56 files changed, 2899 insertions, 624 deletions

diff --git a/Makefile b/Makefile
index 87c20e2..d16e220 100644
--- a/Makefile
+++ b/Makefile
@@ -47,10 +47,6 @@ include Makefile.gzip
 #FEATURES+=-DWANT_DEV_RANDOM
 FEATURES+=-DWANT_FULLSCRAPE
 
-# You need libowfat version 0.34 to allow for automatic release of chunks during
-# full scrape transfer, if you rely on an older versions, enable this flag
-#FEATURES+=-DWANT_NO_AUTO_FREE
-
 # opentracker takes its randomness from arc4random, which is part of libc on
 # the BSDs, on macOS and on glibc 2.36 and newer. On an older glibc or on musl
 # it comes from libbsd instead, so uncomment the next include to link it.
@@ -64,12 +60,17 @@ GIT_VERSION=`sh -c 'command -v git >/dev/null && test -d .git && git rev-parse H
 OPTS_debug=-D_DEBUG -g -ggdb # -pg -fprofile-arcs -ftest-coverage
 OPTS_production=-O3
 
-CFLAGS+=-I$(LIBOWFAT_HEADERS) -DGIT_VERSION=$(GIT_VERSION) -Wall -pipe -pthread -Wextra -Wwrite-strings #-ansi -pedantic
-LDFLAGS+=-L$(LIBOWFAT_LIBRARY) -lowfat -pthread
+CFLAGS+=-DGIT_VERSION=$(GIT_VERSION) -Wall -pipe -pthread -Wextra -Wwrite-strings #-ansi -pedantic
+LDFLAGS+=-pthread
+
+# Only the proxy, which has not been ported since the tracker went dual stack,
+# still wants libowfat.
+CFLAGS_libowfat=-I$(LIBOWFAT_HEADERS)
+LDFLAGS_libowfat=-L$(LIBOWFAT_LIBRARY) -lowfat
 
 BINARY =opentracker
-HEADERS=trackerlogic.h scan_urlencoded_query.h ot_batch.h ot_buf.h ot_fdstate.h ot_hex.h ot_ip.h ot_config.h ot_scan.h ot_socket.h ot_mutex.h ot_random.h ot_stats.h ot_vector.h ot_clean.h ot_udp.h ot_iovec.h ot_fullscrape.h ot_accesslist.h ot_http.h ot_livesync.h ot_rijndael.h
-SOURCES=opentracker.c trackerlogic.c scan_urlencoded_query.c ot_batch.c ot_buf.c ot_fdstate.c ot_hex.c ot_ip.c ot_config.c ot_scan.c ot_socket.c ot_mutex.c ot_random.c ot_stats.c ot_vector.c ot_clean.c ot_udp.c ot_iovec.c ot_fullscrape.c ot_accesslist.c ot_http.c ot_livesync.c ot_rijndael.c
+HEADERS=trackerlogic.h ot_urlencoded.h ot_batch.h ot_buf.h ot_event.h ot_fdstate.h ot_fmt.h ot_hex.h ot_ip.h ot_config.h ot_scan.h ot_socket.h ot_mutex.h ot_random.h ot_stats.h ot_vector.h ot_clean.h ot_udp.h ot_iovec.h ot_fullscrape.h ot_accesslist.h ot_http.h ot_livesync.h ot_rijndael.h
+SOURCES=opentracker.c trackerlogic.c ot_urlencoded.c ot_batch.c ot_buf.c ot_event.c ot_fdstate.c ot_fmt.c ot_hex.c ot_ip.c ot_config.c ot_scan.c ot_socket.c ot_mutex.c ot_random.c ot_stats.c ot_vector.c ot_clean.c ot_udp.c ot_iovec.c ot_fullscrape.c ot_accesslist.c ot_http.c ot_livesync.c ot_rijndael.c
 SOURCES_proxy=proxy.c ot_batch.c ot_fdstate.c ot_vector.c ot_mutex.c ot_random.c ot_scan.c ot_ip.c ot_socket.c
 
 OBJECTS = $(SOURCES:%.c=%.o)
@@ -84,8 +85,8 @@ all: $(BINARY) $(BINARY).debug
 CFLAGS_production = $(CFLAGS) $(OPTS_production) $(FEATURES)
 CFLAGS_debug = $(CFLAGS) $(OPTS_debug) $(FEATURES)
 
-CFLAGS_proxy = $(CFLAGS_production) -DWANT_SYNC_LIVE
-CFLAGS_proxy_debug = $(CFLAGS_debug) -DWANT_SYNC_LIVE
+CFLAGS_proxy = $(CFLAGS_production) $(CFLAGS_libowfat) -DWANT_SYNC_LIVE
+CFLAGS_proxy_debug = $(CFLAGS_debug) $(CFLAGS_libowfat) -DWANT_SYNC_LIVE
 
 $(BINARY): $(OBJECTS)
         $(CC) -o $@ $(OBJECTS) $(LDFLAGS)
@@ -93,9 +94,9 @@ $(BINARY): $(OBJECTS)
 $(BINARY).debug: $(OBJECTS_debug)
         $(CC) -o $@ $(OBJECTS_debug) $(LDFLAGS)
 proxy: $(OBJECTS_proxy)
-        $(CC) -o $@ $(OBJECTS_proxy) $(CFLAGS_production) $(LDFLAGS)
+        $(CC) -o $@ $(OBJECTS_proxy) $(CFLAGS_production) $(LDFLAGS) $(LDFLAGS_libowfat)
 proxy.debug: $(OBJECTS_proxy_debug)
-        $(CC) -o $@ $(OBJECTS_proxy_debug) $(LDFLAGS)
+        $(CC) -o $@ $(OBJECTS_proxy_debug) $(LDFLAGS) $(LDFLAGS_libowfat)
 
 $(OBJECTS): $(HEADERS)
 $(OBJECTS_debug): $(HEADERS)
@@ -119,8 +120,8 @@ $(OBJECTS_proxy_debug): $(HEADERS)
 # has to. tests/stubs.c supplies the few symbols those modules reference but
 # the tests never reach.
 TESTBIN=tests/runner
-TEST_SOURCES=tests/runner.c tests/test.c tests/stubs.c tests/t_scan_urlencoded_query.c tests/t_iovec.c tests/t_vector.c tests/t_random.c tests/t_hex.c tests/t_accesslist.c tests/t_scan.c tests/t_buf.c tests/t_ip.c tests/t_socket.c tests/t_mutex.c tests/t_batch.c tests/t_fdstate.c
-TEST_UNITS=scan_urlencoded_query.c ot_batch.c ot_fdstate.c ot_buf.c ot_ip.c ot_socket.c ot_iovec.c ot_vector.c ot_random.c ot_hex.c ot_scan.c ot_accesslist.c ot_mutex.c
+TEST_SOURCES=tests/runner.c tests/test.c tests/stubs.c tests/t_urlencoded.c tests/t_iovec.c tests/t_vector.c tests/t_random.c tests/t_hex.c tests/t_accesslist.c tests/t_scan.c tests/t_buf.c tests/t_ip.c tests/t_socket.c tests/t_mutex.c tests/t_batch.c tests/t_fdstate.c tests/t_event.c tests/t_fmt.c
+TEST_UNITS=ot_urlencoded.c ot_fmt.c ot_event.c ot_batch.c ot_fdstate.c ot_buf.c ot_ip.c ot_socket.c ot_iovec.c ot_vector.c ot_random.c ot_hex.c ot_scan.c ot_accesslist.c ot_mutex.c
 TEST_HEADERS=tests/test.h $(HEADERS)
 # Tests reach code that sits behind feature flags, so the units under test are
 # built with those features enabled. A test binary is not a production binary.
@@ -133,10 +134,46 @@ $(TESTBIN): $(TEST_SOURCES) $(TEST_UNITS) $(TEST_HEADERS)
 check: $(TESTBIN) $(BINARY)
         ./$(TESTBIN)
 
-.PHONY: all check clean install
+# The same unit tests under the sanitizers. Use clang over $(CC) because the
+# two toolchains do not check the same things
+# Override CC_sanitize to use another compiler.
+CC_sanitize?=clang
+CFLAGS_sanitize=$(CFLAGS_test) -fsanitize=address,undefined -fno-omit-frame-pointer
+LDFLAGS_sanitize=$(LDFLAGS) -fsanitize=address,undefined
+
+$(TESTBIN).sanitize: $(TEST_SOURCES) $(TEST_UNITS) $(TEST_HEADERS)
+        $(CC_sanitize) -o $@ $(CFLAGS_sanitize) $(TEST_SOURCES) $(TEST_UNITS) $(LDFLAGS_sanitize)
+
+check-sanitize: $(TESTBIN).sanitize
+        ./$(TESTBIN).sanitize
+
+# Black box tests: these drive the real binary over the wire, so they cover
+# the event loop and the parsers working together, which the unit tests
+# cannot reach. Built with the sanitizers on, so the tracker reports its own
+# memory errors and the harness turns those into failures.
+PYTHON?=python3
+FEATURES_integration=$(FEATURES) -DWANT_IP_FROM_QUERY_STRING -DWANT_ACCESSLIST_BLACK -DWANT_KEEPALIVE
+CFLAGS_integration=$(CFLAGS) $(OPTS_debug) $(FEATURES_integration) -fsanitize=address,undefined -fno-omit-frame-pointer
+LDFLAGS_integration=$(LDFLAGS) -fsanitize=address,undefined
+
+opentracker.integration: $(SOURCES) $(HEADERS)
+        $(CC) -o $@ $(CFLAGS_integration) $(SOURCES) $(LDFLAGS_integration)
+
+check-integration: opentracker.integration
+        OPENTRACKER=./opentracker.integration $(PYTHON) -m unittest discover -s tests/integration
+
+# Everything, cheapest first, so a quick failure comes back quickly.
+check-all:
+        $(MAKE) check
+        $(MAKE) check-sanitize
+        $(MAKE) check-integration
+
+.PHONY: all check check-sanitize check-integration check-all clean install
+
+BINARIES=opentracker opentracker.debug opentracker.integration proxy proxy.debug $(TESTBIN) $(TESTBIN).sanitize
 
 clean:
-        rm -rf opentracker opentracker.debug proxy proxy.debug $(TESTBIN) *.o *~
+        rm -rf $(BINARIES) $(BINARIES:=.dSYM) *.o *~
 
 install:
         install -m 755 opentracker $(DESTDIR)$(BINDIR)
diff --git a/opentracker.c b/opentracker.c
index 0f0b314..11da486 100644
--- a/opentracker.c
+++ b/opentracker.c
@@ -21,9 +21,6 @@
 #include <syslog.h>
 #endif
 
-/* Libowfat */
-#include "io.h"
-
 /* Opentracker */
 #include "ot_accesslist.h"
 #include "ot_config.h"
@@ -34,6 +31,7 @@
 #include "ot_mutex.h"
 #include "ot_random.h"
 #include "ot_scan.h"
+#include "ot_event.h"
 #include "ot_fdstate.h"
 #include "ot_socket.h"
 #include "ot_stats.h"
@@ -130,14 +128,15 @@ static void handle_dead(const int64_t sock) {
   }
   /* The generation has to move before the kernel can reissue the number */
   fdstate_close(sock);
-  io_close(sock);
+  event_del((int)sock);
+  close((int)sock);
 }
 
 static void handle_read(const int64_t sock, struct ot_workstruct *ws) {
   struct http_data *cookie     = fdstate_cookie(sock);
-  ssize_t           byte_count = io_tryread(sock, ws->inbuf, G_INBUF_SIZE);
+  ssize_t           byte_count = read((int)sock, ws->inbuf, G_INBUF_SIZE);
 
-  if (byte_count == 0 || byte_count == -3) {
+  if (byte_count == 0 || (byte_count == -1 && errno != EAGAIN && errno != EWOULDBLOCK && errno != EINTR)) {
     handle_dead(sock);
     return;
   }
@@ -178,12 +177,13 @@ static void handle_read(const int64_t sock, struct ot_workstruct *ws) {
 }
 
 static void handle_write(const int64_t sock) {
-  struct http_data *cookie = fdstate_cookie(sock);
-  int               chunked = 0;
+  struct http_data *cookie     = fdstate_cookie(sock);
+  int               chunked    = 0;
+  int               keep_alive = 0;
 
   if (cookie) {
-    if (cookie->flag & STRUCT_HTTP_FLAG_CHUNKED_IN_TRANSFER)
-      chunked = 1;
+    chunked    = (cookie->flag & STRUCT_HTTP_FLAG_CHUNKED_IN_TRANSFER) != 0;
+    keep_alive = (cookie->flag & STRUCT_HTTP_FLAG_KEEPALIVE) != 0;
 
     if (cookie->batch) {
       if (batch_send(sock, cookie->batch) == BATCH_FAILED) {
@@ -197,8 +197,14 @@ static void handle_write(const int64_t sock) {
 
   /* In a chunked transfer, wait for the next piece once everything queued has gone out */
   if (chunked)
-    io_dontwantwrite(sock);
-  else
+    http_interest_drop(sock, cookie, EVENT_OUT);
+  else if (keep_alive) {
+    /* The reply is out and the client asked to keep the connection, so stop
+       waiting to write and go back to waiting for the next request */
+    http_interest_drop(sock, cookie, EVENT_OUT);
+    http_interest_add(sock, cookie, EVENT_IN);
+    fdstate_set_expiry(sock, g_now_seconds + OT_CLIENT_TIMEOUT);
+  } else
     handle_dead(sock);
 }
 
@@ -210,25 +216,30 @@ static void handle_accept(const int64_t serversocket) {
 
   while ((sock = socket_accept(serversocket, ip, &port)) != -1) {
 
-    /* Put fd into a non-blocking mode */
-    io_nonblock(sock);
+    socket_set_blocking((int)sock, 0);
 
-    if (!io_fd(sock) || !(cookie = (struct http_data *)malloc(sizeof(struct http_data)))) {
-      io_close(sock);
+    if (!(cookie = (struct http_data *)malloc(sizeof(struct http_data)))) {
+      close((int)sock);
       continue;
     }
     memset(cookie, 0, sizeof(struct http_data));
     memcpy(cookie->ip, ip, sizeof(ot_ip6));
+    cookie->interest = EVENT_IN;
 
-    fdstate_open(sock, cookie, g_now_seconds + OT_CLIENT_TIMEOUT);
-    io_wantread(sock);
+    if (event_add((int)sock, EVENT_IN, fdstate_open(sock, cookie, g_now_seconds + OT_CLIENT_TIMEOUT)) == -1) {
+      fdstate_close(sock);
+      free(cookie);
+      close((int)sock);
+      continue;
+    }
 
     stats_issue_event(EVENT_ACCEPT, FLAG_TCP, (uintptr_t)ip);
-
   }
-  io_eagain(serversocket);
 }
 
+/* How many ready descriptors one wait hands back at a time */
+#define OT_EVENT_BATCH 512
+
 static void *server_mainloop(void *args) {
   struct ot_workstruct ws;
   time_t               next_timeout_check = g_now_seconds + OT_CLIENT_TIMEOUT_CHECKINTERVAL;
@@ -251,28 +262,42 @@ static void *server_mainloop(void *args) {
   random_bytes(ws.rand48_state, sizeof(ws.rand48_state));
 
   for (;;) {
-    int64_t sock;
+    ot_event ready[OT_EVENT_BATCH];
+    int64_t  sock;
+    int      count, i;
+
+    count = event_wait(ready, OT_EVENT_BATCH, OT_CLIENT_TIMEOUT_CHECKINTERVAL * 1000);
+
+    for (i = 0; i < count; ++i) {
+      const void *cookie;
 
-    io_wait();
+      sock = ready[i].fd;
+      /* A descriptor closed earlier in this same batch may already have been
+         handed out again by accept, so an event is only ours if the
+         generation it was registered under is still the one in place */
+      if (fdstate_generation((int)sock) != ready[i].generation)
+        continue;
+      cookie = fdstate_cookie((int)sock);
 
