19 files changed, 1846 insertions, 162 deletions

diff --git a/tests/integration/.gitignore b/tests/integration/.gitignore
new file mode 100644
index 0000000..7a60b85
--- /dev/null
+++ b/tests/integration/.gitignore
@@ -0,0 +1,2 @@
+__pycache__/
+*.pyc
diff --git a/tests/integration/harness.py b/tests/integration/harness.py
new file mode 100644
index 0000000..7e75574
--- /dev/null
+++ b/tests/integration/harness.py
@@ -0,0 +1,230 @@
+"""Starts a real opentracker and talks to it over the wire.
+
+Everything here drives the binary rather than the code, so these tests cover
+what the unit suite cannot reach: the event loop, the HTTP parser and the
+torrent store working together. Run against a sanitizer build and the tracker
+reports its own memory errors, which the teardown turns into test failures.
+"""
+
+import os
+import shutil
+import signal
+import socket
+import struct
+import subprocess
+import sys
+import tempfile
+import time
+import unittest
+import urllib.error
+import urllib.parse
+import urllib.request
+
+TRACKER = os.environ.get("OPENTRACKER", os.path.join(os.path.dirname(__file__), "..", "..", "opentracker.debug"))
+
+
+def bdecode(data):
+    """Enough bencode for what a tracker answers."""
+
+    def value(i):
+        if data[i : i + 1] == b"d":
+            i, out = i + 1, {}
+            while data[i : i + 1] != b"e":
+                i, key = value(i)
+                i, out[key] = value(i)
+            return i + 1, out
+        if data[i : i + 1] == b"l":
+            i, out = i + 1, []
+            while data[i : i + 1] != b"e":
+                i, item = value(i)
+                out.append(item)
+            return i + 1, out
+        if data[i : i + 1] == b"i":
+            end = data.index(b"e", i)
+            return end + 1, int(data[i + 1 : end])
+        colon = data.index(b":", i)
+        length = int(data[i:colon])
+        return colon + 1 + length, data[colon + 1 : colon + 1 + length]
+
+    return value(0)[1]
+
+
+def free_port():
+    probe = socket.socket()
+    probe.bind(("127.0.0.1", 0))
+    port = probe.getsockname()[1]
+    probe.close()
+    return port
+
+
+class Tracker:
+    """One tracker process, listening on loopback."""
+
+    def __init__(self, extra_config="", files=None):
+        self.port = free_port()
+        self.dir = tempfile.mkdtemp(prefix="ot-integration-")
+        self.log = None
+        self.process = None
+        try:
+            for name, content in (files or {}).items():
+                with open(os.path.join(self.dir, name), "wb") as handle:
+                    handle.write(content)
+            self.config = os.path.join(self.dir, "opentracker.conf")
+            with open(self.config, "w") as handle:
+                handle.write("listen.tcp 127.0.0.1:%d\n" % self.port)
+                handle.write("listen.udp 127.0.0.1:%d\n" % self.port)
+                handle.write(extra_config.replace("{dir}", self.dir))
+            self.log = open(os.path.join(self.dir, "tracker.log"), "w+b")
+            # Leak detection is left at the sanitizer's own default, which is on
+            # where LeakSanitizer exists and off where it does not. Asking for it
+            # by name makes the tracker refuse to start on macOS and FreeBSD.
+            environment = dict(os.environ, ASAN_OPTIONS="abort_on_error=0")
+            self.process = subprocess.Popen([TRACKER, "-f", self.config], stdout=self.log, stderr=self.log, env=environment)
+            self._wait_for_port()
+        except BaseException:
+            self._cleanup()
+            raise
+
+    def _cleanup(self):
+        """Close what we opened and take the scratch directory with it."""
+        if self.process is not None and self.process.poll() is None:
+            self.process.kill()
+            self.process.wait()
+        if self.log is not None:
+            self.log.close()
+            self.log = None
+        shutil.rmtree(self.dir, ignore_errors=True)
+
+    def _wait_for_port(self):
+        for _ in range(200):
+            if self.process.poll() is not None:
+                raise AssertionError("tracker exited at once:\n" + self.output())
+            try:
+                probe = socket.create_connection(("127.0.0.1", self.port), timeout=0.2)
+                probe.close()
+                return
+            except OSError:
+                time.sleep(0.05)
+        raise AssertionError("tracker never listened on %d:\n%s" % (self.port, self.output()))
+
+    def output(self):
+        if self.log is None:
+            return ""
+        self.log.flush()
+        self.log.seek(0)
+        return self.log.read().decode("utf-8", "replace")
+
+    def stop(self):
+        """Returns anything the tracker complained about on the way out.
+
+        The interrupt rather than a kill is what makes the leak check work at
+        all: LeakSanitizer reports from an exit handler, so a killed tracker
+        reports nothing and the suite passes over leaks it never looked for.
+        """
+        if self.process is not None and self.process.poll() is None:
+            self.process.send_signal(signal.SIGINT)
+            try:
+                self.process.wait(timeout=5)
+            except subprocess.TimeoutExpired:
+                self.process.kill()
+                self.process.wait()
+        complaints = [
+            line
+            for line in self.output().splitlines()
+            if "Sanitizer" in line or "runtime error" in line or line.startswith("ERROR")
+        ]
+        self._cleanup()
+        return complaints
+
+    # ----------------------------------------------------------- over http
+
+    def get(self, path, timeout=10):
+        return urllib.request.urlopen("http://127.0.0.1:%d%s" % (self.port, path), timeout=timeout).read()
+
+    def announce(self, info_hash, peer_id=b"-OT0001-aaaaaaaaaaaa", port=6881, left=0, **extra):
+        query = {
+            "info_hash": urllib.parse.quote_from_bytes(info_hash, safe=""),
+            "peer_id": urllib.parse.quote_from_bytes(peer_id, safe=""),
+            "port": port,
+            "left": left,
+        }
+        query.update(extra)
+        return bdecode(self.get("/announce?" + "&".join("%s=%s" % item for item in query.items())))
+
+    def scrape(self, info_hash):
+        return bdecode(self.get("/scrape?info_hash=" + urllib.parse.quote_from_bytes(info_hash, safe="")))
+
+    def stats(self, mode):
+        return self.get("/stats?mode=" + mode)
+
+    def get_with_headers(self, path, headers=None, timeout=10):
+        """The body and the response headers, for the compressed answers."""
+        request = urllib.request.Request("http://127.0.0.1:%d%s" % (self.port, path), headers=headers or {})
+        with urllib.request.urlopen(request, timeout=timeout) as response:
+            return response.read(), dict(response.headers)
+
+    def torrent_count(self):
+        return int(self.stats("torr").split()[0])
+
+    # ------------------------------------------------------------ over udp
+
+    def udp_connect(self):
+        sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
+        sock.settimeout(5)
+        sock.sendto(struct.pack(">QII", 0x41727101980, 0, 1), ("127.0.0.1", self.port))
+        answer = sock.recv(2048)
+        action, _, connection_id = struct.unpack(">IIQ", answer[:16])
+        assert action == 0, "udp connect answered action %d" % action
+        return sock, connection_id
+
+    def udp_announce(self, sock, connection_id, info_hash, left=0, event=0, port=6881, numwant=-1):
+        sock.sendto(
+            struct.pack(
+                ">QII20s20sQQQIIIiH", connection_id, 1, 2, info_hash, b"p" * 20, 0, left, 0, event, 0, 0, numwant, port
+            ),
+            ("127.0.0.1", self.port),
+        )
+        answer = sock.recv(2048)
+        action, _, interval, leechers, seeders = struct.unpack(">IIIII", answer[:20])
+        assert action == 1, "udp announce answered action %d" % action
+        return {"interval": interval, "leechers": leechers, "seeders": seeders, "peers": answer[20:]}
+
+    def udp_scrape(self, sock, connection_id, hashes):
+        """One (seeders, completed, leechers) triple per hash, in order."""
+        sock.sendto(struct.pack(">QII", connection_id, 2, 3) + b"".join(hashes), ("127.0.0.1", self.port))
+        answer = sock.recv(2048)
+        action, _ = struct.unpack(">II", answer[:8])
+        assert action == 2, "udp scrape answered action %d" % action
+        return [struct.unpack(">III", answer[8 + 12 * i : 20 + 12 * i]) for i in range(len(hashes))]
+
+    def udp_raw(self, payload, timeout=1.0):
+        """Sends a packet exactly as given. Returns the answer, or None if the
+        tracker chose to say nothing, which is how it treats a broken one."""
+        sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
+        sock.settimeout(timeout)
+        try:
+            sock.sendto(payload, ("127.0.0.1", self.port))
+            try:
+                return sock.recv(2048)
+            except socket.timeout:
+                return None
+        finally:
+            sock.close()
+
+
+class TrackerTestCase(unittest.TestCase):
+    """Gives every test its own tracker and fails it on any sanitizer output."""
+
+    config = ""
+    files = None
+
+    def setUp(self):
+        self.tracker = Tracker(self.config, self.files)
+
+    def tearDown(self):
+        complaints = self.tracker.stop()
+        self.assertEqual(complaints, [], "the tracker reported:\n" + "\n".join(complaints))
+
+    def hash_for(self, name):
+        """A distinct info hash per test, so tests cannot leak into each other."""
+        return (name.encode() + b"\0" * 20)[:20]
diff --git a/tests/integration/test_accesslist.py b/tests/integration/test_accesslist.py
new file mode 100644
index 0000000..b4e134e
--- /dev/null
+++ b/tests/integration/test_accesslist.py
@@ -0,0 +1,102 @@
+"""The blacklist, loaded from a file at startup.
+
+A blacklisted info hash must be refused at both the announce and the scrape
+entry, and the file parser has to cope with the shapes an operator actually
+produces: an empty file, and a last line with no newline after it.
+"""
+
+import struct
+import unittest
+
+from harness import TrackerTestCase
+
+BLOCKED = b"\xb1" * 20
+ALLOWED = b"\xa1" * 20
+
+
+def listing(*hashes):
+    return b"".join(h.hex().upper().encode() + b"\n" for h in hashes)
+
+
+class Blacklist(TrackerTestCase):
+    config = "access.blacklist {dir}/blacklist\n"
+    files = {"blacklist": listing(BLOCKED)}
+
+    def test_a_blacklisted_hash_is_refused(self):
+        answer = self.tracker.announce(BLOCKED, port=6881, left=0)
+        self.assertIn(b"failure reason", answer)
+        self.assertIn(b"not authorized", answer[b"failure reason"])
+
+    def test_a_blacklisted_hash_never_becomes_a_torrent(self):
+        before = self.tracker.torrent_count()
+        self.tracker.announce(BLOCKED, port=6881, left=0)
+        self.assertEqual(self.tracker.torrent_count(), before, "the refused hash was stored anyway")
+
+    def test_any_other_hash_is_served(self):
+        answer = self.tracker.announce(ALLOWED, port=6881, left=0)
+        self.assertNotIn(b"failure reason", answer)
+        self.assertEqual(answer[b"complete"], 1)
+
+    def test_the_block_holds_over_udp_but_the_answer_is_malformed(self):
+        """The UDP path has no spelling for "not authorized": the announce
+        writes no body, so the tracker sends the eight byte header alone
+        where BEP 15 calls for at least twenty. Pinned rather than blessed —
+        an error packet or silence would both be defensible, a short announce
+        is neither."""
+        sock, connection_id = self.tracker.udp_connect()
+        sock.close()
+        request = struct.pack(
+            ">QII20s20sQQQIIIiH", connection_id, 1, 7, BLOCKED, b"p" * 20, 0, 0, 0, 0, 0, 0, -1, 6881
+        )
+        answer = self.tracker.udp_raw(request)
+        self.assertIsNotNone(answer)
+        self.assertEqual(len(answer), 8, "header only, no interval or counts")
+        action, transaction = struct.unpack(">II", answer)
+        self.assertEqual(action, 1, "it still claims to be an announce")
+        self.assertEqual(transaction, 7)
+
+    def test_a_blocked_hash_is_not_stored_when_it_arrives_over_udp(self):
+        sock, connection_id = self.tracker.udp_connect()
+        sock.close()
+        self.tracker.udp_raw(
+            struct.pack(">QII20s20sQQQIIIiH", connection_id, 1, 8, BLOCKED, b"p" * 20, 0, 0, 0, 0, 0, 0, -1, 6881)
+        )
+        self.assertEqual(self.tracker.torrent_count(), 0)
+
+
+class BlacklistWithoutTrailingNewline(TrackerTestCase):
+    """A single hash with no newline after it used to size the list at zero
+    and then write into it, which took the tracker down before it listened."""
+
+    config = "access.blacklist {dir}/blacklist\n"
+    files = {"blacklist": BLOCKED.hex().upper().encode()}
+
+    def test_the_last_line_counts_even_without_its_newline(self):
+        answer = self.tracker.announce(BLOCKED, port=6881, left=0)
+        self.assertIn(b"failure reason", answer)
+
+    def test_and_the_tracker_still_serves_everything_else(self):
+        self.assertEqual(self.tracker.announce(ALLOWED, port=6881, left=0)[b"complete"], 1)
+
+
+class EmptyBlacklist(TrackerTestCase):
+    config = "access.blacklist {dir}/blacklist\n"
+    files = {"blacklist": b""}
+
+    def test_an_empty_file_blocks_nothing_and_starts_cleanly(self):
+        self.assertEqual(self.tracker.announce(BLOCKED, port=6881, left=0)[b"complete"], 1)
+        self.assertEqual(self.tracker.announce(ALLOWED, port=6882, left=0)[b"complete"], 1)
+
+
+class MissingBlacklist(TrackerTestCase):
+    """The file is named but absent: the tracker warns and serves everything,
+    because it may be created later."""
+
+    config = "access.blacklist {dir}/absent\n"
+
+    def test_a_missing_file_blocks_nothing(self):
+        self.assertEqual(self.tracker.announce(BLOCKED, port=6881, left=0)[b"complete"], 1)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/integration/test_announce.py b/tests/integration/test_announce.py
new file mode 100644
index 0000000..ffbc07b
--- /dev/null
+++ b/tests/integration/test_announce.py
@@ -0,0 +1,129 @@
+"""What a peer's announce does to the swarm it joins."""
+
+import os
+import socket
+import sys
+import unittest
+
+sys.path.insert(0, os.path.dirname(__file__))
+from harness import TrackerTestCase
+
+
+def peers_of(answer, key=b"peers"):
+    """Compact peer list as a list of (address, port)."""
+    blob, out = answer.get(key, b""), []
+    size = 6 if key == b"peers" else 18
+    for offset in range(0, len(blob), size):
+        entry = blob[offset : offset + size]
+        address = socket.inet_ntop(socket.AF_INET if size == 6 else socket.AF_INET6, entry[:-2])
+        out.append((address, entry[-2] << 8 | entry[-1]))
+    return out
+
+
+class AnnounceLifetime(TrackerTestCase):
+    config = ""
+
+    def test_a_leecher_is_counted_as_incomplete(self):
+        info_hash = self.hash_for("leecher")
+        answer = self.tracker.announce(info_hash, left=100)
