  `*` does not cross `/` and a pattern without a leading `**/` is anchored at
-  the build-context root. A `.dockerignore` listing `.env`, `*.pem` and `*.key`
-  therefore excludes only the copies at the repository root, while `config/.env`
-  and `certs/server.key` still reach the context and can land in an image layer
-  — which is more dangerous than a short file with no secret patterns at all,
-  because it reads as solved and stops anyone looking. Give every
-  depth-independent pattern the `**/` prefix and leave only genuinely
-  root-anchored entries unprefixed: `.claude`, and the repo's own host-built
-  binary, written `/myapp` and never `**/myapp`, which would also match
-  `cmd/myapp/` and delete the package directory from the context. Matching is
-  case-sensitive, and an ALL-CAPS twin per pattern still misses `Server.Key`, so
-  secret names use character ranges — `**/*.[kK][eE][yY]`, `**/*.[pP][eE][mM]`,
-  and likewise for `.envrc` and the extensionless SSH keys. Where such a pattern
-  also catches something the build needs, re-include it with a negation
-  (`!docs/example.env`); deleting the pattern reopens the exposure for every
-  other file it covers. Fetch the standard `.dockerignore` from
-  `https://git.eeqj.de/sneak/prompts/raw/branch/main/.dockerignore` and extend
-  it with the repo's own artifacts.
-
-- **In-repo agent scratch belongs in both files, written to each file's own
-  semantics.** `.claude/` holds one worktree per in-flight agent — an entire
-  additional checkout of the repo — so under `COPY . .` the build context
-  inflates by a multiple of the repo and another session's unreviewed work can
-  be copied into an image layer. In `.gitignore` the entry is `.claude/`,
-  unanchored. In `.dockerignore` it is `.claude`, anchored and with **no** `**/`
-  prefix, because the prefixed form would also delete any nested directory of
-  that name from the build. Anchoring carries a known gap that the canonical
-  `.dockerignore` states in its own comment, since consuming repos receive the
-  file and not the tracker: the directory is created in the agent's working
-  directory, so a repo running agents in subdirectories still ships
-  `services/api/.claude/` and must add its own anchored entry there.
-
-- **A plain `docker build .` of a clone stamps the version that
-  `git describe --tags --always` gives**, derived from the `.git` in the build
-  context as the canonical `Dockerfile` above shows. Without its failure check,
-  a missing `git` or an unreadable checkout would leave `-X main.Version=` empty
-  and the build would still exit 0. `script/docker` and `script/cibuild` pass
-  the version they compute on the host; it takes precedence. They do this
-  byte-identically across repos:
-
-    ```sh
-    # Own line: a failing command substitution inside an argument does not
-    # trip `set -e`, so the inline form degrades to an empty constant.
-    version="$(git describe --tags --always --dirty 2>/dev/null || true)"
-    [ -n "$version" ] || version="unknown"
-    docker build --no-cache \
-        --build-arg VERSION="$version" \
-        -t "$(script/projectname)" .
-    ```
-
-    `--always` makes an untagged repo yield an abbreviated commit hash rather
-    than failing, and the `[ -n "$version" ]` line is the single place the
-    fallback is applied — a live check that fires on a build from an export with
-    no `.git` and on a repository with no commits yet. Do not fold it into the
-    substitution as `|| echo unknown`, which makes the guard unreachable. The
-    Dockerfile's side is `ARG VERSION` in the stage that compiles, declared
-    there because `ARG` is stage-scoped; passing `VERSION` to a repo whose
-    Dockerfile declares no such `ARG` is ignored and costs nothing, which is why
-    the scripts stay byte-identical. One consequence for CI: the standard
-    checkout action clones shallow and fetches no tags, so a repo that embeds a
-    tag-derived version must set `fetch-depth: 0` on its checkout step.
-
-- **Verify `.dockerignore` by enumerating the image, not by reading the
-  patterns.** Plant files at the root _and_ at least two directories deep, build
-  a probe image that does `COPY . .`, and list what actually landed
-  (`docker run --rm --entrypoint find IMAGE /app`). The `transferring context`
-  size is not a substitute: a nested secret is a few bytes, and BuildKit
-  transfers only the delta from the previous build.
+  editor files (`.swp`, `*~`), language build artifacts, and `node_modules/`.
+  Fetch the standard `.gitignore` from
+  `https://git.eeqj.de/sneak/prompts/raw/branch/main/.gitignore` when setting up
+  a new repo.
 
 - **No build artifacts in version control.** Code-derived data (compiled
   bundles, minified output, generated assets) must never be committed to the
@@ -476,56 +112,9 @@ style conventions are in separate documents:
 - Make all changes on a feature branch. You can do whatever you want on a
   feature branch.
 
-- `.golangci.yml` is standardized. The vendored copy in a consuming repo must
-  _NEVER_ be modified by an agent: fetch it from
-  `https://git.eeqj.de/sneak/prompts/raw/branch/main/.golangci.yml` and keep it
-  byte-identical, so that no repo can quietly loosen its own linting. Linter
-  configuration changes are made to the canonical copy in the `prompts` repo and
-  reach consuming repos by re-vendoring; an agent may open a PR against
-  canonical, which only the user merges. One list is exempt from byte-identity,
-  because it cannot be written once for every repo: the `deny` list of the
-  `test-support` depguard rule, where a repo names its own test-support packages
-  by full import path. A repo adds entries there and changes nothing else, and a
-  re-vendor carries its entries forward. The canonical golangci-lint version is
-  v2.14.0 (released 2026-09-24), pinned as the digest of the lint phase's base
-  image
-  (`golangci/golangci-lint@sha256:ad862ba6b3798cbe0fd9fd7408d498fd74fbd2623a92406b2fd3898faf0bf98f`,
-  which reports `2.14.0 built with go1.27.0 from 114493f9`). A module's `go`
-  directive must not name a newer Go minor version than the one golangci-lint
-  was built with, or golangci-lint refuses to lint it: this release lints
-  `go 1.27.1` but not `go 1.28`. That digest is the only pin, since no repo
-  installs golangci-lint on the host. A repo sets the lint phase digest to the
-  one named here and re-vendors `.golangci.yml` in the same commit, whichever of
-  the two prompted the change: the canonical copy can name linters that an older
-  golangci-lint rejects, and a newer golangci-lint can add linters that
-  `default: all` switches on until the canonical copy disables them.
-
-- **`script/bootstrap` installs a pinned tool by comparing versions, never by
-  testing presence.** An `if ! command -v <tool>; then install; fi` guard tests
-  `PATH` only, so on an already-provisioned machine the pin is inert and a
-  version bump is a silent no-op — while the Dockerfile, installing into a clean
-  image, gets the pinned version, so a local `make check` and `make docker` can
-  disagree about what the tool even is. The canonical form:
-    - compares the installed version against the pin over the **whole** version
-      token; a parser that stops at the first `-` reports `2.12.2` for a host
-      running `2.12.2-rc1` and skips the install;
-    - treats absent, non-zero, empty or unrecognised `--version` output as a
-      mismatch, so the failure direction is a redundant install and never a
-      skipped one;
-    - after installing, re-resolves the binary the way callers do — `hash -r`,
-      then through `PATH`, not through the directory the installer wrote to —
-      and fails naming the resolved path, since an install that a shadowing
-      binary hides succeeds while changing nothing any caller sees;
-    - is actually called, and prints the version on both success paths: a
-      function defined and never invoked has the same exit status and the same
-      empty output as one that worked.
-
-    Keep it POSIX sh: no arrays, no `[[`, no `grep -P`.
-
-    A Go tool a repo needs on the host is installed with `go install` pinned to
-    a commit hash (`go install <package>@<commit hash>`). It is never tracked as
-    a `go.mod` tool dependency or through a `tools.go` file, either of which
-    pulls the tool's own dependencies into the repo's `go.mod` and `go.sum`.
+- `.golangci.yml` is standardized and must _NEVER_ be modified by an agent, only
+  manually by the user. Fetch from
+  `https://git.eeqj.de/sneak/prompts/raw/branch/main/.golangci.yml`.
 
 - When pinning images or packages by hash, add a comment above the reference
   with the version and date (YYYY-MM-DD).
@@ -539,76 +128,12 @@ style conventions are in separate documents:
 - Dockerized web services listen on port 8080 by default, overridable with
   `PORT`.
 
-- **HTTP/web services must be hardened for production internet exposure before
-  tagging 1.0.** This means full compliance with security best practices
-  including, without limitation, all of the following:
-    - **Security headers** on every response:
-        - `Strict-Transport-Security` (HSTS) with `max-age` of at least one year
-          and `includeSubDomains`.
-        - `Content-Security-Policy` (CSP) with a restrictive default policy
-          (`default-src 'self'` as a baseline, tightened per-resource as
-          needed). Never use `unsafe-inline` or `unsafe-eval` unless
-          unavoidable, and document the reason.
-        - `X-Frame-Options: DENY` (or `SAMEORIGIN` if framing is required).
-          Prefer the `frame-ancestors` CSP directive as the primary control.
-        - `X-Content-Type-Options: nosniff`.
-        - `Referrer-Policy: strict-origin-when-cross-origin` (or stricter).
-        - `Permissions-Policy` restricting access to browser features the
-          application does not use (camera, microphone, geolocation, etc.).
-    - **Request and response limits:**
-        - Maximum request body size enforced on all endpoints (e.g. Go
-          `http.MaxBytesReader`). Choose a sane default per-route; never accept
-          unbounded input.
-        - Maximum response body size where applicable (e.g. paginated APIs).
-        - `ReadTimeout` and `ReadHeaderTimeout` on the `http.Server` to defend
-          against slowloris attacks.
-        - `WriteTimeout` on the `http.Server`.
-        - `IdleTimeout` on the `http.Server`.
-        - Per-handler execution time limits via `context.WithTimeout` or
-          chi/stdlib `middleware.Timeout`.
-    - **Authentication and session security:**
-        - Rate limiting on password-based authentication endpoints. API keys are
-          high-entropy and not susceptible to brute force, so they are exempt.
-        - CSRF tokens on all state-mutating HTML forms. API endpoints
-          authenticated via `Authorization` header (Bearer token, API key) are
-          exempt because the browser does not attach these automatically.
-        - Passwords stored using bcrypt, scrypt, or argon2 — never plain-text,
-          MD5, or SHA.
-        - Session cookies set with `HttpOnly`, `Secure`, and `SameSite=Lax` (or
-          `Strict`) attributes.
-    - **Reverse proxy awareness:**
-        - True client IP detection when behind a reverse proxy
-          (`X-Forwarded-For`, `X-Real-IP`). The application must accept
-          forwarded headers only from a configured set of trusted proxy
-          addresses — never trust `X-Forwarded-For` unconditionally.
-    - **CORS:**
-        - Authenticated endpoints must restrict `Access-Control-Allow-Origin` to
-          an explicit allowlist of known origins. Wildcard (`*`) is acceptable
-          only for public, unauthenticated read-only APIs.
-    - **Error handling:**
-        - Internal errors must never leak stack traces, SQL queries, file paths,
-          or other implementation details to the client. Return generic error
-          messages in production; detailed errors only when `DEBUG` is enabled.
-    - **TLS:**
-        - Services never terminate TLS directly. They are always deployed behind
-          a TLS-terminating reverse proxy. The service itself listens on plain
-          HTTP. However, HSTS headers and `Secure` cookie flags must still be
-          set by the application so that the browser enforces HTTPS end-to-end.
-
-    This list is non-exhaustive. Apply defense-in-depth: if a standard security
-    hardening measure exists for HTTP services and is not listed here, it is
-    still expected. When in doubt, harden.
-
 - `README.md` is the primary documentation. Required sections:
     - **Description**: First line must include the project name, purpose,
       category (web server, SPA, CLI tool, etc.), license, and author. Example:
       "µPaaS is an MIT-licensed Go web application by @sneak that receives
       git-frontend webhooks and deploys applications via Docker in realtime."
     - **Getting Started**: Copy-pasteable install/usage code block.
-    - **Entrypoints**: Opens by stating that the repo adheres to the
-      [Scripts to Rule Them All](https://github.com/github/scripts-to-rule-them-all)
-      standard (with that link), then documents each provided `script/`
-      entrypoint and its purpose.
     - **Rationale**: Why does this exist?
     - **Design**: How is the program structured?
     - **TODO**: Update meticulously, even between commits. When planning, put
@@ -639,14 +164,12 @@ style conventions are in separate documents:
   settings.
 
 - Avoid putting files in the repo root unless necessary. Root should contain
-  only project-level config files (`README.md`, `AGENTS.md`, `Makefile`,
-  `Dockerfile`, `LICENSE`, `.gitignore`, `.editorconfig`, `REPO_POLICIES.md`,
-  and language-specific config). Everything else goes in a subdirectory.
-  Canonical subdirectory names:
+  only project-level config files (`README.md`, `Makefile`, `Dockerfile`,
+  `LICENSE`, `.gitignore`, `.editorconfig`, `REPO_POLICIES.md`, and
+  language-specific config). Everything else goes in a subdirectory. Canonical
+  subdirectory names:
     - `bin/` — executable scripts and tools
-    - `cmd/` — Go command entrypoints; thin only: one `main.go` per binary whose
-      body is a single call into `internal/` or `pkg/`, no project logic in
-      `cmd/`
+    - `cmd/` — Go command entrypoints
     - `configs/` — configuration templates and examples
     - `deploy/` — deployment manifests (k8s, compose, terraform)
     - `docs/` — documentation and markdown (README.md stays in root)
@@ -665,15 +188,8 @@ style conventions are in separate documents:
     - `README.md`, `.git`, `.gitignore`, `.editorconfig`
     - `LICENSE`, `REPO_POLICIES.md` (copy from the `prompts` repo)
     - `Makefile`
-    - `script/` entrypoints (`bootstrap`, `setup`, `projectname`, `test`,
-      `lint`, `fmt`, `fmt-check`, `check`, `docker`, `cibuild`, `precommit`,
-      `install-precommit`)
     - `Dockerfile`, `.dockerignore`
     - `.gitea/workflows/check.yml`
     - Go: `go.mod`, `go.sum`, `.golangci.yml`
     - JS: `package.json`, `yarn.lock`, `.prettierrc`, `.prettierignore`
     - Python: `pyproject.toml`
-
-- Guidance for coding agents lives in one `AGENTS.md` at the repository root. It
-  is never committed under a file or directory named after one agent tool, such
-  as `CLAUDE.md` or `.claude/`, and never split into separate memory files.

internal/db/errors.go

@@ -1,3 +1,4 @@
+// Package db provides database access and migration management.
 package db
 
 import (

internal/db/export_test.go

@@ -58,3 +58,19 @@ func (database *Database) Close() error {
 
 	return nil
 }
+
+// ExecForTest runs a raw statement against the test
+// database.  Tests use it to install SQLite triggers that
+// force a specific write to fail, so that the atomicity of
+// multi-statement helpers can be exercised.
+func (database *Database) ExecForTest(
+	ctx context.Context,
+	query string,
+) error {
+	_, err := database.conn.ExecContext(ctx, query)
+	if err != nil {
+		return fmt.Errorf("exec for test: %w", err)
+	}
+
+	return nil
+}

internal/db/queries.go

@@ -7,6 +7,7 @@ import (
 	"database/sql"
 	"encoding/hex"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"strconv"
 	"strings"
@@ -1150,8 +1151,7 @@ func scanMessages(
 			code, _ := strconv.Atoi(msg.Command)
 			msg.Code = code
 
-			mt, lookupErr := irc.FromInt(code)
-			if lookupErr == nil {
+			if mt, err := irc.FromInt(code); err == nil {
 				msg.Command = mt.Name()
 			}
 		}
@@ -1374,9 +1374,7 @@ func (database *Database) GetStaleOrphanSessions(
 
 	for rows.Next() {
 		var stale StaleSession
-
-		err = rows.Scan(&stale.ID, &stale.Nick)
-		if err != nil {
+		if err := rows.Scan(&stale.ID, &stale.Nick); err != nil {
 			return nil, fmt.Errorf(
 				"scan stale session: %w", err,
 			)
@@ -1385,8 +1383,7 @@ func (database *Database) GetStaleOrphanSessions(
 		result = append(result, stale)
 	}
 
-	err = rows.Err()
-	if err != nil {
+	if err := rows.Err(); err != nil {
 		return nil, fmt.Errorf(
 			"iterate stale sessions: %w", err,
 		)
@@ -1909,10 +1906,9 @@ func (database *Database) ListChannelBans(
 	for rows.Next() {
 		var ban BanInfo
 
-		scanErr := rows.Scan(
+		if scanErr := rows.Scan(
 			&ban.Mask, &ban.SetBy, &ban.CreatedAt,
-		)
-		if scanErr != nil {
+		); scanErr != nil {
 			return nil, fmt.Errorf(
 				"scan channel ban: %w", scanErr,
 			)
@@ -1921,8 +1917,7 @@ func (database *Database) ListChannelBans(
 		bans = append(bans, ban)
 	}
 
-	rowErr := rows.Err()
-	if rowErr != nil {
+	if rowErr := rows.Err(); rowErr != nil {
 		return nil, fmt.Errorf(
 			"iterate channel bans: %w", rowErr,
 		)
@@ -2253,12 +2248,11 @@ func (database *Database) ListAllChannelsWithCountsFiltered(
 	for rows.Next() {
 		var chanInfo ChannelInfoFull
 
-		scanErr := rows.Scan(
+		if scanErr := rows.Scan(
 			&chanInfo.Name,
 			&chanInfo.MemberCount,
 			&chanInfo.Topic,
-		)
-		if scanErr != nil {
+		); scanErr != nil {
 			return nil, fmt.Errorf(
 				"scan channel: %w", scanErr,
 			)
@@ -2267,8 +2261,7 @@ func (database *Database) ListAllChannelsWithCountsFiltered(
 		channels = append(channels, chanInfo)
 	}
 
-	rowErr := rows.Err()
-	if rowErr != nil {
+	if rowErr := rows.Err(); rowErr != nil {
 		return nil, fmt.Errorf(
 			"iterate channels: %w", rowErr,
 		)
@@ -2316,12 +2309,11 @@ func (database *Database) GetSessionChannelsFiltered(
 	for rows.Next() {
 		var chanInfo ChannelInfo
 
-		scanErr := rows.Scan(
+		if scanErr := rows.Scan(
 			&chanInfo.ID,
 			&chanInfo.Name,
 			&chanInfo.Topic,
-		)
-		if scanErr != nil {
+		); scanErr != nil {
 			return nil, fmt.Errorf(
 				"scan channel: %w", scanErr,
 			)
@@ -2330,8 +2322,7 @@ func (database *Database) GetSessionChannelsFiltered(
 		channels = append(channels, chanInfo)
 	}
 
-	rowErr := rows.Err()
-	if rowErr != nil {
+	if rowErr := rows.Err(); rowErr != nil {
 		return nil, fmt.Errorf(
 			"iterate channels: %w", rowErr,
 		)
@@ -2423,3 +2414,205 @@ func (database *Database) SetChannelUserLimit(
 
 	return nil
 }
+
+// SetSessionUserModes applies a set of user-mode flag
+// changes to a session inside a single transaction, so a
+// multi-mode change such as "+w-o" is all-or-nothing. A nil
+// pointer means the caller did not mention that mode and
+// the stored value must be left untouched.
+func (database *Database) SetSessionUserModes(
+	ctx context.Context,
+	sessionID int64,
+	wallops *bool,
+	oper *bool,
+) error {
+	if wallops == nil && oper == nil {
+		return nil
+	}
+
+	transaction, err := database.conn.BeginTx(ctx, nil)
+	if err != nil {
+		return fmt.Errorf("begin tx: %w", err)
+	}
+
+	if wallops != nil {
+		if _, err := transaction.ExecContext(
+			ctx,
+			`UPDATE sessions SET is_wallops = ? WHERE id = ?`,
+			boolToInt(*wallops), sessionID,
+		); err != nil {
+			_ = transaction.Rollback()
+
+			return fmt.Errorf(
+				"set session wallops: %w", err,
+			)
+		}
+	}
+
+	if oper != nil {
+		if _, err := transaction.ExecContext(
+			ctx,
+			`UPDATE sessions SET is_oper = ? WHERE id = ?`,
+			boolToInt(*oper), sessionID,
+		); err != nil {
+			_ = transaction.Rollback()
+
+			return fmt.Errorf("set session oper: %w", err)
+		}
+	}
+
+	if err := transaction.Commit(); err != nil {
+		_ = transaction.Rollback()
+
+		return fmt.Errorf("commit user modes: %w", err)
+	}
+
+	return nil
+}
+
+// boolToInt renders a Go bool as the 0/1 integer used for
+// boolean columns in the SQLite schema.
+func boolToInt(value bool) int {
+	if value {
+		return 1
+	}
+
+	return 0
+}
+
+// SetSessionWallops sets the wallops (+w) flag on a
+// session.
+func (database *Database) SetSessionWallops(
+	ctx context.Context,
+	sessionID int64,
+	enabled bool,
+) error {
+	val := 0
+	if enabled {
+		val = 1
+	}
+
+	_, err := database.conn.ExecContext(
+		ctx,
+		`UPDATE sessions SET is_wallops = ? WHERE id = ?`,
+		val, sessionID,
+	)
+	if err != nil {
+		return fmt.Errorf("set session wallops: %w", err)
+	}
+
+	return nil
+}
+
+// IsSessionWallops returns whether the session has the
+// wallops (+w) usermode set.
+func (database *Database) IsSessionWallops(
+	ctx context.Context,
+	sessionID int64,
+) (bool, error) {
+	var isWallops int
+
+	err := database.conn.QueryRowContext(
+		ctx,
+		`SELECT is_wallops FROM sessions WHERE id = ?`,
+		sessionID,
+	).Scan(&isWallops)
+	if err != nil {
+		return false, fmt.Errorf(
+			"check session wallops: %w", err,
+		)
+	}
+
+	return isWallops != 0, nil
+}
+
+// GetWallopsSessionIDs returns all session IDs that have
+// the wallops (+w) usermode set.
+func (database *Database) GetWallopsSessionIDs(
+	ctx context.Context,
+) ([]int64, error) {
+	rows, err := database.conn.QueryContext(
+		ctx,
+		`SELECT id FROM sessions WHERE is_wallops = 1`,
+	)
+	if err != nil {
+		return nil, fmt.Errorf(
+			"get wallops sessions: %w", err,
+		)
+	}
+
+	defer func() { _ = rows.Close() }()
+
+	var ids []int64
+
+	for rows.Next() {
+		var sessionID int64
+		if scanErr := rows.Scan(&sessionID); scanErr != nil {
+			return nil, fmt.Errorf(
+				"scan wallops session: %w", scanErr,
+			)
+		}
+
+		ids = append(ids, sessionID)
+	}
+
+	if err := rows.Err(); err != nil {
+		return nil, fmt.Errorf(
+			"iterate wallops sessions: %w", err,
+		)
+	}
+
+	return ids, nil
+}
+
+// UserhostInfo holds the data needed for RPL_USERHOST.
+type UserhostInfo struct {
+	Nick        string
+	Username    string
+	Hostname    string
+	IsOper      bool
+	AwayMessage string
+}
+
+// GetUserhostInfo returns USERHOST info for the given
+// nicks. Nicks with no session are omitted from the
+// result; any other database failure is returned, because
+// an unreadable row is not the same as an absent one.
+func (database *Database) GetUserhostInfo(
+	ctx context.Context,
+	nicks []string,
+) ([]UserhostInfo, error) {
+	if len(nicks) == 0 {
+		return nil, nil
+	}
+
+	results := make([]UserhostInfo, 0, len(nicks))
+
+	for _, nick := range nicks {
+		var info UserhostInfo
+
+		err := database.conn.QueryRowContext(
+			ctx,
+			`SELECT nick, username, hostname,
+			        is_oper, away_message
+			 FROM sessions WHERE nick = ?`,
+			nick,
+		).Scan(
+			&info.Nick, &info.Username, &info.Hostname,
+			&info.IsOper, &info.AwayMessage,
+		)
+		if err != nil {
+			if errors.Is(err, sql.ErrNoRows) {
+				continue // nick not online
+			}
+
+			return nil, fmt.Errorf(
+				"userhost lookup %q: %w", nick, err,
+			)
+		}
+
+		results = append(results, info)
+	}
+
+	return results, nil
+}

internal/db/queries_test.go

@@ -987,12 +987,11 @@ func TestGetOperCount(t *testing.T) {
 	sid2, _, _, err := database.CreateSession(
 		ctx, "user2", "", "", "",
 	)
+	_ = sid2
 	if err != nil {
 		t.Fatal(err)
 	}
 