-    while ((sock = io_canread()) != -1) {
-      const void *cookie = fdstate_cookie(sock);
       if ((intptr_t)cookie == FLAG_TCP)
         handle_accept(sock);
       else if ((intptr_t)cookie == FLAG_UDP)
         handle_udp6(sock, &ws);
       else if ((intptr_t)cookie == FLAG_SELFPIPE)
-        io_tryread(sock, ws.inbuf, G_INBUF_SIZE);
-      else
-        handle_read(sock, &ws);
+        while (read((int)sock, ws.inbuf, G_INBUF_SIZE) > 0)
+          ;
+      else {
+        if (ready[i].what & EVENT_IN)
+          handle_read(sock, &ws);
+        /* The read may have closed it, so look again before writing */
+        if ((ready[i].what & EVENT_OUT) && fdstate_generation((int)sock) == ready[i].generation)
+          handle_write(sock);
+      }
     }
 
     while ((sock = mutex_workqueue_popresult(&iovec_entries, &iovector, &is_partial)) != -1)
       http_sendiovecdata(sock, &ws, iovec_entries, iovector, is_partial);
 
-    while ((sock = io_canwrite()) != -1)
-      handle_write(sock);
-
     if (g_now_seconds > next_timeout_check) {
       int cursor = 0;
 
@@ -319,11 +344,8 @@ static void listen_bind_one(ot_listen *entry) {
       panic("socket_udp_bind");
   }
 
-  if (!io_fd(entry->sock))
-    panic("io_fd");
-
-  fdstate_open(entry->sock, (void *)entry->proto, 0);
-  io_wantread(entry->sock);
+  if (event_add((int)entry->sock, EVENT_IN, fdstate_open(entry->sock, (void *)entry->proto, 0)) == -1)
+    panic("event_add");
 
 #ifdef _DEBUG
   fputs(" success.\n", stderr);
@@ -352,7 +374,8 @@ static void listen_start_udp_workers(void) {
     if (entry->proto != FLAG_UDP || entry->workers <= 0)
       continue;
 
-    io_block(entry->sock);
+    socket_set_blocking((int)entry->sock, 1);
+    event_del((int)entry->sock);
     udp_workers_install(entry->sock, (unsigned int)entry->workers);
   }
 }
@@ -375,14 +398,14 @@ void load_state(const char *const state_filename) {
   while (fgets(inbuf, sizeof(inbuf), state_filehandle)) {
     size_t i;
 
-    if (!hex_tohash(infohash, inbuf))
+    if (!hex_to_hash(infohash, inbuf))
       continue;
     i = 2 * sizeof(ot_hash);
 
-    if (inbuf[i++] != ':' || !(consumed = scan_udec(inbuf + i, &base, UINT64_MAX)))
+    if (inbuf[i++] != ':' || !(consumed = scan_uint(inbuf + i, &base, UINT64_MAX)))
       continue;
     i += consumed;
-    if (inbuf[i++] != ':' || !(consumed = scan_udec(inbuf + i, &downcount, UINT64_MAX)))
+    if (inbuf[i++] != ':' || !(consumed = scan_uint(inbuf + i, &downcount, UINT64_MAX)))
       continue;
     add_torrent_from_saved_state(infohash, base, downcount);
   }
@@ -453,6 +476,8 @@ int main(int argc, char **argv) {
   random_init();
   if (fdstate_init() == -1)
     panic("fdstate_init");
+  if (event_init() == -1)
+    panic("event_init");
   config_parse(argc, argv);
 
   listen_bind_all();
@@ -471,15 +496,15 @@ int main(int argc, char **argv) {
   pthread_create(&thread_id, NULL, time_caching_worker, NULL);
 
   /* Create our self pipe which allows us to interrupt mainloops
-     io_wait in case some data is available to send out */
+     wait in case some data is available to send out */
   if (pipe(g_self_pipe) == -1)
     panic("selfpipe failed: ");
-  if (!io_fd(g_self_pipe[0]))
-    panic("selfpipe io_fd failed: ");
-  if (!io_fd(g_self_pipe[1]))
-    panic("selfpipe io_fd failed: ");
-  fdstate_open(g_self_pipe[0], (void *)FLAG_SELFPIPE, 0);
-  io_wantread(g_self_pipe[0]);
+  /* Both ends have to be non blocking: the loop drains the read end until it
+     is empty, and a worker nudging a full pipe has already made its point */
+  socket_set_blocking(g_self_pipe[0], 0);
+  socket_set_blocking(g_self_pipe[1], 0);
+  if (event_add(g_self_pipe[0], EVENT_IN, fdstate_open(g_self_pipe[0], (void *)FLAG_SELFPIPE, 0)) == -1)
+    panic("selfpipe event_add");
 
   /* Init all sub systems. This call may fail with an exit() */
   trackerlogic_init();
@@ -499,6 +524,7 @@ int main(int argc, char **argv) {
 
   server_mainloop(0);
 
+  event_deinit();
   fdstate_deinit();
   return 0;
 }
diff --git a/ot_accesslist.c b/ot_accesslist.c
index ef845d6..4bf1701 100644
--- a/ot_accesslist.c
+++ b/ot_accesslist.c
@@ -21,8 +21,6 @@
 #include <errno.h>
 #endif
 
-/* Libowfat */
-
 /* Opentracker */
 #include "ot_accesslist.h"
 #include "ot_hex.h"
@@ -110,7 +108,7 @@ size_t accesslist_parse_hashes(ot_hash *dest, size_t capacity, const char *buf,
   size_t      count = 0;
 
   while (count < capacity && end - offs >= 40) {
-    if (hex_tohash(dest[count], offs)) {
+    if (hex_to_hash(dest[count], offs)) {
       offs += 40;
 
       if (offs == end || !hex_isdigit((unsigned char)*offs))
@@ -162,6 +160,9 @@ static void accesslist_readfile(void) {
   const char    *map;
   size_t         maplen, capacity, found;
 
+  if (!g_accesslist_filename)
+    return;
+
   if (accesslist_map(g_accesslist_filename, &map, &maplen) < 0) {
     char *wd = getcwd(NULL, 0);
     fprintf(stderr, "Warning: Can't open accesslist file: %s (but will try to create it later, if necessary and possible).\nPWD: %s\n", g_accesslist_filename, wd);
@@ -187,7 +188,8 @@ static void accesslist_readfile(void) {
   if (map)
     munmap((void *)map, maplen);
 
-  qsort(accesslist_new->list, found, sizeof(ot_hash), vector_compare_hash);
+  if (found)
+    qsort(accesslist_new->list, found, sizeof(ot_hash), vector_compare_hash);
   accesslist_new->size = found;
 
   /* Now exchange the accesslist vector in the least race condition prone way */
@@ -225,18 +227,18 @@ int accesslist_hashisvalid(const ot_hash hash) {
 #endif
   void *exactmatch = NULL;
 
-  if (accesslist)
+  if (accesslist && accesslist->size)
     exactmatch = bsearch(hash, accesslist->list, accesslist->size, OT_HASH_COMPARE_SIZE, vector_compare_hash);
 
 #ifdef WANT_DYNAMIC_ACCESSLIST
   /* If we had no match on the main list, scan the list of dynamically added hashes */
   accesslist_add = g_accesslist_add;
-  if ((exactmatch == NULL) && accesslist_add)
+  if ((exactmatch == NULL) && accesslist_add && accesslist_add->size)
     exactmatch = bsearch(hash, accesslist_add->list, accesslist_add->size, OT_HASH_COMPARE_SIZE, vector_compare_hash);
 
   /* If we found a matching hash on the main list, scan the list of dynamically deleted hashes */
   accesslist_delete = g_accesslist_delete;
-  if ((exactmatch != NULL) && accesslist_delete && bsearch(hash, accesslist_delete->list, accesslist_delete->size, OT_HASH_COMPARE_SIZE, vector_compare_hash))
+  if ((exactmatch != NULL) && accesslist_delete && accesslist_delete->size && bsearch(hash, accesslist_delete->list, accesslist_delete->size, OT_HASH_COMPARE_SIZE, vector_compare_hash))
     exactmatch = NULL;
 #endif
 
@@ -308,7 +310,7 @@ static void     *accesslist_adddel_worker(const char *fifoname, ot_accesslist *_
       if (linelen < 41)
         continue;
 
-      if (!hex_tohash(info_hash, line))
+      if (!hex_to_hash(info_hash, line))
         continue;
 
       /* From now on we modify g_accesslist_add and g_accesslist_delete, so prevent the
@@ -386,8 +388,9 @@ void accesslist_init(void) {
 }
 
 void accesslist_deinit(void) {
-  /* Wake up sleeping worker */
+  /* Wake the worker and wait for it to notice that the tracker is stopping. */
   pthread_kill(thread_id, SIGHUP);
+  pthread_join(thread_id, NULL);
 
   pthread_mutex_lock(&g_accesslist_mutex);
 
@@ -399,7 +402,6 @@ void accesslist_deinit(void) {
 #endif
 
   pthread_mutex_unlock(&g_accesslist_mutex);
-  pthread_cancel(thread_id);
   pthread_mutex_destroy(&g_accesslist_mutex);
 }
 
diff --git a/ot_clean.c b/ot_clean.c
index 825290d..bf0504c 100644
--- a/ot_clean.c
+++ b/ot_clean.c
@@ -8,9 +8,6 @@
 #include <string.h>
 #include <unistd.h>
 
-/* Libowfat */
-#include "io.h"
-
 /* Opentracker */
 #include "ot_accesslist.h"
 #include "ot_clean.h"
diff --git a/ot_config.c b/ot_config.c
index a5fc06e..ee6bc12 100644
--- a/ot_config.c
+++ b/ot_config.c
@@ -107,7 +107,7 @@ static int listen_scan_options(char *p, int *shared, int *workers) {
       *shared = 1;
       break;
     case LISTEN_OPTION_WORKERS: {
-      size_t off = scan_udec(p, &value, UINT_MAX);
+      size_t off = scan_uint(p, &value, UINT_MAX);
 