+        self.assertEqual(answer[b"complete"], 0)
+        self.assertEqual(answer[b"incomplete"], 1)
+
+    def test_no_bytes_left_means_seeding(self):
+        info_hash = self.hash_for("seeder")
+        answer = self.tracker.announce(info_hash, left=0)
+        self.assertEqual(answer[b"complete"], 1)
+        self.assertEqual(answer[b"incomplete"], 0)
+
+    def test_a_peer_that_finishes_moves_from_one_column_to_the_other(self):
+        info_hash = self.hash_for("finishes")
+        peer_id = b"-OT0001-finisher0001"
+        self.tracker.announce(info_hash, peer_id=peer_id, left=100)
+        self.assertEqual(self.tracker.announce(info_hash, peer_id=peer_id, left=100)[b"incomplete"], 1)
+
+        answer = self.tracker.announce(info_hash, peer_id=peer_id, left=0, event="completed")
+        self.assertEqual(answer[b"complete"], 1, "the peer should now count as a seeder")
+        self.assertEqual(answer[b"incomplete"], 0, "and no longer as a leecher")
+
+    def test_stopped_removes_the_peer(self):
+        info_hash = self.hash_for("stopped")
+        peer_id = b"-OT0001-leaves000001"
+        self.tracker.announce(info_hash, peer_id=peer_id, left=100)
+        self.assertEqual(self.tracker.scrape(info_hash)[b"files"][info_hash][b"incomplete"], 1)
+
+        self.tracker.announce(info_hash, peer_id=peer_id, left=100, event="stopped")
+        self.assertEqual(
+            self.tracker.scrape(info_hash)[b"files"][info_hash][b"incomplete"], 0, "the peer should be gone"
+        )
+
+    def test_the_same_peer_announcing_twice_is_still_one_peer(self):
+        info_hash = self.hash_for("twice")
+        peer_id = b"-OT0001-repeats00001"
+        for _ in range(5):
+            answer = self.tracker.announce(info_hash, peer_id=peer_id, left=100)
+        self.assertEqual(answer[b"incomplete"], 1, "re-announcing must not duplicate the peer")
+
+    def test_a_peer_is_its_address_and_port_not_its_peer_id(self):
+        """Two announces from one address and port are one peer, whatever
+        peer_id they carry, because that pair is the whole identity."""
+        info_hash = self.hash_for("identity")
+        self.tracker.announce(info_hash, peer_id=b"-OT0001-a00000000001", port=6881, left=100)
+        answer = self.tracker.announce(info_hash, peer_id=b"-OT0001-b00000000002", port=6881, left=100)
+        self.assertEqual(answer[b"incomplete"], 1, "same address and port, so still one peer")
+
+        answer = self.tracker.announce(info_hash, peer_id=b"-OT0001-c00000000003", port=6882, left=100)
+        self.assertEqual(answer[b"incomplete"], 2, "a different port makes a different peer")
+
+    def test_a_downloaded_count_is_kept(self):
+        info_hash = self.hash_for("downloaded")
+        self.tracker.announce(info_hash, port=7001, left=0, event="completed")
+        self.tracker.announce(info_hash, port=7002, left=0, event="completed")
+        self.assertEqual(self.tracker.scrape(info_hash)[b"files"][info_hash][b"downloaded"], 2)
+
+    def test_a_peer_is_given_the_whole_swarm_including_itself(self):
+        """opentracker does not filter the announcing peer out of its own
+        answer. Clients are expected to ignore themselves."""
+        info_hash = self.hash_for("sees")
+        self.tracker.announce(info_hash, port=1111, left=100)
+        answer = self.tracker.announce(info_hash, port=2222, left=100)
+
+        ports = sorted(port for _, port in peers_of(answer))
+        self.assertEqual(ports, [1111, 2222])
+
+    def test_an_unknown_torrent_scrapes_as_empty(self):
+        answer = self.tracker.scrape(self.hash_for("never-seen"))
+        self.assertEqual(answer[b"files"], {}, "a torrent nobody announced has no entry")
+
+
+class AnnounceRejects(TrackerTestCase):
+    def assert_rejected(self, query):
+        import urllib.error
+
+        with self.assertRaises(urllib.error.HTTPError) as caught:
+            self.tracker.get("/announce?" + query)
+        self.assertEqual(caught.exception.code, 400)
+
+    def test_a_short_info_hash_is_rejected(self):
+        self.assert_rejected("info_hash=tooshort&peer_id=" + "b" * 20 + "&port=6881&left=0")
+
+    def test_a_missing_info_hash_answers_a_failure_reason(self):
+        """Not a 400: the tracker answers 200 with a bencoded complaint, so
+        that a client shows the message to its user."""
+        from harness import bdecode
+
+        answer = bdecode(self.tracker.get("/announce?peer_id=" + "b" * 20 + "&port=6881&left=0"))
+        self.assertIn(b"failure reason", answer)
+        self.assertIn(b"info_hash", answer[b"failure reason"])
+
+    def test_a_port_out_of_range_is_rejected(self):
+        self.assert_rejected("info_hash=" + "a" * 20 + "&peer_id=" + "b" * 20 + "&port=65536&left=0")
+
+    def test_a_port_that_is_not_a_number_is_rejected(self):
+        self.assert_rejected("info_hash=" + "a" * 20 + "&peer_id=" + "b" * 20 + "&port=abc&left=0")
+
+    def test_two_info_hashes_are_rejected(self):
+        self.assert_rejected("info_hash=" + "a" * 20 + "&info_hash=" + "c" * 20 + "&peer_id=" + "b" * 20 + "&port=6881&left=0")
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/integration/test_dualstack.py b/tests/integration/test_dualstack.py
new file mode 100644
index 0000000..cd5ba7d
--- /dev/null
+++ b/tests/integration/test_dualstack.py
@@ -0,0 +1,89 @@
+"""A tracker serving both families from one socket.
+
+These need WANT_IP_FROM_QUERY_STRING so a peer's address can be dictated
+rather than being whatever loopback the test happened to come from.
+"""
+
+import os
+import socket
+import sys
+import unittest
+
+sys.path.insert(0, os.path.dirname(__file__))
+from harness import TrackerTestCase
+
+
+def addresses(answer, key):
+    blob, out = answer.get(key, b""), []
+    size = 6 if key == b"peers" else 18
+    for offset in range(0, len(blob), size):
+        entry = blob[offset : offset + size]
+        out.append(socket.inet_ntop(socket.AF_INET if size == 6 else socket.AF_INET6, entry[:-2]))
+    return out
+
+
+class DualStack(TrackerTestCase):
+    def test_an_ipv4_peer_lands_in_the_v4_list(self):
+        info_hash = self.hash_for("v4only")
+        self.tracker.announce(info_hash, ip="10.1.2.3", port=5001, left=100)
+        answer = self.tracker.announce(info_hash, ip="10.1.2.4", port=5002, left=100)
+
+        self.assertEqual(sorted(addresses(answer, b"peers")), ["10.1.2.3", "10.1.2.4"])
+        self.assertEqual(addresses(answer, b"peers6"), [], "no v6 peer was announced")
+
+    def test_an_ipv6_peer_lands_in_the_v6_list(self):
+        info_hash = self.hash_for("v6only")
+        self.tracker.announce(info_hash, ip="2001:db8::1", port=5001, left=100)
+        answer = self.tracker.announce(info_hash, ip="2001:db8::2", port=5002, left=100)
+
+        self.assertEqual(sorted(addresses(answer, b"peers6")), ["2001:db8::1", "2001:db8::2"])
+        self.assertEqual(addresses(answer, b"peers"), [], "no v4 peer was announced")
+
+    def test_the_two_families_are_kept_apart_but_both_returned(self):
+        info_hash = self.hash_for("both")
+        self.tracker.announce(info_hash, ip="10.9.9.9", port=6001, left=100)
+        answer = self.tracker.announce(info_hash, ip="2001:db8::9", port=6002, left=100)
+
+        self.assertEqual(addresses(answer, b"peers"), ["10.9.9.9"])
+        self.assertEqual(addresses(answer, b"peers6"), ["2001:db8::9"])
+
+    def test_a_v4_mapped_address_is_the_same_peer_as_the_plain_one(self):
+        info_hash = self.hash_for("v4mapped")
+        self.tracker.announce(info_hash, ip="10.5.5.5", port=7001, left=100)
+        answer = self.tracker.announce(info_hash, ip="::ffff:10.5.5.5", port=7001, left=100)
+
+        self.assertEqual(answer[b"incomplete"], 1, "the same address written two ways is one peer")
+        self.assertEqual(addresses(answer, b"peers"), ["10.5.5.5"], "and it is held as v4")
+
+    def test_the_two_families_count_into_one_swarm(self):
+        info_hash = self.hash_for("counts")
+        self.tracker.announce(info_hash, ip="10.4.4.4", port=8001, left=0)
+        answer = self.tracker.announce(info_hash, ip="2001:db8::4", port=8002, left=100)
+
+        self.assertEqual(answer[b"complete"], 1)
+        self.assertEqual(answer[b"incomplete"], 1)
+        self.assertEqual(self.tracker.scrape(info_hash)[b"files"][info_hash][b"complete"], 1)
+
+    def test_stopped_removes_only_the_family_it_came_from(self):
+        info_hash = self.hash_for("stopfamily")
+        self.tracker.announce(info_hash, ip="10.3.3.3", port=9001, left=100)
+        self.tracker.announce(info_hash, ip="2001:db8::3", port=9002, left=100)
+        self.tracker.announce(info_hash, ip="10.3.3.3", port=9001, left=100, event="stopped")
+
+        answer = self.tracker.announce(info_hash, ip="2001:db8::33", port=9003, left=100)
+        self.assertEqual(addresses(answer, b"peers"), [], "the v4 peer left")
+        self.assertIn("2001:db8::3", addresses(answer, b"peers6"), "the v6 one stayed")
+
+    def test_a_malformed_address_is_rejected(self):
+        import urllib.error
+
+        # The whole field has to be the address: a prefix that happens to
+        # parse would quietly record the peer somewhere else
+        for bad in ("999.1.2.3", "nonsense", "2001:db8:::1", "10.1.2.3.4", "10.1.2.3junk", "2001:db8::1%eth0"):
+            with self.assertRaises(urllib.error.HTTPError, msg="ip=%s should be refused" % bad) as caught:
+                self.tracker.announce(self.hash_for("badip"), ip=bad, port=6881, left=0)
+            self.assertEqual(caught.exception.code, 400)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/integration/test_fullscrape.py b/tests/integration/test_fullscrape.py
new file mode 100644
index 0000000..4059656
--- /dev/null
+++ b/tests/integration/test_fullscrape.py
@@ -0,0 +1,114 @@
+"""The full scrape, in every format the tracker offers.
+
+Each format is a separate writer, and they differ in more than cosmetics:
+one is binary, one is bencoded, three are line based and one dumps the
+tracker's own state for a restart. A worker thread produces them in chunks,
+so these also exercise the chunked transfer the ordinary replies never take.
+"""
+
+import gzip
+import struct
+import unittest
+
+from harness import TrackerTestCase, bdecode
+
+HEX = b"0123456789ABCDEF"
+
+
+class FullScrape(TrackerTestCase):
+    def setUp(self):
+        TrackerTestCase.setUp(self)
+        self.seeding = self.hash_for("fsA")
+        self.leeching = self.hash_for("fsB")
+        self.tracker.announce(self.seeding, port=6001, left=0)
+        self.tracker.announce(self.leeching, port=6002, left=4096)
+
+    def scrape_all(self, query, headers=None):
+        body, head = self.tracker.get_with_headers(query, headers)
+        if head.get("Content-Encoding") == "gzip":
+            body = gzip.decompress(body)
+        return body
+
+    # --------------------------------------------------------- bencoded
+
+    def test_a_bare_scrape_returns_every_torrent(self):
+        answer = bdecode(self.scrape_all("/scrape"))
+        self.assertIn(self.seeding, answer[b"files"])
+        self.assertIn(self.leeching, answer[b"files"])
+        self.assertEqual(answer[b"files"][self.seeding][b"complete"], 1)
+        self.assertEqual(answer[b"files"][self.leeching][b"incomplete"], 1)
+
+    def test_the_bencoded_format_matches_the_bare_scrape(self):
+        self.assertEqual(bdecode(self.scrape_all("/stats?mode=tpbs&format=ben")), bdecode(self.scrape_all("/scrape")))
+
+    def test_a_full_scrape_can_be_gzipped(self):
+        plain = self.scrape_all("/scrape")
+        body, head = self.tracker.get_with_headers("/scrape", {"Accept-Encoding": "gzip"})
+        self.assertEqual(head.get("Content-Encoding"), "gzip")
+        self.assertEqual(gzip.decompress(body), plain)
+
+    # ----------------------------------------------------------- binary
+
+    def test_the_binary_format_is_a_hash_and_two_counts(self):
+        body = self.scrape_all("/stats?mode=tpbs&format=bin")
+        self.assertEqual(len(body) % 28, 0, "twenty byte hash plus two counts")
+        entries = {body[i : i + 20]: struct.unpack(">II", body[i + 20 : i + 28]) for i in range(0, len(body), 28)}
+        self.assertEqual(entries[self.seeding], (1, 0), "one seeder, no leechers")
+        self.assertEqual(entries[self.leeching], (0, 1), "no seeders, one leecher")
+
+    # ------------------------------------------------------- line based
+
+    def entries_from_lines(self, body):
+        return {line.split(b":")[0]: line.split(b":")[1:] for line in body.splitlines() if line}
+
+    def test_the_text_format_is_hex_colon_seeders_colon_leechers(self):
+        entries = self.entries_from_lines(self.scrape_all("/stats?mode=tpbs&format=txt"))
+        self.assertEqual(entries[self.seeding.hex().upper().encode()], [b"1", b"0"])
+        self.assertEqual(entries[self.leeching.hex().upper().encode()], [b"0", b"1"])
+
+    def test_the_text_plus_format_adds_the_completed_count(self):
+        entries = self.entries_from_lines(self.scrape_all("/stats?mode=tpbs&format=txtp"))
+        self.assertEqual(entries[self.seeding.hex().upper().encode()], [b"1", b"0", b"0"])
+
+    def test_the_urlencoded_format_escapes_the_hash(self):
+        body = self.scrape_all("/stats?mode=tpbs&format=url")
+        lines = [line for line in body.splitlines() if line]
+        self.assertEqual(len(lines), 2)
+        for line in lines:
+            escaped = line.rsplit(b":", 2)[0]
+            self.assertIn(b"%", escaped, "these hashes are mostly unprintable bytes")
+
+    def test_the_state_dump_carries_a_base_time_rather_than_a_peer_count(self):
+        """What a restart reads back, so its second column is the torrent's
+        own clock and not a count of anybody."""
+        entries = self.entries_from_lines(self.scrape_all("/stats?mode=statedump"))
+        self.assertIn(self.seeding.hex().upper().encode(), entries)
+        base, completed = entries[self.seeding.hex().upper().encode()]
+        self.assertGreater(int(base), 0)
+        self.assertEqual(int(completed), 0)
+
+    # ------------------------------------------------------------ shape
+
+    def test_every_format_sees_the_same_torrents(self):
+        counts = {
+            "ben": len(bdecode(self.scrape_all("/stats?mode=tpbs&format=ben"))[b"files"]),
+            "bin": len(self.scrape_all("/stats?mode=tpbs&format=bin")) // 28,
+            "txt": len(self.entries_from_lines(self.scrape_all("/stats?mode=tpbs&format=txt"))),
+            "txtp": len(self.entries_from_lines(self.scrape_all("/stats?mode=tpbs&format=txtp"))),
+            "url": len([l for l in self.scrape_all("/stats?mode=tpbs&format=url").splitlines() if l]),
+        }
+        self.assertEqual(set(counts.values()), {2}, "all formats, two torrents: %r" % counts)
+
+
+class FullScrapeChunking(TrackerTestCase):
+    def test_a_scrape_larger_than_one_chunk_arrives_whole(self):
+        """The writer hands the socket a chunk at a time, so a scrape that
+        spans several is the case where the seams show."""
+        for i in range(400):
+            self.tracker.announce(struct.pack(">I", i) + b"\0" * 16, port=7000 + i, left=0)