-	_ = sid2
-
 	// Initially zero opers.
 	count, err := database.GetOperCount(ctx)
 	if err != nil {
@@ -1024,25 +1023,23 @@ func TestGetOperCount(t *testing.T) {
 func TestWildcardMatch(t *testing.T) {
 	t.Parallel()
 
-	const hostmask = "nick!user@host"
-
 	tests := []struct {
 		pattern string
 		input   string
 		match   bool
 	}{
-		{"*!*@*", hostmask, true},
+		{"*!*@*", "nick!user@host", true},
 		{"*!*@*.example.com", "nick!user@foo.example.com", true},
 		{"*!*@*.example.com", "nick!user@other.net", false},
 		{"badnick!*@*", "badnick!user@host", true},
 		{"badnick!*@*", "goodnick!user@host", false},
-		{hostmask, hostmask, true},
-		{hostmask, "nick!user@other", false},
+		{"nick!user@host", "nick!user@host", true},
+		{"nick!user@host", "nick!user@other", false},
 		{"*", "anything", true},
-		{"?ick!*@*", hostmask, true},
+		{"?ick!*@*", "nick!user@host", true},
 		{"?ick!*@*", "nn!user@host", false},
 		// Case-insensitive.
-		{"Nick!*@*", hostmask, true},
+		{"Nick!*@*", "nick!user@host", true},
 	}
 
 	for _, tc := range tests {
@@ -1491,3 +1488,127 @@ func TestChannelUserLimit(t *testing.T) {
 		t.Fatalf("expected 0, got %d", limit)
 	}
 }
+
+// TestSetSessionUserModesIsAtomic proves that a multi-mode
+// change is all-or-nothing.  A trigger makes the is_oper
+// UPDATE fail after the is_wallops UPDATE has already run,
+// which is exactly the "+w-o" partial-failure the previous
+// implementation exhibited: it issued the two UPDATEs
+// independently, so +w persisted while the caller reported
+// total failure.
+func TestSetSessionUserModesIsAtomic(t *testing.T) {
+	t.Parallel()
+
+	database := setupTestDB(t)
+	ctx := t.Context()
+
+	sessionID, _, _, err := database.CreateSession(
+		ctx, "alice", "", "", "",
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	err = database.ExecForTest(ctx,
+		`CREATE TRIGGER reject_oper
+		 BEFORE UPDATE OF is_oper ON sessions
+		 BEGIN SELECT RAISE(ABORT, 'oper write rejected');
+		 END`,
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	wallops := true
+	oper := false
+
+	err = database.SetSessionUserModes(
+		ctx, sessionID, &wallops, &oper,
+	)
+	if err == nil {
+		t.Fatal("expected the rejected oper write to fail")
+	}
+
+	gotWallops, err := database.IsSessionWallops(
+		ctx, sessionID,
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if gotWallops {
+		t.Error(
+			"wallops persisted despite the transaction " +
+				"failing; the apply stage is not atomic",
+		)
+	}
+}
+
+// TestSetSessionUserModesAppliesBoth is the success-path
+// counterpart: when nothing fails, both flags are written,
+// and a nil pointer leaves that flag untouched.
+func TestSetSessionUserModesAppliesBoth(t *testing.T) {
+	t.Parallel()
+
+	database := setupTestDB(t)
+	ctx := t.Context()
+
+	sessionID, _, _, err := database.CreateSession(
+		ctx, "alice", "", "", "",
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if err := database.SetSessionOper(
+		ctx, sessionID, true,
+	); err != nil {
+		t.Fatal(err)
+	}
+
+	wallops := true
+	oper := false
+
+	if err := database.SetSessionUserModes(
+		ctx, sessionID, &wallops, &oper,
+	); err != nil {
+		t.Fatal(err)
+	}
+
+	gotWallops, err := database.IsSessionWallops(
+		ctx, sessionID,
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	gotOper, err := database.IsSessionOper(ctx, sessionID)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if !gotWallops || gotOper {
+		t.Errorf(
+			"want wallops=true oper=false, got %v/%v",
+			gotWallops, gotOper,
+		)
+	}
+
+	// A nil pointer must leave the stored value alone.
+	if err := database.SetSessionUserModes(
+		ctx, sessionID, nil, nil,
+	); err != nil {
+		t.Fatal(err)
+	}
+
+	gotWallops, err = database.IsSessionWallops(
+		ctx, sessionID,
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if !gotWallops {
+		t.Error("nil pointers must not clear wallops")
+	}
+}

internal/db/schema/001_initial.sql

@@ -10,6 +10,7 @@ CREATE TABLE IF NOT EXISTS sessions (
     hostname TEXT NOT NULL DEFAULT '',
     ip TEXT NOT NULL DEFAULT '',
     is_oper INTEGER NOT NULL DEFAULT 0,
+    is_wallops INTEGER NOT NULL DEFAULT 0,
     password_hash TEXT NOT NULL DEFAULT '',
     signing_key TEXT NOT NULL DEFAULT '',
     away_message TEXT NOT NULL DEFAULT '',

internal/handlers/api.go

@@ -125,18 +125,21 @@ func (hdlr *Handlers) authSession(
 }
 
 // setAuthCookie sets the authentication cookie on the
-// response. It is always Secure: the server runs behind a
-// TLS-terminating reverse proxy.
+// response.
 func (hdlr *Handlers) setAuthCookie(
 	writer http.ResponseWriter,
+	request *http.Request,
 	token string,
 ) {
+	secure := request.TLS != nil ||
+		request.Header.Get("X-Forwarded-Proto") == "https"
+
 	http.SetCookie(writer, &http.Cookie{ //nolint:exhaustruct // optional fields
 		Name:     authCookieName,
 		Value:    token,
 		Path:     "/",
 		HttpOnly: true,
-		Secure:   true,
+		Secure:   secure,
 		SameSite: http.SameSiteStrictMode,
 	})
 }
@@ -145,13 +148,17 @@ func (hdlr *Handlers) setAuthCookie(
 // the client.
 func (hdlr *Handlers) clearAuthCookie(
 	writer http.ResponseWriter,
+	request *http.Request,
 ) {
+	secure := request.TLS != nil ||
+		request.Header.Get("X-Forwarded-Proto") == "https"
+
 	http.SetCookie(writer, &http.Cookie{ //nolint:exhaustruct // optional fields
 		Name:     authCookieName,
 		Value:    "",
 		Path:     "/",
 		HttpOnly: true,
-		Secure:   true,
+		Secure:   secure,
 		SameSite: http.SameSiteStrictMode,
 		MaxAge:   -1,
 	})
@@ -165,7 +172,7 @@ func (hdlr *Handlers) requireAuth(
 		hdlr.authSession(request)
 	if err != nil {
 		hdlr.respondJSON(writer, request, map[string]any{
-			errorKey:  "not registered",
+			"error":   "not registered",
 			"numeric": irc.ErrNotRegistered,
 		}, http.StatusUnauthorized)
 
@@ -278,11 +285,11 @@ func (hdlr *Handlers) executeCreateSession(
 
 	hdlr.deliverMOTD(request, clientID, sessionID, nick)
 
-	hdlr.setAuthCookie(writer, token)
+	hdlr.setAuthCookie(writer, request, token)
 
 	hdlr.respondJSON(writer, request, map[string]any{
-		"id":    sessionID,
-		nickKey: nick,
+		"id":   sessionID,
+		"nick": nick,
 	}, http.StatusCreated)
 }
 
@@ -636,7 +643,7 @@ func (hdlr *Handlers) HandleState() http.HandlerFunc {
 
 		hdlr.respondJSON(writer, request, map[string]any{
 			"id":       sessionID,
-			nickKey:    nick,
+			"nick":     nick,
 			"channels": channels,
 		}, http.StatusOK)
 	}
@@ -962,10 +969,12 @@ func (hdlr *Handlers) dispatchCommand(
 	bodyLines func() []string,
 ) {
 	switch command {
-	case irc.CmdAway:
-		hdlr.handleAway(
+	case irc.CmdAway, irc.CmdNick,
+		irc.CmdPass, irc.CmdInvite:
+		hdlr.dispatchBodyOnlyCommand(
 			writer, request,
-			sessionID, clientID, nick, bodyLines,
+			sessionID, clientID, nick,
+			command, bodyLines,
 		)
 	case irc.CmdPrivmsg, irc.CmdNotice:
 		hdlr.handlePrivmsg(
@@ -984,27 +993,12 @@ func (hdlr *Handlers) dispatchCommand(
 			writer, request,
 			sessionID, clientID, nick, target, body,
 		)
-	case irc.CmdNick:
-		hdlr.handleNick(
-			writer, request,
-			sessionID, clientID, nick, bodyLines,
-		)
-	case irc.CmdPass:
-		hdlr.handlePass(
-			writer, request,
-			sessionID, clientID, nick, bodyLines,
-		)
 	case irc.CmdTopic:
 		hdlr.handleTopic(
 			writer, request,
 			sessionID, clientID, nick,
 			target, body, bodyLines,
 		)
-	case irc.CmdInvite:
-		hdlr.handleInvite(
-			writer, request,
-			sessionID, clientID, nick, bodyLines,
-		)
 	case irc.CmdKick:
 		hdlr.handleKick(
 			writer, request,
@@ -1015,12 +1009,15 @@ func (hdlr *Handlers) dispatchCommand(
 		hdlr.handleQuit(
 			writer, request, sessionID, nick, body,
 		)
-	case irc.CmdOper:
-		hdlr.handleOper(
+	case irc.CmdOper, irc.CmdKill, irc.CmdWallops:
+		hdlr.dispatchOperCommand(
 			writer, request,
-			sessionID, clientID, nick, bodyLines,
+			sessionID, clientID, nick,
+			command, bodyLines,
 		)
-	case irc.CmdMotd, irc.CmdPing:
+	case irc.CmdMotd, irc.CmdPing,
+		irc.CmdVersion, irc.CmdAdmin,
+		irc.CmdInfo, irc.CmdTime:
 		hdlr.dispatchInfoCommand(
 			writer, request,
 			sessionID, clientID, nick,
@@ -1075,6 +1072,11 @@ func (hdlr *Handlers) dispatchQueryCommand(
 			writer, request,
 			sessionID, clientID, nick,
 		)
+	case irc.CmdUserhost:
+		hdlr.handleUserhost(
+			writer, request,
+			sessionID, clientID, nick, bodyLines,
+		)
 	default:
 		hdlr.enqueueNumeric(
 			request.Context(), clientID,
@@ -1083,7 +1085,7 @@ func (hdlr *Handlers) dispatchQueryCommand(
 		)
 		hdlr.broker.Notify(sessionID)
 		hdlr.respondJSON(writer, request,
-			map[string]string{statusKey: statusError},
+			map[string]string{"status": "error"},
 			http.StatusOK)
 	}
 }
@@ -1105,7 +1107,7 @@ func (hdlr *Handlers) handlePrivmsg(
 		)
 		hdlr.broker.Notify(sessionID)
 		hdlr.respondJSON(writer, request,
-			map[string]string{statusKey: statusError},
+			map[string]string{"status": "error"},
 			http.StatusOK)
 
 		return
@@ -1120,7 +1122,7 @@ func (hdlr *Handlers) handlePrivmsg(
 		)
 		hdlr.broker.Notify(sessionID)
 		hdlr.respondJSON(writer, request,
-			map[string]string{statusKey: statusError},
+			map[string]string{"status": "error"},
 			http.StatusOK)
 
 		return
@@ -1162,7 +1164,7 @@ func (hdlr *Handlers) respondIRCError(
 	)
 	hdlr.broker.Notify(sessionID)
 	hdlr.respondJSON(writer, request,
-		map[string]string{statusKey: statusError},
+		map[string]string{"status": "error"},
 		http.StatusOK)
 }
 
@@ -1250,7 +1252,7 @@ func (hdlr *Handlers) handleChannelMsg(
 	hdlr.broker.Notify(sessionID)
 
 	hdlr.respondJSON(writer, request,
-		map[string]string{"id": uuid, statusKey: "sent"},
+		map[string]string{"id": uuid, "status": "sent"},
 		http.StatusOK)
 }
 
@@ -1440,7 +1442,7 @@ func (hdlr *Handlers) handleDirectMsg(
 
 	hdlr.respondJSON(writer, request,
 		map[string]string{
-			"id": result.UUID, statusKey: "sent",
+			"id": result.UUID, "status": "sent",
 		},
 		http.StatusOK)
 }
@@ -1515,7 +1517,7 @@ func (hdlr *Handlers) executeJoin(
 
 	hdlr.respondJSON(writer, request,
 		map[string]string{
-			statusKey: "joined",
+			"status":  "joined",
 			"channel": channel,
 		},
 		http.StatusOK)
@@ -1672,7 +1674,6 @@ func (hdlr *Handlers) handlePart(
 
 	// Extract reason from body for the service call.
 	reason := ""
-
 	if body != nil {
 		var lines []string
 		if json.Unmarshal(body, &lines) == nil &&
@@ -1694,7 +1695,7 @@ func (hdlr *Handlers) handlePart(
 
 	hdlr.respondJSON(writer, request,
 		map[string]string{
-			statusKey: "parted",
+			"status":  "parted",
 			"channel": channel,
 		},
 		http.StatusOK)
@@ -1733,7 +1734,7 @@ func (hdlr *Handlers) handleNick(
 	if newNick == nick {
 		hdlr.respondJSON(writer, request,
 			map[string]string{
-				statusKey: "ok", nickKey: newNick,
+				"status": "ok", "nick": newNick,
 			},
 			http.StatusOK)
 
@@ -1764,7 +1765,7 @@ func (hdlr *Handlers) executeNickChange(
 
 	hdlr.respondJSON(writer, request,
 		map[string]string{
-			statusKey: "ok", nickKey: newNick,
+			"status": "ok", "nick": newNick,
 		},
 		http.StatusOK)
 }
@@ -1825,7 +1826,7 @@ func (hdlr *Handlers) handleTopic(
 
 	hdlr.respondJSON(writer, request,
 		map[string]string{
-			statusKey: "ok", "topic": topic,
+			"status": "ok", "topic": topic,
 		},
 		http.StatusOK)
 }
@@ -1868,7 +1869,8 @@ func (hdlr *Handlers) deliverSetTopicNumerics(
 }
 
 // dispatchInfoCommand handles informational IRC commands
-// that produce server-side numerics (MOTD, PING).
+// that produce server-side numerics (MOTD, PING,
+// VERSION, ADMIN, INFO, TIME).
 func (hdlr *Handlers) dispatchInfoCommand(
 	writer http.ResponseWriter,
 	request *http.Request,
@@ -1879,7 +1881,7 @@ func (hdlr *Handlers) dispatchInfoCommand(
 	_ = target
 	_ = bodyLines
 
-	okResp := map[string]string{statusKey: "ok"}
+	okResp := map[string]string{"status": "ok"}
 
 	switch command {
 	case irc.CmdMotd:
@@ -1894,6 +1896,34 @@ func (hdlr *Handlers) dispatchInfoCommand(
 			},
 			http.StatusOK)
 
+		return
+	case irc.CmdVersion:
+		hdlr.handleVersion(
+			writer, request,
+			sessionID, clientID, nick,
+		)
+
+		return
+	case irc.CmdAdmin:
+		hdlr.handleAdmin(
+			writer, request,
+			sessionID, clientID, nick,
+		)
+
+		return
+	case irc.CmdInfo:
+		hdlr.handleInfo(
+			writer, request,
+			sessionID, clientID, nick,
+		)
+
+		return
+	case irc.CmdTime:
+		hdlr.handleTime(
+			writer, request,
+			sessionID, clientID, nick,
+		)
+
 		return
 	}
 
@@ -1910,7 +1940,6 @@ func (hdlr *Handlers) handleQuit(
 	body json.RawMessage,
 ) {
 	reason := "Client quit"
-
 	if body != nil {
 		var lines []string
 		if json.Unmarshal(body, &lines) == nil &&
@@ -1923,10 +1952,10 @@ func (hdlr *Handlers) handleQuit(
 		request.Context(), sessionID, nick, reason,
 	)
 
-	hdlr.clearAuthCookie(writer)
+	hdlr.clearAuthCookie(writer, request)
 
 	hdlr.respondJSON(writer, request,
-		map[string]string{statusKey: "quit"},
+		map[string]string{"status": "quit"},
 		http.StatusOK)
 }
 
@@ -1951,15 +1980,11 @@ func (hdlr *Handlers) handleMode(
 
 	channel := target
 	if !strings.HasPrefix(channel, "#") {
-		// User mode query — return empty modes.
-		hdlr.enqueueNumeric(
-			request.Context(), clientID,
-			irc.RplUmodeIs, nick, nil, "+",
+		hdlr.handleUserMode(
+			writer, request,
+			sessionID, clientID, nick, target,
+			bodyLines,
 		)
-		hdlr.broker.Notify(sessionID)
-		hdlr.respondJSON(writer, request,
-			map[string]string{statusKey: "ok"},
-			http.StatusOK)
 
 		return
 	}
@@ -2059,7 +2084,7 @@ func (hdlr *Handlers) queryChannelMode(
 
 	hdlr.broker.Notify(sessionID)
 	hdlr.respondJSON(writer, request,
-		map[string]string{statusKey: "ok"},
+		map[string]string{"status": "ok"},
 		http.StatusOK)
 }
 
@@ -2236,7 +2261,7 @@ func (hdlr *Handlers) applyParameterizedMode(
 		)
 		hdlr.broker.Notify(sessionID)
 		hdlr.respondJSON(writer, request,
-			map[string]string{statusKey: statusError},
+			map[string]string{"status": "error"},
 			http.StatusOK)
 	}
 }
@@ -2302,7 +2327,7 @@ func (hdlr *Handlers) applyUserMode(
 	)
 
 	hdlr.respondJSON(writer, request,
-		map[string]string{statusKey: "ok"},
+		map[string]string{"status": "ok"},
 		http.StatusOK)
 }
 
@@ -2348,7 +2373,7 @@ func (hdlr *Handlers) setChannelFlag(
 	)
 
 	hdlr.respondJSON(writer, request,
-		map[string]string{statusKey: "ok"},
+		map[string]string{"status": "ok"},
 		http.StatusOK)
 }
 
@@ -2432,7 +2457,7 @@ func (hdlr *Handlers) setHashcashMode(
 	)
 	hdlr.broker.Notify(sessionID)
 	hdlr.respondJSON(writer, request,
-		map[string]string{statusKey: "ok"},
+		map[string]string{"status": "ok"},
 		http.StatusOK)
 }
 
@@ -2481,7 +2506,7 @@ func (hdlr *Handlers) clearHashcashMode(
 	)
 	hdlr.broker.Notify(sessionID)
 	hdlr.respondJSON(writer, request,
-		map[string]string{statusKey: "ok"},
+		map[string]string{"status": "ok"},
 		http.StatusOK)
 }
 
@@ -2586,7 +2611,7 @@ func (hdlr *Handlers) executeBanChange(
 	}
 
 	hdlr.respondJSON(writer, request,
-		map[string]string{statusKey: "ok"},
+		map[string]string{"status": "ok"},
 		http.StatusOK)
 }
 
@@ -2640,7 +2665,7 @@ func (hdlr *Handlers) listBans(
 
 	hdlr.broker.Notify(sessionID)
 	hdlr.respondJSON(writer, request,
-		map[string]string{statusKey: "ok"},
+		map[string]string{"status": "ok"},
 		http.StatusOK)
 }
 
@@ -2704,7 +2729,7 @@ func (hdlr *Handlers) setChannelKeyMode(
 	}
 
 	hdlr.respondJSON(writer, request,
-		map[string]string{statusKey: "ok"},
+		map[string]string{"status": "ok"},
 		http.StatusOK)
 }
 
@@ -2753,7 +2778,7 @@ func (hdlr *Handlers) clearChannelKeyMode(
 	}
 
 	hdlr.respondJSON(writer, request,
-		map[string]string{statusKey: "ok"},
+		map[string]string{"status": "ok"},
 		http.StatusOK)
 }
 
@@ -2828,7 +2853,7 @@ func (hdlr *Handlers) setChannelLimitMode(
 	}
 
 	hdlr.respondJSON(writer, request,
-		map[string]string{statusKey: "ok"},
+		map[string]string{"status": "ok"},
 		http.StatusOK)
 }
 
@@ -2878,7 +2903,7 @@ func (hdlr *Handlers) clearChannelLimitMode(
 	}
 
 	hdlr.respondJSON(writer, request,
-		map[string]string{statusKey: "ok"},
+		map[string]string{"status": "ok"},
 		http.StatusOK)
 }
 
