VIPIRC 0.3.1 - TEST RESULTS AND CORRECTED BUILD
Release date: 2026-10-26
Testing: 2026-10-27 UTC

STATUS

Four production defects were found and fixed. The final complete normal
regression target, full sanitizer target, seeded UI stress, allocation-fault
tests, DCC/parser stress, transport/storage failures, and low-descriptor
regression passed. An isolated clean build reproduced the executable byte
for byte, and staged install/uninstall passed.

THE PLANNED TWENTY-MINUTE LONGEVITY RUN WAS INTERRUPTED BY THE USER.
Its last recorded checkpoint is 720.2 seconds (about 12 minutes), with
3,971,200 delivered chat lines and 11 reconnects. It did not emit its final
JSON summary or completion/cleanup assertions. It is INCOMPLETE and is NOT
counted as a passed 20-minute test. No matching soak driver or client process
remained after the interruption. The separate final idle/throughput benchmark
was not run after that interruption. Earlier 0.3.0 benchmark figures are not
presented as measurements of this corrected executable.

EXACT BUILD AND PROVENANCE

vipirc 0.3.1, Linux x86_64, 379,728 bytes.
SHA256: 44af2f425eee4f8e5ce4dbee71f4232123a5f89cbc89285164a06c7f6fbaf50c
Size change from 0.3.0: +104 bytes. No new runtime dependency or feature.
Compiler: cc (Ubuntu 13.3.0-6ubuntu2~24.04) 13.3.0
Host: Linux-6.18.55-x86_64-with-glibc2.39
C11, -O2, -Wall -Wextra -Wpedantic.
Strict all-source syntax check also used -Wformat=2 -Wshadow -Wconversion
-Werror and passed. The binary dynamically links libc, ncursesw/tinfo 6,
and OpenSSL libssl/libcrypto 3; it uses glibc symbols through GLIBC_2.34.
Python is required only for development tests, not the installed client.

An application of ThatIAm.vip (www.thatiam.vip), designed by remfan1994.
The supplied IALA (Insha-Allah License Agreement) is unchanged byte for byte
against the original 0.2.0 archive: 6,080 bytes, SHA256
16f5cc0b2a43d1c2f85b0f1a0c44a20de73bf4e5dcf6b6597ee9e544d2955e41.

FOUR CONFIRMED DEFECTS FIXED

1. A queued mouse batch could cross into a newly opened DCC receive-review
   form. A click that described the old list could land on the new Accept
   control. Mouse batches now stop when the conversation, session, form,
   field editor, choice, Settings basic/advanced state, or review changes.
   A newly displayed consequential control requires a fresh action on it.
   Live click-flood regressions create no receive file or peer connection.

2. Highlighting only one cell of a two-cell CJK character could corrupt its
   redraw. A minimal draft was a CJK glyph followed by ABC, then Select All,
   Home, and Select All. Chat, Settings, and transfer editors now apply caret
   attributes across the full rendered cluster width. Tests verify the
   actual hardware cursor, content, and visible reverse-video caret cell.

3. The event loop always passed at least nine entries to poll(), including
   unused server slots with fd=-1. Linux rejects nfds above RLIMIT_NOFILE,
   so a five-descriptor limit caused EINVAL and an unintended exit. The
   loop now polls only active descriptors, maps events back to their server,
   and still services timers for every session without a socket.

4. Staged text with leading/trailing ASCII spaces could be saved and then
   silently trimmed on reload. Config validation now rejects those values
   before Apply/Save with a field-specific error, and checks bounded NUL
   termination before scanning fixed buffers. Interior spaces and valid
   non-ASCII whitespace remain supported. Hand-edited INI padding retains
   its documented trimming behavior. Six invalid Apply/Save attempts leave
   existing App state/history unchanged and invoke no writer.

COMPLETED REGRESSION AND SANITIZER GATES

PASS: make check (complete normal target).
PASS: ASAN_OPTIONS=detect_leaks=1 UBSAN_OPTIONS=halt_on_error=1 make sanitize.
PASS: separate optimized and instrumented allocation-failure regressions.
PASS: separate DCC/parser mutation and repeated-lifecycle stress.
PASS: transport/storage stress with explicitly recorded leak settings.
PASS: complete optimized and ASan/UBSan/leak-enabled seeded UI stress.
PASS: whole-client descriptor limits 5, 8, and 16.
PASS: strict optimized compilation and isolated clean build/install/uninstall.
INCOMPLETE: intended 1,200-second TLS longevity run, interrupted after its
720.2-second checkpoint. NOT RUN: new isolated idle/throughput benchmark.