+        answer = bdecode(self.tracker.get("/scrape"))
+        self.assertEqual(len(answer[b"files"]), 400)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/integration/test_stats.py b/tests/integration/test_stats.py
new file mode 100644
index 0000000..7ff9a38
--- /dev/null
+++ b/tests/integration/test_stats.py
@@ -0,0 +1,170 @@
+"""The /stats endpoint.
+
+Each mode is its own writer into a fixed buffer, so these pin the shape of
+every one of them and, where the number means something, that it moves when
+the thing it counts happens.
+"""
+
+import ipaddress
+import re
+import socket
+import unittest
+import urllib.error
+import xml.etree.ElementTree
+
+from harness import TrackerTestCase
+
+# The modes a default build answers. "tpbs" and "statedump" are full scrapes
+# and belong to test_fullscrape; "fulllog" and "woodpeckers" sit behind
+# feature flags this build does not set; "busy" is advertised but unbuilt,
+# which the next case pins.
+MRTG_MODES = ["peer", "conn", "scrp", "udp4", "tcp4", "torr", "fscr", "completed", "syncs"]
+TEXT_MODES = ["herr", "s24s", "top10", "top100", "renew", "version"]
+
+
+class StatsShape(TrackerTestCase):
+    def test_every_mode_answers_something(self):
+        for mode in MRTG_MODES + TEXT_MODES + ["everything"]:
+            self.assertTrue(self.tracker.stats(mode), "mode %s answered empty" % mode)
+
+    def test_an_mrtg_mode_opens_with_two_numbers(self):
+        """MRTG reads the first two lines as counters and the rest as labels,
+        so the order matters to something outside this project."""
+        for mode in MRTG_MODES:
+            lines = self.tracker.stats(mode).splitlines()
+            self.assertGreaterEqual(len(lines), 2, "mode %s" % mode)
+            for line in lines[:2]:
+                self.assertRegex(line, rb"^\d+$", "mode %s line %r" % (mode, line))
+
+    def test_the_busy_mode_is_advertised_but_not_built(self):
+        """TASK_STATS_BUSY_NETWORKS is in the enum and in the mode table, and
+        no switch anywhere handles it, so the worker frees the empty answer
+        and the request ends as a server error. Pinned rather than blessed:
+        either the report gets written or the mode leaves the table."""
+        with self.assertRaises(urllib.error.HTTPError) as caught:
+            self.tracker.stats("busy")
+        self.assertEqual(caught.exception.code, 500)
+
+    def test_an_unknown_mode_is_refused(self):
+        with self.assertRaises(urllib.error.HTTPError) as caught:
+            self.tracker.stats("nosuchmode")
+        self.assertEqual(caught.exception.code, 400)
+
+    def test_everything_is_well_formed_xml(self):
+        root = xml.etree.ElementTree.fromstring(self.tracker.stats("everything").decode())
+        self.assertEqual(root.tag, "stats")
+        self.assertIsNotNone(root.find("torrents/count_mutex"))
+        self.assertIsNotNone(root.find("connections/tcp/announce"))
+
+    def test_version_names_a_commit(self):
+        self.assertIn(b"opentracker", self.tracker.stats("version").lower() + b"opentracker")
+        self.assertRegex(self.tracker.stats("version"), rb"https?://")
+
+
+class StatsCount(TrackerTestCase):
+    def test_the_torrent_count_follows_the_torrents(self):
+        before = self.tracker.torrent_count()
+        self.tracker.announce(self.hash_for("statA"), port=6001, left=0)
+        self.assertEqual(self.tracker.torrent_count(), before + 1)
+        self.tracker.announce(self.hash_for("statB"), port=6002, left=0)
+        self.assertEqual(self.tracker.torrent_count(), before + 2)
+
+    def test_the_peer_count_separates_seeders_from_the_rest(self):
+        self.tracker.announce(self.hash_for("statpeers"), port=6001, left=0)
+        self.tracker.announce(self.hash_for("statpeers"), port=6002, left=4096)
+        peers, seeds = self.tracker.stats("peer").splitlines()[:2]
+        self.assertEqual(int(peers), 2)
+        self.assertEqual(int(seeds), 1)
+
+    def test_the_completed_count_follows_the_completed_event(self):
+        before = int(self.tracker.stats("completed").splitlines()[0])
+        self.tracker.announce(self.hash_for("statdone"), port=6001, left=0, event="completed")
+        self.assertEqual(int(self.tracker.stats("completed").splitlines()[0]), before + 1)
+
+    def test_a_bad_request_is_counted_as_an_http_error(self):
+        before = self.tracker.stats("herr")
+        try:
+            self.tracker.stats("nosuchmode")
+        except urllib.error.HTTPError:
+            pass
+        after = self.tracker.stats("herr")
+        self.assertNotEqual(before, after, "no error counter moved")
+
+    def test_the_tcp_counter_follows_tcp_requests(self):
+        before = int(self.tracker.stats("tcp4").splitlines()[0])
+        for _ in range(3):
+            self.tracker.announce(self.hash_for("stattcp"), port=6001, left=0)
+        self.assertGreaterEqual(int(self.tracker.stats("tcp4").splitlines()[0]), before + 3)
+
+    def test_the_udp_counter_follows_udp_requests(self):
+        before = int(self.tracker.stats("udp4").splitlines()[0])
+        sock, connection_id = self.tracker.udp_connect()
+        try:
+            self.tracker.udp_announce(sock, connection_id, self.hash_for("statudp"), left=0)
+        finally:
+            sock.close()
+        self.assertGreater(int(self.tracker.stats("udp4").splitlines()[0]), before)
+
+    def test_the_scrape_counter_follows_scrapes(self):
+        before = int(self.tracker.stats("scrp").splitlines()[0])
+        self.tracker.scrape(self.hash_for("statscrape"))
+        self.assertEqual(int(self.tracker.stats("scrp").splitlines()[0]), before + 1)
+
+
+class StatsTop(TrackerTestCase):
+    def test_the_top_list_ranks_by_peer_count(self):
+        busy = self.hash_for("topbusy")
+        quiet = self.hash_for("topquiet")
+        for port in range(6001, 6006):
+            self.tracker.announce(busy, port=port, left=0)
+        self.tracker.announce(quiet, port=6100, left=0)
+
+        body = self.tracker.stats("top10")
+        self.assertIn(b"Top 10 torrents by peers", body)
+        ranked = re.findall(rb"\t(\d+)\t([0-9A-F]{40})", body.split(b"by seeds")[0])
+        self.assertEqual(ranked[0][1], busy.hex().upper().encode(), "the busy torrent ranks first")
+        self.assertEqual(int(ranked[0][0]), 5)
+
+    def test_the_top_list_has_three_sections(self):
+        self.tracker.announce(self.hash_for("topsections"), port=6001, left=0)
+        body = self.tracker.stats("top100")
+        for heading in (b"by peers", b"by seeds", b"by leechers"):
+            self.assertIn(heading, body)
+
+
+class StatsNetworks(TrackerTestCase):
+    def source_address(self):
+        """Which address the tracker sees us from is not ours to choose: a
+        FreeBSD jail relocates a loopback connection to the jail's own
+        address, so ask the socket rather than assume 127.0.0.1."""
+        probe = socket.create_connection(("127.0.0.1", self.tracker.port), timeout=5)
+        try:
+            return probe.getsockname()[0]
+        finally:
+            probe.close()
+
+    def test_the_slash24_report_names_the_announcing_network(self):
+        source = self.source_address()
+        self.tracker.announce(self.hash_for("s24"), port=6001, left=0)
+        body = self.tracker.stats("s24s")
+        self.assertIn(b"Networks, limit /28:", body)
+        self.assertIn(b"Networks, limit /24:", body)
+
+        # The prefix is the first three address bytes of a v4 peer, left
+        # aligned in a sixteen byte buffer and then printed by the v6
+        # formatter, so 127.0.0.0/24 reads as "7f00::" rather than as the
+        # network an operator asked about. Pinned as it is, not blessed.
+        prefix = socket.inet_aton(source)[:3] + b"\0" * 13
+        self.assertIn(str(ipaddress.IPv6Address(prefix)).encode(), body)
+
+    def test_the_report_counts_one_network_per_announcing_address(self):
+        for port in (6001, 6002, 6003):
+            self.tracker.announce(self.hash_for("s24count"), port=port, left=0)
+        lines = [line for line in self.tracker.stats("s24s").splitlines() if b":" in line and b"limit" not in line]
+        self.assertEqual(len(lines), 2, "one line under each of the two limits")
+        for line in lines:
+            self.assertEqual(int(line.split(b":")[0]), 3, "three peers from the one network")
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/integration/test_udp.py b/tests/integration/test_udp.py
new file mode 100644
index 0000000..1dfa21b
--- /dev/null
+++ b/tests/integration/test_udp.py
@@ -0,0 +1,153 @@
+"""The UDP tracker protocol, BEP 15.
+
+The HTTP tests cover the torrent store; these cover the packet handling in
+front of it, which has its own framing, its own connection id and its own
+rules about what to answer and what to ignore.
+"""
+
+import socket
+import struct
+import unittest
+
+from harness import TrackerTestCase
+
+MAGIC = 0x41727101980
+
+
+class UdpProtocol(TrackerTestCase):
+    def test_connect_echoes_the_transaction_id(self):
+        sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
+        sock.settimeout(5)
+        try:
+            sock.sendto(struct.pack(">QII", MAGIC, 0, 0xDEADBEEF), ("127.0.0.1", self.tracker.port))
+            action, transaction, connection_id = struct.unpack(">IIQ", sock.recv(2048)[:16])
+            self.assertEqual(action, 0)
+            self.assertEqual(transaction, 0xDEADBEEF)
+            self.assertNotEqual(connection_id, 0)
+        finally:
+            sock.close()
+
+    def test_the_connection_id_is_stable_for_one_peer(self):
+        first, id_one = self.tracker.udp_connect()
+        second, id_two = self.tracker.udp_connect()
+        try:
+            self.assertEqual(id_one, id_two)
+        finally:
+            first.close()
+            second.close()
+
+    def test_a_wrong_connection_id_is_refused(self):
+        payload = struct.pack(">QII20s20sQQQIIIiH", 0, 1, 2, self.hash_for("udpbad"), b"p" * 20, 0, 0, 0, 0, 0, 0, -1, 6881)
+        answer = self.tracker.udp_raw(payload)
+        self.assertIsNotNone(answer, "expected an error packet")
+        action, transaction = struct.unpack(">II", answer[:8])
+        self.assertEqual(action, 3, "action 3 is the error packet")
+        self.assertIn(b"Connection ID missmatch", answer[8:])
+
+    def test_a_packet_shorter_than_the_header_is_ignored(self):
+        self.assertIsNone(self.tracker.udp_raw(b"\x00" * 15))
+
+    def test_an_unknown_action_is_ignored(self):
+        self.assertIsNone(self.tracker.udp_raw(struct.pack(">QII", MAGIC, 9, 1)))
+
+    def test_connect_requires_the_protocol_magic(self):
+        self.assertIsNone(self.tracker.udp_raw(struct.pack(">QII", MAGIC + 1, 0, 1)))
+
+    def test_an_announce_cut_short_is_ignored(self):
+        sock, connection_id = self.tracker.udp_connect()
+        try:
+            self.assertIsNone(self.tracker.udp_raw(struct.pack(">QII", connection_id, 1, 1) + b"\0" * 40))
+        finally:
+            sock.close()
+
+
+class UdpAnnounce(TrackerTestCase):
+    def test_a_seeder_is_counted_as_a_seeder(self):
+        sock, connection_id = self.tracker.udp_connect()
+        try:
+            answer = self.tracker.udp_announce(sock, connection_id, self.hash_for("udpseed"), left=0)
+            self.assertEqual(answer["seeders"], 1)
+            self.assertEqual(answer["leechers"], 0)
+            self.assertGreater(answer["interval"], 0)
+        finally:
+            sock.close()
+
+    def test_a_leecher_is_counted_as_a_leecher(self):
+        sock, connection_id = self.tracker.udp_connect()
+        try:
+            answer = self.tracker.udp_announce(sock, connection_id, self.hash_for("udpleech"), left=1024)
+            self.assertEqual(answer["seeders"], 0)
+            self.assertEqual(answer["leechers"], 1)
+        finally:
+            sock.close()
+
+    def test_stopped_removes_the_peer(self):
+        info_hash = self.hash_for("udpstop")
+        sock, connection_id = self.tracker.udp_connect()
+        try:
+            self.tracker.udp_announce(sock, connection_id, info_hash, left=0)
+            self.tracker.udp_announce(sock, connection_id, info_hash, left=0, event=3)
+            answer = self.tracker.udp_announce(sock, connection_id, info_hash, left=1024)
+            self.assertEqual(answer["seeders"], 0, "the seeder announced stopped")
+        finally:
+            sock.close()
+
+    def test_an_announce_over_udp_is_visible_over_http(self):
+        """One torrent store behind both bearers, not two."""
+        info_hash = self.hash_for("udpcross")
+        sock, connection_id = self.tracker.udp_connect()
+        try:
+            self.tracker.udp_announce(sock, connection_id, info_hash, left=0)
+        finally:
+            sock.close()
+        scrape = self.tracker.scrape(info_hash)
+        self.assertEqual(scrape[b"files"][info_hash][b"complete"], 1)
+
+    def test_the_peer_list_carries_the_announcing_peer(self):
+        info_hash = self.hash_for("udppeers")
+        sock, connection_id = self.tracker.udp_connect()
+        try:
+            answer = self.tracker.udp_announce(sock, connection_id, info_hash, left=0, port=6881)
+            self.assertEqual(len(answer["peers"]) % 6, 0, "v4 peers are six bytes each")
+            self.assertGreaterEqual(len(answer["peers"]), 6)
+            self.assertEqual(struct.unpack(">H", answer["peers"][4:6])[0], 6881)
+        finally:
+            sock.close()
+
+
+class UdpScrape(TrackerTestCase):
+    def test_scrape_reports_the_swarm(self):
+        info_hash = self.hash_for("udpscrape")
+        sock, connection_id = self.tracker.udp_connect()
+        try:
+            self.tracker.udp_announce(sock, connection_id, info_hash, left=0)
+            seeders, completed, leechers = self.tracker.udp_scrape(sock, connection_id, [info_hash])[0]
+            self.assertEqual(seeders, 1)
+            self.assertEqual(leechers, 0)
+            self.assertEqual(completed, 0)
+        finally:
+            sock.close()
+
+    def test_an_unknown_hash_scrapes_as_empty(self):
+        sock, connection_id = self.tracker.udp_connect()
+        try:
+            self.assertEqual(self.tracker.udp_scrape(sock, connection_id, [self.hash_for("udpnone")])[0], (0, 0, 0))
+        finally:
+            sock.close()
+
+    def test_several_hashes_answer_in_order(self):
+        seeding = self.hash_for("udpmultiA")
+        leeching = self.hash_for("udpmultiB")
+        sock, connection_id = self.tracker.udp_connect()
+        try:
+            self.tracker.udp_announce(sock, connection_id, seeding, left=0)
+            self.tracker.udp_announce(sock, connection_id, leeching, left=1024)
+            answers = self.tracker.udp_scrape(sock, connection_id, [seeding, leeching])
+            self.assertEqual(answers[0][0], 1, "first hash is the seeded one")
+            self.assertEqual(answers[1][2], 1, "second hash is the leeched one")
+        finally:
+            sock.close()
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/runner.c b/tests/runner.c
index 148b928..71a5e2a 100644
--- a/tests/runner.c
+++ b/tests/runner.c
@@ -4,7 +4,11 @@
    $id$ */
 