@@ -3045,7 +3070,7 @@ func (hdlr *Handlers) executeInvite(
 	}
 
 	hdlr.respondJSON(writer, request,
-		map[string]string{statusKey: "ok"},
+		map[string]string{"status": "ok"},
 		http.StatusOK)
 }
 
@@ -3114,7 +3139,7 @@ func (hdlr *Handlers) handleNames(
 
 	hdlr.broker.Notify(sessionID)
 	hdlr.respondJSON(writer, request,
-		map[string]string{statusKey: "ok"},
+		map[string]string{"status": "ok"},
 		http.StatusOK)
 }
 
@@ -3167,7 +3192,7 @@ func (hdlr *Handlers) handleList(
 
 	hdlr.broker.Notify(sessionID)
 	hdlr.respondJSON(writer, request,
-		map[string]string{statusKey: "ok"},
+		map[string]string{"status": "ok"},
 		http.StatusOK)
 }
 
@@ -3257,7 +3282,7 @@ func (hdlr *Handlers) executeWhois(
 
 	hdlr.broker.Notify(sessionID)
 	hdlr.respondJSON(writer, request,
-		map[string]string{statusKey: "ok"},
+		map[string]string{"status": "ok"},
 		http.StatusOK)
 }
 
@@ -3282,7 +3307,7 @@ func (hdlr *Handlers) whoisNotFound(
 	)
 	hdlr.broker.Notify(sessionID)
 	hdlr.respondJSON(writer, request,
-		map[string]string{statusKey: "ok"},
+		map[string]string{"status": "ok"},
 		http.StatusOK)
 }
 
@@ -3449,7 +3474,7 @@ func (hdlr *Handlers) handleWho(
 		)
 		hdlr.broker.Notify(sessionID)
 		hdlr.respondJSON(writer, request,
-			map[string]string{statusKey: "ok"},
+			map[string]string{"status": "ok"},
 			http.StatusOK)
 
 		return
@@ -3491,7 +3516,7 @@ func (hdlr *Handlers) handleWho(
 
 	hdlr.broker.Notify(sessionID)
 	hdlr.respondJSON(writer, request,
-		map[string]string{statusKey: "ok"},
+		map[string]string{"status": "ok"},
 		http.StatusOK)
 }
 
@@ -3507,7 +3532,7 @@ func (hdlr *Handlers) handleLusers(
 	)
 	hdlr.broker.Notify(sessionID)
 	hdlr.respondJSON(writer, request,
-		map[string]string{statusKey: "ok"},
+		map[string]string{"status": "ok"},
 		http.StatusOK)
 }
 
@@ -3698,10 +3723,10 @@ func (hdlr *Handlers) HandleLogout() http.HandlerFunc {
 			)
 		}
 
-		hdlr.clearAuthCookie(writer)
+		hdlr.clearAuthCookie(writer, request)
 
 		hdlr.respondJSON(writer, request,
-			map[string]string{statusKey: "ok"},
+			map[string]string{"status": "ok"},
 			http.StatusOK)
 	}
 }
@@ -3804,7 +3829,7 @@ func (hdlr *Handlers) handleOper(
 
 	hdlr.broker.Notify(sessionID)
 	hdlr.respondJSON(writer, request,
-		map[string]string{statusKey: "ok"},
+		map[string]string{"status": "ok"},
 		http.StatusOK)
 }
 
@@ -3852,7 +3877,7 @@ func (hdlr *Handlers) handleAway(
 
 	hdlr.broker.Notify(sessionID)
 	hdlr.respondJSON(writer, request,
-		map[string]string{statusKey: "ok"},
+		map[string]string{"status": "ok"},
 		http.StatusOK)
 }
 
@@ -3914,7 +3939,7 @@ func (hdlr *Handlers) handleKick(
 	}
 
 	hdlr.respondJSON(writer, request,
-		map[string]string{statusKey: "ok"},
+		map[string]string{"status": "ok"},
 		http.StatusOK)
 }
 
@@ -3938,7 +3963,10 @@ func (hdlr *Handlers) deliverWhoisIdle(
 		return
 	}
 
-	idleSeconds := max(int64(time.Since(lastSeen).Seconds()), 0)
+	idleSeconds := int64(time.Since(lastSeen).Seconds())
+	if idleSeconds < 0 {
+		idleSeconds = 0
+	}
 
 	signonUnix := strconv.FormatInt(
 		createdAt.Unix(), 10,

internal/handlers/auth.go

@@ -117,11 +117,11 @@ func (hdlr *Handlers) executeLogin(
 		request, clientID, sessionID, nick,
 	)
 
-	hdlr.setAuthCookie(writer, token)
+	hdlr.setAuthCookie(writer, request, token)
 
 	hdlr.respondJSON(writer, request, map[string]any{
-		"id":    sessionID,
-		nickKey: nick,
+		"id":   sessionID,
+		"nick": nick,
 	}, http.StatusOK)
 }
 
@@ -177,6 +177,6 @@ func (hdlr *Handlers) handlePass(
 	}
 
 	hdlr.respondJSON(writer, request,
-		map[string]string{statusKey: "ok"},
+		map[string]string{"status": "ok"},
 		http.StatusOK)
 }

internal/handlers/handlers.go

@@ -24,14 +24,6 @@ import (
 
 var errUnauthorized = errors.New("unauthorized")
 
-// Field names and values used in many JSON responses.
-const (
-	statusKey   = "status"
-	statusError = "error"
-	errorKey    = "error"
-	nickKey     = "nick"
-)
-
 // Params defines the dependencies for creating Handlers.
 type Params struct {
 	fx.In
@@ -145,7 +137,7 @@ func (hdlr *Handlers) respondError(
 ) {
 	hdlr.respondJSON(
 		writer, request,
-		map[string]string{errorKey: msg},
+		map[string]string{"error": msg},
 		status,
 	)
 }

internal/handlers/utility.go

@@ -0,0 +1,576 @@
+package handlers
+
+import (
+	"encoding/json"
+	"errors"
+	"net/http"
+	"strings"
+	"time"
+
+	"sneak.berlin/go/neoirc/internal/db"
+	"sneak.berlin/go/neoirc/internal/service"
+	"sneak.berlin/go/neoirc/pkg/irc"
+)
+
+// maxUserhostNicks is the maximum number of nicks allowed
+// in a single USERHOST query (RFC 2812).
+const maxUserhostNicks = 5
+
+// dispatchBodyOnlyCommand routes commands that take
+// (writer, request, sessionID, clientID, nick, bodyLines).
+func (hdlr *Handlers) dispatchBodyOnlyCommand(
+	writer http.ResponseWriter,
+	request *http.Request,
+	sessionID, clientID int64,
+	nick, command string,
+	bodyLines func() []string,
+) {
+	switch command {
+	case irc.CmdAway:
+		hdlr.handleAway(
+			writer, request,
+			sessionID, clientID, nick, bodyLines,
+		)
+	case irc.CmdNick:
+		hdlr.handleNick(
+			writer, request,
+			sessionID, clientID, nick, bodyLines,
+		)
+	case irc.CmdPass:
+		hdlr.handlePass(
+			writer, request,
+			sessionID, clientID, nick, bodyLines,
+		)
+	case irc.CmdInvite:
+		hdlr.handleInvite(
+			writer, request,
+			sessionID, clientID, nick, bodyLines,
+		)
+	}
+}
+
+// dispatchOperCommand routes oper-related commands (OPER,
+// KILL, WALLOPS) to their handlers.
+func (hdlr *Handlers) dispatchOperCommand(
+	writer http.ResponseWriter,
+	request *http.Request,
+	sessionID, clientID int64,
+	nick, command string,
+	bodyLines func() []string,
+) {
+	switch command {
+	case irc.CmdOper:
+		hdlr.handleOper(
+			writer, request,
+			sessionID, clientID, nick, bodyLines,
+		)
+	case irc.CmdKill:
+		hdlr.handleKill(
+			writer, request,
+			sessionID, clientID, nick, bodyLines,
+		)
+	case irc.CmdWallops:
+		hdlr.handleWallops(
+			writer, request,
+			sessionID, clientID, nick, bodyLines,
+		)
+	}
+}
+
+// handleUserhost handles the USERHOST command.
+// Returns user@host info for up to 5 nicks.
+func (hdlr *Handlers) handleUserhost(
+	writer http.ResponseWriter,
+	request *http.Request,
+	sessionID, clientID int64,
+	nick string,
+	bodyLines func() []string,
+) {
+	ctx := request.Context()
+
+	lines := bodyLines()
+	if len(lines) == 0 {
+		hdlr.respondIRCError(
+			writer, request, clientID, sessionID,
+			irc.ErrNeedMoreParams, nick,
+			[]string{irc.CmdUserhost},
+			"Not enough parameters",
+		)
+
+		return
+	}
+
+	// Limit to 5 nicks per RFC 2812.
+	nicks := lines
+	if len(nicks) > maxUserhostNicks {
+		nicks = nicks[:maxUserhostNicks]
+	}
+
+	infos, err := hdlr.params.Database.GetUserhostInfo(
+		ctx, nicks,
+	)
+	if err != nil {
+		hdlr.log.Error(
+			"userhost query failed", "error", err,
+		)
+		hdlr.respondError(
+			writer, request,
+			"internal error",
+			http.StatusInternalServerError,
+		)
+
+		return
+	}
+
+	replyStr := hdlr.buildUserhostReply(infos)
+
+	hdlr.enqueueNumeric(
+		ctx, clientID, irc.RplUserHost, nick, nil,
+		replyStr,
+	)
+
+	hdlr.broker.Notify(sessionID)
+	hdlr.respondJSON(writer, request,
+		map[string]string{"status": "ok"},
+		http.StatusOK)
+}
+
+// buildUserhostReply builds the RPL_USERHOST reply
+// string per RFC 2812.
+func (hdlr *Handlers) buildUserhostReply(
+	infos []db.UserhostInfo,
+) string {
+	replies := make([]string, 0, len(infos))
+
+	for idx := range infos {
+		info := &infos[idx]
+
+		username := info.Username
+		if username == "" {
+			username = info.Nick
+		}
+
+		hostname := info.Hostname
+		if hostname == "" {
+			hostname = hdlr.serverName()
+		}
+
+		operStar := ""
+		if info.IsOper {
+			operStar = "*"
+		}
+
+		awayPrefix := "+"
+		if info.AwayMessage != "" {
+			awayPrefix = "-"
+		}
+
+		replies = append(replies,
+			info.Nick+operStar+"="+
+				awayPrefix+username+"@"+hostname,
+		)
+	}
+
+	return strings.Join(replies, " ")
+}
+
+// handleVersion handles the VERSION command.
+// Returns the server version string.
+func (hdlr *Handlers) handleVersion(
+	writer http.ResponseWriter,
+	request *http.Request,
+	sessionID, clientID int64,
+	nick string,
+) {
+	ctx := request.Context()
+	srvName := hdlr.serverName()
+	version := hdlr.svc.ServerVersion()
+
+	// 351 RPL_VERSION
+	hdlr.enqueueNumeric(
+		ctx, clientID, irc.RplVersion, nick,
+		[]string{version + ".", srvName},
+		"",
+	)
+
+	hdlr.broker.Notify(sessionID)
+	hdlr.respondJSON(writer, request,
+		map[string]string{"status": "ok"},
+		http.StatusOK)
+}
+
+// handleAdmin handles the ADMIN command.
+// Returns server admin contact info.
+func (hdlr *Handlers) handleAdmin(
+	writer http.ResponseWriter,
+	request *http.Request,
+	sessionID, clientID int64,
+	nick string,
+) {
+	ctx := request.Context()
+	srvName := hdlr.serverName()
+
+	// 256 RPL_ADMINME
+	hdlr.enqueueNumeric(
+		ctx, clientID, irc.RplAdminMe, nick,
+		[]string{srvName},
+		"Administrative info",
+	)
+
+	// 257 RPL_ADMINLOC1
+	hdlr.enqueueNumeric(
+		ctx, clientID, irc.RplAdminLoc1, nick, nil,
+		"neoirc server",
+	)
+
+	// 258 RPL_ADMINLOC2
+	hdlr.enqueueNumeric(
+		ctx, clientID, irc.RplAdminLoc2, nick, nil,
+		"IRC over HTTP",
+	)
+
+	// 259 RPL_ADMINEMAIL
+	hdlr.enqueueNumeric(
+		ctx, clientID, irc.RplAdminEmail, nick, nil,
+		"admin@"+srvName,
+	)
+
+	hdlr.broker.Notify(sessionID)
+	hdlr.respondJSON(writer, request,
+		map[string]string{"status": "ok"},
+		http.StatusOK)
+}
+
+// handleInfo handles the INFO command.
+// Returns server software information.
+func (hdlr *Handlers) handleInfo(
+	writer http.ResponseWriter,
+	request *http.Request,
+	sessionID, clientID int64,
+	nick string,
+) {
+	ctx := request.Context()
+
+	for _, line := range hdlr.svc.InfoLines() {
+		// 371 RPL_INFO
+		hdlr.enqueueNumeric(
+			ctx, clientID, irc.RplInfo, nick, nil,
+			line,
+		)
+	}
+
+	// 374 RPL_ENDOFINFO
+	hdlr.enqueueNumeric(
+		ctx, clientID, irc.RplEndOfInfo, nick, nil,
+		"End of /INFO list",
+	)
+
+	hdlr.broker.Notify(sessionID)
+	hdlr.respondJSON(writer, request,
+		map[string]string{"status": "ok"},
+		http.StatusOK)
+}
+
+// handleTime handles the TIME command.
+// Returns the server's local time in RFC format.
+func (hdlr *Handlers) handleTime(
+	writer http.ResponseWriter,
+	request *http.Request,
+	sessionID, clientID int64,
+	nick string,
+) {
+	ctx := request.Context()
+	srvName := hdlr.serverName()
+
+	// 391 RPL_TIME
+	hdlr.enqueueNumeric(
+		ctx, clientID, irc.RplTime, nick,
+		[]string{srvName},
+		time.Now().Format(time.RFC1123),
+	)
+
+	hdlr.broker.Notify(sessionID)
+	hdlr.respondJSON(writer, request,
+		map[string]string{"status": "ok"},
+		http.StatusOK)
+}
+
+// handleKill handles the KILL command.
+// Forcibly disconnects a user (oper only).
+func (hdlr *Handlers) handleKill(
+	writer http.ResponseWriter,
+	request *http.Request,
+	sessionID, clientID int64,
+	nick string,
+	bodyLines func() []string,
+) {
+	ctx := request.Context()
+
+	// Check oper status.
+	isOper, err := hdlr.params.Database.IsSessionOper(
+		ctx, sessionID,
+	)
+	if err != nil || !isOper {
+		hdlr.respondIRCError(
+			writer, request, clientID, sessionID,
+			irc.ErrNoPrivileges, nick, nil,
+			"Permission Denied- You're not an IRC operator",
+		)
+
+		return
+	}
+
+	lines := bodyLines()
+
+	var targetNick string
+	if len(lines) > 0 {
+		targetNick = strings.TrimSpace(lines[0])
+	}
+
+	if targetNick == "" {
+		hdlr.respondIRCError(
+			writer, request, clientID, sessionID,
+			irc.ErrNeedMoreParams, nick,
+			[]string{irc.CmdKill},
+			"Not enough parameters",
+		)
+
+		return
+	}
+
+	reason := "KILLed"
+	if len(lines) > 1 {
+		reason = lines[1]
+	}
+
+	targetSID, lookupErr := hdlr.params.Database.
+		GetSessionByNick(ctx, targetNick)
+	if lookupErr != nil {
+		hdlr.respondIRCError(
+			writer, request, clientID, sessionID,
+			irc.ErrNoSuchNick, nick,
+			[]string{targetNick},
+			"No such nick/channel",
+		)
+
+		return
+	}
+
+	// Do not allow killing yourself.
+	if targetSID == sessionID {
+		hdlr.respondIRCError(
+			writer, request, clientID, sessionID,
+			irc.ErrCantKillServer, nick, nil,
+			"You cannot KILL yourself",
+		)
+
+		return
+	}
+
+	quitReason := "Killed (" + nick + " (" + reason + "))"
+
+	// KillSession broadcasts the QUIT, deletes the session
+	// and disconnects the victim's wire connection if it
+	// holds one.
+	hdlr.svc.KillSession(
+		ctx, targetSID, targetNick, quitReason,
+	)
+
+	hdlr.respondJSON(writer, request,
+		map[string]string{"status": "ok"},
+		http.StatusOK)
+}
+
+// handleWallops handles the WALLOPS command.
+// Broadcasts a message to all users with +w usermode
+// (oper only).
+func (hdlr *Handlers) handleWallops(
+	writer http.ResponseWriter,
+	request *http.Request,
+	sessionID, clientID int64,
+	nick string,
+	bodyLines func() []string,
+) {
+	ctx := request.Context()
+
+	// Check oper status.
+	isOper, err := hdlr.params.Database.IsSessionOper(
+		ctx, sessionID,
+	)
+	if err != nil || !isOper {
+		hdlr.respondIRCError(
+			writer, request, clientID, sessionID,
+			irc.ErrNoPrivileges, nick, nil,
+			"Permission Denied- You're not an IRC operator",
+		)
+
+		return
+	}
+
+	lines := bodyLines()
+	if len(lines) == 0 {
+		hdlr.respondIRCError(
+			writer, request, clientID, sessionID,
+			irc.ErrNeedMoreParams, nick,
+			[]string{irc.CmdWallops},
+			"Not enough parameters",
+		)
+
+		return
+	}
+
+	message := strings.Join(lines, " ")
+
+	wallopsSIDs, err := hdlr.params.Database.
+		GetWallopsSessionIDs(ctx)
+	if err != nil {
+		hdlr.log.Error(
+			"get wallops sessions failed", "error", err,
+		)
+		hdlr.respondError(
+			writer, request,
+			"internal error",
+			http.StatusInternalServerError,
+		)
+
+		return
+	}
+
+	if len(wallopsSIDs) > 0 {
+		body, mErr := json.Marshal([]string{message})
+		if mErr != nil {
+			hdlr.log.Error(
+				"marshal wallops body", "error", mErr,
+			)
+			hdlr.respondError(
+				writer, request,
+				"internal error",
+				http.StatusInternalServerError,
+			)
+
+			return
+		}
+
+		_ = hdlr.fanOutSilent(
+			request, irc.CmdWallops, nick, "*",
+			json.RawMessage(body), wallopsSIDs,
+		)
+	}
+
+	hdlr.respondJSON(writer, request,
+		map[string]string{"status": "ok"},
+		http.StatusOK)
+}
+
+// handleUserMode handles user mode queries and changes
+// (e.g., MODE nick, MODE nick +w). Delegates to the
+// shared service.ApplyUserMode / service.QueryUserMode so
+// that mode string processing is identical for both the
+// HTTP API and IRC wire protocol.
+func (hdlr *Handlers) handleUserMode(
+	writer http.ResponseWriter,
+	request *http.Request,
+	sessionID, clientID int64,
+	nick, target string,
+	bodyLines func() []string,
+) {
+	ctx := request.Context()
+
+	// Users can only query or change their own modes. The
+	// check is above the query/change split so that both
+	// forms are rejected, and uses EqualFold because IRC
+	// nicks are case-insensitive — matching the wire path
+	// in ircserver.handleUserMode.
+	if target != "" && !strings.EqualFold(target, nick) {
+		hdlr.respondIRCError(
+			writer, request, clientID, sessionID,
+			irc.ErrUsersDoNotMatch, nick, nil,
+			"Can't change mode for other users",
+		)
+
+		return
+	}
+
+	lines := bodyLines()
+
+	// Mode change requested.
+	if len(lines) > 0 {
+		hdlr.changeUserMode(
+			writer, request,
+			sessionID, clientID, nick, lines[0],
+		)
+
+		return
+	}
+
+	// Mode query — delegate to shared service.
+	modeStr, err := hdlr.svc.QueryUserMode(ctx, sessionID)
+	if err != nil {
+		hdlr.log.Error(
+			"query user mode failed", "error", err,
+		)
+		hdlr.respondError(
+			writer, request,
+			"internal error",
+			http.StatusInternalServerError,
+		)
+
+		return
+	}
+
+	hdlr.enqueueNumeric(
+		ctx, clientID, irc.RplUmodeIs, nick, nil,
+		modeStr,
+	)
+	hdlr.broker.Notify(sessionID)
+	hdlr.respondJSON(writer, request,
+		map[string]string{"status": "ok"},
+		http.StatusOK)
+}
+
+// changeUserMode applies a mode string to the caller's own
+// session. The caller has already verified that the target
+// nick is the caller's own.
+func (hdlr *Handlers) changeUserMode(
+	writer http.ResponseWriter,
+	request *http.Request,
+	sessionID, clientID int64,
+	nick, modeStr string,
+) {
+	ctx := request.Context()
+
+	newModes, err := hdlr.svc.ApplyUserMode(
+		ctx, sessionID, modeStr,
+	)
+	if err != nil {
+		var ircErr *service.IRCError
+		if errors.As(err, &ircErr) {
+			hdlr.respondIRCError(
+				writer, request,
+				clientID, sessionID,
+				ircErr.Code, nick, ircErr.Params,
+				ircErr.Message,
+			)
+
+			return
+		}
+
+		hdlr.respondError(
+			writer, request,
+			"internal error",
+			http.StatusInternalServerError,
+		)
+
+		return
+	}
+
+	hdlr.enqueueNumeric(
+		ctx, clientID, irc.RplUmodeIs, nick, nil,
+		newModes,
+	)
+
+	hdlr.broker.Notify(sessionID)
+	hdlr.respondJSON(writer, request,
+		map[string]string{"status": "ok"},
+		http.StatusOK)
+}

internal/hashcash/hashcash.go

@@ -100,10 +100,9 @@ func (v *Validator) Validate(
 	dateStr := parts[2]
 	resource := parts[3]
 
-	err := v.validateHeader(
+	if err := v.validateHeader(
 		version, bitsStr, resource, requiredBits,
-	)
-	if err != nil {
+	); err != nil {
 		return err
 	}
 
@@ -112,13 +111,13 @@ func (v *Validator) Validate(
 		return err
 	}
 
-	err = validateTime(stampTime)
-	if err != nil {
+	if err := validateTime(stampTime); err != nil {
 		return err
 	}
 