       if (!off)
         return 0;
@@ -140,7 +140,7 @@ static int scan_ip6_port(const char *src, ot_ip6 ip, uint16_t *port) {
     ++s;
   if (*s == '[')
     ++s, ++bracket; /* for v6 style notation */
-  if (!(off = ip_scan(s, ip)))
+  if (!(off = ip_parse(s, ip)))
     return 0;
   s += off;
   if (bracket && *s == ']')
@@ -157,7 +157,7 @@ static int scan_ip6_port(const char *src, ot_ip6 ip, uint16_t *port) {
     if (*(s++) != ':')
       return 0;
   }
-  if (!(off = scan_udec(s, &value, 65535)))
+  if (!(off = scan_uint(s, &value, 65535)))
     return 0;
   *port = (uint16_t)value;
   return off + s - src;
@@ -169,14 +169,14 @@ static int scan_ip6_net(const char *src, ot_net *net) {
   int         off;
   while (isspace(*s))
     ++s;
-  if (!(off = ip_scan(s, net->address)))
+  if (!(off = ip_parse(s, net->address)))
     return 0;
   s += off;
   if (*s != '/')
     net->bits = 128;
   else {
     s++;
-    if (!(off = scan_udec(s, &value, 128)))
+    if (!(off = scan_uint(s, &value, 128)))
       return 0;
     net->bits = (int)value;
     if (ip_is_v4mapped(net->address))
@@ -324,12 +324,12 @@ static int parse_configfile(char *config_filename) {
         break;
       }
       case CONFIG_LISTEN_UDP_WORKERS:
-        if (!scan_udec(p, &value, UINT_MAX))
+        if (!scan_uint(p, &value, UINT_MAX))
           goto parse_error;
         g_listen_workers = (int)value;
         break;
       case CONFIG_LISTEN_SHARED:
-        if (!scan_udec(p, &value, 1))
+        if (!scan_uint(p, &value, 1))
           goto parse_error;
         g_listen_shared = (int)value;
         break;
@@ -479,7 +479,7 @@ void config_parse(int argc, char **argv) {
       scanon = 0;
       break;
     case 'i':
-      if (!ip_scan(optarg, serverip)) {
+      if (!ip_parse(optarg, serverip)) {
         usage(argv[0]);
         exit(1);
       }
@@ -494,7 +494,7 @@ void config_parse(int argc, char **argv) {
       break;
 #endif
     case 'p':
-      if (!scan_udec(optarg, &value, 65535)) {
+      if (!scan_uint(optarg, &value, 65535)) {
         usage(argv[0]);
         exit(1);
       }
@@ -502,7 +502,7 @@ void config_parse(int argc, char **argv) {
       bound++;
       break;
     case 'P':
-      if (!scan_udec(optarg, &value, 65535)) {
+      if (!scan_uint(optarg, &value, 65535)) {
         usage(argv[0]);
         exit(1);
       }
@@ -511,7 +511,7 @@ void config_parse(int argc, char **argv) {
       break;
 #ifdef WANT_SYNC_LIVE
     case 's':
-      if (!scan_udec(optarg, &value, 65535)) {
+      if (!scan_uint(optarg, &value, 65535)) {
         usage(argv[0]);
         exit(1);
       }
@@ -544,8 +544,11 @@ void config_parse(int argc, char **argv) {
       help(argv[0]);
       exit(0);
     case 'v': {
-      char buffer[8192];
-      stats_return_tracker_version(buffer);
+      char  buffer[8192];
+      char *cursor = buffer;
+
+      stats_return_tracker_version(&cursor, buffer + sizeof(buffer) - 1);
+      *cursor = 0;
       fputs(buffer, stderr);
       exit(0);
     }
diff --git a/ot_event.c b/ot_event.c
new file mode 100644
index 0000000..ce0feef
--- /dev/null
+++ b/ot_event.c
@@ -0,0 +1,332 @@
+/* This software was written by Dirk Engling <erdgeist@erdgeist.org>
+   It is considered beerware. Prost. Skol. Cheers or whatever.
+
+   $id$ */
+
+/* System */
+#include <errno.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+
+/* Opentracker */
+#include "ot_event.h"
+
+/* One caller waits, so the scratch the mechanism needs is kept here rather
+   than allocated per call. */
+
+/* poll works everywhere and is what the BSDs get until kqueue is written.
+   Defining OT_EVENT_FORCE_POLL picks it on a platform that would otherwise
+   use something better, which is how both are exercised by the tests. */
+#if defined(OT_EVENT_FORCE_POLL)
+#define OT_EVENT_POLL
+#elif defined(OT_EVENT_FORCE_KQUEUE)
+#define OT_EVENT_KQUEUE
+#elif defined(__linux__)
+#define OT_EVENT_EPOLL
+#elif defined(__FreeBSD__) || defined(__OpenBSD__) || defined(__NetBSD__) || defined(__DragonFly__) || defined(__APPLE__)
+#define OT_EVENT_KQUEUE
+#else
+#define OT_EVENT_POLL
+#endif
+
+#ifdef OT_EVENT_EPOLL
+/* ------------------------------------------------------------- epoll */
+
+#include <sys/epoll.h>
+
+static int                 g_epoll = -1;
+static struct epoll_event *g_ready;
+static int                 g_ready_space;
+
+const char *event_mechanism(void) { return "epoll"; }
+
+int event_init(void) {
+  g_ready       = NULL;
+  g_ready_space = 0;
+  return (g_epoll = epoll_create1(EPOLL_CLOEXEC)) == -1 ? -1 : 0;
+}
+
+void event_deinit(void) {
+  if (g_epoll != -1)
+    close(g_epoll);
+  free(g_ready);
+  g_epoll       = -1;
+  g_ready       = NULL;
+  g_ready_space = 0;
+}
+
+static int event_ctl(int op, int fd, int what, uint32_t generation) {
+  struct epoll_event ev;
+
+  memset(&ev, 0, sizeof(ev));
+  ev.events = (what & EVENT_IN ? (uint32_t)EPOLLIN : 0) | (what & EVENT_OUT ? (uint32_t)EPOLLOUT : 0);
+  /* The generation rides along inside the kernel, so an event says which
+     connection it belongs to without anybody looking it up */
+  ev.data.u64 = ((uint64_t)generation << 32) | (uint32_t)fd;
+  return epoll_ctl(g_epoll, op, fd, &ev);
+}
+
+int event_add(int fd, int what, uint32_t generation) { return event_ctl(EPOLL_CTL_ADD, fd, what, generation); }
+int event_modify(int fd, int what, uint32_t generation) { return event_ctl(EPOLL_CTL_MOD, fd, what, generation); }
+int event_del(int fd) { return epoll_ctl(g_epoll, EPOLL_CTL_DEL, fd, NULL); }
+
+int event_wait(ot_event *out, int max, int timeout_ms) {
+  int count, i;
+
+  if (max > g_ready_space) {
+    struct epoll_event *grown = realloc(g_ready, (size_t)max * sizeof(struct epoll_event));
+
+    if (!grown)
+      return -1;
+    g_ready       = grown;
+    g_ready_space = max;
+  }
+
+  while ((count = epoll_wait(g_epoll, g_ready, max, timeout_ms)) == -1 && errno == EINTR)
+    ;
+  for (i = 0; i < count; ++i) {
+    uint32_t events = g_ready[i].events;
+
+    out[i].fd         = (int)(uint32_t)g_ready[i].data.u64;
+    out[i].generation = (uint32_t)(g_ready[i].data.u64 >> 32);
+    /* A hangup or an error is reported as both, so whichever side the caller
+       was waiting on gets to notice */
+    out[i].what = (events & (EPOLLIN | EPOLLHUP | EPOLLERR) ? EVENT_IN : 0) |
+                  (events & (EPOLLOUT | EPOLLHUP | EPOLLERR) ? EVENT_OUT : 0);
+  }
+  return count;
+}
+
+#endif /* OT_EVENT_EPOLL */
+
+#ifdef OT_EVENT_KQUEUE
+/* ------------------------------------------------------------ kqueue */
+
+#include <sys/event.h>
+#include <sys/time.h>
+#include <sys/types.h>
+
+static int            g_kqueue = -1;
+static struct kevent *g_ready;
+static int            g_ready_space;
+
+const char *event_mechanism(void) { return "kqueue"; }
+
+int event_init(void) {
+  g_ready       = NULL;
+  g_ready_space = 0;
+  return (g_kqueue = kqueue()) == -1 ? -1 : 0;
+}
+
+void event_deinit(void) {
+  if (g_kqueue != -1)
+    close(g_kqueue);
+  free(g_ready);
+  g_kqueue      = -1;
+  g_ready       = NULL;
+  g_ready_space = 0;
+}
+
+/* kqueue keeps one registration per filter, so reading and writing are two
+   entries. A change of interest is an add of the one wanted and a delete
+   of the one not. The generation travels in udata, which the kernel passes
+   back untouched. */
+static int event_change(int fd, int what, uint32_t generation, int deleting) {
+  struct kevent change[2], result[2];
+  void         *udata     = (void *)(uintptr_t)(((uint64_t)generation << 32) | (uint32_t)fd);
+  int           succeeded = 0, count, i;
+
+  EV_SET(&change[0], (uintptr_t)fd, EVFILT_READ,
+         EV_RECEIPT | ((deleting || !(what & EVENT_IN)) ? EV_DELETE : EV_ADD), 0, 0, udata);
+  EV_SET(&change[1], (uintptr_t)fd, EVFILT_WRITE,
+         EV_RECEIPT | ((deleting || !(what & EVENT_OUT)) ? EV_DELETE : EV_ADD), 0, 0, udata);
+
+  if ((count = kevent(g_kqueue, change, 2, result, 2, NULL)) == -1)
+    return -1;
+
+  for (i = 0; i < count && i < 2; ++i) {
+    if (!result[i].data) {
+      ++succeeded;
+      continue;
+    }
+    /* Dropping interest we never registered is not a failure */
+    if ((change[i].flags & EV_DELETE) && result[i].data == ENOENT)
+      continue;
+    errno = (int)result[i].data;
+    return -1;
+  }
+
+  /* Nothing at all was registered or removed, so the descriptor is unknown */
+  if (!succeeded) {
+    errno = ENOENT;
+    return -1;
+  }
+  return 0;
+}
+
+int event_add(int fd, int what, uint32_t generation) { return event_change(fd, what, generation, 0); }
+int event_modify(int fd, int what, uint32_t generation) { return event_change(fd, what, generation, 0); }
+int event_del(int fd) { return event_change(fd, 0, 0, 1); }
+
+int event_wait(ot_event *out, int max, int timeout_ms) {
+  struct timespec  timeout;
+  struct timespec *deadline = NULL;
+  int              count, i;
+
+  if (max > g_ready_space) {
+    struct kevent *grown = realloc(g_ready, (size_t)max * sizeof(struct kevent));
+
+    if (!grown)
+      return -1;
+    g_ready       = grown;
+    g_ready_space = max;
+  }
+
+  if (timeout_ms >= 0) {
+    timeout.tv_sec  = timeout_ms / 1000;
+    timeout.tv_nsec = (long)(timeout_ms % 1000) * 1000000;
+    deadline        = &timeout;
+  }
+
+  while ((count = kevent(g_kqueue, NULL, 0, g_ready, max, deadline)) == -1 && errno == EINTR)
+    ;
+  for (i = 0; i < count; ++i) {
+    uint64_t udata = (uint64_t)(uintptr_t)g_ready[i].udata;
+    int      eof   = (g_ready[i].flags & (EV_EOF | EV_ERROR)) != 0;
+
+    out[i].fd         = (int)(uint32_t)udata;
+    out[i].generation = (uint32_t)(udata >> 32);
+    out[i].what       = ((g_ready[i].filter == EVFILT_READ || eof) ? EVENT_IN : 0) |
+                  ((g_ready[i].filter == EVFILT_WRITE || eof) ? EVENT_OUT : 0);
+  }
+  return count;
+}
+
+#endif /* OT_EVENT_KQUEUE */
+
+#ifdef OT_EVENT_POLL
+/* -------------------------------------------------------------- poll */
+
+#include <poll.h>
+
+/* poll wants its descriptors packed, so the registered ones live in one
+   array and a second maps a descriptor number to its place in it. */
+static struct pollfd *g_pfds;
+static uint32_t      *g_generation;
+static int           *g_where;
+static int            g_count, g_space, g_where_space;
+
+const char *event_mechanism(void) { return "poll"; }
+
+int event_init(void) {
+  g_pfds = NULL, g_generation = NULL, g_where = NULL;
+  g_count = g_space = g_where_space = 0;
+  return 0;
+}
+
+void event_deinit(void) {
+  free(g_pfds), free(g_generation), free(g_where);
+  g_pfds = NULL, g_generation = NULL, g_where = NULL;
+  g_count = g_space = g_where_space = 0;
+}
+
+static short event_to_poll(int what) {
+  return (short)((what & EVENT_IN ? POLLIN : 0) | (what & EVENT_OUT ? POLLOUT : 0));
+}
+
+static int event_room_for(int fd) {
+  if (fd >= g_where_space) {
+    int  space = g_where_space ? g_where_space : 64;
+    int *grown;
+
+    while (space <= fd)
+      space *= 2;
+    if (!(grown = realloc(g_where, (size_t)space * sizeof(int))))
+      return -1;
+    while (g_where_space < space)
+      grown[g_where_space++] = -1;
+    g_where = grown;
+  }
+
+  if (g_count == g_space) {
+    int            space = g_space ? g_space * 2 : 64;
+    struct pollfd *pfds  = realloc(g_pfds, (size_t)space * sizeof(struct pollfd));
+    uint32_t      *gens;
+
+    if (!pfds)
+      return -1;
+    g_pfds = pfds;
+    if (!(gens = realloc(g_generation, (size_t)space * sizeof(uint32_t))))
+      return -1;
+    g_generation = gens;
+    g_space      = space;
+  }
+  return 0;
+}
+
+int event_add(int fd, int what, uint32_t generation) {
+  if (fd < 0 || event_room_for(fd) == -1)
+    return -1;
+  if (g_where[fd] != -1) {
+    errno = EEXIST;
+    return -1;
+  }
+
+  g_pfds[g_count].fd      = fd;
+  g_pfds[g_count].events  = event_to_poll(what);
+  g_pfds[g_count].revents = 0;
+  g_generation[g_count]   = generation;
+  g_where[fd]             = g_count++;
+  return 0;
+}
+
+int event_modify(int fd, int what, uint32_t generation) {
+  if (fd < 0 || fd >= g_where_space || g_where[fd] == -1) {
+    errno = ENOENT;
+    return -1;
+  }
+  g_pfds[g_where[fd]].events = event_to_poll(what);
+  g_generation[g_where[fd]]  = generation;
+  return 0;
+}
+
+int event_del(int fd) {
+  int at;
+
+  if (fd < 0 || fd >= g_where_space || (at = g_where[fd]) == -1) {
+    errno = ENOENT;
+    return -1;
+  }
+
+  /* The last one moves into the gap, so the array stays packed */
+  g_pfds[at]            = g_pfds[--g_count];
+  g_generation[at]      = g_generation[g_count];
+  g_where[g_pfds[at].fd] = at;
+  g_where[fd]            = -1;
+  return 0;
+}
+
+int event_wait(ot_event *out, int max, int timeout_ms) {
+  int ready, found = 0, i;
+
+  while ((ready = poll(g_pfds, (nfds_t)g_count, timeout_ms)) == -1 && errno == EINTR)
+    ;
+  if (ready <= 0)
+    return ready;
+
+  for (i = 0; i < g_count && found < max; ++i) {
+    short revents = g_pfds[i].revents;
+
+    if (!revents)
+      continue;
+    out[found].fd         = g_pfds[i].fd;
+    out[found].generation = g_generation[i];
+    out[found].what       = (revents & (POLLIN | POLLHUP | POLLERR | POLLNVAL) ? EVENT_IN : 0) |
+                      (revents & (POLLOUT | POLLHUP | POLLERR | POLLNVAL) ? EVENT_OUT : 0);
+    ++found;
+  }
+  return found;
+}
+
+#endif /* OT_EVENT_POLL */
diff --git a/ot_event.h b/ot_event.h
new file mode 100644
index 0000000..6023134
--- /dev/null
+++ b/ot_event.h
@@ -0,0 +1,39 @@
+/* This software was written by Dirk Engling <erdgeist@erdgeist.org>
+   It is considered beerware. Prost. Skol. Cheers or whatever.
+
+   $id$ */
+
+#ifndef OT_EVENT_H__
+#define OT_EVENT_H__
+
+#include <stdint.h>
+
+/* Which descriptors have become readable or writable, asked of whichever
+   mechanism the kernel offers. The generation a descriptor was registered
+   with is handed back with every event, so a caller can tell an event for
+   the connection it is holding from one for a connection that has since been
+   closed and had its number reused. */
+
+enum { EVENT_IN = 1, EVENT_OUT = 2 };
+
+typedef struct {
+  int      fd;
+  uint32_t generation;
+  int      what;
+} ot_event;
+
+int  event_init(void);
+void event_deinit(void);
+
+int  event_add(int fd, int what, uint32_t generation);
+int  event_modify(int fd, int what, uint32_t generation);
+int  event_del(int fd);
+
+/* Waits at most timeout_ms, or indefinitely when that is negative, and fills
+   out with up to max ready descriptors. Returns how many, or -1. */
+int  event_wait(ot_event *out, int max, int timeout_ms);
+
+/* Which mechanism was compiled in, for the version string */
+const char *event_mechanism(void);
+
+#endif
diff --git a/ot_fdstate.c b/ot_fdstate.c
index 7f73d3d..537bcb0 100644
--- a/ot_fdstate.c
+++ b/ot_fdstate.c
@@ -99,6 +99,12 @@ uint32_t fdstate_open(int fd, void *cookie, ot_time expiry) {
   return FD_GEN(word);
 }
 
+uint32_t fdstate_generation(int fd) {
+  ot_fdslot *slot = fdstate_slot(fd);
+
+  return slot ? FD_GEN(atomic_load_explicit(&slot->state, memory_order_relaxed)) : 0;
+}
+
 int fdstate_claim(int fd, uint32_t generation) {
   ot_fdslot *slot = fdstate_slot(fd);
   uint64_t   word;
diff --git a/ot_fdstate.h b/ot_fdstate.h
index 88f685d..c09f018 100644
--- a/ot_fdstate.h
+++ b/ot_fdstate.h
@@ -31,6 +31,10 @@ size_t   fdstate_slots(void);
    generation to quote when asking for it back. expiry of 0 never expires. */
 uint32_t fdstate_open(int fd, void *cookie, ot_time expiry);
 
+/* Which generation a descriptor currently carries, to check an event that
+   was handed out earlier against the connection living there now. */
+uint32_t fdstate_generation(int fd);
+
 /* Ask for exclusive use. Returns 0 if the descriptor has been recycled since
    generation was handed out, or if somebody else is using it. */
 int      fdstate_claim(int fd, uint32_t generation);
diff --git a/ot_fmt.c b/ot_fmt.c
new file mode 100644
index 0000000..9cab25f
--- /dev/null
+++ b/ot_fmt.c
@@ -0,0 +1,42 @@
+/* This software was written by Dirk Engling <erdgeist@erdgeist.org>
+   It is considered beerware. Prost. Skol. Cheers or whatever.
+
+   $id$ */
+
+/* System */
+#include <stdarg.h>
+#include <stdio.h>
+#include <string.h>
+
+/* Opentracker */
+#include "ot_fmt.h"
+
+void fmt_append(char **cursor, const char *end, const char *format, ...) {
+  va_list arguments;
+  size_t  room;
+  int     written;
+
+  if (*cursor >= end) {
+    *cursor = (char *)end;
+    return;
+  }
+
+  room = (size_t)(end - *cursor);
+  va_start(arguments, format);
+  written = vsnprintf(*cursor, room, format, arguments);
+  va_end(arguments);
+
+  if (written < 0)
+    return;
+  *cursor = (size_t)written >= room ? (char *)end : *cursor + written;
+}
+
+void fmt_bytes(char **cursor, const char *end, const void *bytes, size_t length) {
+  if (*cursor >= end || (size_t)(end - *cursor) < length) {
+    *cursor = (char *)end;
+    return;
+  }
+
+  memcpy(*cursor, bytes, length);
+  *cursor += length;
+}
diff --git a/ot_fmt.h b/ot_fmt.h
new file mode 100644
index 0000000..851b2d8
--- /dev/null
+++ b/ot_fmt.h
@@ -0,0 +1,21 @@
+/* This software was written by Dirk Engling <erdgeist@erdgeist.org>
+   It is considered beerware. Prost. Skol. Cheers or whatever.
+
+   $id$ */
+
+#ifndef OT_FMT_H__
+#define OT_FMT_H__
+
+#include <stddef.h>
+
+/* Appending to a cursor that walks a fixed buffer. Both take the cursor by
+   reference and advance it, so a reply is written as a run of statements and
+   no caller does pointer arithmetic of its own. */
+
+void fmt_append(char **cursor, const char *end, const char *format, ...) __attribute__((format(printf, 3, 4)));
+
+/* Append raw bytes for the binary stretches of a bencoded reply.
+   Either everything is appended or nothing at all */
+void fmt_bytes(char **cursor, const char *end, const void *bytes, size_t length);
+
+#endif
diff --git a/ot_fullscrape.c b/ot_fullscrape.c
index 788e574..8518bd2 100644
--- a/ot_fullscrape.c
+++ b/ot_fullscrape.c
@@ -17,15 +17,13 @@
 #include <zstd.h>
 #endif
 
-/* Libowfat */
-#include "io.h"
-
 /* Opentracker */
+#include "ot_fmt.h"
 #include "ot_hex.h"
 #include "ot_fullscrape.h"
 #include "ot_iovec.h"
 #include "ot_mutex.h"
-#include "scan_urlencoded_query.h"
+#include "ot_urlencoded.h"
 #include "trackerlogic.h"
 
 /* Fetch full scrape info for all torrents
@@ -86,10 +84,15 @@ void fullscrape_deliver( int64_t sock, ot_tasktype tasktype ) {
   mutex_workqueue_pushtask( sock, TASK_FULLSCRAPE | tasktype );
 }
 