 /* System */
+#include <stdio.h>
+#include <stdlib.h>
 #include <string.h>
+#include <sys/wait.h>
+#include <unistd.h>
 
 /* Opentracker */
 #include "test.h"
@@ -14,7 +18,7 @@ struct module {
   void (*run)(void);
 };
 
-static const struct module modules[] = {{"scan_urlencoded_query", test_scan_urlencoded_query},
+static const struct module modules[] = {{"ot_urlencoded", test_urlencoded},
                                         {"ot_iovec", test_iovec},
                                         {"ot_vector", test_vector},
                                         {"ot_random", test_random},
@@ -25,18 +29,85 @@ static const struct module modules[] = {{"scan_urlencoded_query", test_scan_urle
                                         {"ot_socket", test_socket},
                                         {"ot_mutex", test_mutex},
                                         {"ot_batch", test_batch},
+                                        {"ot_fdstate", test_fdstate},
+                                        {"ot_event", test_event},
+                                        {"ot_fmt", test_fmt},
                                         {"ot_accesslist", test_accesslist},
                                         {NULL, NULL}};
 
-/* Run every module, or only those whose name contains argv[1] */
+struct tally {
+  unsigned long checks;
+  unsigned long failures;
+};
+
+/* Each module runs in a child of its own, so that a crash or a sanitizer
+   abort costs that module's results rather than every module after it. The
+   child reports its tally through a pipe; one that dies without reporting is
+   counted as a failure under its own name. */
+static void run_forked(const struct module *m) {
+  struct tally tally = {0, 0};
+  int          pipefd[2], status = 0;
+  pid_t        child;
+  ssize_t      got;
+
+  if (pipe(pipefd)) {
+    test_failf(__FILE__, __LINE__, "pipe failed, cannot isolate %s", m->name);
+    return;
+  }
+
+  fflush(stdout); /* or the child inherits a copy and prints it again */
+  child = fork();
+  if (child < 0) {
+    close(pipefd[0]);
+    close(pipefd[1]);
+    test_failf(__FILE__, __LINE__, "fork failed, cannot isolate %s", m->name);
+    return;
+  }
+
+  if (!child) {
+    close(pipefd[0]);
+    test_checks = test_failures = 0;
+    m->run();
+    tally.checks   = test_checks;
+    tally.failures = test_failures;
+    if (write(pipefd[1], &tally, sizeof(tally)) != (ssize_t)sizeof(tally))
+      _exit(1);
+    fflush(stdout);
+    _exit(0);
+  }
+
+  close(pipefd[1]);
+  got = read(pipefd[0], &tally, sizeof(tally));
+  close(pipefd[0]);
+  while (waitpid(child, &status, 0) < 0)
+    ;
+
+  if (got == (ssize_t)sizeof(tally)) {
+    test_checks   += tally.checks;
+    test_failures += tally.failures;
+  }
+  if (got != (ssize_t)sizeof(tally) || !WIFEXITED(status) || WEXITSTATUS(status))
+    test_failf(__FILE__, __LINE__, "%s did not run to the end", m->name);
+}
+
+/* Run every module, or only those whose name contains argv[1].
+   OT_TEST_FORK=0 keeps everything in one process, which is what a debugger
+   wants. */
 int main(int argc, char **argv) {
+  const char          *fork_setting = getenv("OT_TEST_FORK");
+  int                  isolate      = !fork_setting || strcmp(fork_setting, "0");
   const struct module *m;
 
   for (m = modules; m->name; ++m) {
     if (argc > 1 && !strstr(m->name, argv[1]))
       continue;
     test_module(m->name);
-    m->run();
+    if (!isolate) {
+      m->run();
+      continue;
+    }
+    test_case("the module runs to the end");
+    run_forked(m);
   }
 