-	err = validateProof(stamp, requiredBits)
-	if err != nil {
+	if err := validateProof(
+		stamp, requiredBits,
+	); err != nil {
 		return err
 	}
 

internal/ircserver/commands.go

@@ -159,7 +159,9 @@ func (c *Conn) handleJoin(
 		return
 	}
 
-	for chanName := range strings.SplitSeq(msg.Params[0], ",") {
+	channels := strings.Split(msg.Params[0], ",")
+
+	for _, chanName := range channels {
 		chanName = strings.TrimSpace(chanName)
 
 		if !strings.HasPrefix(chanName, "#") {
@@ -303,7 +305,9 @@ func (c *Conn) handlePart(
 		reason = msg.Params[1]
 	}
 
-	for ch := range strings.SplitSeq(msg.Params[0], ",") {
+	channels := strings.Split(msg.Params[0], ",")
+
+	for _, ch := range channels {
 		ch = strings.TrimSpace(ch)
 		c.partChannel(ctx, ch, reason)
 	}
@@ -345,7 +349,10 @@ func (c *Conn) handleQuit(msg *Message) {
 
 	c.send("ERROR :Closing Link: " + c.hostname +
 		" (Quit: " + reason + ")")
+
+	c.mu.Lock()
 	c.closed = true
+	c.mu.Unlock()
 }
 
 // handleTopic gets or sets a channel topic via the shared
@@ -427,7 +434,7 @@ func (c *Conn) handleMode(
 	if strings.HasPrefix(target, "#") {
 		c.handleChannelMode(ctx, msg)
 	} else {
-		c.handleUserMode(msg)
+		c.handleUserMode(ctx, msg)
 	}
 }
 
@@ -615,8 +622,8 @@ func (c *Conn) applyChannelModes(
 ) {
 	adding := true
 	argIdx := 0
-
-	var applied, appliedArgs strings.Builder
+	applied := ""
+	appliedArgs := ""
 
 	for _, modeChar := range modeStr {
 		var res modeResult
@@ -668,13 +675,16 @@ func (c *Conn) applyChannelModes(
 		argIdx += res.consumed
 
 		if !res.skip {
-			applied.WriteString(res.applied)
-			appliedArgs.WriteString(res.appliedArgs)
+			applied += res.applied
+			appliedArgs += res.appliedArgs
 		}
 	}
 
-	if applied.Len() > 0 {
-		modeReply := applied.String() + appliedArgs.String()
+	if applied != "" {
+		modeReply := applied
+		if appliedArgs != "" {
+			modeReply += appliedArgs
+		}
 
 		c.send(FormatMessage(
 			c.hostmask(), "MODE", channel, modeReply,
@@ -687,10 +697,13 @@ func (c *Conn) applyChannelModes(
 }
 
 // handleUserMode handles MODE for users.
-func (c *Conn) handleUserMode(msg *Message) {
+func (c *Conn) handleUserMode(
+	ctx context.Context,
+	msg *Message,
+) {
 	target := msg.Params[0]
 
-	if !strings.EqualFold(target, c.nick) {
+	if !strings.EqualFold(target, c.currentNick()) {
 		c.sendNumeric(
 			irc.ErrUsersDoNotMatch,
 			"Can't change mode for other users",
@@ -699,8 +712,48 @@ func (c *Conn) handleUserMode(msg *Message) {
 		return
 	}
 
-	// We don't support user modes beyond the basics.
-	c.sendNumeric(irc.RplUmodeIs, "+")
+	// Mode query (no mode string).
+	if len(msg.Params) < 2 { //nolint:mnd
+		modes, err := c.svc.QueryUserMode(
+			ctx, c.sessionID,
+		)
+		if err != nil {
+			c.log.Error(
+				"query user mode failed", "error", err,
+			)
+			c.sendNumeric(
+				irc.ErrUmodeUnknownFlag,
+				"Unable to read user modes",
+			)
+
+			return
+		}
+
+		c.sendNumeric(irc.RplUmodeIs, modes)
+
+		return
+	}
+
+	newModes, err := c.svc.ApplyUserMode(
+		ctx, c.sessionID, msg.Params[1],
+	)
+	if err != nil {
+		var ircErr *service.IRCError
+		if errors.As(err, &ircErr) {
+			c.sendNumeric(ircErr.Code, ircErr.Message)
+
+			return
+		}
+
+		c.sendNumeric(
+			irc.ErrUmodeUnknownFlag,
+			"Unknown MODE flag",
+		)
+
+		return
+	}
+
+	c.sendNumeric(irc.RplUmodeIs, newModes)
 }
 
 // handleNames replies with channel member list.
@@ -1292,3 +1345,180 @@ func (c *Conn) handleUserhost(
 		strings.Join(replies, " "),
 	)
 }
+
+// handleVersion replies with the server version string.
+func (c *Conn) handleVersion() {
+	c.sendNumeric(
+		irc.RplVersion,
+		c.svc.ServerVersion()+".", c.serverSfx,
+		"",
+	)
+}
+
+// handleAdmin replies with server admin info.
+func (c *Conn) handleAdmin() {
+	srvName := c.serverSfx
+
+	c.sendNumeric(
+		irc.RplAdminMe,
+		srvName, "Administrative info",
+	)
+
+	c.sendNumeric(
+		irc.RplAdminLoc1,
+		"neoirc server",
+	)
+
+	c.sendNumeric(
+		irc.RplAdminLoc2,
+		"IRC over HTTP",
+	)
+
+	c.sendNumeric(
+		irc.RplAdminEmail,
+		"admin@"+srvName,
+	)
+}
+
+// handleInfo replies with server software info.
+func (c *Conn) handleInfo() {
+	for _, line := range c.svc.InfoLines() {
+		c.sendNumeric(irc.RplInfo, line)
+	}
+
+	c.sendNumeric(
+		irc.RplEndOfInfo,
+		"End of /INFO list",
+	)
+}
+
+// handleTime replies with the server's current time.
+func (c *Conn) handleTime() {
+	srvName := c.serverSfx
+
+	c.sendNumeric(
+		irc.RplTime,
+		srvName, time.Now().Format(time.RFC1123),
+	)
+}
+
+// handleKillCmd forcibly disconnects a target user (oper
+// only).
+func (c *Conn) handleKillCmd(
+	ctx context.Context,
+	msg *Message,
+) {
+	isOper, err := c.database.IsSessionOper(
+		ctx, c.sessionID,
+	)
+	if err != nil || !isOper {
+		c.sendNumeric(
+			irc.ErrNoPrivileges,
+			"Permission Denied- "+
+				"You're not an IRC operator",
+		)
+
+		return
+	}
+
+	if len(msg.Params) < 1 {
+		c.sendNumeric(
+			irc.ErrNeedMoreParams,
+			"KILL", "Not enough parameters",
+		)
+
+		return
+	}
+
+	targetNick := msg.Params[0]
+
+	reason := "KILLed"
+	if len(msg.Params) > 1 {
+		reason = msg.Params[1]
+	}
+
+	killerNick := c.currentNick()
+
+	if strings.EqualFold(targetNick, killerNick) {
+		c.sendNumeric(
+			irc.ErrCantKillServer,
+			"You cannot KILL yourself",
+		)
+
+		return
+	}
+
+	targetSID, lookupErr := c.database.GetSessionByNick(
+		ctx, targetNick,
+	)
+	if lookupErr != nil {
+		c.sendNumeric(
+			irc.ErrNoSuchNick,
+			targetNick, "No such nick/channel",
+		)
+
+		return
+	}
+
+	quitReason := "Killed (" + killerNick +
+		" (" + reason + "))"
+
+	// KillSession broadcasts the QUIT, deletes the session
+	// and disconnects the victim's wire connection.
+	c.svc.KillSession(
+		ctx, targetSID, targetNick, quitReason,
+	)
+}
+
+// handleWallopsCmd broadcasts to all +w users (oper only).
+func (c *Conn) handleWallopsCmd(
+	ctx context.Context,
+	msg *Message,
+) {
+	isOper, err := c.database.IsSessionOper(
+		ctx, c.sessionID,
+	)
+	if err != nil || !isOper {
+		c.sendNumeric(
+			irc.ErrNoPrivileges,
+			"Permission Denied- "+
+				"You're not an IRC operator",
+		)
+
+		return
+	}
+
+	if len(msg.Params) < 1 {
+		c.sendNumeric(
+			irc.ErrNeedMoreParams,
+			"WALLOPS", "Not enough parameters",
+		)
+
+		return
+	}
+
+	message := msg.Params[0]
+
+	wallopsSIDs, wallErr := c.database.
+		GetWallopsSessionIDs(ctx)
+	if wallErr != nil {
+		c.log.Error(
+			"get wallops sessions failed",
+			"error", wallErr,
+		)
+
+		return
+	}
+
+	if len(wallopsSIDs) > 0 {
+		body, mErr := json.Marshal([]string{message})
+		if mErr != nil {
+			return
+		}
+
+		_, _, _ = c.svc.FanOut(
+			ctx, irc.CmdWallops, c.currentNick(), "*",
+			nil, body, nil, wallopsSIDs,
+		)
+	}
+}

internal/ircserver/conn.go

@@ -22,6 +22,7 @@ const (
 	maxLineLen      = 512
 	readTimeout     = 5 * time.Minute
 	writeTimeout    = 30 * time.Second
+	killWriteWindow = 2 * time.Second
 	dnsTimeout      = 3 * time.Second
 	pollInterval    = 100 * time.Millisecond
 	pingInterval    = 90 * time.Second
@@ -46,6 +47,12 @@ type Conn struct {
 	serverSfx string
 	commands  map[string]cmdHandler
 
+	// writeMu serializes writes to conn.  A connection is
+	// written to by its own read loop, by its relay
+	// goroutine, and — when an operator KILLs it — by
+	// another client's goroutine.
+	writeMu sync.Mutex
+
 	mu        sync.Mutex
 	nick      string
 	username  string
@@ -62,6 +69,8 @@ type Conn struct {
 
 	lastQueueID int64
 	closed      bool
+	killed      bool
+	cancel      context.CancelFunc
 }
 
 func newConn(
@@ -97,6 +106,76 @@ func newConn(
 	return conn
 }
 
+// Disconnect terminates the connection on behalf of an
+// operator KILL issued from either transport.  The victim
+// is told why, then its socket is closed so that the read
+// loop unblocks and serve() returns; without the close the
+// victim would keep a socket that looks alive but silently
+// delivers nothing.  Disconnect is called from the killer's
+// goroutine, never the victim's.
+//
+// The notify-and-close half runs on its own goroutine and
+// under a short deadline.  There is no per-client send
+// queue: send() writes straight to the victim's socket, so
+// a victim that has stopped reading would otherwise stall
+// the killer for the full writeTimeout on each of the two
+// writes -- wedging the operator's own serve() loop on the
+// IRC path, or the API request on the HTTP path.  Any
+// client could trigger that deliberately.  Disconnect
+// therefore returns as soon as the victim is marked closed;
+// the socket is closed shortly afterwards regardless of
+// whether the notification could be delivered.
+func (c *Conn) Disconnect(reason string) {
+	c.mu.Lock()
+
+	if c.closed {
+		c.mu.Unlock()
+
+		return
+	}
+
+	c.closed = true
+	c.killed = true
+	nick := c.nick
+	host := c.hostname
+	c.mu.Unlock()
+
+	if nick == "" {
+		nick = "*"
+	}
+
+	// Stop the relay goroutine, which would otherwise keep
+	// polling a queue belonging to a deleted session.
+	if c.cancel != nil {
+		c.cancel()
+	}
+
+	go c.notifyKilledAndClose(nick, host, reason)
+}
+
+// notifyKilledAndClose delivers the KILL and ERROR lines to
+// a killed victim and then closes its socket.  It runs on a
+// goroutine owned by neither the killer nor the victim, and
+// bounds both writes with killWriteWindow so an unresponsive
+// victim cannot hold the socket open indefinitely.
+func (c *Conn) notifyKilledAndClose(
+	nick, host, reason string,
+) {
+	defer c.conn.Close() //nolint:errcheck
+
+	c.sendWithin(
+		killWriteWindow,
+		FormatMessage(
+			c.serverSfx, irc.CmdKill, nick, reason,
+		),
+	)
+	c.sendWithin(
+		killWriteWindow,
+		"ERROR :Closing Link: "+host+
+			" ("+reason+")",
+	)
+}
+
 // buildCommandMap returns a map from IRC command strings
 // to handler functions.
 func (c *Conn) buildCommandMap() map[string]cmdHandler {
@@ -129,7 +208,13 @@ func (c *Conn) buildCommandMap() map[string]cmdHandler {
 		"CAP": func(_ context.Context, msg *Message) {
 			c.handleCAP(msg)
 		},
-		"USERHOST": c.handleUserhost,
+		"USERHOST":     c.handleUserhost,
+		irc.CmdVersion: func(context.Context, *Message) { c.handleVersion() },
+		irc.CmdAdmin:   func(context.Context, *Message) { c.handleAdmin() },
+		irc.CmdInfo:    func(context.Context, *Message) { c.handleInfo() },
+		irc.CmdTime:    func(context.Context, *Message) { c.handleTime() },
+		irc.CmdKill:    c.handleKillCmd,
+		irc.CmdWallops: c.handleWallopsCmd,
 	}
 }
 
@@ -150,10 +235,8 @@ func resolveHost(ctx context.Context, addr string) string {
 }
 
 // serve is the main loop for a single IRC client connection.
-// Cancelling ctx when it returns stops the relay goroutine.
 func (c *Conn) serve(ctx context.Context) {
-	ctx, cancel := context.WithCancel(ctx)
-	defer cancel()
+	ctx, c.cancel = context.WithCancel(ctx)
 	defer c.cleanup(ctx)
 
 	scanner := bufio.NewScanner(c.conn)
@@ -180,7 +263,7 @@ func (c *Conn) serve(ctx context.Context) {
 
 		c.handleMessage(ctx, msg)
 
-		if c.closed {
+		if c.isClosed() {
 			return
 		}
 	}
@@ -189,24 +272,65 @@ func (c *Conn) serve(ctx context.Context) {
 func (c *Conn) cleanup(ctx context.Context) {
 	c.mu.Lock()
 	wasRegistered := c.registered
+	wasKilled := c.killed
 	sessID := c.sessionID
 	nick := c.nick
 	c.closed = true
 	c.mu.Unlock()
 
 	if wasRegistered && sessID > 0 {
-		c.svc.BroadcastQuit(
-			ctx, sessID, nick, "Connection closed",
-		)
+		c.svc.UnregisterWireConn(sessID, c)
+
+		// A KILLed session has already been broadcast and
+		// deleted by the killer; broadcasting again would
+		// fan out a QUIT for a session row that is gone.
+		if !wasKilled {
+			c.svc.BroadcastQuit(
+				ctx, sessID, nick, "Connection closed",
+			)
+		}
 	}
 
 	c.conn.Close() //nolint:errcheck,gosec
 }
 
+// isClosed reports whether the connection has been marked
+// for teardown, either by QUIT or by an operator KILL.
+func (c *Conn) isClosed() bool {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+
+	return c.closed
+}
+
+// currentNick returns the connection's registered nick.
+// c.nick is written under c.mu during registration and
+// NICK changes, so every read must take the mutex.
+func (c *Conn) currentNick() string {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+
+	return c.nick
+}
+
 // send writes a formatted IRC line to the connection.
 func (c *Conn) send(line string) {
+	c.sendWithin(writeTimeout, line)
+}
+
+// sendWithin writes a formatted IRC line to the connection
+// under the given write deadline.  Callers that must not be
+// held hostage by an unresponsive peer pass a shorter window
+// than writeTimeout.
+func (c *Conn) sendWithin(
+	timeout time.Duration,
+	line string,
+) {
+	c.writeMu.Lock()
+	defer c.writeMu.Unlock()
+
 	_ = c.conn.SetWriteDeadline(
-		time.Now().Add(writeTimeout),
+		time.Now().Add(timeout),
 	)
 
 	_, _ = fmt.Fprintf(c.conn, "%s\r\n", line)
@@ -387,7 +511,10 @@ func (c *Conn) completeRegistration(ctx context.Context) {
 			"failed to create session", "error", err,
 		)
 		c.send("ERROR :Internal server error")
+
+		c.mu.Lock()
 		c.closed = true
+		c.mu.Unlock()
 
 		return
 	}
@@ -398,6 +525,10 @@ func (c *Conn) completeRegistration(ctx context.Context) {
 	c.registered = true
 	c.mu.Unlock()
 
+	// Make this connection reachable by session ID so that
+	// KILL from either transport can disconnect it.
+	c.svc.RegisterWireConn(sessionID, c)
+
 	// If PASS was provided before registration, set the
 	// session password.
 	if c.passWord != "" && len(c.passWord) >= minPasswordLen {
@@ -482,7 +613,7 @@ func (c *Conn) deliverMOTD() {
 		"- %s Message of the Day -", c.serverSfx,
 	))
 
-	for line := range strings.SplitSeq(motd, "\n") {
+	for _, line := range strings.Split(motd, "\n") {
 		c.sendNumeric(irc.RplMotd, "- "+line)
 	}
 

internal/ircserver/conn_test.go

@@ -0,0 +1,128 @@
+package ircserver_test
+
+import (
+	"bufio"
+	"log/slog"
+	"net"
+	"os"
+	"strings"
+	"testing"
+	"time"
+
+	"sneak.berlin/go/neoirc/internal/config"
+	"sneak.berlin/go/neoirc/internal/ircserver"
+)
+
+// disconnectBudget is how long Disconnect is allowed to
+// take when the victim never reads.  It is far below the
+// 30s writeTimeout that the old synchronous implementation
+// would have burned on each of its two writes.
+const disconnectBudget = 2 * time.Second
+
+// TestDisconnectDoesNotBlockOnUnresponsiveVictim proves
+// that an operator KILL cannot be stalled by its target.
+// The victim's socket is a net.Pipe, so every write blocks
+// until the peer reads and the peer here never does.  The
+// old implementation performed both notification writes on
+// the killer's goroutine, which wedged the operator's own
+// serve() loop on the IRC path and the API request on the
+// HTTP path for as long as the victim cared to stay silent.
+func TestDisconnectDoesNotBlockOnUnresponsiveVictim(
+	t *testing.T,
+) {
+	t.Parallel()
+
+	serverSide, clientSide := net.Pipe()
+
+	t.Cleanup(func() {
+		_ = clientSide.Close()
+	})
+
+	log := slog.New(slog.NewTextHandler(
+		os.Stderr,
+		&slog.HandlerOptions{Level: slog.LevelError}, //nolint:exhaustruct
+	))
+	cfg := &config.Config{ //nolint:exhaustruct
+		ServerName: "test.irc",
+	}
+
+	victim := ircserver.NewTestConn(
+		log, cfg, serverSide, "victim",
+	)
+
+	returned := make(chan struct{})
+
+	go func() {
+		victim.Disconnect("killed by oper")
+		close(returned)
+	}()
+
+	select {
+	case <-returned:
+	case <-time.After(disconnectBudget):
+		t.Fatal(
+			"Disconnect blocked on the victim's socket; " +
+				"the killer must not be held hostage",
+		)
+	}
+}
+
+// TestDisconnectNotifiesAndClosesVictim is the other half
+// of the contract: moving the notification off the killer's
+// goroutine must not lose it.  A victim that does read gets
+// both the KILL and the ERROR line, and then its socket is
+// closed so its read loop unblocks.
+func TestDisconnectNotifiesAndClosesVictim(t *testing.T) {
+	t.Parallel()
+
+	serverSide, clientSide := net.Pipe()
+
+	t.Cleanup(func() {
+		_ = clientSide.Close()
+	})
+
+	log := slog.New(slog.NewTextHandler(
+		os.Stderr,
+		&slog.HandlerOptions{Level: slog.LevelError}, //nolint:exhaustruct
+	))
+	cfg := &config.Config{ //nolint:exhaustruct
+		ServerName: "test.irc",
+	}
+
+	victim := ircserver.NewTestConn(
+		log, cfg, serverSide, "victim",
+	)
+
+	lines := make(chan []string, 1)
+
+	go func() {
+		var got []string
+
+		scanner := bufio.NewScanner(clientSide)
+		for scanner.Scan() {
+			got = append(got, scanner.Text())
+		}
+
+		lines <- got
+	}()
+
+	victim.Disconnect("killed by oper")
+
+	var got []string
+
+	select {
+	case got = <-lines:
+	case <-time.After(5 * time.Second):
+		t.Fatal("victim socket was never closed")
+	}
+
+	joined := strings.Join(got, "\n")
+
+	if !strings.Contains(joined, "KILL victim") {
+		t.Errorf("missing KILL line, got: %q", joined)
+	}
+
+	if !strings.Contains(joined, "ERROR :Closing Link:") {
+		t.Errorf("missing ERROR line, got: %q", joined)
+	}
+}

internal/ircserver/export_test.go

@@ -4,10 +4,12 @@ import (
 	"context"
 	"log/slog"
 	"net"
+	"time"
 
 	"sneak.berlin/go/neoirc/internal/broker"
 	"sneak.berlin/go/neoirc/internal/config"
 	"sneak.berlin/go/neoirc/internal/db"
+	"sneak.berlin/go/neoirc/internal/globals"
 	"sneak.berlin/go/neoirc/internal/service"
 )
 
@@ -19,8 +21,14 @@ func NewTestServer(
 	database *db.Database,
 	brk *broker.Broker,
 ) *Server {
+	globs := &globals.Globals{
+		Appname:   "neoirc",
+		Version:   "test",
+		StartTime: time.Now(),
+	}
+
 	svc := service.NewTestService(
-		database, brk, cfg, log,
+		database, brk, cfg, globs, log,
 	)
 
 	return &Server{ //nolint:exhaustruct
@@ -47,3 +55,21 @@ func (s *Server) Stop() {
 func (s *Server) Listener() net.Listener {
 	return s.listener
 }
+
+// NewTestConn wraps an already-established net.Conn in a
+// Conn so tests can drive connection-level behaviour such
+// as Disconnect without standing up a whole server.
+func NewTestConn(
+	log *slog.Logger,
+	cfg *config.Config,
+	tcpConn net.Conn,
+	nick string,
+) *Conn {
+	conn := newConn(
+		context.Background(), tcpConn, log,
+		nil, nil, cfg, nil,
+	)
+	conn.nick = nick
+
+	return conn
+}

internal/ircserver/integration_test.go

@@ -282,7 +282,6 @@ func TestIntegrationTwoClients(t *testing.T) {
 
 	// Both nicks should appear in the name list.
 	foundBothNames := false
-
 	for _, line := range aliceNames {
 		if strings.Contains(line, " 353 ") &&
 			strings.Contains(line, "alice") &&
@@ -672,7 +671,6 @@ func TestIntegrationTwoClients(t *testing.T) {
 	})
 
 	foundPartErr := false
-
 	for _, line := range bobPartFail {
 		if strings.Contains(line, " 403 ") ||
 			strings.Contains(line, " 442 ") {
@@ -762,6 +760,336 @@ func TestIntegrationTwoClients(t *testing.T) {
 	)
 }
 