The complete ordinary gates cover protocol/byte budgeting, editor state,
configuration safety, application/client state, DCC files and sockets,
welcome interrupt/suspend controls, Ctrl-D safety, offline simulation,
input thresholds/repeat/paste/selection, Settings, away/keyed-join/ignore,
server/channel/query isolation, transfer consent, and local integration.
Transport integration includes verified TLS, bad DNS/IP identity and
untrusted-CA rejection, SASL success/failure, byte integrity, and resolver
cancellation/descriptor isolation. Public IRC servers were not contacted.

The completed final instrumented runs report no address-sanitizer,
undefined-behavior, or leak error. The -O1 sanitizer compilation emits one
reviewed format diagnostic concerning the inline Buffer.name array in
toolbar_layout; it is not a runtime finding. The -O2 all-source -Werror
check is clean. No universal compiler-warning-free claim is made.
New stress workloads are separate from make sanitize; their results must
not be inferred merely from that target passing.

ALLOCATION FAILURES AND STORAGE RACES

The real App allocation fixture passes 11,920 checked cases and 12,000
injected ENOMEM failures per normal/instrumented run. It checks partial
initialization cleanup; failure-atomic resizing of ten view histories;
complete send-plan rollback preserving the existing queue and sending no
partial plan; roster/view/history recovery; bounded history accounting;
and exact zero balance of tracked App allocations after destruction.

Normal and explicit ASan/UBSan/leak-enabled storage fixtures cover:
  One real RLIMIT_FSIZE short-write failure.
  Seven injected file-fsync, rename, and directory-fsync failures.
  Complete old/new files, truthful commit state, stable profile-ID retries,
  no leftover temporary files, and descriptor/child cleanup.
  Seven concurrent processes, each saving its own profile 20 times:
  140 saves across seven profiles, with no lost catalog entries.
  400 leaf-symlink swaps with 400 save/load pairs.
  400 ancestor-directory swaps; outside victim contents stay unchanged,
  and failures preserve the caller's prior state.

Normal storage: 1.623 s, 495 busy retries, 140 complete snapshots.
Final explicit leak-enabled storage: 1.452 s, 411 busy retries, 98 complete
snapshots. These fixture times exclude compilation/driver overhead. Both
return from 4 descriptors to 4 with zero child processes.

The client-lifetime fixture performs 512 reused-slot lifecycles/connect
callbacks, 64 full eight-slot sets, 64 saved/closed profiles and 16 reloads.
It uses minimal App doubles with real profile/catalog I/O; those callbacks
do not open sockets. All App objects are released, stable tokens and
isolation hold, and offline operations do not write. Fixture times:
0.206 s normal; 0.292 s instrumented. These counts are separate from the
real transport lifetimes below.

TRANSPORT AND LOW-DESCRIPTOR TESTS

Each main transport stress run covers 339 real lifetimes:
  300 cancellation/forced-timeout/refused-connect cycles;
  12 stalled TLS handshakes;
  24 abrupt TLS closes;
  1 MiB plaintext and 1 MiB TLS byte-checked under backpressure;
  one real 30-second connection-setup deadline.
Every completed lifetime returns the fixture descriptor count from 4 to 4
with no unreaped resolver child. The actual deadline fires at 30.006 s in
the normal run and 30.004 s in the final explicit leak-enabled repeat.
Network fixture totals: 32.099 s normal; 32.431 s final instrumented.
The final network-plus-storage command takes 38.125909 s including driver
and compilation, exits 0, and records ASAN_OPTIONS=detect_leaks=1:abort_on_error=1
and UBSAN_OPTIONS=halt_on_error=1 plus production-source/log hashes.

The original normal network stdout was captured by the execution tool but
not redirected; its JSON summary labels that reconstruction. Earlier
instrumented logs omitted runtime options and are not used to establish
leak detection. The final explicit repeat resolves that evidence gap.