   return test_summary();
diff --git a/tests/t_event.c b/tests/t_event.c
new file mode 100644
index 0000000..5509f19
--- /dev/null
+++ b/tests/t_event.c
@@ -0,0 +1,222 @@
+/* This software was written by Dirk Engling <erdgeist@erdgeist.org>
+   It is considered beerware. Prost. Skol. Cheers or whatever.
+
+   $id$ */
+
+/* System */
+#include <string.h>
+#include <sys/socket.h>
+#include <sys/time.h>
+#include <unistd.h>
+
+/* Opentracker */
+#include "ot_event.h"
+#include "test.h"
+
+/* Against real socket pairs: only the kernel can say whether a descriptor is
+   ready, so there is nothing useful to mock here. */
+
+#define EVENTS 16
+
+static int  sv[2];
+static ot_event ready[EVENTS];
+
+static void pair_open(void) {
+  if (socketpair(AF_UNIX, SOCK_STREAM, 0, sv) == -1)
+    sv[0] = sv[1] = -1;
+}
+
+static void pair_close(void) {
+  if (sv[0] != -1)
+    close(sv[0]);
+  if (sv[1] != -1)
+    close(sv[1]);
+  sv[0] = sv[1] = -1;
+}
+
+static int wait_for(int fd, int what, int timeout_ms, uint32_t *generation) {
+  int count = event_wait(ready, EVENTS, timeout_ms), i;
+
+  for (i = 0; i < count; ++i)
+    if (ready[i].fd == fd && (ready[i].what & what)) {
+      if (generation)
+        *generation = ready[i].generation;
+      return 1;
+    }
+  return 0;
+}
+
+static unsigned long elapsed_ms(struct timeval *since) {
+  struct timeval now;
+
+  gettimeofday(&now, NULL);
+  return (unsigned long)((now.tv_sec - since->tv_sec) * 1000 + (now.tv_usec - since->tv_usec) / 1000);
+}
+
+static void case_readable(void) {
+  uint32_t generation = 0;
+
+  test_case("a descriptor with something to read is reported, with its generation");
+  pair_open();
+  CHECK(sv[0] != -1);
+  CHECK_INT(event_add(sv[0], EVENT_IN, 4711), 0);
+  CHECK_INT(write(sv[1], "x", 1), 1);
+  CHECK_INT(wait_for(sv[0], EVENT_IN, 1000, &generation), 1);
+  CHECK_INT(generation, 4711);
+
+  test_case("and keeps being reported until it is read");
+  CHECK_INT(wait_for(sv[0], EVENT_IN, 1000, NULL), 1);
+  {
+    char scratch[4];
+    CHECK_INT(read(sv[0], scratch, sizeof(scratch)), 1);
+  }
+  CHECK_INT(wait_for(sv[0], EVENT_IN, 50, NULL), 0);
+
+  CHECK_INT(event_del(sv[0]), 0);
+  pair_close();
+}
+
+static void case_writable(void) {
+  test_case("a descriptor with room to write is reported");
+  pair_open();
+  CHECK(sv[0] != -1);
+  CHECK_INT(event_add(sv[0], EVENT_OUT, 1), 0);
+  CHECK_INT(wait_for(sv[0], EVENT_OUT, 1000, NULL), 1);
+
+  test_case("and is not, once we say we no longer care");
+  CHECK_INT(event_modify(sv[0], EVENT_IN, 1), 0);
+  CHECK_INT(wait_for(sv[0], EVENT_OUT, 50, NULL), 0);
+
+  CHECK_INT(event_del(sv[0]), 0);
+  pair_close();
+}
+
+static void case_interest_is_separate(void) {
+  test_case("asking only about writing does not report reading");
+  pair_open();
+  CHECK(sv[0] != -1);
+  CHECK_INT(event_add(sv[0], EVENT_OUT, 1), 0);
+  CHECK_INT(write(sv[1], "x", 1), 1);
+  CHECK_INT(wait_for(sv[0], EVENT_IN, 50, NULL), 0);
+
+  test_case("until we ask about it");
+  CHECK_INT(event_modify(sv[0], EVENT_IN | EVENT_OUT, 1), 0);
+  CHECK_INT(wait_for(sv[0], EVENT_IN, 1000, NULL), 1);
+
+  CHECK_INT(event_del(sv[0]), 0);
+  pair_close();
+}
+
+static void case_removed_is_silent(void) {
+  test_case("a removed descriptor is not reported again");
+  pair_open();
+  CHECK(sv[0] != -1);
+  CHECK_INT(event_add(sv[0], EVENT_IN, 1), 0);
+  CHECK_INT(write(sv[1], "x", 1), 1);
+  CHECK_INT(wait_for(sv[0], EVENT_IN, 1000, NULL), 1);
+  CHECK_INT(event_del(sv[0]), 0);
+  CHECK_INT(wait_for(sv[0], EVENT_IN, 50, NULL), 0);
+  pair_close();
+}
+
+static void case_generations_do_not_mix(void) {
+  int      other[2];
+  uint32_t generation = 0;
+
+  test_case("two descriptors carry their own generations");
+  pair_open();
+  CHECK(sv[0] != -1);
+  CHECK_INT(socketpair(AF_UNIX, SOCK_STREAM, 0, other), 0);
+  CHECK_INT(event_add(sv[0], EVENT_IN, 100), 0);
+  CHECK_INT(event_add(other[0], EVENT_IN, 200), 0);
+  CHECK_INT(write(sv[1], "x", 1), 1);
+  CHECK_INT(write(other[1], "y", 1), 1);
+
+  CHECK_INT(wait_for(sv[0], EVENT_IN, 1000, &generation), 1);
+  CHECK_INT(generation, 100);
+  CHECK_INT(wait_for(other[0], EVENT_IN, 1000, &generation), 1);
+  CHECK_INT(generation, 200);
+
+  test_case("and re-registering one changes only its own");
+  CHECK_INT(event_modify(sv[0], EVENT_IN, 101), 0);
+  CHECK_INT(wait_for(sv[0], EVENT_IN, 1000, &generation), 1);
+  CHECK_INT(generation, 101);
+  CHECK_INT(wait_for(other[0], EVENT_IN, 1000, &generation), 1);
+  CHECK_INT(generation, 200);
+
+  event_del(sv[0]);
+  event_del(other[0]);
+  close(other[0]);
+  close(other[1]);
+  pair_close();
+}
+
+/* Removing one of several has to leave the rest addressable: a backend that
+   keeps its descriptors packed moves the last one into the gap, and has to
+   remember where it went. */
+static void case_delete_from_the_middle(void) {
+  int      pair[3][2];
+  uint32_t generation = 0;
+  int      i;
+
+  test_case("deleting one of three leaves the others reported correctly");
+  for (i = 0; i < 3; ++i) {
+    CHECK_INT(socketpair(AF_UNIX, SOCK_STREAM, 0, pair[i]), 0);
+    CHECK_INT(event_add(pair[i][0], EVENT_IN, (uint32_t)(10 + i)), 0);
+  }
+  CHECK_INT(event_del(pair[1][0]), 0);
+
+  for (i = 0; i < 3; i += 2) {
+    CHECK_INT(write(pair[i][1], "x", 1), 1);
+    CHECK_INT(wait_for(pair[i][0], EVENT_IN, 1000, &generation), 1);
+    CHECK_INT(generation, 10 + i);
+  }
+
+  test_case("and the survivors can still be changed and removed");
+  CHECK_INT(event_modify(pair[2][0], EVENT_IN, 99), 0);
+  CHECK_INT(wait_for(pair[2][0], EVENT_IN, 1000, &generation), 1);
+  CHECK_INT(generation, 99);
+  CHECK_INT(event_del(pair[0][0]), 0);
+  CHECK_INT(event_del(pair[2][0]), 0);
+  CHECK_INT(wait_for(pair[2][0], EVENT_IN, 50, NULL), 0);
+
+  for (i = 0; i < 3; ++i)
+    close(pair[i][0]), close(pair[i][1]);
+}
+
+static void case_timeout(void) {
+  struct timeval started;
+
+  test_case("waiting on nothing comes back empty when the time is up");
+  gettimeofday(&started, NULL);
+  CHECK_INT(event_wait(ready, EVENTS, 200), 0);
+  {
+    unsigned long took = elapsed_ms(&started);
+    /* Scheduling makes the upper bound generous. The point is that it waited
+       rather than returning at once, and that it came back at all */
+    CHECK(took >= 150);
+    CHECK(took < 5000);
+  }
+}
+
+static void case_unknown_descriptor(void) {
+  test_case("changing or removing one that was never added is refused");
+  CHECK_INT(event_modify(4096, EVENT_IN, 1), -1);
+  CHECK_INT(event_del(4096), -1);
+}
+
+void test_event(void) {
+  CHECK_INT(event_init(), 0);
+  CHECK(event_mechanism() != NULL);
+
+  case_readable();
+  case_writable();
+  case_interest_is_separate();
+  case_removed_is_silent();
+  case_generations_do_not_mix();
+  case_delete_from_the_middle();
+  case_timeout();
+  case_unknown_descriptor();
+
+  event_deinit();
+}
diff --git a/tests/t_fdstate.c b/tests/t_fdstate.c
new file mode 100644
index 0000000..bf8724a
--- /dev/null
+++ b/tests/t_fdstate.c
@@ -0,0 +1,224 @@
+/* This software was written by Dirk Engling <erdgeist@erdgeist.org>
+   It is considered beerware. Prost. Skol. Cheers or whatever.
+
+   $id$ */
+
+/* System */
+#include <pthread.h>
+#include <stdatomic.h>
+#include <stdint.h>
+#include <stdlib.h>
+#include <string.h>
+
+/* Opentracker */
+#include "ot_fdstate.h"
+#include "test.h"
+
+/* ------------------------------------------------------- one thread first */
+
+static void case_open_claim_release(void) {
+  char     cookie[4];
+  uint32_t generation;
+
+  test_case("a descriptor taken into the table can be claimed and gives back its cookie");
+  generation = fdstate_open(7, cookie, 0);
+  CHECK_INT(fdstate_claim(7, generation), 1);
+  CHECK_PTR(fdstate_cookie(7), cookie);
+  fdstate_release(7);
+
+  test_case("and can be claimed again once released");
+  CHECK_INT(fdstate_claim(7, generation), 1);
+  fdstate_release(7);
+  fdstate_close(7);
+}
+
+static void case_one_holder_at_a_time(void) {
+  uint32_t generation = fdstate_open(8, NULL, 0);
+
+  test_case("a descriptor somebody holds cannot be claimed again");
+  CHECK_INT(fdstate_claim(8, generation), 1);
+  CHECK_INT(fdstate_claim(8, generation), 0);
+  fdstate_release(8);
+  CHECK_INT(fdstate_claim(8, generation), 1);
+  fdstate_release(8);
+  fdstate_close(8);
+}
+
+static void case_stale_generation_is_refused(void) {
+  char     first[4], second[4];
+  uint32_t old, new;
+
+  test_case("a caller quoting the generation of a closed descriptor is turned away");
+  old = fdstate_open(9, first, 0);
+  fdstate_close(9);
+  new = fdstate_open(9, second, 0);
+  CHECK(old != new);
+  CHECK_INT(fdstate_claim(9, old), 0);
+
+  test_case("while the one quoting the new generation gets the new cookie");
+  CHECK_INT(fdstate_claim(9, new), 1);
+  CHECK_PTR(fdstate_cookie(9), second);
+  fdstate_release(9);
+  fdstate_close(9);
+}
+
+static void case_expiry(void) {
+  uint32_t generation = fdstate_open(10, NULL, 100);
+
+  test_case("a descriptor past its expiry is collected");
+  CHECK_INT(fdstate_claim_expired(10, 99), 0);
+  CHECK_INT(fdstate_claim_expired(10, 100), 1);
+  fdstate_close(10);
+
+  test_case("one that never expires is never collected");
+  generation = fdstate_open(10, NULL, 0);
+  CHECK_INT(fdstate_claim_expired(10, 1 << 30), 0);
+
+  test_case("and one somebody is working on is left alone");
+  fdstate_set_expiry(10, 1);
+  CHECK_INT(fdstate_claim(10, generation), 1);
+  CHECK_INT(fdstate_claim_expired(10, 1 << 30), 0);
+  fdstate_release(10);
+  CHECK_INT(fdstate_claim_expired(10, 1 << 30), 1);
+  fdstate_close(10);
+}
+
+static void case_out_of_range(void) {
+  test_case("a descriptor outside the table is refused rather than trusted");
+  CHECK_INT(fdstate_claim(-1, 0), 0);
+  CHECK_INT(fdstate_claim((int)fdstate_slots(), 0), 0);
+  CHECK_INT(fdstate_claim_expired(-1, 0), 0);
+  CHECK_PTR(fdstate_cookie(-1), NULL);
+}
+
+/* --------------------------------------------------------- then in anger */
+
+/* The race this is about only exists while a descriptor is being recycled,
+   so recycling is driven by work done rather than by a clock: every slot is
+   given up after RECYCLE_AFTER claims, whatever the machine's speed. */
+
+#define STRESS_SLOTS   64
+#define RECYCLE_AFTER  32
+#define STRESS_CLAIMS  200000
+#define STRESS_GIVEUP  (STRESS_CLAIMS * 100)
+
+static _Atomic long     stress_claims, stress_recycles, stress_violations, stress_attempts;
+static _Atomic int      stress_lives[STRESS_SLOTS];
+static _Atomic int      stress_live[STRESS_SLOTS];
+
+/* Generation and cookie are published in one word so a worker can never read
+   a cookie that belongs to a different generation than the one it claimed
+   with. Each connection gets a cookie nobody else ever gets. */
+static _Atomic uint64_t stress_conn[STRESS_SLOTS];
+static _Atomic uint64_t stress_next_cookie;
+
+#define STRESS_CONN(cookie, gen) (((uint64_t)(cookie) << 32) | (uint32_t)(gen))
+#define STRESS_CONN_COOKIE(w)    ((void *)(uintptr_t)((w) >> 32))
+#define STRESS_CONN_GEN(w)       ((uint32_t)(w))
+
+static int stress_running(void) {
+  return atomic_load(&stress_claims) < STRESS_CLAIMS && atomic_load(&stress_attempts) < STRESS_GIVEUP;
+}
+
+static void *stress_worker(void *arg) {
+  unsigned seed = (unsigned)(uintptr_t)arg;
+
+  while (stress_running()) {
+    int      fd   = (int)(rand_r(&seed) % STRESS_SLOTS);
+    uint64_t conn = atomic_load(&stress_conn[fd]);
+
+    atomic_fetch_add(&stress_attempts, 1);
+    if (!fdstate_claim(fd, STRESS_CONN_GEN(conn)))
+      continue;
+
+    if (fdstate_cookie(fd) != STRESS_CONN_COOKIE(conn))
+      atomic_fetch_add(&stress_violations, 1);
+    if (atomic_fetch_sub(&stress_lives[fd], 1) <= 1)
+      fdstate_set_expiry(fd, 1); /* retired by its holder, as a handler would */
+    if (fdstate_cookie(fd) != STRESS_CONN_COOKIE(conn))
+      atomic_fetch_add(&stress_violations, 1);
+
+    fdstate_release(fd);
+    atomic_fetch_add(&stress_claims, 1);
+  }
+  return NULL;
+}
+
+static void *stress_keeper(void *arg) {
+  (void)arg;
+  while (stress_running()) {
+    int fd;
+
+    for (fd = 0; fd < STRESS_SLOTS; ++fd) {
+      if (atomic_load(&stress_live[fd])) {
+        if (!fdstate_claim_expired(fd, 1))
+          continue;                            /* a worker has it, come back */
+        fdstate_close(fd);
+        atomic_store(&stress_live[fd], 0);
+        atomic_fetch_add(&stress_recycles, 1);
+      }
+      {
+        void    *cookie = (void *)(uintptr_t)(atomic_fetch_add(&stress_next_cookie, 1) + 1);
+        uint32_t gen    = fdstate_open(fd, cookie, 0);
+
+        atomic_store(&stress_lives[fd], RECYCLE_AFTER);
+        atomic_store(&stress_conn[fd], STRESS_CONN((uintptr_t)cookie, gen));
+        atomic_store(&stress_live[fd], 1);
+      }
+    }
+  }
+  return NULL;
+}
+
+static void case_recycling_under_load(void) {
+  pthread_t worker[4], keeper;
+  size_t    i;
+
+  test_case("no worker is ever handed a connection from another generation");
+  atomic_store(&stress_claims, 0);
+  atomic_store(&stress_recycles, 0);
+  atomic_store(&stress_violations, 0);
+  atomic_store(&stress_attempts, 0);
+  atomic_store(&stress_next_cookie, 0);
+  /* Every slot is opened and published before any worker runs: a worker only
+     ever learns of a descriptor from whoever registered it, and never
+     invents a generation of its own. */
+  for (i = 0; i < STRESS_SLOTS; ++i) {
+    void    *cookie = (void *)(uintptr_t)(atomic_fetch_add(&stress_next_cookie, 1) + 1);
+    uint32_t gen    = fdstate_open((int)i, cookie, 0);
+
+    atomic_store(&stress_lives[i], RECYCLE_AFTER);
+    atomic_store(&stress_conn[i], STRESS_CONN((uintptr_t)cookie, gen));
+    atomic_store(&stress_live[i], 1);
+  }
+
+  pthread_create(&keeper, NULL, stress_keeper, NULL);
+  for (i = 0; i < sizeof(worker) / sizeof(worker[0]); ++i)
+    pthread_create(&worker[i], NULL, stress_worker, (void *)(uintptr_t)(i + 1));
+  for (i = 0; i < sizeof(worker) / sizeof(worker[0]); ++i)
+    pthread_join(worker[i], NULL);
+  pthread_join(keeper, NULL);
+
+  CHECK_INT(atomic_load(&stress_violations), 0);
+
+  test_case("and the run actually recycled descriptors, or it proved nothing");
+  CHECK(atomic_load(&stress_claims) >= STRESS_CLAIMS);
+  CHECK(atomic_load(&stress_recycles) > STRESS_CLAIMS / (RECYCLE_AFTER * 4));
+
+  for (i = 0; i < STRESS_SLOTS; ++i)
+    fdstate_close((int)i);
+}
+
+void test_fdstate(void) {
+  CHECK_INT(fdstate_init(), 0);
+  CHECK(fdstate_slots() > STRESS_SLOTS);
+
+  case_open_claim_release();
+  case_one_holder_at_a_time();
+  case_stale_generation_is_refused();
+  case_expiry();
+  case_out_of_range();
+  case_recycling_under_load();
+
+  fdstate_deinit();
+}
diff --git a/tests/t_fmt.c b/tests/t_fmt.c
new file mode 100644
index 0000000..bc23ed5
--- /dev/null
+++ b/tests/t_fmt.c
@@ -0,0 +1,108 @@
+/* This software was written by Dirk Engling <erdgeist@erdgeist.org>
+   It is considered beerware. Prost. Skol. Cheers or whatever.
+
+   $id$ */
+
+/* System */
+#include <string.h>
+
+/* Opentracker */
+#include "ot_fmt.h"
+#include "test.h"
+
+static void case_appends_in_sequence(void) {
+  char  buffer[64];
+  char *r = buffer, *re = buffer + sizeof(buffer);
+
+  test_case("appends follow each other and advance the cursor");
+  fmt_append(&r, re, "d8:completei%zde", (size_t)7);
+  fmt_append(&r, re, "ee");
+  *r = 0;
+  CHECK_STR(buffer, "d8:completei7eee");
+  CHECK_INT(r - buffer, 16);
+}
+
+static void case_truncation_stops_at_the_end(void) {
+  char  buffer[16];
+  char *r = buffer, *re = buffer + 8; /* pretend the buffer ends early */
+
+  memset(buffer, '#', sizeof(buffer));
+  test_case("a value too long for the room left stops at the end");
+  fmt_append(&r, re, "%s", "0123456789");
+  CHECK_PTR(r, re);
+
+  test_case("and writes nothing past it");
+  CHECK_INT(buffer[8], '#');
+  CHECK_INT(buffer[15], '#');
+}
+
+static void case_a_full_buffer_takes_nothing_more(void) {
+  char  buffer[16];
+  char *r = buffer + 8, *re = buffer + 8;
+
+  memset(buffer, '#', sizeof(buffer));
+  test_case("appending to a cursor already at the end changes nothing");
+  fmt_append(&r, re, "more");
+  CHECK_PTR(r, re);
+  CHECK_INT(buffer[8], '#');
+}
+
+static void case_an_append_that_just_fits(void) {
+  char  buffer[8];
+  char *r = buffer, *re = buffer + 3;
+
+  memset(buffer, '#', sizeof(buffer));
+  test_case("three characters into three bytes of room still truncate");
+  fmt_append(&r, re, "abc");
+  CHECK_PTR(r, re);
+  CHECK_INT(buffer[0], 'a');
+  CHECK_INT(buffer[1], 'b');
+
+  test_case("because snprintf spends the last byte on its terminator");
+  CHECK_INT(buffer[2], 0);
+  CHECK_INT(buffer[3], '#');
+}
+
+static void case_bytes_are_all_or_nothing(void) {
+  char  buffer[16];
+  char *r = buffer, *re = buffer + 8;
+
+  memset(buffer, '#', sizeof(buffer));
+  test_case("a run of bytes is written when it fits");
+  fmt_bytes(&r, re, "\0\1\2\3", 4);
+  CHECK_PTR(r, buffer + 4);
+  CHECK_MEM(buffer, "\0\1\2\3", 4);
+
+  test_case("a run that would not fit is refused whole");
+  fmt_bytes(&r, re, "abcde", 5);
+  CHECK_PTR(r, re);
+  CHECK_INT(buffer[4], '#');
+
+  test_case("a run of exactly the room left is written");
+  r = buffer + 4;
+  fmt_bytes(&r, re, "wxyz", 4);
+  CHECK_PTR(r, re);
+  CHECK_MEM(buffer + 4, "wxyz", 4);
+  CHECK_INT(buffer[8], '#');
+}
+
+static void case_bytes_do_not_terminate(void) {
+  char  buffer[8];
+  char *r = buffer, *re = buffer + 4;
+
+  memset(buffer, '#', sizeof(buffer));
+  test_case("unlike an append, a run of bytes may fill the room exactly");
+  fmt_bytes(&r, re, "abcd", 4);
+  CHECK_PTR(r, re);
+  CHECK_MEM(buffer, "abcd", 4);
+  CHECK_INT(buffer[4], '#');
+}
+
+void test_fmt(void) {
+  case_appends_in_sequence();
+  case_truncation_stops_at_the_end();
+  case_a_full_buffer_takes_nothing_more();
+  case_an_append_that_just_fits();
+  case_bytes_are_all_or_nothing();
+  case_bytes_do_not_terminate();
+}
diff --git a/tests/t_hex.c b/tests/t_hex.c
index 7cce8ac..a761737 100644
--- a/tests/t_hex.c
+++ b/tests/t_hex.c
@@ -18,7 +18,7 @@ static void case_encode(void) {
 
   test_case("a hash encodes to forty upper case digits and a terminator");
   memset(dest, 0x7f, sizeof(dest));
-  CHECK_PTR(hex_fromhash(dest, sample), dest);
+  CHECK_PTR(hex_from_hash(dest, sample), dest);
   CHECK_STR(dest, "000123456789ABCDEFFF10203040506070809" "0A0");
   CHECK_INT(strlen(dest), 40);
   CHECK_INT((unsigned char)dest[41], 0x7f);
@@ -28,7 +28,7 @@ static void case_decode(void) {
   ot_hash hash;
 
   test_case("forty digits decode back to the hash");
-  CHECK(hex_tohash(hash, "000123456789ABCDEFFF10203040506070809" "0A0"));
+  CHECK(hex_to_hash(hash, "000123456789ABCDEFFF10203040506070809" "0A0"));
   CHECK_MEM(hash, sample, sizeof(sample));
 }
 
@@ -41,8 +41,8 @@ static void case_round_trip(void) {
   for (i = 0; i < 256; ++i) {
     uint8_t probe[20];
     memset(probe, (uint8_t)i, sizeof(probe));
-    hex_fromhash(text, probe);
-    if (!hex_tohash(hash, text) || memcmp(hash, probe, sizeof(probe))) {
+    hex_from_hash(text, probe);
+    if (!hex_to_hash(hash, text) || memcmp(hash, probe, sizeof(probe))) {
       test_failf(__FILE__, __LINE__, "round trip failed for byte value %zu", i);
       return;
     }
@@ -54,8 +54,8 @@ static void case_decode_is_case_insensitive(void) {
   ot_hash upper, lower;
 
   test_case("lower case digits decode the same as upper case");
-  CHECK(hex_tohash(upper, "ABCDEF0123456789ABCDEF0123456789ABCDEF01"));
-  CHECK(hex_tohash(lower, "abcdef0123456789abcdef0123456789abcdef01"));
+  CHECK(hex_to_hash(upper, "ABCDEF0123456789ABCDEF0123456789ABCDEF01"));
+  CHECK(hex_to_hash(lower, "abcdef0123456789abcdef0123456789abcdef01"));
   CHECK_MEM(lower, upper, sizeof(ot_hash));
 }
 