+// ── Tier 3 Utility Command Integration Tests ──────────
+
+// TestIntegrationUserhost verifies the USERHOST command
+// returns user@host info for connected nicks.
+func TestIntegrationUserhost(t *testing.T) {
+	t.Parallel()
+
+	env := newTestEnv(t)
+
+	alice := env.dial(t)
+	alice.register("alice")
+
+	bob := env.dial(t)
+	bob.register("bob")
+
+	// Query single nick.
+	alice.send("USERHOST bob")
+
+	aliceReply := alice.readUntil(func(l string) bool {
+		return strings.Contains(l, " 302 ")
+	})
+	assertContains(
+		t, aliceReply, " 302 ",
+		"RPL_USERHOST",
+	)
+	assertContains(
+		t, aliceReply, "bob",
+		"USERHOST contains queried nick",
+	)
+
+	// Query multiple nicks.
+	bob.send("USERHOST alice bob")
+
+	bobReply := bob.readUntil(func(l string) bool {
+		return strings.Contains(l, " 302 ")
+	})
+	assertContains(
+		t, bobReply, " 302 ",
+		"RPL_USERHOST multi-nick",
+	)
+	assertContains(
+		t, bobReply, "alice",
+		"USERHOST multi contains alice",
+	)
+	assertContains(
+		t, bobReply, "bob",
+		"USERHOST multi contains bob",
+	)
+}
+
+// TestIntegrationVersion verifies the VERSION command
+// returns the server version string.
+func TestIntegrationVersion(t *testing.T) {
+	t.Parallel()
+
+	env := newTestEnv(t)
+
+	alice := env.dial(t)
+	alice.register("alice")
+
+	alice.send("VERSION")
+
+	aliceReply := alice.readUntil(func(l string) bool {
+		return strings.Contains(l, " 351 ")
+	})
+	assertContains(
+		t, aliceReply, " 351 ",
+		"RPL_VERSION",
+	)
+	assertContains(
+		t, aliceReply, "neoirc",
+		"VERSION reply contains server name",
+	)
+}
+
+// TestIntegrationAdmin verifies the ADMIN command returns
+// server admin info (256–259 numerics).
+func TestIntegrationAdmin(t *testing.T) {
+	t.Parallel()
+
+	env := newTestEnv(t)
+
+	alice := env.dial(t)
+	alice.register("alice")
+
+	alice.send("ADMIN")
+
+	aliceReply := alice.readUntil(func(l string) bool {
+		return strings.Contains(l, " 259 ")
+	})
+	assertContains(
+		t, aliceReply, " 256 ",
+		"RPL_ADMINME",
+	)
+	assertContains(
+		t, aliceReply, " 257 ",
+		"RPL_ADMINLOC1",
+	)
+	assertContains(
+		t, aliceReply, " 258 ",
+		"RPL_ADMINLOC2",
+	)
+	assertContains(
+		t, aliceReply, " 259 ",
+		"RPL_ADMINEMAIL",
+	)
+}
+
+// TestIntegrationInfo verifies the INFO command returns
+// server information (371/374 numerics).
+func TestIntegrationInfo(t *testing.T) {
+	t.Parallel()
+
+	env := newTestEnv(t)
+
+	alice := env.dial(t)
+	alice.register("alice")
+
+	alice.send("INFO")
+
+	aliceReply := alice.readUntil(func(l string) bool {
+		return strings.Contains(l, " 374 ")
+	})
+	assertContains(
+		t, aliceReply, " 371 ",
+		"RPL_INFO",
+	)
+	assertContains(
+		t, aliceReply, " 374 ",
+		"RPL_ENDOFINFO",
+	)
+	assertContains(
+		t, aliceReply, "neoirc",
+		"INFO reply mentions server name",
+	)
+}
+
+// TestIntegrationTime verifies the TIME command returns
+// the server time (391 numeric).
+func TestIntegrationTime(t *testing.T) {
+	t.Parallel()
+
+	env := newTestEnv(t)
+
+	alice := env.dial(t)
+	alice.register("alice")
+
+	alice.send("TIME")
+
+	aliceReply := alice.readUntil(func(l string) bool {
+		return strings.Contains(l, " 391 ")
+	})
+	assertContains(
+		t, aliceReply, " 391 ",
+		"RPL_TIME",
+	)
+	assertContains(
+		t, aliceReply, "test.irc",
+		"TIME reply includes server name",
+	)
+}
+
+// TestIntegrationKill verifies the KILL command: oper can
+// kill a user, non-oper cannot, and — most importantly —
+// that the victim is actually disconnected rather than
+// merely announced as having quit.
+//
+//nolint:funlen // one KILL scenario asserted end to end
+func TestIntegrationKill(t *testing.T) {
+	t.Parallel()
+
+	env := newTestEnvWithOper(t)
+
+	alice := env.dial(t)
+	alice.register("alice")
+
+	bob := env.dial(t)
+	bob.register("bob")
+
+	// Both join a channel so KILL's QUIT is visible.
+	alice.joinAndDrain("#killtest")
+	bob.joinAndDrain("#killtest")
+
+	// Drain alice's view of bob's join.
+	alice.readUntil(func(l string) bool {
+		return strings.Contains(l, "JOIN") &&
+			strings.Contains(l, "bob")
+	})
+
+	// Non-oper KILL should fail.
+	alice.send("KILL bob :nope")
+
+	aliceKillFail := alice.readUntil(func(l string) bool {
+		return strings.Contains(l, " 481 ")
+	})
+	assertContains(
+		t, aliceKillFail, " 481 ",
+		"ERR_NOPRIVILEGES for non-oper KILL",
+	)
+
+	// alice becomes oper.
+	alice.send("OPER testoper testpass")
+	alice.readUntil(func(l string) bool {
+		return strings.Contains(l, " 381 ")
+	})
+
+	// Oper KILL should succeed.
+	alice.send("KILL bob :bad behavior")
+
+	// The victim must be told why and then disconnected.
+	// Reading to EOF is the assertion that matters: a KILL
+	// that only broadcasts a QUIT leaves bob holding a
+	// socket that looks alive but delivers nothing.
+	bobLines := bob.readUntilClosed()
+	assertContains(
+		t, bobLines, "KILL",
+		"victim receives KILL before disconnect",
+	)
+	assertContains(
+		t, bobLines, "ERROR :Closing Link",
+		"victim receives ERROR before disconnect",
+	)
+	assertContains(
+		t, bobLines, "bad behavior",
+		"KILL reason delivered to victim",
+	)
+
+	// alice should see bob's QUIT relay.
+	aliceSeesQuit := alice.readUntil(func(l string) bool {
+		return strings.Contains(l, "QUIT") &&
+			strings.Contains(l, "bob")
+	})
+	assertContains(
+		t, aliceSeesQuit, "Killed",
+		"KILL reason in QUIT message",
+	)
+
+	// bob must be gone from the channel member list.
+	alice.send("NAMES #killtest")
+
+	aliceNames := alice.readUntil(func(l string) bool {
+		return strings.Contains(l, " 366 ")
+	})
+	assertContains(
+		t, aliceNames, "alice",
+		"alice still in NAMES after killing bob",
+	)
+	assertNotContains(
+		t, aliceNames, "bob",
+		"killed user must not appear in NAMES",
+	)
+
+	// ...nor from WHO.
+	alice.send("WHO #killtest")
+
+	aliceWho := alice.readUntil(func(l string) bool {
+		return strings.Contains(l, " 315 ")
+	})
+	assertNotContains(
+		t, aliceWho, "bob",
+		"killed user must not appear in WHO",
+	)
+
+	// KILL nonexistent nick.
+	alice.send("KILL nobody123 :gone")
+
+	aliceNoSuch := alice.readUntil(func(l string) bool {
+		return strings.Contains(l, " 401 ")
+	})
+	assertContains(
+		t, aliceNoSuch, " 401 ",
+		"ERR_NOSUCHNICK for KILL missing target",
+	)
+}
+
+// TestIntegrationWallops verifies the WALLOPS command:
+// oper can broadcast to +w users.
+func TestIntegrationWallops(t *testing.T) {
+	t.Parallel()
+
+	env := newTestEnvWithOper(t)
+
+	alice := env.dial(t)
+	alice.register("alice")
+
+	bob := env.dial(t)
+	bob.register("bob")
+
+	// Non-oper WALLOPS should fail.
+	alice.send("WALLOPS :test broadcast")
+
+	aliceWallopsFail := alice.readUntil(func(l string) bool {
+		return strings.Contains(l, " 481 ")
+	})
+	assertContains(
+		t, aliceWallopsFail, " 481 ",
+		"ERR_NOPRIVILEGES for non-oper WALLOPS",
+	)
+
+	// alice becomes oper.
+	alice.send("OPER testoper testpass")
+	alice.readUntil(func(l string) bool {
+		return strings.Contains(l, " 381 ")
+	})
+
+	// bob sets +w to receive wallops.
+	bob.send("MODE bob +w")
+	bob.readUntil(func(l string) bool {
+		return strings.Contains(l, " 221 ")
+	})
+
+	// alice sends WALLOPS.
+	alice.send("WALLOPS :important announcement")
+
+	// bob (who has +w) should receive it.
+	bobWallops := bob.readUntil(func(l string) bool {
+		return strings.Contains(
+			l, "important announcement",
+		)
+	})
+	assertContains(
+		t, bobWallops, "important announcement",
+		"bob receives WALLOPS message",
+	)
+	assertContains(
+		t, bobWallops, "WALLOPS",
+		"message is WALLOPS command",
+	)
+}
+
 // TestIntegrationModeSecret tests +s (secret) channel
 // mode — verifies that +s can be set and the mode is
 // reflected in MODE queries.
@@ -835,7 +1163,6 @@ func TestIntegrationModeModerated(t *testing.T) {
 	})
 
 	foundModErr := false
-
 	for _, line := range bobLines {
 		if strings.Contains(line, " 404 ") ||
 			strings.Contains(line, " 482 ") {
@@ -862,7 +1189,6 @@ func TestIntegrationModeModerated(t *testing.T) {
 	})
 
 	bob.send("PRIVMSG #modtest :voiced message")
-
 	aliceLines := alice.readUntil(func(l string) bool {
 		return strings.Contains(l, "voiced message")
 	})
@@ -915,3 +1241,80 @@ func TestIntegrationThirdClientObserver(t *testing.T) {
 		"carol receives trio message",
 	)
 }
+
+// assertNoEmptyParam fails if any line contains a doubled
+// space, which is what FormatMessage emits for an empty
+// non-trailing parameter.  A numeric whose server-name
+// parameter came out empty is malformed on the wire even
+// though it still contains the numeric code, so the other
+// assertions in this file would not catch it.
+func assertNoEmptyParam(
+	t *testing.T,
+	lines []string,
+	context string,
+) {
+	t.Helper()
+
+	for _, line := range lines {
+		if strings.Contains(line, "  ") {
+			t.Errorf(
+				"%s: empty parameter in wire line: %q",
+				context, line,
+			)
+		}
+	}
+}
+
+// TestIntegrationDefaultServerNameFallback runs the wire
+// server with SERVER_NAME unset, which is the shipped
+// default from config.go, and verifies that VERSION, ADMIN
+// and TIME fall back to "neoirc" exactly as the HTTP path
+// does instead of emitting an empty server-name parameter.
+//
+// Every other wire test hardcodes ServerName: "test.irc",
+// so none of them exercise the default configuration.
+func TestIntegrationDefaultServerNameFallback(t *testing.T) {
+	t.Parallel()
+
+	env := newTestEnvWithServerName(t, "")
+
+	alice := env.dial(t)
+	alice.register("alice")
+
+	alice.send("VERSION")
+
+	versionReply := alice.readUntil(func(l string) bool {
+		return strings.Contains(l, " 351 ")
+	})
+	assertNoEmptyParam(t, versionReply, "VERSION")
+	assertContains(
+		t, versionReply, "neoirc",
+		"VERSION falls back to default server name",
+	)
+
+	alice.send("ADMIN")
+
+	adminReply := alice.readUntil(func(l string) bool {
+		return strings.Contains(l, " 259 ")
+	})
+	assertNoEmptyParam(t, adminReply, "ADMIN")
+	assertContains(
+		t, adminReply, " 256 alice neoirc ",
+		"RPL_ADMINME names the default server",
+	)
+	assertContains(
+		t, adminReply, "admin@neoirc",
+		"RPL_ADMINEMAIL is a well-formed address",
+	)
+
+	alice.send("TIME")
+
+	timeReply := alice.readUntil(func(l string) bool {
+		return strings.Contains(l, " 391 ")
+	})
+	assertNoEmptyParam(t, timeReply, "TIME")
+	assertContains(
+		t, timeReply, " 391 alice neoirc ",
+		"RPL_TIME names the default server",
+	)
+}

internal/ircserver/parser_test.go

@@ -4,18 +4,12 @@ import (
 	"testing"
 
 	"sneak.berlin/go/neoirc/internal/ircserver"
-	"sneak.berlin/go/neoirc/pkg/irc"
 )
 
 //nolint:funlen // table-driven test
 func TestParseMessage(t *testing.T) {
 	t.Parallel()
 
-	const (
-		nick    = "alice"
-		channel = "#general"
-	)
-
 	tests := []struct {
 		name    string
 		input   string
@@ -30,10 +24,10 @@ func TestParseMessage(t *testing.T) {
 		},
 		{
 			name:  "simple command",
-			input: irc.CmdPing,
+			input: "PING",
 			want: &ircserver.Message{
 				Prefix:  "",
-				Command: irc.CmdPing,
+				Command: "PING",
 				Params:  nil,
 			},
 			wantNil: false,
@@ -44,7 +38,7 @@ func TestParseMessage(t *testing.T) {
 			want: &ircserver.Message{
 				Prefix:  "",
 				Command: "NICK",
-				Params:  []string{nick},
+				Params:  []string{"alice"},
 			},
 			wantNil: false,
 		},
@@ -63,8 +57,8 @@ func TestParseMessage(t *testing.T) {
 			input: "PRIVMSG #general :hello world",
 			want: &ircserver.Message{
 				Prefix:  "",
-				Command: irc.CmdPrivmsg,
-				Params:  []string{channel, "hello world"},
+				Command: "PRIVMSG",
+				Params:  []string{"#general", "hello world"},
 			},
 			wantNil: false,
 		},
@@ -74,7 +68,7 @@ func TestParseMessage(t *testing.T) {
 			want: &ircserver.Message{
 				Prefix:  "server.example.com",
 				Command: "001",
-				Params:  []string{nick, "Welcome to IRC"},
+				Params:  []string{"alice", "Welcome to IRC"},
 			},
 			wantNil: false,
 		},
@@ -85,7 +79,7 @@ func TestParseMessage(t *testing.T) {
 				Prefix:  "",
 				Command: "USER",
 				Params: []string{
-					nick, "0", "*", "Alice Smith",
+					"alice", "0", "*", "Alice Smith",
 				},
 			},
 			wantNil: false,
@@ -96,7 +90,7 @@ func TestParseMessage(t *testing.T) {
 			want: &ircserver.Message{
 				Prefix:  "",
 				Command: "JOIN",
-				Params:  []string{channel},
+				Params:  []string{"#general"},
 			},
 			wantNil: false,
 		},
@@ -105,17 +99,17 @@ func TestParseMessage(t *testing.T) {
 			input: "QUIT :leaving now",
 			want: &ircserver.Message{
 				Prefix:  "",
-				Command: irc.CmdQuit,
+				Command: "QUIT",
 				Params:  []string{"leaving now"},
 			},
 			wantNil: false,
 		},
 		{
 			name:  "quit without reason",
-			input: irc.CmdQuit,
+			input: "QUIT",
 			want: &ircserver.Message{
 				Prefix:  "",
-				Command: irc.CmdQuit,
+				Command: "QUIT",
 				Params:  nil,
 			},
 			wantNil: false,
@@ -126,7 +120,7 @@ func TestParseMessage(t *testing.T) {
 			want: &ircserver.Message{
 				Prefix:  "",
 				Command: "MODE",
-				Params:  []string{channel},
+				Params:  []string{"#general"},
 			},
 			wantNil: false,
 		},
@@ -137,7 +131,7 @@ func TestParseMessage(t *testing.T) {
 				Prefix:  "",
 				Command: "KICK",
 				Params: []string{
-					channel, "bob", "misbehaving",
+					"#general", "bob", "misbehaving",
 				},
 			},
 			wantNil: false,
@@ -147,8 +141,8 @@ func TestParseMessage(t *testing.T) {
 			input: "PRIVMSG #general :",
 			want: &ircserver.Message{
 				Prefix:  "",
-				Command: irc.CmdPrivmsg,
-				Params:  []string{channel, ""},
+				Command: "PRIVMSG",
+				Params:  []string{"#general", ""},
 			},
 			wantNil: false,
 		},
@@ -167,7 +161,7 @@ func TestParseMessage(t *testing.T) {
 			input: "PING :irc.example.com",
 			want: &ircserver.Message{
 				Prefix:  "",
-				Command: irc.CmdPing,
+				Command: "PING",
 				Params:  []string{"irc.example.com"},
 			},
 			wantNil: false,
@@ -179,7 +173,7 @@ func TestParseMessage(t *testing.T) {
 				Prefix:  "",
 				Command: "TOPIC",
 				Params: []string{
-					channel,
+					"#general",
 					"Welcome to the channel!",
 				},
 			},
@@ -243,12 +237,6 @@ func TestParseMessage(t *testing.T) {
 func TestFormatMessage(t *testing.T) {
 	t.Parallel()
 
-	const (
-		nick       = "alice"
-		channel    = "#general"
-		serverName = "server"
-	)
-
 	tests := []struct {
 		name    string
 		prefix  string
@@ -259,35 +247,35 @@ func TestFormatMessage(t *testing.T) {
 		{
 			name:    "simple command",
 			prefix:  "",
-			command: irc.CmdPing,
+			command: "PING",
 			params:  nil,
-			want:    irc.CmdPing,
+			want:    "PING",
 		},
 		{
 			name:    "with prefix",
-			prefix:  serverName,
+			prefix:  "server",
 			command: "PONG",
-			params:  []string{serverName},
+			params:  []string{"server"},
 			want:    ":server PONG server",
 		},
 		{
 			name:    "privmsg with trailing",
 			prefix:  "alice!alice@host",
-			command: irc.CmdPrivmsg,
-			params:  []string{channel, "hello world"},
+			command: "PRIVMSG",
+			params:  []string{"#general", "hello world"},
 			want:    ":alice!alice@host PRIVMSG #general :hello world",
 		},
 		{
 			name:    "numeric reply",
-			prefix:  serverName,
+			prefix:  "server",
 			command: "001",
-			params:  []string{nick, "Welcome to IRC"},
+			params:  []string{"alice", "Welcome to IRC"},
 			want:    ":server 001 alice :Welcome to IRC",
 		},
 		{
 			name:    "empty trailing",
-			prefix:  serverName,
-			command: irc.CmdPrivmsg,
+			prefix:  "server",
+			command: "PRIVMSG",
 			params:  []string{"#chan", ""},
 			want:    ":server PRIVMSG #chan :",
 		},
@@ -314,7 +302,7 @@ func TestParseFormatRoundTrip(t *testing.T) {
 	// parameter either contains a space (gets ':' prefix
 	// on format) or is a non-trailing single token.
 	lines := []string{
-		irc.CmdPing,
+		"PING",
 		"NICK alice",
 		"PRIVMSG #general :hello world",
 		"JOIN #general",

internal/ircserver/relay.go

@@ -120,6 +120,8 @@ func (c *Conn) deliverIRCMessage(
 		c.deliverKickMsg(msg, text)
 	case command == "INVITE":
 		c.deliverInviteMsg(msg, text)
+	case command == irc.CmdWallops:
+		c.deliverWallops(msg, text)
 	case command == irc.CmdMode:
 		c.deliverMode(msg, text)
 	case command == irc.CmdPing:
@@ -128,11 +130,7 @@ func (c *Conn) deliverIRCMessage(
 	default:
 		// Unknown command — deliver as server notice.
 		if text != "" {
-			c.mu.Lock()
-			nick := c.nick
-			c.mu.Unlock()
-
-			c.sendFromServer("NOTICE", nick, text)
+			c.sendFromServer("NOTICE", c.nick, text)
 		}
 	}
 }
@@ -162,12 +160,8 @@ func (c *Conn) deliverNumeric(
 		_ = json.Unmarshal(msg.Params, &params)
 	}
 
-	c.mu.Lock()
-	nick := c.nick
-	c.mu.Unlock()
-
 	allParams := make([]string, 0, 1+len(params)+1)
-	allParams = append(allParams, nick)
+	allParams = append(allParams, c.nick)
 	allParams = append(allParams, params...)
 
 	if text != "" {
@@ -185,12 +179,8 @@ func (c *Conn) deliverTextMessage(
 	from := msg.From
 	target := msg.To
 
-	c.mu.Lock()
-	nick := c.nick
-	c.mu.Unlock()
-
 	// Don't echo our own messages back.
-	if strings.EqualFold(from, nick) {
+	if strings.EqualFold(from, c.nick) {
 		return
 	}
 
@@ -204,13 +194,9 @@ func (c *Conn) deliverTextMessage(
 
 // deliverJoin sends a JOIN notification.
 func (c *Conn) deliverJoin(msg *db.IRCMessage) {
-	c.mu.Lock()
-	nick := c.nick
-	c.mu.Unlock()
-
 	// Don't echo our own JOINs (we already sent them
 	// during joinChannel).
-	if strings.EqualFold(msg.From, nick) {
+	if strings.EqualFold(msg.From, c.nick) {
 		return
 	}
 
@@ -222,11 +208,7 @@ func (c *Conn) deliverJoin(msg *db.IRCMessage) {
 
 // deliverPart sends a PART notification.
 func (c *Conn) deliverPart(msg *db.IRCMessage, text string) {
-	c.mu.Lock()
-	nick := c.nick
-	c.mu.Unlock()
-
-	if strings.EqualFold(msg.From, nick) {
+	if strings.EqualFold(msg.From, c.nick) {
 		return
 	}
 
@@ -247,11 +229,7 @@ func (c *Conn) deliverNickChange(
 	msg *db.IRCMessage,
 	newNick string,
 ) {
-	c.mu.Lock()
-	nick := c.nick
-	c.mu.Unlock()
-
-	if strings.EqualFold(msg.From, nick) {
+	if strings.EqualFold(msg.From, c.nick) {
 		return
 	}
 