Whole-client descriptor-pressure cases on the exact optimized build:
  limit 5: 1 connected, 7 failed, 4 descriptors, 0 children; 0.794 s
  limit 8: 4 connected, 4 failed, 7 descriptors, 0 children; 0.641 s
  limit 16: 8 connected, 0 failed, 11 descriptors, 0 children; 0.476 s
All 13 healthy connections answer PING. Every failed slot visibly reports
"Cannot create resolver pipe: Too many open files". Failed attempts retain
zero descriptors. Drafts survive server-list/manual navigation, the editor
remains usable, all exits are 0, and terminal attributes are restored.
Only the child client's limit changes; the parent's limits are unchanged.

DCC AND PROTOCOL STRESS

Each principal run performs 200,000 deterministic exact-allocation mutation
cases for parser/sanitizer/splitting inputs and 80,000 unique offer lifetimes.
Live tests use all four transfer slots, mixed send/receive, fragmented,
duplicate, regressive and invalid ACKs, stalled peers, source truncation,
destination-directory replacement, stale snapshots, cancellation, timeout
and destructor cleanup. Data bytes and private temporary-file cleanup are
verified. These are bounded deterministic mutations, not exhaustive or
coverage-guided fuzzing.

Optimized: 90.972106 s total, 4,439 live cycles,
119,952 completed lifecycles, 1,126,498,344 verified bytes.
Final ASan/UBSan with leaks: 62.295490 s total,
3,262 live cycles, 109,359 completed lifecycles,
827,782,624 verified bytes; recorded exit 0 and no diagnostic.
Descriptors return from 3 to 3 in both runs (peak 20 including fixture ends).

DCC timeout checks advance an injected monotonic timestamp instead of
waiting the entire timeout. DCC RSS is standalone-harness RSS, not client
RSS. An earlier incomplete leak-enabled attempt is explicitly excluded.
Earlier rough lifecycle labels were corrected without changing workload;
strict final builds and short instrumented/normal smokes verified counters.

INPUT, MODES, PASTE, AND UNUSUAL INTERACTIONS

Final optimized 12-case suite: 221.493 s, exit success.
Final ASan/UBSan/leak-enabled 12-case suite: 226.499 s,
exit success, with no sanitizer diagnostic files.
Instrumented executable SHA256:
bf00ae10556dee890e3b8ee930afa0464c8d369f591ffe03b95a4c4594b27080

Each run completes:
  3,600 modeled editor operations over three deterministic seeds.
  Original and Vim-style navigation, C.UTF-8 and C locales, and
  xterm-256color/screen terminal descriptions.
  48 focused wide-glyph checks across chat, Settings and transfer fields.
  240 modal geometry transitions, including below-minimum windows.
  12 maximum-draft cycles, totaling 163,840 accepted paste bytes, including
  scalar/byte caps, fragmented UTF-8, warnings, default-No confirmations,
  invalid paste, selection replacement, and full clearing.
  192 switches among eight sessions with independent drafts/carets/keymaps.
  64 stale-coordinate server-switch/Clear batches.
  DCC floods of 9, 33 and 129 clicks with zero unreviewed file/socket I/O.
  Eight live secondary-screen/disconnect cases while another server
  continues answering PING.

Byte counts, retained draft content, hardware cursor position, visible
caret, return paths, no unintended chat sends, and terminal restoration
are checked. These use actual PTYs with an external screen model; they
are not native deployments of SSH, GNU screen, or tmux.

COMPLETED EFFICIENCY OBSERVATIONS

The optimized one-session editor/modal scenarios sample roughly
3,944..4,696 KiB RSS. Eight-session UI churn samples 6,592..7,004 KiB and
ends at 6,908 KiB. Measurements identify the actual vipirc child by PPid,
namespace PID, executable and process start time; they are not Python
driver RSS. Instrumented allocator/quarantine memory is kept separate.

The executable remains 379,728 bytes with the same runtime
libraries. The App history-text bound remains 8 MiB per server (64 MiB
over eight servers), distinct from total RSS: ring pointers, rosters,
editors, TLS/curses, allocation overhead and shared libraries also consume
memory. No controlled ircii comparison was performed, so parity with
that client's resource use has not been established.

INTERRUPTED LONGEVITY RUN: OBSERVATIONS, NOT A COMPLETED PASS

Eight simultaneous verified-TLS loopback servers, 20 channels each, and
history_lines=5000. Warmup requests 40,000 messages per server, followed by
sustained traffic with mentions, private-query overflow, hostile terminal
control payloads, input editing, resizes and background reconnects.