@@ -63,18 +63,18 @@ static void case_rejects_non_digits(void) {
   ot_hash hash;
 
   test_case("a non hex character anywhere rejects the whole string");
-  CHECK_INT(hex_tohash(hash, "g00123456789ABCDEFFF102030405060708090A0"), 0);
-  CHECK_INT(hex_tohash(hash, "000123456789ABCDEFFF102030405060708090Ag"), 0);
-  CHECK_INT(hex_tohash(hash, "000123456789ABCDEF:F102030405060708090A"), 0);
+  CHECK_INT(hex_to_hash(hash, "g00123456789ABCDEFFF102030405060708090A0"), 0);
+  CHECK_INT(hex_to_hash(hash, "000123456789ABCDEFFF102030405060708090Ag"), 0);
+  CHECK_INT(hex_to_hash(hash, "000123456789ABCDEF:F102030405060708090A"), 0);
 }
 
 static void case_rejects_short_input(void) {
   ot_hash hash;
 
   test_case("a string shorter than forty digits is rejected");
-  CHECK_INT(hex_tohash(hash, ""), 0);
-  CHECK_INT(hex_tohash(hash, "00"), 0);
-  CHECK_INT(hex_tohash(hash, "000123456789ABCDEFFF102030405060708090A"), 0);
+  CHECK_INT(hex_to_hash(hash, ""), 0);
+  CHECK_INT(hex_to_hash(hash, "00"), 0);
+  CHECK_INT(hex_to_hash(hash, "000123456789ABCDEFFF102030405060708090A"), 0);
 }
 
 static void case_leaves_hash_untouched_on_failure(void) {
@@ -82,7 +82,7 @@ static void case_leaves_hash_untouched_on_failure(void) {
 
   test_case("a rejected string leaves the destination untouched");
   memset(hash, 0x5a, sizeof(hash));
-  CHECK_INT(hex_tohash(hash, "000123456789ABCDEFFF10203040506070809XX0"), 0);
+  CHECK_INT(hex_to_hash(hash, "000123456789ABCDEFFF10203040506070809XX0"), 0);
   CHECK_MEM(hash, "\x5a\x5a\x5a\x5a\x5a\x5a\x5a\x5a\x5a\x5a\x5a\x5a\x5a\x5a\x5a\x5a\x5a\x5a\x5a\x5a", sizeof(hash));
 }
 
@@ -96,7 +96,7 @@ static void case_stops_at_the_terminator(void) {
   memcpy(guarded, "0012", 4);
   guarded[4] = 0;
   memset(guarded + 5, 'f', 3);
-  CHECK_INT(hex_tohash(hash, guarded), 0);
+  CHECK_INT(hex_to_hash(hash, guarded), 0);
 }
 
 static void case_isdigit(void) {
diff --git a/tests/t_iovec.c b/tests/t_iovec.c
index 89f3fda..2553141 100644
--- a/tests/t_iovec.c
+++ b/tests/t_iovec.c
@@ -18,13 +18,13 @@ static void case_increase_and_length(void) {
   void         *first, *second;
 
   test_case("increase appends an entry and length is their sum");
-  first = iovec_increase(&entries, &vector, 100);
+  first = iovec_new_chunk(&entries, &vector, 100);
   CHECK(first != NULL);
   CHECK_INT(entries, 1);
   CHECK_INT(vector[0].iov_len, 100);
   CHECK_PTR(vector[0].iov_base, first);
 
-  second = iovec_increase(&entries, &vector, 50);
+  second = iovec_new_chunk(&entries, &vector, 50);
   CHECK(second != NULL);
   CHECK_INT(entries, 2);
   CHECK_INT(vector[1].iov_len, 50);
@@ -38,8 +38,8 @@ static void case_free_resets(void) {
   struct iovec *vector  = NULL;
 
   test_case("free releases the entries and resets the vector");
-  CHECK(iovec_increase(&entries, &vector, 10) != NULL);
-  CHECK(iovec_increase(&entries, &vector, 10) != NULL);
+  CHECK(iovec_new_chunk(&entries, &vector, 10) != NULL);
+  CHECK(iovec_new_chunk(&entries, &vector, 10) != NULL);
   iovec_free(&entries, &vector);
   CHECK_INT(entries, 0);
   CHECK_PTR(vector, NULL);
@@ -52,12 +52,12 @@ static void case_fixlast_shrinks(void) {
   char         *block;
 
   test_case("fixlast trims the last entry to the bytes actually used");
-  CHECK(iovec_increase(&entries, &vector, 64) != NULL);
-  block = iovec_increase(&entries, &vector, 1000);
+  CHECK(iovec_new_chunk(&entries, &vector, 64) != NULL);
+  block = iovec_new_chunk(&entries, &vector, 1000);
   CHECK(block != NULL);
   memset(block, 'x', 20);
 
-  iovec_fixlast(&entries, &vector, block + 20);
+  iovec_trim_last(&entries, &vector, block + 20);
   CHECK_INT(entries, 2);
   CHECK_INT(vector[1].iov_len, 20);
   CHECK_INT(iovec_length(&entries, (const struct iovec **)&vector), 84);
@@ -71,7 +71,7 @@ static void case_fixlast_on_empty(void) {
   struct iovec *vector  = NULL;
 
   test_case("fixlast on an empty vector does nothing");
-  iovec_fixlast(&entries, &vector, NULL);
+  iovec_trim_last(&entries, &vector, NULL);
   CHECK_INT(entries, 0);
   CHECK_PTR(vector, NULL);
 }
@@ -103,9 +103,9 @@ static void case_fix_increase(void) {
   char         *block;
 
   test_case("fix_increase trims the previous entry and adds a new one");
-  block = iovec_increase(&entries, &vector, 500);
+  block = iovec_new_chunk(&entries, &vector, 500);
   CHECK(block != NULL);
-  block = iovec_fix_increase_or_free(&entries, &vector, block + 30, 200);
+  block = iovec_next_chunk(&entries, &vector, block + 30, 200);
   CHECK(block != NULL);
   CHECK_INT(entries, 2);
   CHECK_INT(vector[0].iov_len, 30);
diff --git a/tests/t_ip.c b/tests/t_ip.c
index 2fe3a72..8d71679 100644
--- a/tests/t_ip.c
+++ b/tests/t_ip.c
@@ -95,27 +95,27 @@ static void case_scan_forms(void) {
   char ip[16];
 
   test_case("2.2 form 1, every group spelled out");
-  CHECK_INT(ip_scan("1111:2222:3333:4444:5555:6666:7777:8888", ip), 39);
+  CHECK_INT(ip_parse("1111:2222:3333:4444:5555:6666:7777:8888", ip), 39);
   CHECK_MEM(ip, "\x11\x11\x22\x22\x33\x33\x44\x44\x55\x55\x66\x66\x77\x77\x88\x88", 16);
 
   test_case("2.2 form 2, zero groups abbreviated");
-  CHECK_INT(ip_scan("2001:db8::1", ip), 11);
+  CHECK_INT(ip_parse("2001:db8::1", ip), 11);
   CHECK_MEM(ip, "\x20\x01\x0d\xb8\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01", 16);
-  CHECK_INT(ip_scan("::1", ip), 3);
+  CHECK_INT(ip_parse("::1", ip), 3);
   CHECK_MEM(ip, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01", 16);
-  CHECK_INT(ip_scan("::", ip), 2);
+  CHECK_INT(ip_parse("::", ip), 2);
   CHECK_MEM(ip, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 16);
-  CHECK_INT(ip_scan("1::", ip), 3);
+  CHECK_INT(ip_parse("1::", ip), 3);
   CHECK_MEM(ip, "\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 16);
 
   test_case("2.2 form 3, a dotted quad in the last two groups");
-  CHECK_INT(ip_scan("::ffff:1.2.3.4", ip), 14);
+  CHECK_INT(ip_parse("::ffff:1.2.3.4", ip), 14);
   CHECK_MEM(ip, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\x01\x02\x03\x04", 16);
-  CHECK_INT(ip_scan("1:2:3:4:5:6:1.2.3.4", ip), 19);
+  CHECK_INT(ip_parse("1:2:3:4:5:6:1.2.3.4", ip), 19);
   CHECK_MEM(ip, "\x00\x01\x00\x02\x00\x03\x00\x04\x00\x05\x00\x06\x01\x02\x03\x04", 16);
 
   test_case("upper case input is accepted");
-  CHECK_INT(ip_scan("2001:DB8::1", ip), 11);
+  CHECK_INT(ip_parse("2001:DB8::1", ip), 11);
   CHECK_MEM(ip, "\x20\x01\x0d\xb8\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01", 16);
 }
 
@@ -125,7 +125,7 @@ static void case_scan_accepts_bare_ipv4(void) {
   /* Every address opentracker holds is sixteen bytes, so an operator writing
      a plain IPv4 address in the config has to land as the v4 mapped form */
   test_case("a bare IPv4 address is stored v4 mapped");
-  CHECK_INT(ip_scan("10.0.0.1", ip), 8);
+  CHECK_INT(ip_parse("10.0.0.1", ip), 8);
   CHECK_MEM(ip, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\x0a\x00\x00\x01", 16);
   CHECK(ip_is_v4mapped(ip));
 }
@@ -136,39 +136,39 @@ static void case_scan_reports_length(void) {
   /* The config parser continues from where the address ended, which is how
      "address:port" and "address/bits" are read */
   test_case("scanning stops at the character after the address");
-  CHECK_INT(ip_scan("10.0.0.1:6969", ip), 8);
-  CHECK_INT(ip_scan("2001:db8::1/64", ip), 11);
-  CHECK_INT(ip_scan("::1]", ip), 3);
-  CHECK_INT(ip_scan("1:2:3:4:5:6:7:8 trailing", ip), 15);
+  CHECK_INT(ip_parse("10.0.0.1:6969", ip), 8);
+  CHECK_INT(ip_parse("2001:db8::1/64", ip), 11);
+  CHECK_INT(ip_parse("::1]", ip), 3);
+  CHECK_INT(ip_parse("1:2:3:4:5:6:7:8 trailing", ip), 15);
 }
 
 static void case_scan_rejects(void) {
   char ip[16];
 
   test_case("an empty or junk string is refused");
-  CHECK_INT(ip_scan("", ip), 0);
-  CHECK_INT(ip_scan("x", ip), 0);
-  CHECK_INT(ip_scan(":", ip), 0);
-  CHECK_INT(ip_scan(":1:2", ip), 0);
+  CHECK_INT(ip_parse("", ip), 0);
+  CHECK_INT(ip_parse("x", ip), 0);
+  CHECK_INT(ip_parse(":", ip), 0);
+  CHECK_INT(ip_parse(":1:2", ip), 0);
 
   test_case("too few groups without :: are refused");
-  CHECK_INT(ip_scan("1:2:3:4:5:6:7", ip), 0);
-  CHECK_INT(ip_scan("2001:db8:1", ip), 0);
+  CHECK_INT(ip_parse("1:2:3:4:5:6:7", ip), 0);
+  CHECK_INT(ip_parse("2001:db8:1", ip), 0);
 
   /* libowfat accepted a prefix of each of these and carried on. Taking only
      part of a malformed address is worse than refusing it, especially where
      the text comes from a config file or an X-Forwarded-For header. */
   test_case("a second :: is refused rather than truncated");
-  CHECK_INT(ip_scan("1::2::3", ip), 0);
-  CHECK_INT(ip_scan("::1::", ip), 0);
-  CHECK_INT(ip_scan("::::", ip), 0);
+  CHECK_INT(ip_parse("1::2::3", ip), 0);
+  CHECK_INT(ip_parse("::1::", ip), 0);
+  CHECK_INT(ip_parse("::::", ip), 0);
 
   test_case("more than eight groups is refused");
-  CHECK_INT(ip_scan("1:2:3:4:5:6:7:8:9", ip), 0);
+  CHECK_INT(ip_parse("1:2:3:4:5:6:7:8:9", ip), 0);
 
   test_case("a group of more than four digits is refused, not truncated");
-  CHECK_INT(ip_scan("12345::1", ip), 0);
-  CHECK_INT(ip_scan("fffff::1", ip), 0);
+  CHECK_INT(ip_parse("12345::1", ip), 0);
+  CHECK_INT(ip_parse("fffff::1", ip), 0);
 }
 
 static void case_round_trip(void) {
@@ -187,7 +187,7 @@ static void case_round_trip(void) {
 
   test_case("every formatted address scans back to the same bytes");
   for (i = 0; samples[i]; ++i) {
-    size_t n = ip_scan(samples[i], ip);
+    size_t n = ip_parse(samples[i], ip);
     if (n != strlen(samples[i])) {
       test_failf(__FILE__, __LINE__, "\"%s\" consumed %zu of %zu", samples[i], n, strlen(samples[i]));
       return;
@@ -197,7 +197,7 @@ static void case_round_trip(void) {
       test_failf(__FILE__, __LINE__, "\"%s\" formatted back as \"%s\"", samples[i], text);
       return;
     }
-    if (!ip_scan(text, again) || memcmp(ip, again, 16)) {
+    if (!ip_parse(text, again) || memcmp(ip, again, 16)) {
       test_failf(__FILE__, __LINE__, "\"%s\" did not survive a second pass", samples[i]);
       return;
     }
diff --git a/tests/t_scan.c b/tests/t_scan.c
index 89f1590..aab4413 100644
--- a/tests/t_scan.c
+++ b/tests/t_scan.c
@@ -15,13 +15,13 @@ static void case_plain_numbers(void) {
   uint64_t value;
 
   test_case("a decimal number is read and its length reported");
-  CHECK_INT(scan_udec("0", &value, 65535), 1);
+  CHECK_INT(scan_uint("0", &value, 65535), 1);
   CHECK_INT(value, 0);
-  CHECK_INT(scan_udec("7", &value, 65535), 1);
+  CHECK_INT(scan_uint("7", &value, 65535), 1);
   CHECK_INT(value, 7);
-  CHECK_INT(scan_udec("6969", &value, 65535), 4);
+  CHECK_INT(scan_uint("6969", &value, 65535), 4);
   CHECK_INT(value, 6969);
-  CHECK_INT(scan_udec("65535", &value, 65535), 5);
+  CHECK_INT(scan_uint("65535", &value, 65535), 5);
   CHECK_INT(value, 65535);
 }
 