-static char * fullscrape_write_one( ot_tasktype mode, char *r, ot_torrent *torrent, ot_hash *hash ) {
-  size_t seed_count = torrent->peer_list6->seed_count + torrent->peer_list4->seed_count;
-  size_t peer_count = torrent->peer_list6->peer_count + torrent->peer_list4->peer_count;
-  size_t down_count = torrent->peer_list6->down_count + torrent->peer_list4->down_count;
+static void fullscrape_write_one( ot_tasktype mode, char **cursor, ot_torrent *torrent, ot_hash *hash ) {
+  /* Callers guarantee this much room: the chunk writer keeps its low
+     watermark that far from the end, the compressors hand over a buffer of
+     exactly that size */
+  char       *r          = *cursor;
+  const char *r_end      = r + OT_SCRAPE_MAXENTRYLEN;
+  size_t      seed_count = torrent->peer_list6->seed_count + torrent->peer_list4->seed_count;
+  size_t      peer_count = torrent->peer_list6->peer_count + torrent->peer_list4->peer_count;
+  size_t      down_count = torrent->peer_list6->down_count + torrent->peer_list4->down_count;
 
   switch (mode & TASK_TASK_MASK) {
   case TASK_FULLSCRAPE:
@@ -101,18 +104,18 @@ static char * fullscrape_write_one( ot_tasktype mode, char *r, ot_torrent *torre
     memcpy(r, hash, sizeof(ot_hash));
     r += sizeof(ot_hash);
     /* push rest of the scrape string */
-    r += sprintf(r, "d8:completei%zde10:downloadedi%zde10:incompletei%zdee", seed_count, down_count, peer_count - seed_count);
+    fmt_append(&r, r_end, "d8:completei%zde10:downloadedi%zde10:incompletei%zdee", seed_count, down_count, peer_count - seed_count);
 
     break;
   case TASK_FULLSCRAPE_TPB_ASCII:
-    hex_fromhash(r, *hash);
+    hex_from_hash(r, *hash);
     r += 2 * sizeof(ot_hash);
-    r += sprintf(r, ":%zd:%zd\n", seed_count, peer_count - seed_count);
+    fmt_append(&r, r_end, ":%zd:%zd\n", seed_count, peer_count - seed_count);
     break;
   case TASK_FULLSCRAPE_TPB_ASCII_PLUS:
-    hex_fromhash(r, *hash);
+    hex_from_hash(r, *hash);
     r += 2 * sizeof(ot_hash);
-    r += sprintf(r, ":%zd:%zd:%zd\n", seed_count, peer_count - seed_count, down_count);
+    fmt_append(&r, r_end, ":%zd:%zd:%zd\n", seed_count, peer_count - seed_count, down_count);
     break;
   case TASK_FULLSCRAPE_TPB_BINARY:
     memcpy(r, *hash, sizeof(ot_hash));
@@ -123,15 +126,15 @@ static char * fullscrape_write_one( ot_tasktype mode, char *r, ot_torrent *torre
     break;
   case TASK_FULLSCRAPE_TPB_URLENCODED:
     r += urlencoded_format(r, *hash, sizeof(ot_hash));
-    r += sprintf(r, ":%zd:%zd\n", seed_count, peer_count - seed_count);
+    fmt_append(&r, r_end, ":%zd:%zd\n", seed_count, peer_count - seed_count);
     break;
   case TASK_FULLSCRAPE_TRACKERSTATE:
-    hex_fromhash(r, *hash);
+    hex_from_hash(r, *hash);
     r += 2 * sizeof(ot_hash);
-    r += sprintf(r, ":%zd:%zd\n", torrent->peer_list6->base, down_count);
+    fmt_append(&r, r_end, ":%zd:%zd\n", torrent->peer_list6->base, down_count);
     break;
   }
-  return r;
+  *cursor = r;
 }
 
 static void fullscrape_make(int taskid, ot_tasktype mode) {
@@ -148,7 +151,7 @@ static void fullscrape_make(int taskid, ot_tasktype mode) {
   re = r + OT_SCRAPE_CHUNK_SIZE - OT_SCRAPE_MAXENTRYLEN;
 
   if ((mode & TASK_TASK_MASK) == TASK_FULLSCRAPE)
-    r += sprintf(r, "d5:filesd");
+    fmt_append(&r, (char *)iovector.iov_base + OT_SCRAPE_CHUNK_SIZE, "d5:filesd");
 
   /* For each bucket... */
   for (bucket = 0; bucket < OT_BUCKET_COUNT; ++bucket) {
@@ -159,7 +162,7 @@ static void fullscrape_make(int taskid, ot_tasktype mode) {
 
     /* For each torrent in this bucket.. */
     for (i = 0; i < torrents_list->size; ++i) {
-      r = fullscrape_write_one(mode, r, torrents + i, &torrents[i].hash);
+      fullscrape_write_one(mode, &r, torrents + i, &torrents[i].hash);
 
       if (r > re) {
         iovector.iov_len = r - (char *)iovector.iov_base;
@@ -190,7 +193,7 @@ static void fullscrape_make(int taskid, ot_tasktype mode) {
   }
 
   if ((mode & TASK_TASK_MASK) == TASK_FULLSCRAPE)
-    r += sprintf(r, "ee");
+    fmt_append(&r, (char *)iovector.iov_base + OT_SCRAPE_CHUNK_SIZE, "ee");
 
   /* Send rest of data */
   iovector.iov_len = r - (char *)iovector.iov_base;
@@ -233,7 +236,8 @@ static void fullscrape_make_gzip(int taskid, ot_tasktype mode) {
     /* For each torrent in this bucket.. */
     for (i = 0; i < torrents_list->size; ++i) {
       char compress_buffer[OT_SCRAPE_MAXENTRYLEN];
-      r             = fullscrape_write_one(mode, compress_buffer, torrents + i, &torrents[i].hash);
+      r             = compress_buffer;
+      fullscrape_write_one(mode, &r, torrents + i, &torrents[i].hash);
       strm.next_in  = (uint8_t *)compress_buffer;
       strm.avail_in = r - compress_buffer;
       zres          = deflate(&strm, Z_NO_FLUSH);
@@ -296,7 +300,7 @@ static void fullscrape_make_gzip(int taskid, ot_tasktype mode) {
       iovector.iov_base = malloc(OT_SCRAPE_CHUNK_SIZE);
 
       if (!iovector.iov_base) {
-        fprintf(stderr, "Problem with iovec_fix_increase_or_free\n");
+        fprintf(stderr, "Problem with iovec_next_chunk\n");
         deflateEnd(&strm);
         return;
       }
@@ -362,7 +366,8 @@ static void fullscrape_make_zstd(int taskid, ot_tasktype mode) {
     /* For each torrent in this bucket.. */
     for (i = 0; i < torrents_list->size; ++i) {
       char compress_buffer[OT_SCRAPE_MAXENTRYLEN];
-      r             = fullscrape_write_one(mode, compress_buffer, torrents + i, &torrents[i].hash);
+      r             = compress_buffer;
+      fullscrape_write_one(mode, &r, torrents + i, &torrents[i].hash);
       inbuf.src     = compress_buffer;
       inbuf.size    = r - compress_buffer;
       inbuf.pos     = 0;
@@ -422,7 +427,7 @@ static void fullscrape_make_zstd(int taskid, ot_tasktype mode) {
       iovector.iov_base = malloc(OT_SCRAPE_CHUNK_SIZE);
 
       if (!iovector.iov_base) {
-        fprintf(stderr, "Problem with iovec_fix_increase_or_free\n");
+        fprintf(stderr, "Problem with iovec_next_chunk\n");
         ZSTD_freeCCtx(zstream);
         return;
       }
diff --git a/ot_hex.c b/ot_hex.c
index 9581951..2bf69c4 100644
--- a/ot_hex.c
+++ b/ot_hex.c
@@ -23,7 +23,7 @@ int hex_value(int c) {
 
 int hex_isdigit(int c) { return hex_value(c) >= 0; }
 
-char *hex_fromhash(char *dest, const uint8_t *hash) {
+char *hex_from_hash(char *dest, const uint8_t *hash) {
   static const char digits[] = "0123456789ABCDEF";
   char             *d        = dest;
   size_t            i;
@@ -36,7 +36,7 @@ char *hex_fromhash(char *dest, const uint8_t *hash) {
   return dest;
 }
 
-int hex_tohash(ot_hash hash, const char *src) {
+int hex_to_hash(ot_hash hash, const char *src) {
   uint8_t decoded[sizeof(ot_hash)];
   size_t  i;
 
diff --git a/ot_hex.h b/ot_hex.h
index 3b45b61..28eddf5 100644
--- a/ot_hex.h
+++ b/ot_hex.h
@@ -12,12 +12,12 @@
 
 /* Write hash as forty upper case hex digits followed by a terminating zero.
    dest must have room for forty one bytes. Returns dest. */
-char *hex_fromhash(char *dest, const uint8_t *hash);
+char *hex_from_hash(char *dest, const uint8_t *hash);
 
 /* Read forty hex digits from src into hash. Returns non-zero on success.
    On failure hash is left untouched and no byte of src beyond the offending
    character is read, so src need not be forty characters long. */
-int   hex_tohash(ot_hash hash, const char *src);
+int   hex_to_hash(ot_hash hash, const char *src);
 
 /* Non-zero if c is a hexadecimal digit, in either case. */
 int   hex_isdigit(int c);
diff --git a/ot_http.c b/ot_http.c
index 6bf343c..2216453 100644
--- a/ot_http.c
+++ b/ot_http.c
@@ -14,9 +14,6 @@
 #include <sys/types.h>
 #include <unistd.h>
 
-/* Libowfat */
-#include "io.h"
-
 /* Opentracker */
 #include "ot_accesslist.h"
 #include "ot_fullscrape.h"
@@ -25,9 +22,12 @@
 #include "ot_ip.h"
 #include "ot_mutex.h"
 #include "ot_scan.h"
+#include "ot_event.h"
 #include "ot_fdstate.h"
+#include "ot_vector.h"
+#include "ot_fmt.h"
 #include "ot_stats.h"
-#include "scan_urlencoded_query.h"
+#include "ot_urlencoded.h"
 #include "trackerlogic.h"
 
 #define OT_MAXMULTISCRAPE_COUNT 64
@@ -43,7 +43,7 @@ static void http_senddata(const int64_t sock, struct ot_workstruct *ws) {
   ssize_t           written_size;
 
   if (!cookie) {
-    io_close(sock);
+    event_del((int)sock), close((int)sock);
     return;
   }
 
@@ -67,7 +67,7 @@ static void http_senddata(const int64_t sock, struct ot_workstruct *ws) {
   if ((written_size < 0) || ((written_size == ws->reply_size) && !ws->keep_alive)) {
     buf_reset(&cookie->request);
     free(cookie);
-    io_close(sock);
+    event_del((int)sock), close((int)sock);
     return;
   }
 
@@ -77,7 +77,7 @@ static void http_senddata(const int64_t sock, struct ot_workstruct *ws) {
     if (!(outbuf = malloc(ws->reply_size - written_size))) {
       buf_reset(&cookie->request);
       free(cookie);
-      io_close(sock);
+      event_del((int)sock), close((int)sock);
       return;
     }
 
@@ -88,7 +88,7 @@ static void http_senddata(const int64_t sock, struct ot_workstruct *ws) {
         free(outbuf);
         buf_reset(&cookie->request);
         free(cookie);
-        io_close(sock);
+        event_del((int)sock), close((int)sock);
         return;
       }
     }
@@ -98,9 +98,9 @@ static void http_senddata(const int64_t sock, struct ot_workstruct *ws) {
     /* writeable short data sockets just have a tcp timeout */
     if (!ws->keep_alive) {
       fdstate_set_expiry(sock, 0);
-      io_dontwantread(sock);
+      http_interest_drop(sock, cookie, EVENT_IN);
     }
-    io_wantwrite(sock);
+    http_interest_add(sock, cookie, EVENT_OUT);
   }
 }
 
@@ -113,6 +113,21 @@ static void http_senddata(const int64_t sock, struct ot_workstruct *ws) {
 #define HTTPERROR_403_IP         return http_issue_error(sock, ws, CODE_HTTPERROR_403_IP)
 #define HTTPERROR_404            return http_issue_error(sock, ws, CODE_HTTPERROR_404)
 #define HTTPERROR_500            return http_issue_error(sock, ws, CODE_HTTPERROR_500)
+static void http_interest(const int64_t sock, struct http_data *cookie, int what) {
+  if (cookie->interest == what)
+    return;
+  cookie->interest = what;
+  event_modify((int)sock, what, fdstate_generation((int)sock));
+}
+
+void http_interest_add(const int64_t sock, struct http_data *cookie, int what) {
+  http_interest(sock, cookie, cookie->interest | what);
+}
+
+void http_interest_drop(const int64_t sock, struct http_data *cookie, int what) {
+  http_interest(sock, cookie, cookie->interest & ~what);
+}
+
 ssize_t http_issue_error(const int64_t sock, struct ot_workstruct *ws, int code) {
   const char *error_code[] = {"302 Found",      "400 Invalid Request", "400 Invalid Request", "400 Invalid Request",      "402 Payment Required",
                         "403 Not Modest", "403 Access Denied",   "404 Not Found",       "500 Internal Server Error"};
@@ -157,7 +172,7 @@ ssize_t http_sendiovecdata(const int64_t sock, struct ot_workstruct *ws, size_t
 
   /* If we came here, wait for the answer is over */
   if (cookie->flag & STRUCT_HTTP_FLAG_WAITINGFORTASK) {
-    io_dontwantread(sock);
+    http_interest_drop(sock, cookie, EVENT_IN);
     cookie->flag &= ~STRUCT_HTTP_FLAG_WAITINGFORTASK;
   }
 
@@ -208,7 +223,7 @@ ssize_t http_sendiovecdata(const int64_t sock, struct ot_workstruct *ws, size_t
   }
 
   fdstate_set_expiry(sock, g_now_seconds + OT_CLIENT_TIMEOUT_SEND);
-  io_wantwrite(sock);
+  http_interest_add(sock, cookie, EVENT_OUT);
   return 0;
 }
 
@@ -219,7 +234,6 @@ static ssize_t http_handle_stats(const int64_t sock, struct ot_workstruct *ws, c
                                               {"scrp", TASK_STATS_SCRAPE},
                                               {"udp4", TASK_STATS_UDP},
                                               {"tcp4", TASK_STATS_TCP},
-                                              {"busy", TASK_STATS_BUSY_NETWORKS},
                                               {"torr", TASK_STATS_TORRENTS},
                                               {"fscr", TASK_STATS_FULLSCRAPE},
                                               {"s24s", TASK_STATS_SLASH24S},
@@ -244,6 +258,7 @@ static ssize_t http_handle_stats(const int64_t sock, struct ot_workstruct *ws, c
                                                 {"txtp", TASK_FULLSCRAPE_TPB_ASCII_PLUS}, {NULL, -3}};
 
   struct http_data *cookie = fdstate_cookie(sock);
+  char             *reply;
   int               mode = TASK_STATS_PEERS, scanon = 1, format = 0;
 