@@ -265,11 +243,7 @@ func (c *Conn) deliverQuitMsg(
 	msg *db.IRCMessage,
 	text string,
 ) {
-	c.mu.Lock()
-	nick := c.nick
-	c.mu.Unlock()
-
-	if strings.EqualFold(msg.From, nick) {
+	if strings.EqualFold(msg.From, c.nick) {
 		return
 	}
 
@@ -330,11 +304,19 @@ func (c *Conn) deliverInviteMsg(
 	_ *db.IRCMessage,
 	text string,
 ) {
-	c.mu.Lock()
-	nick := c.nick
-	c.mu.Unlock()
+	c.sendFromServer("NOTICE", c.nick, text)
+}
 
-	c.sendFromServer("NOTICE", nick, text)
+// deliverWallops sends a WALLOPS notification.
+func (c *Conn) deliverWallops(
+	msg *db.IRCMessage,
+	text string,
+) {
+	prefix := msg.From + "!" + msg.From + "@*"
+
+	c.send(FormatMessage(
+		prefix, irc.CmdWallops, text,
+	))
 }
 
 // deliverMode sends a MODE change notification.

internal/ircserver/server.go

@@ -81,24 +81,22 @@ func New(
 // start begins listening for TCP connections.
 //
 //nolint:contextcheck // long-lived server ctx, not the short Fx one
-func (s *Server) start(ctx context.Context, addr string) error {
-	var listenConfig net.ListenConfig
-
-	ln, err := listenConfig.Listen(ctx, "tcp", addr)
+func (s *Server) start(_ context.Context, addr string) error {
+	ln, err := net.Listen("tcp", addr)
 	if err != nil {
 		return fmt.Errorf("irc listen: %w", err)
 	}
 
 	s.listener = ln
 
-	serverCtx, cancel := context.WithCancel(context.Background())
+	ctx, cancel := context.WithCancel(context.Background())
 	s.cancel = cancel
 
 	s.log.Info(
 		"irc server listening", "addr", addr,
 	)
 
-	go s.acceptLoop(serverCtx)
+	go s.acceptLoop(ctx)
 
 	return nil
 }

internal/ircserver/server_test.go

@@ -38,6 +38,20 @@ type testEnv struct {
 func newTestEnv(t *testing.T) *testEnv {
 	t.Helper()
 
+	return newTestEnvWithServerName(t, "test.irc")
+}
+
+// newTestEnvWithServerName creates a test environment with
+// an explicit SERVER_NAME. Passing "" exercises the shipped
+// default from config.go, under which the server must fall
+// back to "neoirc" rather than emitting an empty
+// server-name parameter.
+func newTestEnvWithServerName(
+	t *testing.T,
+	serverName string,
+) *testEnv {
+	t.Helper()
+
 	dsn := fmt.Sprintf(
 		"file:%s?mode=memory&cache=shared&_journal_mode=WAL",
 		t.Name(),
@@ -67,13 +81,92 @@ func newTestEnv(t *testing.T) *testEnv {
 	brk := broker.New()
 
 	cfg := &config.Config{ //nolint:exhaustruct
-		ServerName: "test.irc",
+		ServerName: serverName,
 		MOTD:       "Welcome to test IRC",
 	}
 
-	var listenConfig net.ListenConfig
+	listener, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatalf("listen: %v", err)
+	}
 
-	listener, err := listenConfig.Listen(t.Context(), "tcp", "127.0.0.1:0")
+	addr := listener.Addr().String()
+
+	err = listener.Close()
+	if err != nil {
+		t.Fatalf("close listener: %v", err)
+	}
+
+	log := slog.New(slog.NewTextHandler(
+		os.Stderr,
+		&slog.HandlerOptions{Level: slog.LevelError}, //nolint:exhaustruct
+	))
+
+	srv := ircserver.NewTestServer(log, cfg, database, brk)
+
+	err = srv.Start(addr)
+	if err != nil {
+		t.Fatalf("start irc server: %v", err)
+	}
+
+	t.Cleanup(func() {
+		srv.Stop()
+
+		err := conn.Close()
+		if err != nil {
+			t.Logf("close db: %v", err)
+		}
+	})
+
+	return &testEnv{
+		database: database,
+		brk:      brk,
+		cfg:      cfg,
+		srv:      srv,
+	}
+}
+
+// newTestEnvWithOper creates a test environment with oper
+// credentials configured.
+func newTestEnvWithOper(t *testing.T) *testEnv {
+	t.Helper()
+
+	dsn := fmt.Sprintf(
+		"file:%s?mode=memory&cache=shared&_journal_mode=WAL",
+		t.Name(),
+	)
+
+	conn, err := sql.Open("sqlite", dsn)
+	if err != nil {
+		t.Fatalf("open db: %v", err)
+	}
+
+	conn.SetMaxOpenConns(1)
+
+	_, err = conn.ExecContext(
+		t.Context(), "PRAGMA foreign_keys = ON",
+	)
+	if err != nil {
+		t.Fatalf("pragma: %v", err)
+	}
+
+	database := db.NewTestDatabaseFromConn(conn)
+
+	err = database.RunMigrations(t.Context())
+	if err != nil {
+		t.Fatalf("migrate: %v", err)
+	}
+
+	brk := broker.New()
+
+	cfg := &config.Config{ //nolint:exhaustruct
+		ServerName:   "test.irc",
+		MOTD:         "Welcome to test IRC",
+		OperName:     "testoper",
+		OperPassword: "testpass",
+	}
+
+	listener, err := net.Listen("tcp", "127.0.0.1:0")
 	if err != nil {
 		t.Fatalf("listen: %v", err)
 	}
@@ -118,12 +211,10 @@ func newTestEnv(t *testing.T) *testEnv {
 func (env *testEnv) dial(t *testing.T) *testClient {
 	t.Helper()
 
-	dialer := net.Dialer{Timeout: testTimeout}
-
-	conn, err := dialer.DialContext(
-		t.Context(),
+	conn, err := net.DialTimeout(
 		"tcp",
 		env.srv.Listener().Addr().String(),
+		testTimeout,
 	)
 	if err != nil {
 		t.Fatalf("dial: %v", err)
@@ -214,6 +305,36 @@ func (tc *testClient) register(nick string) []string {
 	})
 }
 
+// readUntilClosed reads until the peer closes the
+// connection, returning the lines received first.  It
+// fails the test if the connection is still open when the
+// read deadline expires, which is what a KILL that never
+// terminates the victim's socket looks like.
+func (tc *testClient) readUntilClosed() []string {
+	tc.t.Helper()
+
+	_ = tc.conn.SetReadDeadline(
+		time.Now().Add(testTimeout),
+	)
+
+	var lines []string
+
+	for tc.scanner.Scan() {
+		lines = append(lines, tc.scanner.Text())
+	}
+
+	err := tc.scanner.Err()
+	if err != nil {
+		tc.t.Fatalf(
+			"expected EOF on victim socket, got %v "+
+				"(lines: %v)",
+			err, lines,
+		)
+	}
+
+	return lines
+}
+
 // assertContains checks that at least one line matches the
 // given substring.
 func assertContains(
@@ -232,6 +353,27 @@ func assertContains(
 	t.Errorf("did not find %q in output: %s", substr, description)
 }
 
+// assertNotContains checks that no line matches the given
+// substring.
+func assertNotContains(
+	t *testing.T,
+	lines []string,
+	substr, description string,
+) {
+	t.Helper()
+
+	for _, line := range lines {
+		if strings.Contains(line, substr) {
+			t.Errorf(
+				"unexpectedly found %q in output: %s",
+				substr, description,
+			)
+
+			return
+		}
+	}
+}
+
 // joinAndDrain joins a channel and reads until
 // RPL_ENDOFNAMES.
 func (tc *testClient) joinAndDrain(channel string) {
@@ -327,7 +469,6 @@ func TestPrivmsgBetweenClients(t *testing.T) {
 	bob.joinAndDrain("#chat")
 
 	alice.send("PRIVMSG #chat :hello bob!")
-
 	lines := bob.sendAndExpect("PING :sync", "hello bob!")
 	assertContains(t, lines, "hello bob!", "channel PRIVMSG")
 }

internal/server/server.go

@@ -45,7 +45,6 @@ type Params struct {
 // It manages routing, middleware, and lifecycle.
 type Server struct {
 	startupTime   time.Time
-	exitCode      int
 	sentryEnabled bool
 	log           *slog.Logger
 	ctx           context.Context //nolint:containedctx // signal handling pattern
@@ -71,16 +70,17 @@ func New(
 	lifecycle.Append(fx.Hook{
 		OnStart: func(_ context.Context) error {
 			srv.startupTime = time.Now()
-
-			// Build the router before OnStart returns, so srv can
-			// handle requests as soon as the app has started.
+			// Configure, enable Sentry, and build the router
+			// synchronously so that srv.router is fully initialized
+			// before OnStart returns. Any HTTP traffic (including
+			// httptest harnesses that wrap srv as a handler) is
+			// therefore guaranteed to see an initialized router,
+			// eliminating the previous race between SetupRoutes
+			// and ServeHTTP.
 			srv.configure()
 			srv.enableSentry()
 			srv.SetupRoutes()
-
-			// The start hook's context ends when the hook
-			// returns; serving must outlive it.
-			go srv.serve() //nolint:contextcheck,gosec // G118
+			go srv.serve() //nolint:contextcheck
 
 			return nil
 		},
@@ -129,7 +129,7 @@ func (srv *Server) enableSentry() {
 	srv.sentryEnabled = true
 }
 
-func (srv *Server) serve() int {
+func (srv *Server) serve() {
 	srv.ctx, srv.cancelFunc = context.WithCancel(
 		context.Background(),
 	)
@@ -154,8 +154,6 @@ func (srv *Server) serve() int {
 	<-srv.ctx.Done()
 
 	srv.cleanShutdown()
-
-	return srv.exitCode
 }
 
 func (srv *Server) cleanupForExit() {
@@ -163,8 +161,6 @@ func (srv *Server) cleanupForExit() {
 }
 
 func (srv *Server) cleanShutdown() {
-	srv.exitCode = 0
-
 	ctxShutdown, shutdownCancel := context.WithTimeout(
 		context.Background(), shutdownTimeout,
 	)

internal/service/service.go

@@ -10,21 +10,18 @@ import (
 	"log/slog"
 	"strconv"
 	"strings"
+	"sync"
+	"time"
 
 	"go.uber.org/fx"
 	"sneak.berlin/go/neoirc/internal/broker"
 	"sneak.berlin/go/neoirc/internal/config"
 	"sneak.berlin/go/neoirc/internal/db"
+	"sneak.berlin/go/neoirc/internal/globals"
 	"sneak.berlin/go/neoirc/internal/logger"
 	"sneak.berlin/go/neoirc/pkg/irc"
 )
 
-// Error texts that several commands reply with.
-const (
-	msgNoSuchChannel = "No such channel"
-	msgNotChannelOp  = "You're not channel operator"
-)
-
 // Params defines the dependencies for creating a Service.
 type Params struct {
 	fx.In
@@ -33,23 +30,41 @@ type Params struct {
 	Config   *config.Config
 	Database *db.Database
 	Broker   *broker.Broker
+	Globals  *globals.Globals
+}
+
+// WireConn is a live client connection that a transport
+// registers with the service so that commands such as KILL
+// can reach it.  The IRC wire server registers one per
+// registered connection; the HTTP transport has no
+// long-lived socket and registers nothing.
+type WireConn interface {
+	// Disconnect terminates the connection, telling the
+	// client why before closing the socket.
+	Disconnect(reason string)
 }
 
 // Service provides shared business logic for IRC commands.
 type Service struct {
-	db     *db.Database
-	broker *broker.Broker
-	config *config.Config
-	log    *slog.Logger
+	db      *db.Database
+	broker  *broker.Broker
+	config  *config.Config
+	globals *globals.Globals
+	log     *slog.Logger
+
+	wireMu    sync.Mutex
+	wireConns map[int64]WireConn
 }
 
 // New creates a new Service.
 func New(params Params) *Service {
-	return &Service{
-		db:     params.Database,
-		broker: params.Broker,
-		config: params.Config,
-		log:    params.Logger.Get(),
+	return &Service{ //nolint:exhaustruct // mutex zero value
+		db:        params.Database,
+		broker:    params.Broker,
+		config:    params.Config,
+		globals:   params.Globals,
+		log:       params.Logger.Get(),
+		wireConns: make(map[int64]WireConn),
 	}
 }
 
@@ -59,13 +74,105 @@ func NewTestService(
 	database *db.Database,
 	brk *broker.Broker,
 	cfg *config.Config,
+	globs *globals.Globals,
 	log *slog.Logger,
 ) *Service {
-	return &Service{
-		db:     database,
-		broker: brk,
-		config: cfg,
-		log:    log,
+	return &Service{ //nolint:exhaustruct // mutex zero value
+		db:        database,
+		broker:    brk,
+		config:    cfg,
+		globals:   globs,
+		log:       log,
+		wireConns: make(map[int64]WireConn),
+	}
+}
+
+// ServerVersion returns the canonical server version string
+// used by every transport, e.g. "neoirc-1.2.3".  Both the
+// IRC wire protocol and the HTTP API must report the same
+// string, so this is the only place it is built.
+func (s *Service) ServerVersion() string {
+	name := "neoirc"
+	ver := "dev"
+
+	if s.globals != nil {
+		if s.globals.Appname != "" {
+			name = s.globals.Appname
+		}
+
+		if s.globals.Version != "" {
+			ver = s.globals.Version
+		}
+	}
+
+	return name + "-" + ver
+}
+
+// InfoLines returns the RPL_INFO body.  Both transports
+// send exactly these lines so that INFO does not diverge
+// between the wire protocol and the HTTP API.
+func (s *Service) InfoLines() []string {
+	started := "unknown"
+	if s.globals != nil && !s.globals.StartTime.IsZero() {
+		started = s.globals.StartTime.Format(time.RFC1123)
+	}
+
+	return []string{
+		"neoirc — IRC semantics over HTTP",
+		"Version: " + s.ServerVersion(),
+		"Written in Go",
+		"Started: " + started,
+	}
+}
+
+// RegisterWireConn associates a live wire connection with
+// its session ID so that KillSession can reach it.
+func (s *Service) RegisterWireConn(
+	sessionID int64,
+	conn WireConn,
+) {
+	s.wireMu.Lock()
+	defer s.wireMu.Unlock()
+
+	s.wireConns[sessionID] = conn
+}
+
+// UnregisterWireConn removes the association created by
+// RegisterWireConn.  It is a no-op if the session has
+// already been rebound to a different connection.
+func (s *Service) UnregisterWireConn(
+	sessionID int64,
+	conn WireConn,
+) {
+	s.wireMu.Lock()
+	defer s.wireMu.Unlock()
+
+	if s.wireConns[sessionID] == conn {
+		delete(s.wireConns, sessionID)
+	}
+}
+
+// KillSession forcibly removes a user from the server: the
+// victim's channel peers are told via QUIT, the victim's
+// session is deleted, and any live wire connection it holds
+// is disconnected.  Both the IRC KILL command and the HTTP
+// KILL endpoint route through here so the two transports
+// cannot diverge.
+func (s *Service) KillSession(
+	ctx context.Context,
+	sessionID int64,
+	nick, reason string,
+) {
+	s.BroadcastQuit(ctx, sessionID, nick, reason)
+
+	// A session with no registered wire connection (an
+	// HTTP-only client) has nothing left to disconnect.
+	s.wireMu.Lock()
+	conn := s.wireConns[sessionID]
+	s.wireMu.Unlock()
+
+	if conn != nil {
+		conn.Disconnect(reason)
 	}
 }
 
@@ -148,7 +255,7 @@ func (s *Service) SendChannelMessage(
 		return 0, "", &IRCError{
 			irc.ErrNoSuchChannel,
 			[]string{channel},
-			msgNoSuchChannel,
+			"No such channel",
 		}
 	}
 
@@ -262,11 +369,10 @@ func (s *Service) JoinChannel(
 	isCreator := countErr == nil && memberCount == 0
 
 	if !isCreator {
-		joinErr := checkJoinRestrictions(
+		if joinErr := checkJoinRestrictions(
 			ctx, s.db, chID, sessionID,
 			channel, suppliedKey, memberCount,
-		)
-		if joinErr != nil {
+		); joinErr != nil {
 			return nil, joinErr
 		}
 	}
@@ -313,7 +419,7 @@ func (s *Service) PartChannel(
 		return &IRCError{
 			irc.ErrNoSuchChannel,
 			[]string{channel},
-			msgNoSuchChannel,
+			"No such channel",
 		}
 	}
 
@@ -355,7 +461,7 @@ func (s *Service) SetTopic(
 		return &IRCError{
 			irc.ErrNoSuchChannel,
 			[]string{channel},
-			msgNoSuchChannel,
+			"No such channel",
 		}
 	}
 
@@ -379,13 +485,14 @@ func (s *Service) SetTopic(
 			return &IRCError{
 				irc.ErrChanOpPrivsNeeded,
 				[]string{channel},
-				msgNotChannelOp,
+				"You're not channel operator",
 			}
 		}
 	}
 
-	setErr := s.db.SetTopic(ctx, channel, topic)
-	if setErr != nil {
+	if setErr := s.db.SetTopic(
+		ctx, channel, topic,
+	); setErr != nil {
 		return fmt.Errorf("set topic: %w", setErr)
 	}
 
@@ -415,7 +522,7 @@ func (s *Service) KickUser(
 		return &IRCError{
 			irc.ErrNoSuchChannel,
 			[]string{channel},
-			msgNoSuchChannel,
+			"No such channel",
 		}
 	}
 
@@ -426,7 +533,7 @@ func (s *Service) KickUser(
 		return &IRCError{
 			irc.ErrChanOpPrivsNeeded,
 			[]string{channel},
-			msgNotChannelOp,
+			"You're not channel operator",
 		}
 	}
 
@@ -615,7 +722,7 @@ func (s *Service) ValidateChannelOp(
 		return 0, &IRCError{
 			irc.ErrNoSuchChannel,
 			[]string{channel},
-			msgNoSuchChannel,
+			"No such channel",
 		}
 	}
 
@@ -626,7 +733,7 @@ func (s *Service) ValidateChannelOp(
 		return 0, &IRCError{
 			irc.ErrChanOpPrivsNeeded,
 			[]string{channel},
-			msgNotChannelOp,
+			"You're not channel operator",
 		}
 	}
 
@@ -688,28 +795,33 @@ func (s *Service) SetChannelFlag(
 ) error {
 	switch flag {
 	case 'm':
-		err := s.db.SetChannelModerated(ctx, chID, setting)
-		if err != nil {
+		if err := s.db.SetChannelModerated(
+			ctx, chID, setting,
+		); err != nil {
 			return fmt.Errorf("set moderated: %w", err)
 		}
 	case 't':
-		err := s.db.SetChannelTopicLocked(ctx, chID, setting)
-		if err != nil {
+		if err := s.db.SetChannelTopicLocked(
+			ctx, chID, setting,
+		); err != nil {
 			return fmt.Errorf("set topic locked: %w", err)
 		}
 	case 'i':
-		err := s.db.SetChannelInviteOnly(ctx, chID, setting)
-		if err != nil {
+		if err := s.db.SetChannelInviteOnly(
+			ctx, chID, setting,
+		); err != nil {
 			return fmt.Errorf("set invite only: %w", err)
 		}
 	case 's':
-		err := s.db.SetChannelSecret(ctx, chID, setting)
-		if err != nil {
+		if err := s.db.SetChannelSecret(
+			ctx, chID, setting,
+		); err != nil {
 			return fmt.Errorf("set secret: %w", err)
 		}
 	case 'n':
-		err := s.db.SetChannelNoExternal(ctx, chID, setting)
-		if err != nil {
+		if err := s.db.SetChannelNoExternal(
+			ctx, chID, setting,
+		); err != nil {
 			return fmt.Errorf(
 				"set no external: %w", err,
 			)
@@ -792,6 +904,201 @@ func (s *Service) QueryChannelMode(
 	return modes + modeParams
 }
 