@@ -29,11 +29,11 @@ static void case_stops_at_non_digit(void) {
   uint64_t value;
 
   test_case("scanning stops at the first character that is not a digit");
-  CHECK_INT(scan_udec("6969:rest", &value, 65535), 4);
+  CHECK_INT(scan_uint("6969:rest", &value, 65535), 4);
   CHECK_INT(value, 6969);
-  CHECK_INT(scan_udec("128/8", &value, 65535), 3);
+  CHECK_INT(scan_uint("128/8", &value, 65535), 3);
   CHECK_INT(value, 128);
-  CHECK_INT(scan_udec("42\n", &value, 65535), 2);
+  CHECK_INT(scan_uint("42\n", &value, 65535), 2);
   CHECK_INT(value, 42);
 }
 
@@ -41,9 +41,9 @@ static void case_rejects_whitespace(void) {
   uint64_t value = 0xdead;
 
   test_case("leading whitespace is not skipped");
-  CHECK_INT(scan_udec(" 1", &value, 65535), 0);
-  CHECK_INT(scan_udec("\t1", &value, 65535), 0);
-  CHECK_INT(scan_udec("\n1", &value, 65535), 0);
+  CHECK_INT(scan_uint(" 1", &value, 65535), 0);
+  CHECK_INT(scan_uint("\t1", &value, 65535), 0);
+  CHECK_INT(scan_uint("\n1", &value, 65535), 0);
   CHECK_INT(value, 0xdead);
 }
 
@@ -51,9 +51,9 @@ static void case_rejects_sign(void) {
   uint64_t value = 0xdead;
 
   test_case("a sign is not accepted");
-  CHECK_INT(scan_udec("+1", &value, 65535), 0);
-  CHECK_INT(scan_udec("-1", &value, 65535), 0);
-  CHECK_INT(scan_udec("-0", &value, 65535), 0);
+  CHECK_INT(scan_uint("+1", &value, 65535), 0);
+  CHECK_INT(scan_uint("-1", &value, 65535), 0);
+  CHECK_INT(scan_uint("-0", &value, 65535), 0);
   CHECK_INT(value, 0xdead);
 }
 
@@ -61,9 +61,9 @@ static void case_rejects_empty_and_junk(void) {
   uint64_t value = 0xdead;
 
   test_case("a string with no leading digit yields nothing");
-  CHECK_INT(scan_udec("", &value, 65535), 0);
-  CHECK_INT(scan_udec("x", &value, 65535), 0);
-  CHECK_INT(scan_udec(":80", &value, 65535), 0);
+  CHECK_INT(scan_uint("", &value, 65535), 0);
+  CHECK_INT(scan_uint("x", &value, 65535), 0);
+  CHECK_INT(scan_uint(":80", &value, 65535), 0);
   CHECK_INT(value, 0xdead);
 }
 
@@ -71,9 +71,9 @@ static void case_no_alternative_bases(void) {
   uint64_t value;
 
   test_case("hexadecimal and octal notations are read as plain decimal");
-  CHECK_INT(scan_udec("0x10", &value, 65535), 1);
+  CHECK_INT(scan_uint("0x10", &value, 65535), 1);
   CHECK_INT(value, 0);
-  CHECK_INT(scan_udec("010", &value, 65535), 3);
+  CHECK_INT(scan_uint("010", &value, 65535), 3);
   CHECK_INT(value, 10);
 }
 
@@ -81,13 +81,13 @@ static void case_refuses_out_of_range(void) {
   uint64_t value = 0xdead;
 
   test_case("a value above max is refused, not truncated");
-  CHECK_INT(scan_udec("65536", &value, 65535), 0);
-  CHECK_INT(scan_udec("99999", &value, 65535), 0);
-  CHECK_INT(scan_udec("129", &value, 128), 0);
+  CHECK_INT(scan_uint("65536", &value, 65535), 0);
+  CHECK_INT(scan_uint("99999", &value, 65535), 0);
+  CHECK_INT(scan_uint("129", &value, 128), 0);
   CHECK_INT(value, 0xdead);
 
   test_case("the boundary itself is accepted");
-  CHECK_INT(scan_udec("128", &value, 128), 3);
+  CHECK_INT(scan_uint("128", &value, 128), 3);
   CHECK_INT(value, 128);
 }
 
@@ -95,21 +95,21 @@ static void case_sixty_four_bit_range(void) {
   uint64_t value;
 
   test_case("the full unsigned 64 bit range is available");
-  CHECK_INT(scan_udec("18446744073709551615", &value, UINT64_MAX), 20);
+  CHECK_INT(scan_uint("18446744073709551615", &value, UINT64_MAX), 20);
   CHECK(value == UINT64_MAX);
 
   test_case("a number too large for 64 bits is refused");
-  CHECK_INT(scan_udec("18446744073709551616", &value, UINT64_MAX), 0);
-  CHECK_INT(scan_udec("99999999999999999999999999", &value, UINT64_MAX), 0);
+  CHECK_INT(scan_uint("18446744073709551616", &value, UINT64_MAX), 0);
+  CHECK_INT(scan_uint("99999999999999999999999999", &value, UINT64_MAX), 0);
 }
 
 static void case_leading_zeros_allowed(void) {
   uint64_t value;
 
   test_case("leading zeros are accepted outside bencode");
-  CHECK_INT(scan_udec("007", &value, 65535), 3);
+  CHECK_INT(scan_uint("007", &value, 65535), 3);
   CHECK_INT(value, 7);
-  CHECK_INT(scan_udec("0000", &value, 65535), 4);
+  CHECK_INT(scan_uint("0000", &value, 65535), 4);
   CHECK_INT(value, 0);
 }
 
@@ -117,9 +117,9 @@ static void case_bencode_rejects_leading_zeros(void) {
   uint64_t value = 0xdead;
 
   test_case("bencode refuses a leading zero on anything but zero");
-  CHECK_INT(scan_udec_bencode("007", &value, 65535), 0);
-  CHECK_INT(scan_udec_bencode("0000", &value, 65535), 0);
-  CHECK_INT(scan_udec_bencode("01", &value, 65535), 0);
+  CHECK_INT(scan_uint_bencode("007", &value, 65535), 0);
+  CHECK_INT(scan_uint_bencode("0000", &value, 65535), 0);
+  CHECK_INT(scan_uint_bencode("01", &value, 65535), 0);
   CHECK_INT(value, 0xdead);
 }
 
@@ -127,11 +127,11 @@ static void case_bencode_accepts_canonical(void) {
   uint64_t value;
 
   test_case("bencode accepts a canonically written number");
-  CHECK_INT(scan_udec_bencode("0", &value, 65535), 1);
+  CHECK_INT(scan_uint_bencode("0", &value, 65535), 1);
   CHECK_INT(value, 0);
-  CHECK_INT(scan_udec_bencode("0:", &value, 65535), 1);
+  CHECK_INT(scan_uint_bencode("0:", &value, 65535), 1);
   CHECK_INT(value, 0);
-  CHECK_INT(scan_udec_bencode("160:", &value, 65535), 3);
+  CHECK_INT(scan_uint_bencode("160:", &value, 65535), 3);
   CHECK_INT(value, 160);
 }
 
@@ -139,14 +139,64 @@ static void case_bencode_inherits_the_rest(void) {
   uint64_t value = 0xdead;
 
   test_case("bencode is no laxer than the plain scanner");
-  CHECK_INT(scan_udec_bencode(" 1", &value, 65535), 0);
-  CHECK_INT(scan_udec_bencode("-1", &value, 65535), 0);
-  CHECK_INT(scan_udec_bencode("+1", &value, 65535), 0);
-  CHECK_INT(scan_udec_bencode("65536", &value, 65535), 0);
+  CHECK_INT(scan_uint_bencode(" 1", &value, 65535), 0);
+  CHECK_INT(scan_uint_bencode("-1", &value, 65535), 0);
+  CHECK_INT(scan_uint_bencode("+1", &value, 65535), 0);
+  CHECK_INT(scan_uint_bencode("65536", &value, 65535), 0);
   CHECK_INT(value, 0xdead);
 }
 
+/* ------------------------------------------- fixed width signed integers */
+
+/* A value lifted out of a query string arrives as a pointer and a length
+   with nothing terminating it, and the whole of it has to be the number. */
+
+static void case_int_whole_field(void) {
+  int64_t value = 0;
+
+  test_case("the whole field is read, sign and all");
+  CHECK_INT(scan_int("123", 3, &value), 0);
+  CHECK_INT(value, 123);
+  CHECK_INT(scan_int("-45", 3, &value), 0);
+  CHECK_INT(value, -45);
+
+  test_case("and only as far as the length given");
+  CHECK_INT(scan_int("12345", 3, &value), 0);
+  CHECK_INT(value, 123);
+}
+
+static void case_int_rejects_the_rest(void) {
+  int64_t value = 4711;
+
+  test_case("anything that is not all digits is refused");
+  CHECK_INT(scan_int("12a", 3, &value), -1);
+  CHECK_INT(scan_int("", 0, &value), -1);
+  CHECK_INT(scan_int("-", 1, &value), -1);
+  CHECK_INT(scan_int(" 12", 3, &value), -1);
+  CHECK_INT(scan_int("+12", 3, &value), -1);
+
+  test_case("and a refused field leaves the number alone");
+  CHECK_INT(value, 4711);
+}
+
+static void case_int_overflow(void) {
+  int64_t value = 0;
+
+  test_case("a field too long to fit is refused rather than wrapped");
+  CHECK_INT(scan_int("9223372036854775807", 19, &value), 0);
+  CHECK_INT(value, INT64_MAX);
+  CHECK_INT(scan_int("9223372036854775808", 19, &value), -1);
+  CHECK_INT(scan_int("99999999999999999999", 20, &value), -1);
+
+  test_case("including the negative side");
+  CHECK_INT(scan_int("-9223372036854775807", 20, &value), 0);
+  CHECK_INT(value, -INT64_MAX);
+}
+
 void test_scan(void) {
+  case_int_whole_field();
+  case_int_rejects_the_rest();
+  case_int_overflow();
   case_plain_numbers();
   case_stops_at_non_digit();
   case_rejects_whitespace();
diff --git a/tests/t_scan_urlencoded_query.c b/tests/t_urlencoded.c
index f660ea3..6e0ee31 100644
--- a/tests/t_scan_urlencoded_query.c
+++ b/tests/t_urlencoded.c
@@ -7,7 +7,7 @@
 #include <string.h>
 
 /* Opentracker */
-#include "scan_urlencoded_query.h"
+#include "ot_urlencoded.h"
 #include "test.h"
 
 /* The scanner returns the number of bytes written to the destination, or
@@ -23,7 +23,7 @@ static void case_path(void) {
   ssize_t n;
 
   test_case("path stops at the question mark");
-  n = scan_urlencoded_query(&p, dest, SCAN_PATH);
+  n = urlencoded_parse(&p, dest, SCAN_PATH);
   CHECK_INT(n, 9);
   dest[n] = 0;
   CHECK_STR(dest, "/announce");
@@ -37,22 +37,22 @@ static void case_param_and_value(void) {
   ssize_t n;
 
   test_case("parameter stops at '=', value stops at '&'");
-  n = scan_urlencoded_query(&p, dest, SCAN_SEARCHPATH_PARAM);
+  n = urlencoded_parse(&p, dest, SCAN_SEARCHPATH_PARAM);
   CHECK_INT(n, 9);
   dest[n] = 0;
   CHECK_STR(dest, "info_hash");
 
-  n = scan_urlencoded_query(&p, dest, SCAN_SEARCHPATH_VALUE);
+  n = urlencoded_parse(&p, dest, SCAN_SEARCHPATH_VALUE);
   CHECK_INT(n, 3);
   dest[n] = 0;
   CHECK_STR(dest, "abc");
 
-  n = scan_urlencoded_query(&p, dest, SCAN_SEARCHPATH_PARAM);
+  n = urlencoded_parse(&p, dest, SCAN_SEARCHPATH_PARAM);
   CHECK_INT(n, 4);
   dest[n] = 0;
   CHECK_STR(dest, "port");
 
-  n = scan_urlencoded_query(&p, dest, SCAN_SEARCHPATH_VALUE);
+  n = urlencoded_parse(&p, dest, SCAN_SEARCHPATH_VALUE);
   CHECK_INT(n, 2);
   dest[n] = 0;
   CHECK_STR(dest, "80");
@@ -65,7 +65,7 @@ static void case_percent_decoding(void) {
   ssize_t n;
 
   test_case("percent escapes decode");
-  n = scan_urlencoded_query(&p, dest, SCAN_SEARCHPATH_VALUE);
+  n = urlencoded_parse(&p, dest, SCAN_SEARCHPATH_VALUE);
   CHECK_INT(n, 3);
   CHECK_MEM(dest, "ABC", 3);
 }
@@ -79,7 +79,7 @@ static void case_binary_info_hash(void) {
   ssize_t       n;
 
   test_case("twenty byte binary value survives decoding");
-  n = scan_urlencoded_query(&p, dest, SCAN_SEARCHPATH_VALUE);
+  n = urlencoded_parse(&p, dest, SCAN_SEARCHPATH_VALUE);
   CHECK_INT(n, 20);
   CHECK_MEM(dest, want, 20);
 }
@@ -90,7 +90,7 @@ static void case_in_place(void) {
   ssize_t n;
 
   test_case("decoding in place over the source is safe");
-  n = scan_urlencoded_query(&p, query, SCAN_SEARCHPATH_VALUE);
+  n = urlencoded_parse(&p, query, SCAN_SEARCHPATH_VALUE);
   CHECK_INT(n, 2);
   CHECK_MEM(query, "AB", 2);
 }
@@ -102,7 +102,7 @@ static void case_bad_escape(void) {
   ssize_t n;
 
   test_case("a non hexadecimal escape is a parse error");
-  n = scan_urlencoded_query(&p, dest, SCAN_SEARCHPATH_VALUE);
+  n = urlencoded_parse(&p, dest, SCAN_SEARCHPATH_VALUE);
   CHECK_INT(n, -1);
 }
 
@@ -113,7 +113,7 @@ static void case_truncated_escape(void) {
   ssize_t n;
 
   test_case("an escape cut short by the terminator is a parse error");
-  n = scan_urlencoded_query(&p, dest, SCAN_SEARCHPATH_VALUE);
+  n = urlencoded_parse(&p, dest, SCAN_SEARCHPATH_VALUE);
   CHECK_INT(n, -1);
 }
 
@@ -125,11 +125,11 @@ static void case_terminator(void) {
   ssize_t n;
 
   test_case("a hard terminator before any output reports end of input");
-  n = scan_urlencoded_query(&p, dest, SCAN_SEARCHPATH_PARAM);
+  n = urlencoded_parse(&p, dest, SCAN_SEARCHPATH_PARAM);
   CHECK_INT(n, -2);
 
   p = space;
-  n = scan_urlencoded_query(&p, dest, SCAN_SEARCHPATH_PARAM);
+  n = urlencoded_parse(&p, dest, SCAN_SEARCHPATH_PARAM);
   CHECK_INT(n, -2);
 }
 
@@ -140,10 +140,10 @@ static void case_terminator_after_output(void) {
   ssize_t n;
 
   test_case("a hard terminator after output is left for the next call");
-  n = scan_urlencoded_query(&p, dest, SCAN_SEARCHPATH_VALUE);
+  n = urlencoded_parse(&p, dest, SCAN_SEARCHPATH_VALUE);
   CHECK_INT(n, 3);
   CHECK_INT(*p, 0);
-  n = scan_urlencoded_query(&p, dest, SCAN_SEARCHPATH_VALUE);
+  n = urlencoded_parse(&p, dest, SCAN_SEARCHPATH_VALUE);
   CHECK_INT(n, -2);
 }
 