   /* A socket without one is a dead socket, which is what http_sendiovecdata
@@ -257,21 +272,21 @@ static ssize_t http_handle_stats(const int64_t sock, struct ot_workstruct *ws, c
 #endif
 
   while (scanon) {
-    switch (scan_find_keywords(keywords_main, &read_ptr, SCAN_SEARCHPATH_PARAM)) {
+    switch (urlencoded_match_keyword(keywords_main, &read_ptr, SCAN_SEARCHPATH_PARAM)) {
     case -2:
       scanon = 0;
       break; /* TERMINATOR */
     case -1:
       HTTPERROR_400_PARAM; /* PARSE ERROR */
     case -3:
-      scan_urlencoded_skipvalue(&read_ptr);
+      urlencoded_skip_value(&read_ptr);
       break;
     case 1: /* matched "mode" */
-      if ((mode = scan_find_keywords(keywords_mode, &read_ptr, SCAN_SEARCHPATH_VALUE)) <= 0)
+      if ((mode = urlencoded_match_keyword(keywords_mode, &read_ptr, SCAN_SEARCHPATH_VALUE)) <= 0)
         HTTPERROR_400_PARAM;
       break;
     case 2: /* matched "format" */
-      if ((format = scan_find_keywords(keywords_format, &read_ptr, SCAN_SEARCHPATH_VALUE)) <= 0)
+      if ((format = urlencoded_match_keyword(keywords_format, &read_ptr, SCAN_SEARCHPATH_VALUE)) <= 0)
         HTTPERROR_400_PARAM;
       break;
     case 3:
@@ -303,7 +318,7 @@ static ssize_t http_handle_stats(const int64_t sock, struct ot_workstruct *ws, c
     /* Clients waiting for us should not easily timeout */
     fdstate_set_expiry(sock, 0);
     fullscrape_deliver(sock, format);
-    io_dontwantread(sock);
+    http_interest_drop(sock, cookie, EVENT_IN);
     return ws->reply_size = -2;
   }
 #endif
@@ -320,7 +335,9 @@ static ssize_t http_handle_stats(const int64_t sock, struct ot_workstruct *ws, c
   }
 
   /* Simple stats can be answerred immediately */
-  return ws->reply_size = return_stats_for_tracker(ws->reply, mode, 0);
+  reply = ws->reply;
+  return_stats_for_tracker(&reply, ws->outbuf + G_OUTBUF_SIZE, mode, 0);
+  return ws->reply_size = reply - ws->reply;
 }
 
 #ifdef WANT_MODEST_FULLSCRAPES
@@ -396,17 +413,20 @@ static ssize_t http_handle_fullscrape(const int64_t sock, struct ot_workstruct *
   /* Clients waiting for us should not easily timeout */
   fdstate_set_expiry(sock, 0);
   fullscrape_deliver(sock, format);
-  io_dontwantread(sock);
+  http_interest_drop(sock, cookie, EVENT_IN);
   return ws->reply_size = -2;
 }
 #endif
 
+static int compare_hash(const void *left, const void *right) { return memcmp(left, right, sizeof(ot_hash)); }
+
 static ssize_t http_handle_scrape(const int64_t sock, struct ot_workstruct *ws, char *read_ptr) {
   static const ot_keywords keywords_scrape[] = {{"info_hash", 1}, {NULL, -3}};
 
-  ot_hash *multiscrape_buf   = (ot_hash *)ws->request;
-  int      scanon = 1;
-  size_t   numwant = 0;
+  ot_hash *multiscrape_buf = (ot_hash *)ws->request;
+  char    *reply           = ws->reply;
+  int      scanon          = 1;
+  size_t   i, unique, numwant = 0;
 
   /* This is to hack around stupid clients that send "scrape ?info_hash" */
   if (read_ptr[-1] != '?') {
@@ -418,18 +438,18 @@ static ssize_t http_handle_scrape(const int64_t sock, struct ot_workstruct *ws,
   }
 
   while (scanon) {
-    switch (scan_find_keywords(keywords_scrape, &read_ptr, SCAN_SEARCHPATH_PARAM)) {
+    switch (urlencoded_match_keyword(keywords_scrape, &read_ptr, SCAN_SEARCHPATH_PARAM)) {
     case -2:
       scanon = 0;
       break; /* TERMINATOR */
     default:
       HTTPERROR_400_PARAM; /* PARSE ERROR */
     case -3:
-      scan_urlencoded_skipvalue(&read_ptr);
+      urlencoded_skip_value(&read_ptr);
       break;
     case 1: /* matched "info_hash" */
       /* ignore this, when we have less than 20 bytes */
-      if (scan_urlencoded_query(&read_ptr, (char *)(multiscrape_buf + numwant++), SCAN_SEARCHPATH_VALUE) != (ssize_t)sizeof(ot_hash))
+      if (urlencoded_parse(&read_ptr, (char *)(multiscrape_buf + numwant++), SCAN_SEARCHPATH_VALUE) != (ssize_t)sizeof(ot_hash))
         HTTPERROR_400_PARAM;
       break;
     }
@@ -443,8 +463,17 @@ static ssize_t http_handle_scrape(const int64_t sock, struct ot_workstruct *ws,
   if (numwant > OT_MAXMULTISCRAPE_COUNT)
     numwant = OT_MAXMULTISCRAPE_COUNT;
 
+  /* A bencoded dictionary has its keys in order and names each one once, so
+     the answer cannot just follow the order the client asked in */
+  qsort(multiscrape_buf, numwant, sizeof(ot_hash), compare_hash);
+  for (i = unique = 1; i < numwant; ++i)
+    if (memcmp(multiscrape_buf[i], multiscrape_buf[unique - 1], sizeof(ot_hash)))
+      memcpy(multiscrape_buf[unique++], multiscrape_buf[i], sizeof(ot_hash));
+  numwant = unique;
+
   /* Enough for http header + whole scrape string */
-  ws->reply_size = return_tcp_scrape_for_torrent((const ot_hash *)multiscrape_buf, numwant, ws->reply);
+  return_tcp_scrape_for_torrent((const ot_hash *)multiscrape_buf, numwant, &reply, ws->outbuf + G_OUTBUF_SIZE);
+  ws->reply_size = reply - ws->reply;
   stats_issue_event(EVENT_SCRAPE, FLAG_TCP, ws->reply_size);
   return ws->reply_size;
 }
@@ -480,9 +509,20 @@ static ot_keywords keywords_announce[] = {{"port", 1},    {"left", 2}, {"event",
 #endif
                                           {"peer_id", 9}, {NULL, -3}};
 static ot_keywords keywords_announce_event[] = {{"completed", 1}, {"stopped", 2}, {NULL, -3}};
+
+/* For the replies that are one fixed string and nothing else, where the only
+   thing the caller wants back is how long it turned out */
+static ssize_t     reply_literal(struct ot_workstruct *ws, const char *text) {
+  char *reply = ws->reply;
+
+  fmt_bytes(&reply, ws->outbuf + G_OUTBUF_SIZE, text, strlen(text));
+  return reply - ws->reply;
+}
+
 static ssize_t     http_handle_announce(const int64_t sock, struct ot_workstruct *ws, char *read_ptr) {
   size_t            numwant;
-  int               tmp, scanon;
+  int64_t           tmp;
+  int               scanon;
   unsigned short    port = 0;
   char             *write_ptr;
   ssize_t           len;
@@ -501,7 +541,7 @@ static ssize_t     http_handle_announce(const int64_t sock, struct ot_workstruct
   if (accesslist_is_blessed(cookie->ip, OT_PERMISSION_MAY_PROXY)) {
     ot_ip6 proxied_ip;
     char  *fwd = http_header(ws->request, ws->header_size, "x-forwarded-for");
-    if (fwd && ip_scan(fwd, proxied_ip)) {
+    if (fwd && ip_parse(fwd, proxied_ip)) {
       OT_SETIP(ws->peer, proxied_ip);
     } else
       OT_SETIP(ws->peer, cookie->ip);
@@ -518,32 +558,32 @@ static ssize_t     http_handle_announce(const int64_t sock, struct ot_workstruct
   scanon                = 1;
 
   while (scanon) {
-    switch (scan_find_keywords(keywords_announce, &read_ptr, SCAN_SEARCHPATH_PARAM)) {
+    switch (urlencoded_match_keyword(keywords_announce, &read_ptr, SCAN_SEARCHPATH_PARAM)) {
     case -2:
       scanon = 0;
       break; /* TERMINATOR */
     case -1:
       HTTPERROR_400_PARAM; /* PARSE ERROR */
     case -3:
-      scan_urlencoded_skipvalue(&read_ptr);
+      urlencoded_skip_value(&read_ptr);
       break;
     case 1: /* matched "port" */
-      len = scan_urlencoded_query(&read_ptr, write_ptr = read_ptr, SCAN_SEARCHPATH_VALUE);
-      if ((len <= 0) || scan_fixed_int(write_ptr, len, &tmp) || (tmp > 0xffff))
+      len = urlencoded_parse(&read_ptr, write_ptr = read_ptr, SCAN_SEARCHPATH_VALUE);
+      if ((len <= 0) || scan_int(write_ptr, len, &tmp) || (tmp > 0xffff))
         HTTPERROR_400_PARAM;
-      port = htons(tmp);
+      port = htons((uint16_t)tmp);
       OT_SETPORT(&ws->peer, &port);
       break;
     case 2: /* matched "left" */
-      if ((len = scan_urlencoded_query(&read_ptr, write_ptr = read_ptr, SCAN_SEARCHPATH_VALUE)) <= 0)
+      if ((len = urlencoded_parse(&read_ptr, write_ptr = read_ptr, SCAN_SEARCHPATH_VALUE)) <= 0)
         HTTPERROR_400_PARAM;
-      if (scan_fixed_int(write_ptr, len, &tmp))
+      if (scan_int(write_ptr, len, &tmp))
         tmp = 0;
       if (!tmp)
         OT_PEERFLAG(&ws->peer) |= PEER_FLAG_SEEDING;
       break;
     case 3: /* matched "event" */
-      switch (scan_find_keywords(keywords_announce_event, &read_ptr, SCAN_SEARCHPATH_VALUE)) {
+      switch (urlencoded_match_keyword(keywords_announce_event, &read_ptr, SCAN_SEARCHPATH_VALUE)) {
       case -1:
         HTTPERROR_400_PARAM;
       case 1: /* matched "completed" */
@@ -557,18 +597,18 @@ static ssize_t     http_handle_announce(const int64_t sock, struct ot_workstruct
       }
       break;
     case 4: /* matched "numwant" */
-      len = scan_urlencoded_query(&read_ptr, write_ptr = read_ptr, SCAN_SEARCHPATH_VALUE);
-      if ((len <= 0) || scan_fixed_int(write_ptr, len, &tmp))
+      len = urlencoded_parse(&read_ptr, write_ptr = read_ptr, SCAN_SEARCHPATH_VALUE);
+      if ((len <= 0) || scan_int(write_ptr, len, &tmp))
         HTTPERROR_400_PARAM;
       if (tmp < 0)
         tmp = 50;
       if (tmp > 200)
         tmp = 200;
-      numwant = tmp;
+      numwant = (size_t)tmp;
       break;
     case 5: /* matched "compact" */
-      len = scan_urlencoded_query(&read_ptr, write_ptr = read_ptr, SCAN_SEARCHPATH_VALUE);
-      if ((len <= 0) || scan_fixed_int(write_ptr, len, &tmp))
+      len = urlencoded_parse(&read_ptr, write_ptr = read_ptr, SCAN_SEARCHPATH_VALUE);
+      if ((len <= 0) || scan_int(write_ptr, len, &tmp))
         HTTPERROR_400_PARAM;
       if (!tmp)
         HTTPERROR_400_COMPACT;
@@ -577,7 +617,7 @@ static ssize_t     http_handle_announce(const int64_t sock, struct ot_workstruct
       if (ws->hash)
         HTTPERROR_400_DOUBLEHASH;
       /* ignore this, when we have less than 20 bytes */
-      if (scan_urlencoded_query(&read_ptr, write_ptr = read_ptr, SCAN_SEARCHPATH_VALUE) != 20)
+      if (urlencoded_parse(&read_ptr, write_ptr = read_ptr, SCAN_SEARCHPATH_VALUE) != 20)
         HTTPERROR_400_PARAM;
       ws->hash = (ot_hash *)write_ptr;
       break;
@@ -585,9 +625,9 @@ static ssize_t     http_handle_announce(const int64_t sock, struct ot_workstruct
     case 7: /* matched "ip" */
     {
       char *tmp_buf1 = ws->reply, *tmp_buf2 = ws->reply + 16;
-      len           = scan_urlencoded_query(&read_ptr, tmp_buf2, SCAN_SEARCHPATH_VALUE);
+      len           = urlencoded_parse(&read_ptr, tmp_buf2, SCAN_SEARCHPATH_VALUE);
       tmp_buf2[len] = 0;
-      if ((len <= 0) || !ip_scan(tmp_buf2, tmp_buf1))
+      if ((len <= 0) || ip_parse(tmp_buf2, tmp_buf1) != (size_t)len)
         HTTPERROR_400_PARAM;
       OT_SETIP(&ws->peer, tmp_buf1);
     } break;
@@ -601,21 +641,21 @@ static ssize_t     http_handle_announce(const int64_t sock, struct ot_workstruct
       uint64_t     value;
       signed short parsed, bits;
 
-      len          = scan_urlencoded_query(&read_ptr, tmp_buf, SCAN_SEARCHPATH_VALUE);
+      len          = urlencoded_parse(&read_ptr, tmp_buf, SCAN_SEARCHPATH_VALUE);
       tmp_buf[len] = 0;
       if (len <= 0)
         HTTPERROR_400_PARAM;
       if (*tmp_buf == '-') {
         loglist_reset();
-        return ws->reply_size = sprintf(ws->reply, "Successfully removed.\n");
+        return ws->reply_size = reply_literal(ws, "Successfully removed.\n");
       }
-      parsed = ip_scan(tmp_buf, net.address);
+      parsed = ip_parse(tmp_buf, net.address);
       if (!parsed)
         HTTPERROR_400_PARAM;
       if (tmp_buf[parsed++] != '/')
         bits = 128;
       else {
-        parsed = scan_udec(tmp_buf + parsed, &value, 128);
+        parsed = scan_uint(tmp_buf + parsed, &value, 128);
         if (!parsed)
           HTTPERROR_400_PARAM;
         bits = (signed short)value;
@@ -624,13 +664,13 @@ static ssize_t     http_handle_announce(const int64_t sock, struct ot_workstruct
       }
       net.bits = bits;
       loglist_add_network(&net);
-      return ws->reply_size = sprintf(ws->reply, "Successfully added.\n");
+      return ws->reply_size = reply_literal(ws, "Successfully added.\n");
       //}
     } break;
 #endif
     case 9: /* matched "peer_id" */
       /* ignore this, when we have less than 20 bytes */
-      if (scan_urlencoded_query(&read_ptr, write_ptr = read_ptr, SCAN_SEARCHPATH_VALUE) != 20)
+      if (urlencoded_parse(&read_ptr, write_ptr = read_ptr, SCAN_SEARCHPATH_VALUE) != 20)
         HTTPERROR_400_PARAM;
       ws->peer_id = write_ptr;
       break;
@@ -647,7 +687,7 @@ static ssize_t     http_handle_announce(const int64_t sock, struct ot_workstruct
 
   /* Scanned whole query string */
   if (!ws->hash)
-    return ws->reply_size = sprintf(ws->reply, "d14:failure reason80:Your client forgot to send your torrent's info_hash. Please upgrade your client.e");
+    return ws->reply_size = reply_literal(ws, "d14:failure reason80:Your client forgot to send your torrent's info_hash. Please upgrade your client.e");
 
   if (OT_PEERFLAG(&ws->peer) & PEER_FLAG_STOPPED)
     ws->reply_size = remove_peer_from_torrent(FLAG_TCP, ws);
@@ -697,6 +737,24 @@ ssize_t http_handle_request(const int64_t sock, struct ot_workstruct *ws) {
   /* Tell subroutines where to put reply data */
   ws->reply = ws->outbuf + SUCCESS_HTTP_HEADER_LENGTH;
 
+  /* Find out if the client wants to keep this connection alive, before any
+     subroutine gets to answer: an error reply finishes with the connection
+     on its way out, and ws outlives the connection it was serving */
+  ws->keep_alive = 0;
+#ifdef WANT_KEEPALIVE
+  if ((write_ptr = http_header(ws->request, ws->header_size, "connection")) && (*write_ptr == 'K' || *write_ptr == 'k'))
+    ws->keep_alive = 1;
+#endif
+  {
+    struct http_data *connection = fdstate_cookie(sock);
+    if (connection) {
+      if (ws->keep_alive)
+        connection->flag |= STRUCT_HTTP_FLAG_KEEPALIVE;
+      else
+        connection->flag &= ~STRUCT_HTTP_FLAG_KEEPALIVE;
+    }
+  }
+
   /* This one implicitely tests strlen < 5, too -- remember, it is \n terminated */
   if (memcmp(read_ptr, "GET /", 5))
     HTTPERROR_400;
@@ -709,7 +767,7 @@ ssize_t http_handle_request(const int64_t sock, struct ot_workstruct *ws) {
      In reality we abandoned requiring the url to be correct. This now
      only decodes url encoded characters, we check for announces and
      scrapes by looking for "a*" or "sc" */
-  len = scan_urlencoded_query(&read_ptr, write_ptr = read_ptr, SCAN_PATH);
+  len = urlencoded_parse(&read_ptr, write_ptr = read_ptr, SCAN_PATH);
 