+// QueryUserMode returns the current user mode string for
+// the given session (e.g. "+ow", "+w", "+").  A database
+// failure is returned rather than being reported as an
+// unset flag: an unreadable mode is not the same as an
+// absent one, and reporting "+" for either would tell the
+// user they are de-opered when the truth is unknown.
+func (s *Service) QueryUserMode(
+	ctx context.Context,
+	sessionID int64,
+) (string, error) {
+	modes := "+"
+
+	isOper, err := s.db.IsSessionOper(ctx, sessionID)
+	if err != nil {
+		return "", fmt.Errorf(
+			"query oper flag: %w", err,
+		)
+	}
+
+	if isOper {
+		modes += "o"
+	}
+
+	isWallops, err := s.db.IsSessionWallops(
+		ctx, sessionID,
+	)
+	if err != nil {
+		return "", fmt.Errorf(
+			"query wallops flag: %w", err,
+		)
+	}
+
+	if isWallops {
+		modes += "w"
+	}
+
+	return modes, nil
+}
+
+// userModeOp is a single parsed user-mode change collected
+// by parseUserModeString before any DB writes happen.
+type userModeOp struct {
+	char   rune
+	adding bool
+}
+
+// ApplyUserMode parses an IRC user-mode string and applies
+// the resulting changes atomically. It supports multiple
+// sign transitions (e.g. "+w-o", "-w+o", "+o-w+w") and
+// rejects malformed input (empty string, no leading sign,
+// bare sign with no mode letters, unknown mode letters,
+// +o which must be set via OPER) with an IRCError. On
+// failure, no persistent change is made: parsing happens
+// before any write, and the writes themselves run inside a
+// single database transaction that is rolled back whole if
+// any statement fails. On success, the resulting mode
+// string is returned.
+func (s *Service) ApplyUserMode(
+	ctx context.Context,
+	sessionID int64,
+	modeStr string,
+) (string, error) {
+	ops, err := parseUserModeString(modeStr)
+	if err != nil {
+		return "", err
+	}
+
+	wallops, oper, err := collapseUserModeOps(ops)
+	if err != nil {
+		return "", err
+	}
+
+	if err := s.db.SetSessionUserModes(
+		ctx, sessionID, wallops, oper,
+	); err != nil {
+		s.log.Error(
+			"apply user modes failed", "error", err,
+		)
+
+		return "", fmt.Errorf("apply user modes: %w", err)
+	}
+
+	return s.QueryUserMode(ctx, sessionID)
+}
+
+// parseUserModeString validates and parses a user-mode
+// string into a list of operations. The string must begin
+// with '+' or '-'; subsequent '+' / '-' characters flip the
+// active sign, and letters between them are applied with
+// the current sign. Every letter must be a recognized user
+// mode for this server, and '+o' is never allowed via MODE
+// (use OPER to become operator). If any character is
+// invalid, no operations are returned and an IRCError with
+// ERR_UMODEUNKNOWNFLAG (501) is returned.
+func parseUserModeString(
+	modeStr string,
+) ([]userModeOp, error) {
+	unknownFlag := &IRCError{
+		Code:    irc.ErrUmodeUnknownFlag,
+		Params:  nil,
+		Message: "Unknown MODE flag",
+	}
+
+	if modeStr == "" {
+		return nil, unknownFlag
+	}
+
+	first := modeStr[0]
+	if first != '+' && first != '-' {
+		return nil, unknownFlag
+	}
+
+	ops := make([]userModeOp, 0, len(modeStr)-1)
+	adding := true
+
+	for _, modeChar := range modeStr {
+		switch modeChar {
+		case '+':
+			adding = true
+		case '-':
+			adding = false
+		default:
+			if !isKnownUserModeChar(modeChar) {
+				return nil, unknownFlag
+			}
+
+			if modeChar == 'o' && adding {
+				return nil, unknownFlag
+			}
+
+			ops = append(ops, userModeOp{
+				char: modeChar, adding: adding,
+			})
+		}
+	}
+
+	if len(ops) == 0 {
+		return nil, unknownFlag
+	}
+
+	return ops, nil
+}
+
+// isKnownUserModeChar reports whether the character is a
+// recognized user mode letter.
+func isKnownUserModeChar(modeChar rune) bool {
+	switch modeChar {
+	case 'w', 'o':
+		return true
+	default:
+		return false
+	}
+}
+
+// collapseUserModeOps reduces an already-parsed operation
+// list to the final desired value of each user mode flag.
+// A nil result for a flag means the mode string never
+// mentioned it, so it must be left untouched. Later
+// operations win over earlier ones for the same letter
+// (e.g. "+w-w" ends with wallops off), which matches the
+// left-to-right semantics of applying each op in turn.
+// parseUserModeString must have validated every character
+// and sign before this runs; the default branch here is
+// defence-in-depth only.
+func collapseUserModeOps(
+	ops []userModeOp,
+) (*bool, *bool, error) {
+	unknownFlag := &IRCError{
+		Code:    irc.ErrUmodeUnknownFlag,
+		Params:  nil,
+		Message: "Unknown MODE flag",
+	}
+
+	var wallops, oper *bool
+
+	for _, modeOp := range ops {
+		switch modeOp.char {
+		case 'w':
+			val := modeOp.adding
+			wallops = &val
+		case 'o':
+			if modeOp.adding {
+				return nil, nil, unknownFlag
+			}
+
+			val := false
+			oper = &val
+		default:
+			return nil, nil, unknownFlag
+		}
+	}
+
+	return wallops, oper, nil
+}
+
 // broadcastNickChange notifies channel peers of a nick
 // change.
 func (s *Service) broadcastNickChange(

internal/service/service_test.go

@@ -11,6 +11,7 @@ import (
 	"fmt"
 	"os"
 	"testing"
+	"time"
 
 	"go.uber.org/fx"
 	"go.uber.org/fx/fxtest"
@@ -55,9 +56,10 @@ func newTestEnv(t *testing.T) *testEnv {
 	app := fxtest.New(t,
 		fx.Provide(
 			func() *globals.Globals {
-				return &globals.Globals{ //nolint:exhaustruct
-					Appname: "neoirc-test",
-					Version: "test",
+				return &globals.Globals{
+					Appname:   "neoirc-test",
+					Version:   "test",
+					StartTime: time.Now(),
 				}
 			},
 			logger.New,
@@ -363,3 +365,450 @@ func TestSendChannelMessage_Moderated(t *testing.T) {
 		t.Errorf("operator should be able to send in moderated channel: %v", err)
 	}
 }
+
+func TestQueryUserMode(t *testing.T) {
+	env := newTestEnv(t)
+	ctx := t.Context()
+
+	sid := createSession(ctx, t, env.db, "alice")
+
+	// Fresh session has no modes.
+	modes, err := env.svc.QueryUserMode(ctx, sid)
+	if err != nil {
+		t.Fatalf("query user mode: %v", err)
+	}
+
+	if modes != "+" {
+		t.Errorf("expected +, got %s", modes)
+	}
+
+	// Set wallops.
+	_ = env.db.SetSessionWallops(ctx, sid, true)
+
+	modes, err = env.svc.QueryUserMode(ctx, sid)
+	if err != nil {
+		t.Fatalf("query user mode: %v", err)
+	}
+
+	if modes != "+w" {
+		t.Errorf("expected +w, got %s", modes)
+	}
+
+	// Set oper.
+	_ = env.db.SetSessionOper(ctx, sid, true)
+
+	modes, err = env.svc.QueryUserMode(ctx, sid)
+	if err != nil {
+		t.Fatalf("query user mode: %v", err)
+	}
+
+	if modes != "+ow" {
+		t.Errorf("expected +ow, got %s", modes)
+	}
+}
+
+// applyUserModeCaseState is the subset of session user-mode
+// state the rigorous TestApplyUserMode suite asserts on. It
+// mirrors the columns (oper, wallops) that the parser is
+// permitted to mutate.
+type applyUserModeCaseState struct {
+	oper    bool
+	wallops bool
+}
+
+// applyUserModeCase describes one rigor-suite case for
+// Service.ApplyUserMode: the pre-call DB state, the mode
+// string input, and the expected post-call observable state
+// (mode string on success, IRC error code on rejection, and
+// persisted session state either way).
+type applyUserModeCase struct {
+	name         string
+	initialState applyUserModeCaseState
+	modeStr      string
+	wantModes    string
+	wantErr      bool
+	wantErrCode  irc.IRCMessageType
+	wantState    applyUserModeCaseState
+}
+
+// applyUserModeCases returns every case listed in sneak's
+// review of PR #96 plus a few adjacent ones. Split across
+// helpers by category so each stays under funlen.
+func applyUserModeCases() []applyUserModeCase {
+	cases := applyUserModeHappyPathCases()
+	cases = append(cases, applyUserModeSignTransitionCases()...)
+	cases = append(cases, applyUserModeMalformedCases()...)
+	cases = append(cases, applyUserModeUnknownLetterCases()...)
+
+	return cases
+}
+
+// applyUserModeHappyPathCases covers valid single-char and
+// multi-char-without-sign-transition mode operations.
+func applyUserModeHappyPathCases() []applyUserModeCase {
+	return []applyUserModeCase{
+		{
+			name:         "+w from empty",
+			initialState: applyUserModeCaseState{oper: false, wallops: false},
+			modeStr:      "+w",
+			wantModes:    "+w",
+			wantErr:      false,
+			wantErrCode:  0,
+			wantState:    applyUserModeCaseState{oper: false, wallops: true},
+		},
+		{
+			name:         "-w from +w",
+			initialState: applyUserModeCaseState{oper: false, wallops: true},
+			modeStr:      "-w",
+			wantModes:    "+",
+			wantErr:      false,
+			wantErrCode:  0,
+			wantState:    applyUserModeCaseState{oper: false, wallops: false},
+		},
+		{
+			name:         "-o from +o",
+			initialState: applyUserModeCaseState{oper: true, wallops: false},
+			modeStr:      "-o",
+			wantModes:    "+",
+			wantErr:      false,
+			wantErrCode:  0,
+			wantState:    applyUserModeCaseState{oper: false, wallops: false},
+		},
+		{
+			name:         "-wo from +ow",
+			initialState: applyUserModeCaseState{oper: true, wallops: true},
+			modeStr:      "-wo",
+			wantModes:    "+",
+			wantErr:      false,
+			wantErrCode:  0,
+			wantState:    applyUserModeCaseState{oper: false, wallops: false},
+		},
+	}
+}
+
+// applyUserModeSignTransitionCases covers multi-char mode
+// strings where '+' and '-' flip partway through. +o is
+// never legal via MODE, so strings containing it must be
+// rejected atomically.
+func applyUserModeSignTransitionCases() []applyUserModeCase {
+	return []applyUserModeCase{
+		{
+			name:         "+w-o from +o",
+			initialState: applyUserModeCaseState{oper: true, wallops: false},
+			modeStr:      "+w-o",
+			wantModes:    "+w",
+			wantErr:      false,
+			wantErrCode:  0,
+			wantState:    applyUserModeCaseState{oper: false, wallops: true},
+		},
+		{
+			// +o is rejected before any op applies; wallops
+			// stays set.
+			name:         "-w+o always rejects +o",
+			initialState: applyUserModeCaseState{oper: true, wallops: true},
+			modeStr:      "-w+o",
+			wantModes:    "",
+			wantErr:      true,
+			wantErrCode:  irc.ErrUmodeUnknownFlag,
+			wantState:    applyUserModeCaseState{oper: true, wallops: true},
+		},
+		{
+			// Wallops must NOT be cleared; oper must NOT be
+			// cleared. Rejection is fully atomic.
+			name:         "+o-w+w rejects because of +o",
+			initialState: applyUserModeCaseState{oper: true, wallops: true},
+			modeStr:      "+o-w+w",
+			wantModes:    "",
+			wantErr:      true,
+			wantErrCode:  irc.ErrUmodeUnknownFlag,
+			wantState:    applyUserModeCaseState{oper: true, wallops: true},
+		},
+	}
+}
+
+// applyUserModeMalformedCases covers inputs that lack a
+// leading '+' or '-' and inputs that consist of bare signs
+// without mode letters. All must be rejected with no side
+// effects.
+func applyUserModeMalformedCases() []applyUserModeCase {
+	return []applyUserModeCase{
+		{
+			name:         "w no prefix rejects",
+			initialState: applyUserModeCaseState{oper: false, wallops: false},
+			modeStr:      "w",
+			wantModes:    "",
+			wantErr:      true,
+			wantErrCode:  irc.ErrUmodeUnknownFlag,
+			wantState:    applyUserModeCaseState{oper: false, wallops: false},
+		},
+		{
+			// Prove wallops is NOT cleared — the whole point
+			// of sneak's review.
+			name: "xw no prefix rejects (would have been" +
+				" silently -w before)",
+			initialState: applyUserModeCaseState{oper: false, wallops: true},
+			modeStr:      "xw",
+			wantModes:    "",
+			wantErr:      true,
+			wantErrCode:  irc.ErrUmodeUnknownFlag,
+			wantState:    applyUserModeCaseState{oper: false, wallops: true},
+		},
+		{
+			name:         "empty string rejects",
+			initialState: applyUserModeCaseState{oper: false, wallops: false},
+			modeStr:      "",
+			wantModes:    "",
+			wantErr:      true,
+			wantErrCode:  irc.ErrUmodeUnknownFlag,
+			wantState:    applyUserModeCaseState{oper: false, wallops: false},
+		},
+		{
+			name:         "bare + rejects",
+			initialState: applyUserModeCaseState{oper: false, wallops: false},
+			modeStr:      "+",
+			wantModes:    "",
+			wantErr:      true,
+			wantErrCode:  irc.ErrUmodeUnknownFlag,
+			wantState:    applyUserModeCaseState{oper: false, wallops: false},
+		},
+		{
+			name:         "bare - rejects",
+			initialState: applyUserModeCaseState{oper: false, wallops: false},
+			modeStr:      "-",
+			wantModes:    "",
+			wantErr:      true,
+			wantErrCode:  irc.ErrUmodeUnknownFlag,
+			wantState:    applyUserModeCaseState{oper: false, wallops: false},
+		},
+		{
+			name:         "+-+ rejects (no mode letters)",
+			initialState: applyUserModeCaseState{oper: false, wallops: false},
+			modeStr:      "+-+",
+			wantModes:    "",
+			wantErr:      true,
+			wantErrCode:  irc.ErrUmodeUnknownFlag,
+			wantState:    applyUserModeCaseState{oper: false, wallops: false},
+		},
+	}
+}
+
+// applyUserModeUnknownLetterCases covers well-formed prefix
+// strings that contain unknown mode letters. Rejection must
+// be atomic: any valid letters before the invalid one must
+// not persist.
+func applyUserModeUnknownLetterCases() []applyUserModeCase {
+	return []applyUserModeCase{
+		{
+			name:         "-x+y rejects unknown -x",
+			initialState: applyUserModeCaseState{oper: false, wallops: false},
+			modeStr:      "-x+y",
+			wantModes:    "",
+			wantErr:      true,
+			wantErrCode:  irc.ErrUmodeUnknownFlag,
+			wantState:    applyUserModeCaseState{oper: false, wallops: false},
+		},
+		{
+			name:         "+y-x rejects unknown +y",
+			initialState: applyUserModeCaseState{oper: false, wallops: false},
+			modeStr:      "+y-x",
+			wantModes:    "",
+			wantErr:      true,
+			wantErrCode:  irc.ErrUmodeUnknownFlag,
+			wantState:    applyUserModeCaseState{oper: false, wallops: false},
+		},
+		{
+			name:         "+z unknown mode rejects",
+			initialState: applyUserModeCaseState{oper: false, wallops: false},
+			modeStr:      "+z",
+			wantModes:    "",
+			wantErr:      true,
+			wantErrCode:  irc.ErrUmodeUnknownFlag,
+			wantState:    applyUserModeCaseState{oper: false, wallops: false},
+		},
+		{
+			// Wallops must NOT be set.
+			name: "+wz rejects whole thing; +w side effect" +
+				" must NOT persist",
+			initialState: applyUserModeCaseState{oper: false, wallops: false},
+			modeStr:      "+wz",
+			wantModes:    "",
+			wantErr:      true,
+			wantErrCode:  irc.ErrUmodeUnknownFlag,
+			wantState:    applyUserModeCaseState{oper: false, wallops: false},
+		},
+		{
+			name: "+wo rejects whole thing; +w side effect" +
+				" must NOT persist",
+			initialState: applyUserModeCaseState{oper: false, wallops: false},
+			modeStr:      "+wo",
+			wantModes:    "",
+			wantErr:      true,
+			wantErrCode:  irc.ErrUmodeUnknownFlag,
+			wantState:    applyUserModeCaseState{oper: false, wallops: false},
+		},
+	}
+}
+
+// TestApplyUserMode is the rigorous table-driven suite for
+// the shared user-mode parser. It covers every case listed
+// in sneak's review of PR #96 plus a few adjacent ones.
+// Each case asserts the resulting mode string AND the
+// persisted session state, to prove that rejected input
+// leaves no side effects.
+func TestApplyUserMode(t *testing.T) {
+	for _, testCase := range applyUserModeCases() {
+		t.Run(testCase.name, func(t *testing.T) {
+			runApplyUserModeCase(t, testCase)
+		})
+	}
+}
+
+// runApplyUserModeCase executes one applyUserModeCase: seed
+// the session state, invoke ApplyUserMode, and verify both
+// the returned value and the post-call persisted state.
+func runApplyUserModeCase(
+	t *testing.T, testCase applyUserModeCase,
+) {
+	t.Helper()
+
+	env := newTestEnv(t)
+	ctx := t.Context()
+	sid := createSession(ctx, t, env.db, "alice")
+
+	seedApplyUserModeState(ctx, t, env.db, sid, testCase.initialState)
+
+	result, err := env.svc.ApplyUserMode(
+		ctx, sid, testCase.modeStr,
+	)
+
+	verifyApplyUserModeOutcome(t, testCase, result, err)
+	verifyApplyUserModeState(ctx, t, env.db, sid, testCase.wantState)
+}
+
+// seedApplyUserModeState installs the pre-call session
+// state described by initialState.
+func seedApplyUserModeState(
+	ctx context.Context,
+	t *testing.T,
+	database *db.Database,
+	sid int64,
+	initialState applyUserModeCaseState,
+) {
+	t.Helper()
+
+	if initialState.oper {
+		if err := database.SetSessionOper(
+			ctx, sid, true,
+		); err != nil {
+			t.Fatalf("init oper: %v", err)
+		}
+	}
+
+	if initialState.wallops {
+		if err := database.SetSessionWallops(
+			ctx, sid, true,
+		); err != nil {
+			t.Fatalf("init wallops: %v", err)
+		}
+	}
+}
+
+// verifyApplyUserModeOutcome asserts the direct return
+// value of ApplyUserMode. It dispatches to the error- or
+// success-specific verifier based on wantErr.
+func verifyApplyUserModeOutcome(
+	t *testing.T,
+	testCase applyUserModeCase,
+	result string,
+	err error,
+) {
+	t.Helper()
+
+	if testCase.wantErr {
+		verifyApplyUserModeError(t, testCase, err)
+
+		return
+	}
+
+	verifyApplyUserModeSuccess(t, testCase, result, err)
+}
+
+// verifyApplyUserModeError checks that err is a
+// *service.IRCError whose code matches wantErrCode.
+func verifyApplyUserModeError(
+	t *testing.T, testCase applyUserModeCase, err error,
+) {
+	t.Helper()
+
+	var ircErr *service.IRCError
+	if !errors.As(err, &ircErr) {
+		t.Fatalf("expected IRCError, got %v", err)
+	}
+
+	if ircErr.Code != testCase.wantErrCode {
+		t.Errorf(
+			"code: want %d got %d",
+			testCase.wantErrCode, ircErr.Code,
+		)
+	}
+}
+
+// verifyApplyUserModeSuccess checks that err is nil and the
+// returned mode string matches wantModes.
+func verifyApplyUserModeSuccess(
+	t *testing.T,
+	testCase applyUserModeCase,
+	result string,
+	err error,
+) {
+	t.Helper()
+
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	if result != testCase.wantModes {
+		t.Errorf(
+			"modes: want %q got %q",
+			testCase.wantModes, result,
+		)
+	}
+}
+
+// verifyApplyUserModeState asserts the post-call persisted
+// session state. This is the atomicity guarantee sneak
+// demanded: whether the call succeeded or was rejected, the
+// DB must match wantState exactly.
+func verifyApplyUserModeState(
+	ctx context.Context,
+	t *testing.T,
+	database *db.Database,
+	sid int64,
+	wantState applyUserModeCaseState,
+) {
+	t.Helper()
+
+	gotOper, err := database.IsSessionOper(ctx, sid)
+	if err != nil {
+		t.Fatalf("read oper: %v", err)
+	}
+
+	gotWallops, err := database.IsSessionWallops(ctx, sid)
+	if err != nil {
+		t.Fatalf("read wallops: %v", err)
+	}
+
+	if gotOper != wantState.oper {
+		t.Errorf(
+			"oper: want %v got %v",
+			wantState.oper, gotOper,
+		)
+	}
+
+	if gotWallops != wantState.wallops {
+		t.Errorf(
+			"wallops: want %v got %v",
+			wantState.wallops, gotWallops,
+		)
+	}
+}

package.json

@@ -1,6 +0,0 @@
-{
-    "private": true,
-    "devDependencies": {
-        "prettier": "3.8.1"
-    }
-}

pkg/irc/commands.go

@@ -2,26 +2,33 @@ package irc
 
 // IRC command names (RFC 1459 / RFC 2812).
 const (
-	CmdAway    = "AWAY"
-	CmdInvite  = "INVITE"
-	CmdJoin    = "JOIN"
-	CmdKick    = "KICK"
-	CmdList    = "LIST"
-	CmdLusers  = "LUSERS"
-	CmdMode    = "MODE"
-	CmdMotd    = "MOTD"
-	CmdNames   = "NAMES"
-	CmdNick    = "NICK"
-	CmdNotice  = "NOTICE"
-	CmdOper    = "OPER"
-	CmdPass    = "PASS"
-	CmdPart    = "PART"
-	CmdPing    = "PING"
-	CmdPong    = "PONG"
-	CmdPrivmsg = "PRIVMSG"
-	CmdQuit    = "QUIT"
-	CmdTopic   = "TOPIC"
-	CmdUser    = "USER"
-	CmdWho     = "WHO"
-	CmdWhois   = "WHOIS"
+	CmdAdmin    = "ADMIN"
+	CmdAway     = "AWAY"
+	CmdInfo     = "INFO"
+	CmdInvite   = "INVITE"
+	CmdJoin     = "JOIN"
+	CmdKick     = "KICK"
+	CmdKill     = "KILL"
+	CmdList     = "LIST"
+	CmdLusers   = "LUSERS"
+	CmdMode     = "MODE"
+	CmdMotd     = "MOTD"
+	CmdNames    = "NAMES"
+	CmdNick     = "NICK"
+	CmdNotice   = "NOTICE"
+	CmdOper     = "OPER"
+	CmdPass     = "PASS"
+	CmdPart     = "PART"
+	CmdPing     = "PING"
+	CmdPong     = "PONG"
+	CmdPrivmsg  = "PRIVMSG"
+	CmdQuit     = "QUIT"
+	CmdTime     = "TIME"
+	CmdTopic    = "TOPIC"
+	CmdUser     = "USER"
+	CmdUserhost = "USERHOST"
+	CmdVersion  = "VERSION"
+	CmdWallops  = "WALLOPS"
+	CmdWho      = "WHO"
+	CmdWhois    = "WHOIS"
 )

pkg/irc/numerics.go

@@ -68,7 +68,6 @@ const (
 // Command responses (200-399).
 const (
 	// RFC 2812 trace/stats/links replies (200-219).
-
 	RplTraceLink       IRCMessageType = 200
 	RplTraceConnecting IRCMessageType = 201
 	RplTraceHandshake  IRCMessageType = 202
@@ -225,7 +224,7 @@ const (
 
 // names maps numeric codes to their standard IRC names.
 //
-//nolint:gochecknoglobals,gosec // G101: IRC numeric names, not credentials
+//nolint:gochecknoglobals
 var names = map[IRCMessageType]string{
 	RplWelcome:  "RPL_WELCOME",
 	RplYourHost: "RPL_YOURHOST",

schema/README.md

@@ -22,20 +22,19 @@ Structured: {"command": "PUBKEY", "body": {"alg": "ed25519", "key": "base64..."}
 
 Common fields (see `message.json` for full schema):
 
-| Field     | Type            | Description                                          |
-| --------- | --------------- | ---------------------------------------------------- |
-| `id`      | string (uuid)   | Server-assigned message UUID                         |
-| `command` | string          | IRC command or 3-digit numeric code                  |
-| `from`    | string          | Source nick or server name (IRC prefix)              |
-| `to`      | string          | Target: #channel or nick                             |
-| `params`  | string[]        | Middle parameters (mainly for numerics)              |
-| `body`    | array \| object | Structured body — never a raw string (see below)     |
-| `ts`      | string          | ISO 8601 timestamp (server-assigned, not in raw IRC) |
-| `meta`    | object          | Extensible metadata (signatures, hashes, etc.)       |
+| Field     | Type           | Description                                          |
+|-----------|----------------|------------------------------------------------------|
+| `id`      | string (uuid)  | Server-assigned message UUID                         |
+| `command` | string         | IRC command or 3-digit numeric code                  |
+| `from`    | string         | Source nick or server name (IRC prefix)              |
+| `to`      | string         | Target: #channel or nick                             |
+| `params`  | string[]       | Middle parameters (mainly for numerics)              |
+| `body`    | array \| object | Structured body — never a raw string (see below)    |
+| `ts`      | string         | ISO 8601 timestamp (server-assigned, not in raw IRC) |
+| `meta`    | object         | Extensible metadata (signatures, hashes, etc.)       |
 
 **Structured bodies:** `body` is always an array of strings (for text) or an
 object (for structured data like PUBKEY). Never a raw string. This enables:
-
 - Multiline messages without escape sequences
 - Deterministic canonicalization via RFC 8785 JCS for signing
 - Structured data where needed
@@ -44,20 +43,20 @@ object (for structured data like PUBKEY). Never a raw string. This enables:
 
 IRC commands used for client↔server and server↔server communication.
 