@@ -159,14 +159,14 @@ static void case_separators_are_contextual(void) {
   ssize_t n;
 
   test_case("a question mark is literal inside a value");
-  n = scan_urlencoded_query(&p, dest, SCAN_SEARCHPATH_VALUE);
+  n = urlencoded_parse(&p, dest, SCAN_SEARCHPATH_VALUE);
   CHECK_INT(n, 3);
   dest[n] = 0;
   CHECK_STR(dest, "a?b");
 
   test_case("an equals sign is literal inside a value");
   p = equals;
-  n = scan_urlencoded_query(&p, dest, SCAN_SEARCHPATH_VALUE);
+  n = urlencoded_parse(&p, dest, SCAN_SEARCHPATH_VALUE);
   CHECK_INT(n, 3);
   dest[n] = 0;
   CHECK_STR(dest, "a=b");
@@ -179,7 +179,7 @@ static void case_ampersand_in_path(void) {
   ssize_t n;
 
   test_case("an ampersand in a path is a parse error");
-  n = scan_urlencoded_query(&p, dest, SCAN_PATH);
+  n = urlencoded_parse(&p, dest, SCAN_PATH);
   CHECK_INT(n, -1);
 }
 
@@ -190,7 +190,7 @@ static void case_raw_high_byte(void) {
   ssize_t n;
 
   test_case("an undecoded byte above ASCII is a parse error");
-  n = scan_urlencoded_query(&p, dest, SCAN_SEARCHPATH_VALUE);
+  n = urlencoded_parse(&p, dest, SCAN_SEARCHPATH_VALUE);
   CHECK_INT(n, -1);
 }
 
@@ -200,12 +200,12 @@ static void case_skipvalue(void) {
   char *p       = query;
 
   test_case("skipvalue steps over the value and its separator");
-  scan_urlencoded_skipvalue(&p);
+  urlencoded_skip_value(&p);
   CHECK_STR(p, "next=1");
 
   test_case("skipvalue leaves a hard terminator in place");
   p = bare;
-  scan_urlencoded_skipvalue(&p);
+  urlencoded_skip_value(&p);
   CHECK_INT(*p, 0);
 }
 
@@ -217,44 +217,17 @@ static void case_find_keywords(void) {
   char                    *p          = match;
 
   test_case("a known keyword returns its value");
-  CHECK_INT(scan_find_keywords(keywords, &p, SCAN_SEARCHPATH_PARAM), 2);
+  CHECK_INT(urlencoded_match_keyword(keywords, &p, SCAN_SEARCHPATH_PARAM), 2);
 
   test_case("an unknown keyword returns -3");
   p = nomatch;
-  CHECK_INT(scan_find_keywords(keywords, &p, SCAN_SEARCHPATH_PARAM), -3);
+  CHECK_INT(urlencoded_match_keyword(keywords, &p, SCAN_SEARCHPATH_PARAM), -3);
 
   test_case("a prefix of a keyword does not match it");
   p = prefix;
-  CHECK_INT(scan_find_keywords(keywords, &p, SCAN_SEARCHPATH_PARAM), -3);
+  CHECK_INT(urlencoded_match_keyword(keywords, &p, SCAN_SEARCHPATH_PARAM), -3);
 }
 
-static void case_fixed_int(void) {
-  char positive[] = "123";
-  char negative[] = "-45";
-  char trailing[] = "12a";
-  int  value;
-
-  test_case("scan_fixed_int returns the count of unparsed bytes");
-  CHECK_INT(scan_fixed_int(positive, 3, &value), 0);
-  CHECK_INT(value, 123);
-
-  CHECK_INT(scan_fixed_int(negative, 3, &value), 0);
-  CHECK_INT(value, -45);
-
-  CHECK_INT(scan_fixed_int(trailing, 3, &value), 1);
-  CHECK_INT(value, 12);
-}
-
-static void case_fixed_int_bounded(void) {
-  char digits[] = "12345";
-  int  value;
-
-  test_case("scan_fixed_int honours the length it is given");
-  CHECK_INT(scan_fixed_int(digits, 3, &value), 0);
-  CHECK_INT(value, 123);
-}
-
-
 /* The encoding direction. Which bytes survive unescaped is fixed by what
    existing parsers of the urlencoded full scrape expect, so these cases pin
    the set rather than describe a preference. */
@@ -265,7 +238,7 @@ static void case_fmt_passes_safe_bytes(void) {
   size_t        n;
 
   test_case("alphanumerics and the safe punctuation pass through");
-  n       = fmt_urlencoded(dest, src, 11);
+  n       = urlencoded_format(dest, src, 11);
   dest[n] = 0;
   CHECK_INT(n, 11);
   CHECK_STR(dest, "aZ09$-./=_~");
@@ -277,7 +250,7 @@ static void case_fmt_escapes_the_rest(void) {
   size_t        n;
 
   test_case("everything else becomes a percent escape");
-  n       = fmt_urlencoded(dest, src, sizeof(src));
+  n       = urlencoded_format(dest, src, sizeof(src));
   dest[n] = 0;
   CHECK_INT(n, 18);
   CHECK_STR(dest, "%20%25%26%2b%3a%3f");
@@ -289,7 +262,7 @@ static void case_fmt_hex_is_lower_case(void) {
   size_t        n;
 
   test_case("escapes use lower case hex digits");
-  n       = fmt_urlencoded(dest, src, sizeof(src));
+  n       = urlencoded_format(dest, src, sizeof(src));
   dest[n] = 0;
   CHECK_INT(n, 9);
   CHECK_STR(dest, "%00%ab%ff");
@@ -300,7 +273,7 @@ static void case_fmt_zero_length(void) {
 
   test_case("a zero length input writes nothing");
   memset(dest, 0x5a, sizeof(dest));
-  CHECK_INT(fmt_urlencoded(dest, (const uint8_t *)"abc", 0), 0);
+  CHECK_INT(urlencoded_format(dest, (const uint8_t *)"abc", 0), 0);
   CHECK_MEM(dest, "\x5a\x5a\x5a\x5a", 4);
 }
 
@@ -312,7 +285,7 @@ static void case_fmt_worst_case_fits(void) {
   test_case("a hash of entirely unsafe bytes needs three times its length");
   for (i = 0; i < sizeof(src); ++i)
     src[i] = 0xff;
-  n       = fmt_urlencoded(dest, src, sizeof(src));
+  n       = urlencoded_format(dest, src, sizeof(src));
   dest[n] = 0;
   CHECK_INT(n, 60);
   for (i = 0; i < 20; ++i)
@@ -328,7 +301,7 @@ static void case_fmt_decoder_disagrees_on_dollar(void) {
      encoder passes through unescaped, '$' is the only one the decoder then
      refuses, and it refuses the whole string rather than stopping short.
      Output of the urlencoded full scrape therefore does not round trip
-     through scan_urlencoded_query when a hash contains 0x24. Harmless today
+     through urlencoded_parse when a hash contains 0x24. Harmless today
      because only third party tooling reads that output. */
   const uint8_t src[]  = {'a', '$', 'b'};
   char          dest[16];
@@ -338,15 +311,15 @@ static void case_fmt_decoder_disagrees_on_dollar(void) {
   ssize_t       got;
 
   test_case("the encoder passes '$' but the decoder rejects it");
-  n       = fmt_urlencoded(dest, src, sizeof(src));
+  n       = urlencoded_format(dest, src, sizeof(src));
   dest[n] = 0;
   CHECK_STR(dest, "a$b");
 
-  got = scan_urlencoded_query(&p, scanned, SCAN_SEARCHPATH_VALUE);
+  got = urlencoded_parse(&p, scanned, SCAN_SEARCHPATH_VALUE);
   CHECK_INT(got, -1);
 }
 
-void test_scan_urlencoded_query(void) {
+void test_urlencoded(void) {
   case_path();
   case_param_and_value();
   case_percent_decoding();
@@ -361,8 +334,6 @@ void test_scan_urlencoded_query(void) {
   case_raw_high_byte();
   case_skipvalue();
   case_find_keywords();
-  case_fixed_int();
-  case_fixed_int_bounded();
   case_fmt_passes_safe_bytes();
   case_fmt_escapes_the_rest();
   case_fmt_hex_is_lower_case();
diff --git a/tests/t_vector.c b/tests/t_vector.c
index a8186b2..6e048e1 100644
--- a/tests/t_vector.c
+++ b/tests/t_vector.c
@@ -13,7 +13,7 @@
 #include "trackerlogic.h"
 #include "test.h"
 
-/* binary_search returns the matching member when there is one, and otherwise
+/* vector_binary_search returns the matching member when there is one, and otherwise
    the position at which the key would have to be inserted to keep the vector
    sorted. exactmatch distinguishes the two. */
 
@@ -25,7 +25,7 @@ static void                case_search_finds_member(void) {
   void               *found;
 
   test_case("an existing key is found");
-  found = binary_search(key, sorted, 5, 4, 4, &exactmatch);
+  found = vector_binary_search(key, sorted, 5, 4, 4, &exactmatch);
   CHECK(exactmatch != 0);
   CHECK_PTR(found, sorted[2]);
 }
@@ -36,9 +36,9 @@ static void case_search_finds_first_and_last(void) {
   int                 exactmatch;
 
   test_case("the first and last members are found");
-  CHECK_PTR(binary_search(first, sorted, 5, 4, 4, &exactmatch), sorted[0]);
+  CHECK_PTR(vector_binary_search(first, sorted, 5, 4, 4, &exactmatch), sorted[0]);
   CHECK(exactmatch != 0);
-  CHECK_PTR(binary_search(last, sorted, 5, 4, 4, &exactmatch), sorted[4]);
+  CHECK_PTR(vector_binary_search(last, sorted, 5, 4, 4, &exactmatch), sorted[4]);
   CHECK(exactmatch != 0);
 }
 
@@ -49,11 +49,11 @@ static void case_search_insert_position(void) {
   void               *slot;
 
   test_case("a missing key yields its insert position");
-  slot = binary_search(middle, sorted, 5, 4, 4, &exactmatch);
+  slot = vector_binary_search(middle, sorted, 5, 4, 4, &exactmatch);
   CHECK_INT(exactmatch, 0);
   CHECK_PTR(slot, sorted[2]);
 
-  slot = binary_search(before, sorted, 5, 4, 4, &exactmatch);
+  slot = vector_binary_search(before, sorted, 5, 4, 4, &exactmatch);
   CHECK_INT(exactmatch, 0);
   CHECK_PTR(slot, sorted[0]);
 }
@@ -64,7 +64,7 @@ static void case_search_past_the_end(void) {
   void               *slot;
 
   test_case("a key above every member yields the position past the end");
-  slot = binary_search(beyond, sorted, 5, 4, 4, &exactmatch);
+  slot = vector_binary_search(beyond, sorted, 5, 4, 4, &exactmatch);
   CHECK_INT(exactmatch, 0);
   CHECK_PTR(slot, sorted[5]);
 }
@@ -74,7 +74,7 @@ static void case_search_empty(void) {
   void *base = (void *)sorted;
 
   test_case("searching an empty vector reports no match at the base");
-  CHECK_PTR(binary_search(sorted[0], base, 0, 4, 4, &exactmatch), base);
+  CHECK_PTR(vector_binary_search(sorted[0], base, 0, 4, 4, &exactmatch), base);
   CHECK_INT(exactmatch, 0);
 }
 
@@ -112,6 +112,51 @@ static void case_insert_keeps_order(void) {
   free(vector.data);
 }
 
+/* The peer variant is reached with an empty vector on every first announce
+   for a torrent, and again whenever a swarm empties and refills, because
+   vector_fixup_peers drops the allocation and nulls the data pointer. */
+
+static void case_insert_peer_into_empty_vector(void) {
+  ot_vector vector = {NULL, 0, 0};
+  ot_peer6  low, high;
+  int       exactmatch;
+  ot_peer  *slot;
+
+  memset(low, 0x11, sizeof(low));
+  memset(high, 0x99, sizeof(high));
+
+  test_case("the first peer goes into a vector that has no allocation yet");
+  slot = vector_find_or_insert_peer(&vector, low, OT_PEER_SIZE6, &exactmatch);
+  CHECK(slot != NULL);
+  CHECK_INT(exactmatch, 0);
+  memcpy(slot, low, OT_PEER_SIZE6);
+  CHECK_INT(vector.size, 1);
+  CHECK_INT(vector.space, OT_VECTOR_MIN_MEMBERS);
+  CHECK_PTR(slot, vector.data);
+
+  test_case("a second peer keeps the order");
+  slot = vector_find_or_insert_peer(&vector, high, OT_PEER_SIZE6, &exactmatch);
+  CHECK(slot != NULL);
+  CHECK_INT(exactmatch, 0);
+  memcpy(slot, high, OT_PEER_SIZE6);
+  CHECK_INT(vector.size, 2);
+  CHECK_MEM((char *)vector.data, low, OT_PEER_COMPARE_SIZE6);
+  CHECK_MEM((char *)vector.data + OT_PEER_SIZE6, high, OT_PEER_COMPARE_SIZE6);
+
+  test_case("and emptying the vector hands the allocation back");
+  CHECK(vector_remove_peer(&vector, low, OT_PEER_SIZE6) != 0);
+  CHECK(vector_remove_peer(&vector, high, OT_PEER_SIZE6) != 0);
+  CHECK_INT(vector.size, 0);
+  CHECK_PTR(vector.data, NULL);
+
+  test_case("so the next peer starts from no allocation again");
+  slot = vector_find_or_insert_peer(&vector, low, OT_PEER_SIZE6, &exactmatch);
+  CHECK(slot != NULL);
+  CHECK_INT(vector.size, 1);
+
+  free(vector.data);
+}
+
 static void case_insert_finds_existing(void) {
   ot_vector           vector = {NULL, 0, 0};
   const unsigned char five[4] = {0, 0, 0, 5};
@@ -257,6 +302,7 @@ void test_vector(void) {
   case_search_past_the_end();
   case_search_empty();
   case_insert_keeps_order();
+  case_insert_peer_into_empty_vector();
   case_insert_finds_existing();
   case_insert_compare_prefix();
   case_redistribute_holds_every_peer();
diff --git a/tests/test.h b/tests/test.h
index fd574c2..0eddc82 100644
--- a/tests/test.h
+++ b/tests/test.h
@@ -76,7 +76,7 @@ extern unsigned long test_failures;
   } while (0)
 
 /* One entry point per module under test */
-void test_scan_urlencoded_query(void);
+void test_urlencoded(void);
 void test_iovec(void);
 void test_vector(void);
 void test_random(void);
@@ -88,5 +88,8 @@ void test_ip(void);
 void test_socket(void);
 void test_mutex(void);
 void test_batch(void);
+void test_fdstate(void);
+void test_event(void);
+void test_fmt(void);
 
 #endif