   /* If parsing returned an error, leave with not found */
   if (g_redirecturl && (len == -2))
@@ -733,14 +791,6 @@ ssize_t http_handle_request(const int64_t sock, struct ot_workstruct *ws) {
   else
     HTTPERROR_404;
 
-  /* Find out if the client wants to keep this connection alive */
-  ws->keep_alive = 0;
-#ifdef WANT_KEEPALIVE
-  read_ptr = http_header(ws->request, ws->header_size, "connection");
-  if (read_ptr && (*read_ptr == 'K' || *read_ptr == 'k'))
-    ws->keep_alive = 1;
-#endif
-
   /* If routines handled sending themselves, just return */
   if (ws->reply_size == -2)
     return 0;
@@ -758,9 +808,11 @@ ssize_t http_handle_request(const int64_t sock, struct ot_workstruct *ws) {
   reply_off       = SUCCESS_HTTP_SIZE_OFF - snprintf(ws->outbuf, 0, "%zd", ws->reply_size);
   ws->reply       = ws->outbuf + reply_off;
 
-  /* 2. Now we sprintf our header so that sprintf writes its terminating '\0' exactly one byte before content starts. Complete
-     packet size is increased by size of header plus one byte '\n', we will copy over '\0' in next step */
-  ws->reply_size += 1 + sprintf(ws->reply, "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nContent-Length: %zd\r\n\r", ws->reply_size);
+  /* 2. Now we write the header so that its terminating '\0' lands exactly one byte before the content starts. The bound is the
+     space step 1 reserved, so the '\0' falls where step 3 expects it. Complete packet size is increased by size of header plus
+     one byte '\n', we will copy over '\0' in next step */
+  ws->reply_size += 1 + snprintf(ws->reply, (size_t)(SUCCESS_HTTP_HEADER_LENGTH - reply_off),
+                                 "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nContent-Length: %zd\r\n\r", ws->reply_size);
 
   /* 3. Finally we join both blocks neatly */
   ws->outbuf[SUCCESS_HTTP_HEADER_LENGTH - 1] = '\n';
diff --git a/ot_http.h b/ot_http.h
index 003b545..1ccabfd 100644
--- a/ot_http.h
+++ b/ot_http.h
@@ -11,6 +11,7 @@
 #include <sys/uio.h>
 
 #include "ot_batch.h"
+#include "ot_event.h"
 #include "ot_buf.h"
 #include "trackerlogic.h"
 
@@ -20,16 +21,22 @@ typedef enum {
   STRUCT_HTTP_FLAG_BZIP2               = 4,
   STRUCT_HTTP_FLAG_ZSTD                = 8,
   STRUCT_HTTP_FLAG_CHUNKED             = 16,
-  STRUCT_HTTP_FLAG_CHUNKED_IN_TRANSFER = 32
+  STRUCT_HTTP_FLAG_CHUNKED_IN_TRANSFER = 32,
+  STRUCT_HTTP_FLAG_KEEPALIVE           = 64
 } STRUCT_HTTP_FLAG;
 
 struct http_data {
   ot_buf           request;
+  int              interest; /* EVENT_IN and EVENT_OUT as asked for */
   ot_batch        *batch;
   ot_ip6           ip;
   STRUCT_HTTP_FLAG flag;
 };
 
+/* Add to or drop from what this connection is waiting to be told about */
+void           http_interest_add(const int64_t s, struct http_data *cookie, int what);
+void           http_interest_drop(const int64_t s, struct http_data *cookie, int what);
+
 ssize_t        http_handle_request(const int64_t s, struct ot_workstruct *ws);
 ssize_t        http_sendiovecdata(const int64_t s, struct ot_workstruct *ws, size_t iovec_entries, struct iovec *iovector, int is_partial);
 ssize_t        http_issue_error(const int64_t s, struct ot_workstruct *ws, int code);
diff --git a/ot_iovec.c b/ot_iovec.c
index cd5b9f9..7e5903f 100644
--- a/ot_iovec.c
+++ b/ot_iovec.c
@@ -7,12 +7,10 @@
 #include <stdlib.h>
 #include <sys/uio.h>
 
-/* Libowfat */
-
 /* Opentracker */
 #include "ot_iovec.h"
 
-void *iovec_increase(size_t *iovec_entries, struct iovec **iovector, size_t new_alloc) {
+void *iovec_new_chunk(size_t *iovec_entries, struct iovec **iovector, size_t new_alloc) {
   void         *new_data;
   size_t        new_entries = 1 + *iovec_entries;
   struct iovec *new_vec     = realloc(*iovector, new_entries * sizeof(struct iovec));
@@ -62,7 +60,7 @@ void iovec_free(size_t *iovec_entries, struct iovec **iovector) {
   *iovec_entries = 0;
 }
 
-void iovec_fixlast(size_t *iovec_entries, struct iovec **iovector, void *last_ptr) {
+void iovec_trim_last(size_t *iovec_entries, struct iovec **iovector, void *last_ptr) {
   if (*iovec_entries) {
     char  *base      = (char *)((*iovector)[*iovec_entries - 1]).iov_base;
     size_t new_alloc = ((char *)last_ptr) - base;
@@ -72,12 +70,12 @@ void iovec_fixlast(size_t *iovec_entries, struct iovec **iovector, void *last_pt
   }
 }
 
-void *iovec_fix_increase_or_free(size_t *iovec_entries, struct iovec **iovector, void *last_ptr, size_t new_alloc) {
+void *iovec_next_chunk(size_t *iovec_entries, struct iovec **iovector, void *last_ptr, size_t new_alloc) {
   void *new_data;
 
-  iovec_fixlast(iovec_entries, iovector, last_ptr);
+  iovec_trim_last(iovec_entries, iovector, last_ptr);
 
-  if (!(new_data = iovec_increase(iovec_entries, iovector, new_alloc)))
+  if (!(new_data = iovec_new_chunk(iovec_entries, iovector, new_alloc)))
     iovec_free(iovec_entries, iovector);
 
   return new_data;
diff --git a/ot_iovec.h b/ot_iovec.h
index eb4365b..6f5a1d6 100644
--- a/ot_iovec.h
+++ b/ot_iovec.h
@@ -8,13 +8,13 @@
 
 #include <sys/uio.h>
 
-void  *iovec_increase(size_t *iovec_entries, struct iovec **iovector, size_t new_alloc);
+void  *iovec_new_chunk(size_t *iovec_entries, struct iovec **iovector, size_t new_alloc);
 void  *iovec_append(size_t *iovec_entries, struct iovec **iovector, struct iovec *append_iovector);
-void   iovec_fixlast(size_t *iovec_entries, struct iovec **iovector, void *last_ptr);
+void   iovec_trim_last(size_t *iovec_entries, struct iovec **iovector, void *last_ptr);
 void   iovec_free(size_t *iovec_entries, struct iovec **iovector);
 
 size_t iovec_length(const size_t *iovec_entries, const struct iovec **iovector);
 
-void  *iovec_fix_increase_or_free(size_t *iovec_entries, struct iovec **iovector, void *last_ptr, size_t new_alloc);
+void  *iovec_next_chunk(size_t *iovec_entries, struct iovec **iovector, void *last_ptr, size_t new_alloc);
 
 #endif
diff --git a/ot_ip.c b/ot_ip.c
index 8cde7d2..e694883 100644
--- a/ot_ip.c
+++ b/ot_ip.c
@@ -120,7 +120,7 @@ size_t ip_format(char *dest, const ot_ip6 ip) {
   return (size_t)(d - dest);
 }
 
-size_t ip_scan(const char *src, ot_ip6 ip) {
+size_t ip_parse(const char *src, ot_ip6 ip) {
   uint8_t     prefix[16], suffix[16];
   size_t      prefixlen = 0, suffixlen = 0;
   const char *s          = src;
diff --git a/ot_ip.h b/ot_ip.h
index ac8964d..344bd45 100644
--- a/ot_ip.h
+++ b/ot_ip.h
@@ -23,7 +23,7 @@ static inline int ip_is_v4mapped(const void *ip) { return !memcmp(ip, ip_v4mappe
 
    The count lets the caller carry on where the address ended, which is how
    "address:port" and "address/bits" are read. */
-size_t ip_scan(const char *src, ot_ip6 ip);
+size_t ip_parse(const char *src, ot_ip6 ip);
 
 /* Write an address and return how many characters it took. Nothing is
    terminated, so a caller may keep appending. A v4 mapped address is written
diff --git a/ot_livesync.h b/ot_livesync.h
index 5b9fa0e..4725023 100644
--- a/ot_livesync.h
+++ b/ot_livesync.h
@@ -6,7 +6,6 @@
 #ifndef OT_LIVESYNC_H__
 #define OT_LIVESYNC_H__
 
-#include "io.h"
 #include "trackerlogic.h"
 
 /*
diff --git a/ot_mutex.c b/ot_mutex.c
index 2a8cbf5..37d9962 100644
--- a/ot_mutex.c
+++ b/ot_mutex.c
@@ -8,11 +8,10 @@
 #include <pthread.h>
 #include <stdio.h>
 #include <stdlib.h>
+#include <unistd.h>
 #include <string.h>
 #include <sys/uio.h>
 
-/* Libowfat */
-#include "io.h"
 
 /* Opentracker */
 #include "ot_iovec.h"
@@ -193,7 +192,8 @@ int mutex_workqueue_pushresult(ot_taskid taskid, size_t iovec_entries, struct io
   /* Release lock */
   pthread_mutex_unlock(&tasklist_mutex);
 
-  io_trywrite(g_self_pipe[1], &byte, 1);
+  /* A full pipe has already done this nudge's job, so a failure is fine */
+  (void)!write(g_self_pipe[1], &byte, 1);
 
   /* Indicate whether the worker has to throw away results */
   return task ? 0 : -1;
@@ -221,7 +221,8 @@ int mutex_workqueue_pushchunked(ot_taskid taskid, struct iovec *iovec) {
   /* Release lock */
   pthread_mutex_unlock(&tasklist_mutex);
 
-  io_trywrite(g_self_pipe[1], &byte, 1);
+  /* A full pipe has already done this nudge's job, so a failure is fine */
+  (void)!write(g_self_pipe[1], &byte, 1);
 
   /* Indicate whether the worker has to throw away results */
   return task ? 0 : -1;
diff --git a/ot_mutex.h b/ot_mutex.h
index b5af96e..3bbbe9c 100644
--- a/ot_mutex.h
+++ b/ot_mutex.h
@@ -29,7 +29,6 @@ typedef enum {
   TASK_STATS_TPB                 = 0x0006,
   TASK_STATS_HTTPERRORS          = 0x0007,
   TASK_STATS_VERSION             = 0x0008,
-  TASK_STATS_BUSY_NETWORKS       = 0x0009,
   TASK_STATS_RENEW               = 0x000a,
   TASK_STATS_SYNCS               = 0x000b,
   TASK_STATS_COMPLETED           = 0x000c,
diff --git a/ot_scan.c b/ot_scan.c
index a96f82b..c4b951a 100644
--- a/ot_scan.c
+++ b/ot_scan.c
@@ -11,7 +11,7 @@
 /* Opentracker */
 #include "ot_scan.h"
 
-size_t scan_udec(const char *src, uint64_t *dest, uint64_t max) {
+size_t scan_uint(const char *src, uint64_t *dest, uint64_t max) {
   unsigned long long value;
   char              *end;
 
@@ -28,9 +28,9 @@ size_t scan_udec(const char *src, uint64_t *dest, uint64_t max) {
   return (size_t)(end - src);
 }
 
-size_t scan_udec_bencode(const char *src, uint64_t *dest, uint64_t max) {
+size_t scan_uint_bencode(const char *src, uint64_t *dest, uint64_t max) {
   uint64_t value;
-  size_t   consumed = scan_udec(src, &value, max);
+  size_t   consumed = scan_uint(src, &value, max);
 
   /* bencode writes no leading zeros, so anything longer than a single digit
      must not begin with one. */
@@ -42,3 +42,26 @@ size_t scan_udec_bencode(const char *src, uint64_t *dest, uint64_t max) {
 
   return consumed;
 }
+
+int scan_int(const char *src, size_t len, int64_t *dest) {
+  int64_t value  = 0;
+  int     negate = 0;
+
+  if (len && *src == '-')
+    --len, ++src, negate = 1;
+  if (!len)
+    return -1;
+
+  while (len--) {
+    if (*src < '0' || *src > '9')
+      return -1;
+    /* A twenty character field of nines does not fit, and silently wrapping
+       would magically heal a nonsense announce */
+    if (value > (INT64_MAX - (*src - '0')) / 10)
+      return -1;
+    value = 10 * value + (*src++ - '0');
+  }
+
+  *dest = negate ? -value : value;
+  return 0;
+}
diff --git a/ot_scan.h b/ot_scan.h
index 860a088..ca3bbbd 100644
--- a/ot_scan.h
+++ b/ot_scan.h
@@ -7,15 +7,21 @@
 #define OT_SCAN_H__
 
 #include <stddef.h>
+#include <stddef.h>
 #include <stdint.h>
 
 /* Read an unsigned decimal number from src into dest and return how many
    characters were consumed. Returns zero and leaves dest untouched when src
    does not begin with a digit, or when the value would exceed max. */
-size_t scan_udec(const char *src, uint64_t *dest, uint64_t max);
+size_t scan_uint(const char *src, uint64_t *dest, uint64_t max);
 
-/* As scan_udec, but following the bencode integer grammar, which permits a
+/* As scan_uint, but following the bencode integer grammar, which permits a
    leading zero on zero alone. */
-size_t scan_udec_bencode(const char *src, uint64_t *dest, uint64_t max);
+size_t scan_uint_bencode(const char *src, uint64_t *dest, uint64_t max);
+
+/* Read a signed decimal number that has to take up exactly len characters,
+   which is how a value lifted out of a query string arrives. Returns 0, or
+   -1 leaving dest untouched. */
+int    scan_int(const char *src, size_t len, int64_t *dest);
 
 #endif
diff --git a/ot_socket.c b/ot_socket.c
index 84020ca..576087f 100644
--- a/ot_socket.c
+++ b/ot_socket.c
@@ -40,14 +40,16 @@ static void ip_from_sockaddr(ot_ip6 ip, uint16_t *port, const struct sockaddr_st
   }
 }
 
-static int set_nonblocking(int s) {
+int socket_set_blocking(int s, int blocking) {
   int flags = fcntl(s, F_GETFL, 0);
 
   if (flags == -1)
     return -1;
-  return fcntl(s, F_SETFL, flags | O_NONBLOCK);
+  return fcntl(s, F_SETFL, blocking ? (flags & ~O_NONBLOCK) : (flags | O_NONBLOCK));
 }
 
+static int set_nonblocking(int s) { return socket_set_blocking(s, 0); }
+
 /* Close without letting the failure we are about to report be overwritten */
 static int close_and_fail(int s) {
   int saved = errno;
diff --git a/ot_socket.h b/ot_socket.h
index 21d04b1..aa4e2d2 100644
--- a/ot_socket.h
+++ b/ot_socket.h
@@ -27,6 +27,7 @@ int     socket_udp_bind(const ot_ip6 ip, uint16_t port, socket_sharing sharing);
 int     socket_tcp_connect(const ot_ip6 srcip, uint16_t srcport, const ot_ip6 dstip, uint16_t dstport);
 int     socket_is_connected(int s);
 int     socket_accept(int s, ot_ip6 ip, uint16_t *port);
+int     socket_set_blocking(int s, int blocking);
 
 ssize_t socket_recv(int s, void *buf, size_t len, ot_ip6 ip, uint16_t *port);
 ssize_t socket_send(int s, const void *buf, size_t len, const ot_ip6 ip, uint16_t port);
diff --git a/ot_stats.c b/ot_stats.c
index 6589aef..45dc8db 100644
--- a/ot_stats.c
+++ b/ot_stats.c
@@ -16,15 +16,13 @@
 #include <syslog.h>
 #endif
 