-| Command   | File                    | RFC         | Description                |
-| --------- | ----------------------- | ----------- | -------------------------- |
-| `PRIVMSG` | `commands/PRIVMSG.json` | 1459 §4.4.1 | Message to channel or user |
-| `NOTICE`  | `commands/NOTICE.json`  | 1459 §4.4.2 | Notice (no auto-reply)     |
-| `JOIN`    | `commands/JOIN.json`    | 1459 §4.2.1 | Join a channel             |
-| `PART`    | `commands/PART.json`    | 1459 §4.2.2 | Leave a channel            |
-| `QUIT`    | `commands/QUIT.json`    | 1459 §4.1.6 | User disconnected          |
-| `NICK`    | `commands/NICK.json`    | 1459 §4.1.2 | Change nickname            |
-| `TOPIC`   | `commands/TOPIC.json`   | 1459 §4.2.4 | Get/set channel topic      |
-| `MODE`    | `commands/MODE.json`    | 1459 §4.2.3 | Set channel/user modes     |
-| `KICK`    | `commands/KICK.json`    | 1459 §4.2.8 | Kick user from channel     |
-| `PING`    | `commands/PING.json`    | 1459 §4.6.2 | Keepalive                  |
-| `PONG`    | `commands/PONG.json`    | 1459 §4.6.3 | Keepalive response         |
-| `PUBKEY`  | `commands/PUBKEY.json`  | (extension) | Announce/relay signing key |
+| Command   | File                      | RFC       | Description                    |
+|-----------|---------------------------|-----------|--------------------------------|
+| `PRIVMSG` | `commands/PRIVMSG.json`  | 1459 §4.4.1 | Message to channel or user  |
+| `NOTICE`  | `commands/NOTICE.json`   | 1459 §4.4.2 | Notice (no auto-reply)      |
+| `JOIN`    | `commands/JOIN.json`     | 1459 §4.2.1 | Join a channel              |
+| `PART`    | `commands/PART.json`     | 1459 §4.2.2 | Leave a channel             |
+| `QUIT`    | `commands/QUIT.json`     | 1459 §4.1.6 | User disconnected           |
+| `NICK`    | `commands/NICK.json`     | 1459 §4.1.2 | Change nickname             |
+| `TOPIC`   | `commands/TOPIC.json`    | 1459 §4.2.4 | Get/set channel topic       |
+| `MODE`    | `commands/MODE.json`     | 1459 §4.2.3 | Set channel/user modes      |
+| `KICK`    | `commands/KICK.json`     | 1459 §4.2.8 | Kick user from channel      |
+| `PING`    | `commands/PING.json`     | 1459 §4.6.2 | Keepalive                   |
+| `PONG`    | `commands/PONG.json`     | 1459 §4.6.3 | Keepalive response          |
+| `PUBKEY`  | `commands/PUBKEY.json`   | (extension)  | Announce/relay signing key  |
 
 ## Numeric Replies
 
@@ -65,30 +64,30 @@ Three-digit codes for server responses, per IRC convention.
 
 ### Success / Informational (0xx–3xx)
 
-| Code  | Name           | File                | Description                    |
-| ----- | -------------- | ------------------- | ------------------------------ |
-| `001` | RPL_WELCOME    | `numerics/001.json` | Welcome after session creation |
-| `002` | RPL_YOURHOST   | `numerics/002.json` | Server host info               |
-| `003` | RPL_CREATED    | `numerics/003.json` | Server creation date           |
-| `004` | RPL_MYINFO     | `numerics/004.json` | Server info and modes          |
-| `322` | RPL_LIST       | `numerics/322.json` | Channel list entry             |
-| `323` | RPL_LISTEND    | `numerics/323.json` | End of channel list            |
-| `332` | RPL_TOPIC      | `numerics/332.json` | Channel topic                  |
-| `353` | RPL_NAMREPLY   | `numerics/353.json` | Channel member list            |
-| `366` | RPL_ENDOFNAMES | `numerics/366.json` | End of NAMES list              |
-| `372` | RPL_MOTD       | `numerics/372.json` | MOTD line                      |
-| `375` | RPL_MOTDSTART  | `numerics/375.json` | Start of MOTD                  |
-| `376` | RPL_ENDOFMOTD  | `numerics/376.json` | End of MOTD                    |
+| Code  | Name              | File                  | Description                    |
+|-------|-------------------|-----------------------|--------------------------------|
+| `001` | RPL_WELCOME       | `numerics/001.json`  | Welcome after session creation     |
+| `002` | RPL_YOURHOST      | `numerics/002.json`  | Server host info               |
+| `003` | RPL_CREATED       | `numerics/003.json`  | Server creation date           |
+| `004` | RPL_MYINFO        | `numerics/004.json`  | Server info and modes          |
+| `322` | RPL_LIST          | `numerics/322.json`  | Channel list entry             |
+| `323` | RPL_LISTEND       | `numerics/323.json`  | End of channel list            |
+| `332` | RPL_TOPIC         | `numerics/332.json`  | Channel topic                  |
+| `353` | RPL_NAMREPLY      | `numerics/353.json`  | Channel member list            |
+| `366` | RPL_ENDOFNAMES    | `numerics/366.json`  | End of NAMES list              |
+| `372` | RPL_MOTD          | `numerics/372.json`  | MOTD line                      |
+| `375` | RPL_MOTDSTART     | `numerics/375.json`  | Start of MOTD                  |
+| `376` | RPL_ENDOFMOTD     | `numerics/376.json`  | End of MOTD                    |
 
 ### Errors (4xx)
 
-| Code  | Name                 | File                | Description             |
-| ----- | -------------------- | ------------------- | ----------------------- |
-| `401` | ERR_NOSUCHNICK       | `numerics/401.json` | No such nick/channel    |
-| `403` | ERR_NOSUCHCHANNEL    | `numerics/403.json` | No such channel         |
-| `433` | ERR_NICKNAMEINUSE    | `numerics/433.json` | Nickname already in use |
-| `442` | ERR_NOTONCHANNEL     | `numerics/442.json` | Not on that channel     |
-| `482` | ERR_CHANOPRIVSNEEDED | `numerics/482.json` | Not channel operator    |
+| Code  | Name                 | File                  | Description                    |
+|-------|----------------------|-----------------------|--------------------------------|
+| `401` | ERR_NOSUCHNICK       | `numerics/401.json`  | No such nick/channel           |
+| `403` | ERR_NOSUCHCHANNEL    | `numerics/403.json`  | No such channel                |
+| `433` | ERR_NICKNAMEINUSE    | `numerics/433.json`  | Nickname already in use        |
+| `442` | ERR_NOTONCHANNEL     | `numerics/442.json`  | Not on that channel            |
+| `482` | ERR_CHANOPRIVSNEEDED | `numerics/482.json`  | Not channel operator           |
 
 ## Federation (S2S)
 

script/bootstrap

@@ -1,143 +0,0 @@
-#!/bin/sh
-# script/bootstrap: install all dependencies needed to build and develop
-# this repo. Idempotent: every install is guarded by a check so already
-# installed tools are skipped. Base tooling comes from nix, apt, brew,
-# or apk (detected in that order); assumes nothing is present. Node is
-# used directly if installed; otherwise it is installed at a pinned
-# version via nvm (installing nvm itself first, from a hash-verified
-# release archive, never curl | sh).
-#
-# The Go install at the end of main() is this repo's addition.
-set -eu
-
-ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
-
-# Pinned versions, 2026-07-06
-NODE_VERSION="22.17.0"
-NVM_VERSION="0.40.3"
-# sha256 of https://github.com/nvm-sh/nvm/archive/refs/tags/v0.40.3.tar.gz
-NVM_SHA256="5f4d6aaa04a177dc93c985e31dbc411ab6b8c6e1e21d8015dbc1372625fcd1d0"
-YARN_VERSION="1.22.22"
-
-PKGMGR=""
-SUDO=""
-
-detect_pkgmgr() {
-    [ -n "$PKGMGR" ] && return 0
-    if command -v nix-env >/dev/null 2>&1; then
-        PKGMGR="nix"
-    elif command -v apt-get >/dev/null 2>&1; then
-        PKGMGR="apt"
-    elif command -v brew >/dev/null 2>&1; then
-        PKGMGR="brew"
-    elif command -v apk >/dev/null 2>&1; then
-        PKGMGR="apk"
-    else
-        echo "bootstrap: no supported package manager (nix, apt, brew, apk)" >&2
-        exit 1
-    fi
-    if [ "$PKGMGR" = "apt" ]; then
-        export DEBIAN_FRONTEND=noninteractive
-        if [ "$(id -u)" != "0" ]; then
-            SUDO="sudo"
-        fi
-    fi
-}
-
-# pkg_install <nix-attr> <apt-pkg> <brew-formula> <apk-pkg>
-pkg_install() {
-    detect_pkgmgr
-    case "$PKGMGR" in
-        nix) nix-env -iA "nixpkgs.$1" ;;
-        apt) $SUDO env DEBIAN_FRONTEND=noninteractive apt-get install -y "$2" ;;
-        brew) brew install "$3" ;;
-        apk) apk add --no-cache "$4" ;;
-    esac
-}
-
-missing() {
-    ! command -v "$1" >/dev/null 2>&1
-}
-
-# verify_sha256 <file> <expected-hash>
-verify_sha256() {
-    if command -v sha256sum >/dev/null 2>&1; then
-        actual="$(sha256sum "$1" | cut -d' ' -f1)"
-    else
-        actual="$(shasum -a 256 "$1" | cut -d' ' -f1)"
-    fi
-    if [ "$actual" != "$2" ]; then
-        echo "bootstrap: sha256 mismatch for $1" >&2
-        echo "  expected: $2" >&2
-        echo "  actual:   $actual" >&2
-        exit 1
-    fi
-}
-
-# nvm is a bash script; run a command in a bash with nvm loaded
-nvm_sh() {
-    bash -c ". \"\$HOME/.nvm/nvm.sh\" && $*"
-}
-
-ensure_nvm() {
-    [ -s "$HOME/.nvm/nvm.sh" ] && return 0
-    # nvm prerequisites; nvm itself requires bash
-    if missing bash; then pkg_install bash bash bash bash; fi
-    if missing curl; then pkg_install curl curl curl curl; fi
-    if missing git; then pkg_install git git git git; fi
-    tmp="$(mktemp -d)"
-    curl -fsSL -o "$tmp/nvm.tar.gz" \
-        "https://github.com/nvm-sh/nvm/archive/refs/tags/v${NVM_VERSION}.tar.gz"
-    verify_sha256 "$tmp/nvm.tar.gz" "$NVM_SHA256"
-    mkdir -p "$HOME/.nvm"
-    tar -xzf "$tmp/nvm.tar.gz" -C "$HOME/.nvm" --strip-components=1
-    rm -rf "$tmp"
-}
-
-ensure_node() {
-    if ! missing node; then return 0; fi
-    ensure_nvm
-    nvm_sh "nvm install $NODE_VERSION"
-}
-
-ensure_yarn() {
-    if ! missing yarn; then return 0; fi
-    if ! missing corepack; then
-        corepack enable
-        corepack prepare "yarn@$YARN_VERSION" --activate
-    elif [ -s "$HOME/.nvm/nvm.sh" ]; then
-        nvm_sh "nvm use $NODE_VERSION >/dev/null && corepack enable && \
-            corepack prepare yarn@$YARN_VERSION --activate"
-    else
-        npm install -g "yarn@$YARN_VERSION"
-    fi
-}
-
-install_js_deps() {
-    if missing yarn && [ -s "$HOME/.nvm/nvm.sh" ]; then
-        nvm_sh "nvm use $NODE_VERSION >/dev/null && cd \"$ROOT\" && \
-            yarn install --frozen-lockfile"
-    else
-        yarn install --frozen-lockfile
-    fi
-}
-
-main() {
-    cd "$ROOT"
-
-    if missing make; then pkg_install gnumake make make make; fi
-    if missing git; then pkg_install git git git git; fi
-
-    ensure_node
-    ensure_yarn
-    install_js_deps
-
-    # Go, for make build, script/precommit and the gofmt step of
-    # script/fmt and script/fmt-check. golangci-lint is not installed: it
-    # runs only in the Dockerfile's lint phase.
-    if missing go; then pkg_install go golang go go; fi
-
-    echo "bootstrap complete"
-}
-
-main "$@"

script/check

@@ -1,16 +0,0 @@
-#!/bin/sh
-# script/check: run all checks (test, lint, fmt-check). Our own
-# extension to scripts-to-rule-them-all. test and lint are Docker
-# phases; fmt-check is native, because a formatter writes the working
-# tree. Must not modify any files.
-set -eu
-
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
-
-main() {
-    "$SCRIPT_DIR/test"
-    "$SCRIPT_DIR/lint"
-    "$SCRIPT_DIR/fmt-check"
-}
-
-main "$@"

script/cibuild

@@ -1,28 +0,0 @@
-#!/bin/sh
-# script/cibuild: run the CI build. It bootstraps first: a CI runner
-# checks out and runs this and nothing else, and script/fmt-check runs
-# the formatter on the host, which a pristine checkout cannot do.
-# --no-cache for the same reason as script/docker: the gate phases the
-# final stage depends on are RUN steps, and a cached one is a check that
-# did not run.
-set -eu
-
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
-ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
-
-main() {
-    cd "$ROOT"
-    "$SCRIPT_DIR/bootstrap"
-    "$SCRIPT_DIR/check"
-    # Own line: a failing command substitution inside an argument does
-    # not trip `set -e`, so the inline form degrades silently to an
-    # empty constant. The VERSION build argument takes precedence over
-    # the version a build stage derives from the .git in the context.
-    version="$(git describe --tags --always --dirty 2>/dev/null || true)"
-    [ -n "$version" ] || version="unknown"
-    docker build --no-cache \
-        --build-arg VERSION="$version" \
-        -t "$("$SCRIPT_DIR/projectname")" .
-}
-
-main "$@"

script/docker

@@ -1,24 +0,0 @@
-#!/bin/sh
-# script/docker: build the Docker image tagged with the project name.
-# Identical in all repos; the tag comes from script/projectname.
-# --no-cache because the gate phases the final stage depends on are RUN
-# steps, and a cached one is a check that did not run.
-set -eu
-
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
-ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
-
-main() {
-    cd "$ROOT"
-    # Own line: a failing command substitution inside an argument does
-    # not trip `set -e`, so the inline form degrades silently to an
-    # empty constant. The VERSION build argument takes precedence over
-    # the version a build stage derives from the .git in the context.
-    version="$(git describe --tags --always --dirty 2>/dev/null || true)"
-    [ -n "$version" ] || version="unknown"
-    docker build --no-cache \
-        --build-arg VERSION="$version" \
-        -t "$("$SCRIPT_DIR/projectname")" .
-}
-
-main "$@"

script/fmt

@@ -1,35 +0,0 @@
-#!/bin/sh
-# script/fmt: format all files (writes).
-#
-# The gofmt step in main() is this repo's addition.
-set -eu
-
-ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
-
-# Must match the pin in script/bootstrap.
-NODE_VERSION="22.17.0"
-
-# script/bootstrap installs node and yarn under nvm and leaves neither
-# on the PATH of the shell that called it, so resolve the pinned
-# toolchain here the way bootstrap's own install step does. nvm is a
-# bash script, hence the subshell.
-run_yarn() {
-    if command -v yarn >/dev/null 2>&1; then
-        exec yarn "$@"
-    fi
-    if [ ! -s "$HOME/.nvm/nvm.sh" ]; then
-        echo "fmt: no yarn; run script/bootstrap first" >&2
-        exit 1
-    fi
-    exec bash -c '. "$HOME/.nvm/nvm.sh" && nvm use "$1" >/dev/null &&
-        shift && exec yarn "$@"' bash "$NODE_VERSION" "$@"
-}
-
-main() {
-    cd "$ROOT"
-    # Before prettier, because run_yarn replaces this shell with yarn.
-    gofmt -s -w .
-    run_yarn run prettier --write '**/*.md' --tab-width 4 --prose-wrap always
-}
-
-main "$@"

script/fmt-check

@@ -1,40 +0,0 @@
-#!/bin/sh
-# script/fmt-check: check formatting (read-only).
-#
-# The gofmt check in main() is this repo's addition.
-set -eu
-
-ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
-
-# Must match the pin in script/bootstrap.
-NODE_VERSION="22.17.0"
-
-# script/bootstrap installs node and yarn under nvm and leaves neither
-# on the PATH of the shell that called it, so resolve the pinned
-# toolchain here the way bootstrap's own install step does. nvm is a
-# bash script, hence the subshell.
-run_yarn() {
-    if command -v yarn >/dev/null 2>&1; then
-        exec yarn "$@"
-    fi
-    if [ ! -s "$HOME/.nvm/nvm.sh" ]; then
-        echo "fmt-check: no yarn; run script/bootstrap first" >&2
-        exit 1
-    fi
-    exec bash -c '. "$HOME/.nvm/nvm.sh" && nvm use "$1" >/dev/null &&
-        shift && exec yarn "$@"' bash "$NODE_VERSION" "$@"
-}
-
-main() {
-    cd "$ROOT"
-    # Before prettier, because run_yarn replaces this shell with yarn.
-    unformatted="$(gofmt -s -l .)"
-    if [ -n "$unformatted" ]; then
-        echo "fmt-check: run make fmt; gofmt would change:" >&2
-        echo "$unformatted" >&2
-        exit 1
-    fi
-    run_yarn run prettier --check '**/*.md' --tab-width 4 --prose-wrap always
-}
-
-main "$@"

script/install-precommit

@@ -1,16 +0,0 @@
-#!/bin/sh
-# script/install-precommit: install the git pre-commit hook that runs
-# script/precommit. Our own extension to scripts-to-rule-them-all.
-set -eu
-
-ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
-
-main() {
-    cd "$ROOT"
-    hook=".git/hooks/pre-commit"
-    printf '#!/bin/sh\nset -e\nscript/precommit\n' > .git/hooks/pre-commit
-    chmod +x .git/hooks/pre-commit
-    echo "pre-commit hook installed: runs script/precommit"
-}
-
-main "$@"

script/lint

@@ -1,23 +0,0 @@
-#!/bin/sh
-# script/lint: run the linter. Linting is a phase of the Dockerfile and
-# this builds that phase alone; the linter is never installed or run on
-# a developer host, where a shared result cache and a host-global lock
-# make its answer untrustworthy.
-#
-# The phase is not the last stage in the file, so it is built only when
-# --target names it. --no-cache because a cached lint layer is a lint
-# that did not run. The tag makes each build replace the previous image
-# instead of leaving a dangling one behind.
-set -eu
-
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
-ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
-
-main() {
-    cd "$ROOT"
-    docker build --no-cache \
-        --target lint \
-        -t "$("$SCRIPT_DIR/projectname")-lint" .
-}
-
-main "$@"

script/precommit

@@ -1,23 +0,0 @@
-#!/bin/sh
-# script/precommit: run by the git pre-commit hook; fails the commit if
-# checks fail. Our own extension to scripts-to-rule-them-all.
-#
-# This repo's addition: go mod tidy runs first, failing the commit if it
-# changes go.mod or go.sum.
-set -eu
-
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
-ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
-
-main() {
-    cd "$ROOT"
-    go mod tidy
-    git diff --exit-code -- go.mod go.sum || {
-        echo "precommit: go mod tidy changed go.mod or go.sum;" \
-            "stage the changes and retry" >&2
-        exit 1
-    }
-    "$SCRIPT_DIR/check"
-}
-
-main "$@"

script/projectname

@@ -1,12 +0,0 @@
-#!/bin/sh
-# script/projectname: output the name of this project. Our own
-# extension to scripts-to-rule-them-all. Other scripts that need the
-# name (e.g. script/docker) call this, so they can stay identical
-# across all repos.
-set -eu
-
-main() {
-    echo "neoirc"
-}
-
-main "$@"

script/setup

@@ -1,13 +0,0 @@
-#!/bin/sh
-# script/setup: set up the repo for development after a fresh clone:
-# installs dependencies and the git pre-commit hook.
-set -eu
-
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
-
-main() {
-    "$SCRIPT_DIR/bootstrap"
-    "$SCRIPT_DIR/install-precommit"
-}
-
-main "$@"

script/test

@@ -1,19 +0,0 @@
-#!/bin/sh
-# script/test: run the test suite. Testing is a phase of the Dockerfile
-# and this builds that phase alone, on the same terms as script/lint:
-# --target because a phase that is not the last stage is built only when
-# named, --no-cache because a cached test layer is a test that did not
-# run, and a tag so each build replaces the previous image.
-set -eu
-
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
-ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
-
-main() {
-    cd "$ROOT"
-    docker build --no-cache \
-        --target test \
-        -t "$("$SCRIPT_DIR/projectname")-test" .
-}
-
-main "$@"

yarn.lock

@@ -1,8 +0,0 @@
-# THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
-# yarn lockfile v1
-
-
-prettier@3.8.1:
-  version "3.8.1"
-  resolved "https://registry.yarnpkg.com/prettier/-/prettier-3.8.1.tgz#edf48977cf991558f4fcbd8a3ba6015ba2a3a173"
-  integrity sha512-UOnG6LftzbdaHZcKoPFtOcCKztrQ57WkHDeRD9t/PTQtmT0NHSeWWepj6pS0z/N7+08BHFDQVUrfmfMRcZwbMg==