Requested sustained duration: 1,200 seconds.
Last recorded progress checkpoint: 720.2 seconds.
Cumulative delivered chat lines at that point: 3,971,200.
Reconnects recorded: 11.
Descriptors at every printed progress checkpoint: 11.
RSS at printed checkpoints: 91,188..92,004 KiB
(89.051..89.848 MiB); last 92,000 KiB.
No assertion failure was reported before the interruption. Message totals
include warmup, not solely the sustained interval. Retained history is
bounded and intentionally evicts old lines.

The user interrupted the wait, which ended the execution session. No final
JSON was emitted; the final latency, CPU-window, full sample series, finish
PING barriers, normal exit and terminal-restoration assertions are therefore
unavailable for this run. They are not inferred or invented. Its empty JSON
and progress log are preserved with soak-user-interruption-031.json.
No matching driver/client process remained in the post-interruption check.
A separate superseded pre-fix soak was also interrupted and is not counted
as completed. Finishing a new full-duration run remains an open validation
item. The independent completed suites' shutdown checks remain valid.

BUILD, MANUAL, AND ARCHIVE CHECKS

A fresh private source snapshot with no copied objects reproduced the
exact executable. Staged install put exactly ten expected regular files
in place, executable mode 0755 and docs/man mode 0644, with exact content.
Installed -h/-v passed. --manual matched doc/manual.txt exactly: 60,559 bytes,
1,191 lines. Staged uninstall removed all ten files. All seven commands
exited 0; total local check time was 1.792695 s.

GNU groff 1.23.0 rendered the man page with -ww -man -Tutf8, exit 0 and no
diagnostics. Embedded Help and the plain manual match byte for byte.
README, INSTALL, DESIGN, SECURITY and CHANGELOG describe the fixes and
repeatable test commands. IALA and attribution are retained.

The source archive contains source/tests/docs/license, this report and raw
test evidence. The generic shipped Makefile does not retain build-host
temporary include paths; ./configure detects the user's local dependencies.
Only regular files/directories with safe relative paths are archived.
Runtime-source hashes match the clean-build snapshot; the binary archive's
executable equals the tested file. SHA256SUMS covers both archives, the
standalone manual and this report. The corrected build is delivered with
the interrupted longevity check clearly disclosed, not as a fully passed
twenty-minute release-validation result.

REPRODUCTION

  ./configure
  make
  make check
  ASAN_OPTIONS=detect_leaks=1 UBSAN_OPTIONS=halt_on_error=1 make sanitize
  make check-stress STRESS_SECONDS=90
  ASAN_OPTIONS=detect_leaks=1:abort_on_error=1 UBSAN_OPTIONS=halt_on_error=1 python3 tests/test_lifecycle_stress.py --sanitize

For instrumented UI stress, set VIPIRC_BINARY to the absolute
build/sanitize/vipirc path and use the same sanitizer environment.
Private build/reproduction scripts are included for the App allocation and
DCC instrumented fixtures under test-results. Seeded UI defaults are
seed=20261027, steps=1200, rounds=48.

To complete a new full-length run and collect the remaining benchmark:

  python3 tests/test_soak.py --seconds 1200 --servers 8 --tls > soak.json
  python3 tests/bench.py --messages 100000 --idle-seconds 3 --idle-instances 3

These are local tests, not public IRC load generators. PTY/loopback access,
Python 3, a compiler, development headers and the OpenSSL command-line tool
are needed. The resource-sampling fixtures require Linux /proc where stated.

LIMITS OF THE EVIDENCE

The tests establish the stated finite observations on this build and host.
They do not establish the absence of all defects, multi-day uptime, every
Unicode grapheme/terminal behavior, every network/filesystem failure, or
native BSD/macOS/ChromeOS compatibility. No real multi-hop SSH session,
public IRC service, public DCC/NAT path or alternate curses/LibreSSL runtime
was tested in this pass. This Linux binary is not a universal Unix binary.

GCC 13.3 static analysis of net.c, config.c and client.c found no confirmed
additional defect. Internal path-complexity cutoffs remain, so it is partial
analysis. A dup2(fd,3)/close(3) descriptor-leak warning was reproduced in a
minimal correct program and classified as a compiler-model false positive;
the reproducer and diagnostics are retained. This is not an independent
security audit, and no bulletproof, audited or universally portable claim
is made.