-/* Libowfat */
-#include "io.h"
-
 /* Opentracker */
 #include "ot_accesslist.h"
 #include "ot_hex.h"
 #include "ot_iovec.h"
 #include "ot_ip.h"
 #include "ot_mutex.h"
+#include "ot_fmt.h"
 #include "ot_stats.h"
 #include "trackerlogic.h"
 
@@ -178,8 +176,8 @@ static size_t stats_get_highscore_networks(stats_network_node *node, int depth,
       ++j;
     --j;
 
-    memcpy(scores, scores + 1, j * sizeof(*scores));
-    memcpy(networks, networks + 1, j * sizeof(*networks));
+    memmove(scores, scores + 1, j * sizeof(*scores));
+    memmove(networks, networks + 1, j * sizeof(*networks));
     scores[j] = node_score;
     memcpy(networks + j, node_value, sizeof(*networks));
   }
@@ -187,12 +185,11 @@ static size_t stats_get_highscore_networks(stats_network_node *node, int depth,
   return score;
 }
 
-static size_t stats_return_busy_networks(char *reply, stats_network_node *tree, size_t amount, int limit) {
+static void stats_return_busy_networks(char **reply, const char *reply_end, stats_network_node *tree, size_t amount, int limit) {
   ot_ip6 networks[amount];
   ot_ip6 node_value;
   size_t scores[amount];
   size_t i;
-  char  *r = reply;
 
   memset(scores, 0, sizeof(scores));
   memset(networks, 0, sizeof(networks));
@@ -200,24 +197,21 @@ static size_t stats_return_busy_networks(char *reply, stats_network_node *tree,
 
   stats_get_highscore_networks(tree, 0, node_value, scores, networks, amount, limit);
 
-  r += sprintf(r, "Networks, limit /%d:\n", limit + STATS_NETWORK_NODE_BITWIDTH);
+  fmt_append(reply, reply_end, "Networks, limit /%d:\n", limit + STATS_NETWORK_NODE_BITWIDTH);
   for (i = amount; i > 0; --i) {
     if (scores[i - 1]) {
-      r += sprintf(r, "%08zd: ", scores[i - 1]);
-      // #ifdef WANT_V6
-      r += ip_format(r, networks[i - 1]);
-      *r++ = '\n';
+      char ip_readable[64];
+
+      ip_readable[ip_format(ip_readable, networks[i - 1])] = 0;
+      fmt_append(reply, reply_end, "%08zd: %s\n", scores[i - 1], ip_readable);
     }
   }
-  *r++ = '\n';
-
-  return r - reply;
+  fmt_append(reply, reply_end, "\n");
 }
 
-static size_t stats_slash24s_txt(char *reply, size_t amount) {
+static void stats_slash24s_txt(char **reply, const char *reply_end, size_t amount) {
   stats_network_node *slash24s_network_counters_root = NULL;
-  char  *r = reply;
-  size_t i, bucket, peer_size = OT_PEER_SIZE4;
+  size_t              i, bucket, peer_size = OT_PEER_SIZE4;
 
   for (bucket = 0; bucket < OT_BUCKET_COUNT; ++bucket) {
     ot_vector *torrents_list = mutex_bucket_lock(bucket);
@@ -244,35 +238,28 @@ static size_t stats_slash24s_txt(char *reply, size_t amount) {
     }
     mutex_bucket_unlock(bucket, 0);
     if (!g_opentracker_running)
-      goto bailout_error;
+      goto done;
   }
 
   /* The tree is built. Now analyze */
-  r += stats_return_busy_networks(r, slash24s_network_counters_root, amount, STATS_NETWORK_NODE_MAXDEPTH);
-  r += stats_return_busy_networks(r, slash24s_network_counters_root, amount, STATS_NETWORK_NODE_LIMIT);
-  goto success;
+  stats_return_busy_networks(reply, reply_end, slash24s_network_counters_root, amount, STATS_NETWORK_NODE_MAXDEPTH);
+  stats_return_busy_networks(reply, reply_end, slash24s_network_counters_root, amount, STATS_NETWORK_NODE_LIMIT);
+  goto done;
 
 bailout_unlock:
   mutex_bucket_unlock(bucket, 0);
-bailout_error:
-  r = reply;
-success:
+done:
   stats_shift_down_network_count(&slash24s_network_counters_root, 0, sizeof(int) * 8 - 1);
-
-  return r - reply;
 }
 
 #ifdef WANT_SPOT_WOODPECKER
 static stats_network_node *stats_woodpeckers_tree;
 static pthread_mutex_t     g_woodpeckers_mutex = PTHREAD_MUTEX_INITIALIZER;
 
-static size_t              stats_return_woodpeckers(char *reply, int amount) {
-  char *r = reply;
-
+static void              stats_return_woodpeckers(char **reply, const char *reply_end, int amount) {
   pthread_mutex_lock(&g_woodpeckers_mutex);
-  r += stats_return_busy_networks(r, stats_woodpeckers_tree, amount, STATS_NETWORK_NODE_MAXDEPTH);
+  stats_return_busy_networks(reply, reply_end, stats_woodpeckers_tree, amount, STATS_NETWORK_NODE_MAXDEPTH);
   pthread_mutex_unlock(&g_woodpeckers_mutex);
-  return r - reply;
 }
 #endif
 
@@ -312,10 +299,10 @@ static inline void stats_insert_into_highscore(size_t val, ot_record* list, size
 
 
 /* Fetches stats from tracker */
-size_t stats_top_txt(char *reply, size_t amount) {
+void stats_top_txt(char **reply, const char *reply_end, size_t amount) {
   size_t    j, idx, bucket;
   ot_record top100s[100], top100c[100], top100l[100];
-  char     *r = reply, hex_out[42];
+  char      hex_out[42];
 
   if (amount > 100)
     amount = 100;
@@ -326,7 +313,7 @@ size_t stats_top_txt(char *reply, size_t amount) {
 
   /* Iterate over complete torrent list */
   for (bucket = 0; bucket < OT_BUCKET_COUNT; ++bucket) {
-    ot_vector *torrents_list  = mutex_bucket_lock(bucket);
+    ot_vector *torrents_list = mutex_bucket_lock(bucket);
     for (j = 0; j < torrents_list->size; ++j) {
       ot_torrent *torrent     = (ot_torrent *)(torrents_list->data) + j;
       size_t      peer_count  = torrent->peer_list6->peer_count + torrent->peer_list4->peer_count;
@@ -339,114 +326,110 @@ size_t stats_top_txt(char *reply, size_t amount) {
     }
     mutex_bucket_unlock(bucket, 0);
     if (!g_opentracker_running)
-      return 0;
+      return;
   }
 
-  r += sprintf(r, "Top %zd torrents by peers:\n", amount);
+  fmt_append(reply, reply_end, "Top %zd torrents by peers:\n", amount);
   for (idx = 0; idx < amount; ++idx)
     if (top100c[idx].val)
-      r += sprintf(r, "\t%zd\t%s\n", top100c[idx].val, hex_fromhash(hex_out, top100c[idx].hash));
-  r += sprintf(r, "Top %zd torrents by seeds:\n", amount);
+      fmt_append(reply, reply_end, "\t%zd\t%s\n", top100c[idx].val, hex_from_hash(hex_out, top100c[idx].hash));
+  fmt_append(reply, reply_end, "Top %zd torrents by seeds:\n", amount);
   for (idx = 0; idx < amount; ++idx)
     if (top100s[idx].val)
-      r += sprintf(r, "\t%zd\t%s\n", top100s[idx].val, hex_fromhash(hex_out, top100s[idx].hash));
-  r += sprintf(r, "Top %zd torrents by leechers:\n", amount);
+      fmt_append(reply, reply_end, "\t%zd\t%s\n", top100s[idx].val, hex_from_hash(hex_out, top100s[idx].hash));
+  fmt_append(reply, reply_end, "Top %zd torrents by leechers:\n", amount);
   for (idx = 0; idx < amount; ++idx)
     if (top100l[idx].val)
-      r += sprintf(r, "\t%zd\t%s\n", top100l[idx].val, hex_fromhash(hex_out, top100l[idx].hash));
-
-  return r - reply;
+      fmt_append(reply, reply_end, "\t%zd\t%s\n", top100l[idx].val, hex_from_hash(hex_out, top100l[idx].hash));
 }
 
 static unsigned long events_per_time(unsigned long long events, time_t t) { return events / ((unsigned int)t ? (unsigned int)t : 1); }
 
-static size_t        stats_connections_mrtg(char *reply) {
+static void        stats_connections_mrtg(char **reply, const char *reply_end) {
   ot_time t = time(NULL) - ot_start_time;
-  return sprintf(reply, "%llu\n%llu\n%i seconds (%i hours)\nopentracker connections, %lu conns/s :: %lu success/s.",
-                        ot_overall_tcp_connections + ot_overall_udp_connections,
-                        ot_overall_tcp_successfulannounces + ot_overall_udp_successfulannounces + ot_overall_udp_connects, (int)t, (int)(t / 3600),
-                        events_per_time(ot_overall_tcp_connections + ot_overall_udp_connections, t),
-                        events_per_time(ot_overall_tcp_successfulannounces + ot_overall_udp_successfulannounces + ot_overall_udp_connects, t));
+  fmt_append(reply, reply_end, "%llu\n%llu\n%i seconds (%i hours)\nopentracker connections, %lu conns/s :: %lu success/s.",
+                    ot_overall_tcp_connections + ot_overall_udp_connections,
+                    ot_overall_tcp_successfulannounces + ot_overall_udp_successfulannounces + ot_overall_udp_connects, (int)t, (int)(t / 3600),
+                    events_per_time(ot_overall_tcp_connections + ot_overall_udp_connections, t),
+                    events_per_time(ot_overall_tcp_successfulannounces + ot_overall_udp_successfulannounces + ot_overall_udp_connects, t));
 }
 
-static size_t stats_udpconnections_mrtg(char *reply) {
+static void stats_udpconnections_mrtg(char **reply, const char *reply_end) {
   ot_time t = time(NULL) - ot_start_time;
-  return sprintf(reply, "%llu\n%llu\n%i seconds (%i hours)\nopentracker udp4 stats, %lu conns/s :: %lu success/s.", ot_overall_udp_connections,
-                 ot_overall_udp_successfulannounces + ot_overall_udp_connects, (int)t, (int)(t / 3600), events_per_time(ot_overall_udp_connections, t),
-                 events_per_time(ot_overall_udp_successfulannounces + ot_overall_udp_connects, t));
+  fmt_append(reply, reply_end, "%llu\n%llu\n%i seconds (%i hours)\nopentracker udp4 stats, %lu conns/s :: %lu success/s.", ot_overall_udp_connections,
+                    ot_overall_udp_successfulannounces + ot_overall_udp_connects, (int)t, (int)(t / 3600), events_per_time(ot_overall_udp_connections, t),
+                    events_per_time(ot_overall_udp_successfulannounces + ot_overall_udp_connects, t));
 }
 
-static size_t stats_tcpconnections_mrtg(char *reply) {
+static void stats_tcpconnections_mrtg(char **reply, const char *reply_end) {
   time_t t = time(NULL) - ot_start_time;
-  return sprintf(reply, "%llu\n%llu\n%i seconds (%i hours)\nopentracker tcp4 stats, %lu conns/s :: %lu success/s.", ot_overall_tcp_connections,
-                 ot_overall_tcp_successfulannounces, (int)t, (int)(t / 3600), events_per_time(ot_overall_tcp_connections, t),
-                 events_per_time(ot_overall_tcp_successfulannounces, t));
+  fmt_append(reply, reply_end, "%llu\n%llu\n%i seconds (%i hours)\nopentracker tcp4 stats, %lu conns/s :: %lu success/s.", ot_overall_tcp_connections,
+                    ot_overall_tcp_successfulannounces, (int)t, (int)(t / 3600), events_per_time(ot_overall_tcp_connections, t),
+                    events_per_time(ot_overall_tcp_successfulannounces, t));
 }
 
-static size_t stats_scrape_mrtg(char *reply) {
+static void stats_scrape_mrtg(char **reply, const char *reply_end) {
   time_t t = time(NULL) - ot_start_time;
-  return sprintf(reply, "%llu\n%llu\n%i seconds (%i hours)\nopentracker scrape stats, %lu scrape/s (tcp and udp)", ot_overall_tcp_successfulscrapes,
-                 ot_overall_udp_successfulscrapes, (int)t, (int)(t / 3600),
-                 events_per_time((ot_overall_tcp_successfulscrapes + ot_overall_udp_successfulscrapes), t));
+  fmt_append(reply, reply_end, "%llu\n%llu\n%i seconds (%i hours)\nopentracker scrape stats, %lu scrape/s (tcp and udp)",
+                    ot_overall_tcp_successfulscrapes, ot_overall_udp_successfulscrapes, (int)t, (int)(t / 3600),
+                    events_per_time((ot_overall_tcp_successfulscrapes + ot_overall_udp_successfulscrapes), t));
 }
 
-static size_t stats_fullscrapes_mrtg(char *reply) {
+static void stats_fullscrapes_mrtg(char **reply, const char *reply_end) {
   ot_time t = time(NULL) - ot_start_time;
-  return sprintf(reply, "%llu\n%llu\n%i seconds (%i hours)\nopentracker full scrape stats, %lu conns/s :: %lu bytes/s.", ot_full_scrape_count * 1000,
-                 ot_full_scrape_size, (int)t, (int)(t / 3600), events_per_time(ot_full_scrape_count, t), events_per_time(ot_full_scrape_size, t));
+  fmt_append(reply, reply_end, "%llu\n%llu\n%i seconds (%i hours)\nopentracker full scrape stats, %lu conns/s :: %lu bytes/s.",
+                    ot_full_scrape_count * 1000, ot_full_scrape_size, (int)t, (int)(t / 3600), events_per_time(ot_full_scrape_count, t),
+                    events_per_time(ot_full_scrape_size, t));
 }
 
-static size_t stats_peers_mrtg(char *reply) {
+static void stats_peers_mrtg(char **reply, const char *reply_end) {
   torrent_stats stats = {0, 0, 0};
 
   iterate_all_torrents(torrent_statter, (uintptr_t)&stats);
 
-  return sprintf(reply, "%llu\n%llu\nopentracker serving %llu torrents\nopentracker", stats.peer_count, stats.seed_count, stats.torrent_count);
+  fmt_append(reply, reply_end, "%llu\n%llu\nopentracker serving %llu torrents\nopentracker", stats.peer_count, stats.seed_count,
+                    stats.torrent_count);
 }
 
-static size_t stats_torrents_mrtg(char *reply) {
+static void stats_torrents_mrtg(char **reply, const char *reply_end) {
   size_t torrent_count = mutex_get_torrent_count();
 
-  return sprintf(reply, "%zd\n%zd\nopentracker serving %zd torrents\nopentracker", torrent_count, (size_t)0, torrent_count);
+  fmt_append(reply, reply_end, "%zd\n%zd\nopentracker serving %zd torrents\nopentracker", torrent_count, (size_t)0, torrent_count);
 }
 
-static size_t stats_httperrors_txt(char *reply) {
-  return sprintf(reply, "302 RED %llu\n400 ... %llu\n400 PAR %llu\n400 COM %llu\n403 IP  %llu\n404 INV %llu\n500 SRV %llu\n", ot_failed_request_counts[0],
-                 ot_failed_request_counts[1], ot_failed_request_counts[2], ot_failed_request_counts[3], ot_failed_request_counts[4],
-                 ot_failed_request_counts[5], ot_failed_request_counts[6]);
+static void stats_httperrors_txt(char **reply, const char *reply_end) {
+  fmt_append(reply, reply_end, "302 RED %llu\n400 ... %llu\n400 PAR %llu\n400 COM %llu\n403 IP  %llu\n404 INV %llu\n500 SRV %llu\n",
+                    ot_failed_request_counts[0], ot_failed_request_counts[1], ot_failed_request_counts[2], ot_failed_request_counts[3],
+                    ot_failed_request_counts[4], ot_failed_request_counts[5], ot_failed_request_counts[6]);
 }
 
-static size_t stats_return_renew_bucket(char *reply) {
-  char *r = reply;
-  int   i;
+static void stats_return_renew_bucket(char **reply, const char *reply_end) {
+  int i;
 
   for (i = 0; i < OT_PEER_TIMEOUT; ++i)
-    r += sprintf(r, "%02i %llu\n", i, ot_renewed[i]);
-  return r - reply;
+    fmt_append(reply, reply_end, "%02i %llu\n", i, ot_renewed[i]);
 }
 
-static size_t stats_return_sync_mrtg(char *reply) {
+static void stats_return_sync_mrtg(char **reply, const char *reply_end) {
   ot_time t = time(NULL) - ot_start_time;
-  return sprintf(reply, "%llu\n%llu\n%i seconds (%i hours)\nopentracker connections, %lu conns/s :: %lu success/s.", ot_overall_sync_count, 0LL, (int)t,
-                 (int)(t / 3600), events_per_time(ot_overall_tcp_connections + ot_overall_udp_connections, t),
-                 events_per_time(ot_overall_tcp_successfulannounces + ot_overall_udp_successfulannounces + ot_overall_udp_connects, t));
+  fmt_append(reply, reply_end, "%llu\n%llu\n%i seconds (%i hours)\nopentracker connections, %lu conns/s :: %lu success/s.", ot_overall_sync_count, 0LL,
+                    (int)t, (int)(t / 3600), events_per_time(ot_overall_tcp_connections + ot_overall_udp_connections, t),
+                    events_per_time(ot_overall_tcp_successfulannounces + ot_overall_udp_successfulannounces + ot_overall_udp_connects, t));
 }
 
-static size_t stats_return_completed_mrtg(char *reply) {
+static void stats_return_completed_mrtg(char **reply, const char *reply_end) {
   ot_time t = time(NULL) - ot_start_time;
 
-  return sprintf(reply, "%llu\n%llu\n%i seconds (%i hours)\nopentracker, %lu completed/h.", ot_overall_completed, 0LL, (int)t, (int)(t / 3600),
-                 events_per_time(ot_overall_completed, t / 3600));
+  fmt_append(reply, reply_end, "%llu\n%llu\n%i seconds (%i hours)\nopentracker, %lu completed/h.", ot_overall_completed, 0LL, (int)t, (int)(t / 3600),
+                    events_per_time(ot_overall_completed, t / 3600));
 }
 
 #ifdef WANT_LOG_NUMWANT
 extern unsigned long long numwants[201];
-static size_t             stats_return_numwants(char *reply) {
-  char *r = reply;
-  int   i;
+static void             stats_return_numwants(char **reply, const char *reply_end) {
+  int i;
   for (i = 0; i <= 200; ++i)
-    r += sprintf(r, "%03d => %lld\n", i, numwants[i]);
-  return r - reply;
+    fmt_append(reply, reply_end, "%03d => %lld\n", i, numwants[i]);
 }
 #endif
 
@@ -459,148 +442,158 @@ static void stats_return_fulllog(size_t *iovec_entries, struct iovec **iovector,
 
   while (loglist) {
     if (r + (loglist->size + 64) >= re) {
-      r = iovec_fix_increase_or_free(iovec_entries, iovector, r, 32 * OT_STATS_TMPSIZE);
+      r = iovec_next_chunk(iovec_entries, iovector, r, 32 * OT_STATS_TMPSIZE);
       if (!r)
         return;
       re = r + 32 * OT_STATS_TMPSIZE;
     }
-    r      += sprintf(r, "%08ld: ", loglist->time);
-    r      += ip_format(r, loglist->ip);
-    *r++    = '\n';
-    memcpy(r, loglist->data, loglist->size);
-    r      += loglist->size;
-    *r++    = '\n';
-    *r++    = '*';
-    *r++    = '\n';
-    *r++    = '\n';
+    char ip_readable[64];
+
+    ip_readable[ip_format(ip_readable, loglist->ip)] = 0;
+    fmt_append(&r, re, "%08ld: %s\n", loglist->time, ip_readable);
+    fmt_bytes(&r, re, loglist->data, loglist->size);
+    fmt_append(&r, re, "\n*\n\n");
 
-    llnext  = loglist->next;
+    llnext = loglist->next;
     free(loglist->data);
     free(loglist);
     loglist = llnext;
   }
-  iovec_fixlast(iovec_entries, iovector, r);
+  iovec_trim_last(iovec_entries, iovector, r);
 }
 #endif
 
-static size_t stats_return_everything(char *reply) {
+static void stats_return_everything(char **reply, const char *reply_end) {
   torrent_stats stats = {0, 0, 0};
   int           i;
-  char         *r = reply;
 
   iterate_all_torrents(torrent_statter, (uintptr_t)&stats);
 
-  r += sprintf(r, "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n");
-  r += sprintf(r, "<stats>\n");
-  r += sprintf(r, "  <tracker_id>%" PRIu32 "</tracker_id>\n", g_tracker_id);
-  r += sprintf(r, "  <version>\n");
-  r += stats_return_tracker_version(r);
-  r += sprintf(r, "  </version>\n");
-  r += sprintf(r, "  <uptime>%llu</uptime>\n", (unsigned long long)(time(NULL) - ot_start_time));
-  r += sprintf(r, "  <torrents>\n");
-  r += sprintf(r, "    <count_mutex>%zd</count_mutex>\n", mutex_get_torrent_count());
-  r += sprintf(r, "    <count_iterator>%llu</count_iterator>\n", stats.torrent_count);
-  r += sprintf(r, "  </torrents>\n");
-  r += sprintf(r, "  <peers>\n    <count>%llu</count>\n  </peers>\n", stats.peer_count);
-  r += sprintf(r, "  <seeds>\n    <count>%llu</count>\n  </seeds>\n", stats.seed_count);
-  r += sprintf(r, "  <completed>\n    <count>%llu</count>\n  </completed>\n", ot_overall_completed);
-  r += sprintf(r, "  <connections>\n");
-  r += sprintf(r, "    <tcp>\n      <accept>%llu</accept>\n      <announce>%llu</announce>\n      <scrape>%llu</scrape>\n    </tcp>\n",
-      ot_overall_tcp_connections, ot_overall_tcp_successfulannounces, ot_overall_tcp_successfulscrapes);
-  r += sprintf(r, "    <udp>\n      <overall>%llu</overall>\n      <connect>%llu</connect>\n      <announce>%llu</announce>\n      <scrape>%llu</scrape>\n      <missmatch>%llu</missmatch>\n    </udp>\n",
-      ot_overall_udp_connections, ot_overall_udp_connects, ot_overall_udp_successfulannounces, ot_overall_udp_successfulscrapes,
-      ot_overall_udp_connectionidmissmatches);
-  r += sprintf(r, "    <livesync>\n      <count>%llu</count>\n    </livesync>\n", ot_overall_sync_count);
-  r += sprintf(r, "  </connections>\n");
-  r += sprintf(r, "  <debug>\n");
-  r += sprintf(r, "    <renew>\n");
+  fmt_append(reply, reply_end, "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n");
+  fmt_append(reply, reply_end, "<stats>\n");
+  fmt_append(reply, reply_end, "  <tracker_id>%" PRIu32 "</tracker_id>\n", g_tracker_id);
+  fmt_append(reply, reply_end, "  <version>\n");
+  stats_return_tracker_version(reply, reply_end);
+  fmt_append(reply, reply_end, "  </version>\n");
+  fmt_append(reply, reply_end, "  <uptime>%llu</uptime>\n", (unsigned long long)(time(NULL) - ot_start_time));
+  fmt_append(reply, reply_end, "  <torrents>\n");
+  fmt_append(reply, reply_end, "    <count_mutex>%zd</count_mutex>\n", mutex_get_torrent_count());
+  fmt_append(reply, reply_end, "    <count_iterator>%llu</count_iterator>\n", stats.torrent_count);
+  fmt_append(reply, reply_end, "  </torrents>\n");
+  fmt_append(reply, reply_end, "  <peers>\n    <count>%llu</count>\n  </peers>\n", stats.peer_count);
+  fmt_append(reply, reply_end, "  <seeds>\n    <count>%llu</count>\n  </seeds>\n", stats.seed_count);
+  fmt_append(reply, reply_end, "  <completed>\n    <count>%llu</count>\n  </completed>\n", ot_overall_completed);
+  fmt_append(reply, reply_end, "  <connections>\n");
+  fmt_append(reply, reply_end, "    <tcp>\n      <accept>%llu</accept>\n      <announce>%llu</announce>\n      <scrape>%llu</scrape>\n    </tcp>\n",
+             ot_overall_tcp_connections, ot_overall_tcp_successfulannounces, ot_overall_tcp_successfulscrapes);
+  fmt_append(reply, reply_end, "    <udp>\n      <overall>%llu</overall>\n      <connect>%llu</connect>\n      <announce>%llu</announce>\n      <scrape>%llu</scrape>\n      <missmatch>%llu</missmatch>\n    </udp>\n",
+             ot_overall_udp_connections, ot_overall_udp_connects, ot_overall_udp_successfulannounces, ot_overall_udp_successfulscrapes,
+             ot_overall_udp_connectionidmissmatches);
+  fmt_append(reply, reply_end, "    <livesync>\n      <count>%llu</count>\n    </livesync>\n", ot_overall_sync_count);
+  fmt_append(reply, reply_end, "  </connections>\n");
+  fmt_append(reply, reply_end, "  <debug>\n");
+  fmt_append(reply, reply_end, "    <renew>\n");
   for (i = 0; i < OT_PEER_TIMEOUT; ++i)
-    r += sprintf(r, "      <count interval=\"%02i\">%llu</count>\n", i, ot_renewed[i]);
-  r += sprintf(r, "    </renew>\n");
-  r += sprintf(r, "    <http_error>\n");
+    fmt_append(reply, reply_end, "      <count interval=\"%02i\">%llu</count>\n", i, ot_renewed[i]);
+  fmt_append(reply, reply_end, "    </renew>\n");
+  fmt_append(reply, reply_end, "    <http_error>\n");
   for (i = 0; i < CODE_HTTPERROR_COUNT; ++i)
-    r += sprintf(r, "      <count code=\"%s\">%llu</count>\n", ot_failed_request_names[i], ot_failed_request_counts[i]);
-  r += sprintf(r, "    </http_error>\n");
-  r += sprintf(r, "    <mutex_stall>\n      <count>%llu</count>\n    </mutex_stall>\n", ot_overall_stall_count);
-  r += sprintf(r, "  </debug>\n");
-  r += sprintf(r, "</stats>");
-  return r - reply;
+    fmt_append(reply, reply_end, "      <count code=\"%s\">%llu</count>\n", ot_failed_request_names[i], ot_failed_request_counts[i]);
+  fmt_append(reply, reply_end, "    </http_error>\n");
+  fmt_append(reply, reply_end, "    <mutex_stall>\n      <count>%llu</count>\n    </mutex_stall>\n", ot_overall_stall_count);
+  fmt_append(reply, reply_end, "  </debug>\n");
+  fmt_append(reply, reply_end, "</stats>");
 }
 
-size_t stats_return_tracker_version(char *reply) {
+void stats_return_tracker_version(char **reply, const char *reply_end) {
 #define QUOTE(name) #name
 #define SQUOTE(name) QUOTE(name)
-  return sprintf(reply, "https://erdgeist.org/gitweb/opentracker/commit/?id=" SQUOTE(GIT_VERSION) "\n");
+  fmt_append(reply, reply_end, "https://erdgeist.org/gitweb/opentracker/commit/?id=" SQUOTE(GIT_VERSION) "\n");
 }
 
-size_t return_stats_for_tracker(char *reply, int mode, int format) {
+void return_stats_for_tracker(char **reply, const char *reply_end, int mode, int format) {
   (void)format;
   switch (mode & TASK_TASK_MASK) {
   case TASK_STATS_CONNS:
-    return stats_connections_mrtg(reply);
+    stats_connections_mrtg(reply, reply_end);
+    break;
   case TASK_STATS_SCRAPE:
-    return stats_scrape_mrtg(reply);
+    stats_scrape_mrtg(reply, reply_end);
+    break;
   case TASK_STATS_UDP:
-    return stats_udpconnections_mrtg(reply);
+    stats_udpconnections_mrtg(reply, reply_end);
+    break;
   case TASK_STATS_TCP:
-    return stats_tcpconnections_mrtg(reply);
+    stats_tcpconnections_mrtg(reply, reply_end);
+    break;
   case TASK_STATS_FULLSCRAPE:
-    return stats_fullscrapes_mrtg(reply);
+    stats_fullscrapes_mrtg(reply, reply_end);
+    break;
   case TASK_STATS_COMPLETED:
-    return stats_return_completed_mrtg(reply);
+    stats_return_completed_mrtg(reply, reply_end);
+    break;
   case TASK_STATS_HTTPERRORS:
-    return stats_httperrors_txt(reply);
+    stats_httperrors_txt(reply, reply_end);
+    break;
   case TASK_STATS_VERSION:
-    return stats_return_tracker_version(reply);
+    stats_return_tracker_version(reply, reply_end);
+    break;
   case TASK_STATS_RENEW:
-    return stats_return_renew_bucket(reply);
+    stats_return_renew_bucket(reply, reply_end);
+    break;
   case TASK_STATS_SYNCS:
-    return stats_return_sync_mrtg(reply);
+    stats_return_sync_mrtg(reply, reply_end);
+    break;
 #ifdef WANT_LOG_NUMWANT
   case TASK_STATS_NUMWANTS:
-    return stats_return_numwants(reply);
+    stats_return_numwants(reply, reply_end);
+    break;
 #endif
   default:
-    return 0;
+    break;
   }
 }
 
 static void stats_make(size_t *iovec_entries, struct iovec **iovector, ot_tasktype mode) {
-  char *r;
+  char       *r;
+  const char *r_end;
 
   *iovec_entries = 0;
   *iovector      = NULL;
-  if (!(r = iovec_increase(iovec_entries, iovector, OT_STATS_TMPSIZE)))
+  if (!(r = iovec_new_chunk(iovec_entries, iovector, OT_STATS_TMPSIZE)))
     return;
+  r_end = r + OT_STATS_TMPSIZE;
 
   switch (mode & TASK_TASK_MASK) {
   case TASK_STATS_TORRENTS:
-    r += stats_torrents_mrtg(r);
+    stats_torrents_mrtg(&r, r_end);
     break;
   case TASK_STATS_PEERS:
-    r += stats_peers_mrtg(r);
+    stats_peers_mrtg(&r, r_end);
     break;
   case TASK_STATS_SLASH24S:
-    r += stats_slash24s_txt(r, 128);
+    stats_slash24s_txt(&r, r_end, 128);
     break;
   case TASK_STATS_TOP10:
-    r += stats_top_txt(r, 10);
+    stats_top_txt(&r, r_end, 10);
     break;
   case TASK_STATS_TOP100:
-    r = iovec_fix_increase_or_free(iovec_entries, iovector, r, 4 * OT_STATS_TMPSIZE);
+    r = iovec_next_chunk(iovec_entries, iovector, r, 4 * OT_STATS_TMPSIZE);
     if (!r)
       return;
-    r += stats_top_txt(r, 100);
+    r_end = r + 4 * OT_STATS_TMPSIZE;
+    stats_top_txt(&r, r_end, 100);
     break;
   case TASK_STATS_EVERYTHING:
-    r = iovec_fix_increase_or_free(iovec_entries, iovector, r, OT_STATS_TMPSIZE + 64 * OT_PEER_TIMEOUT);
+    r = iovec_next_chunk(iovec_entries, iovector, r, OT_STATS_TMPSIZE + 64 * OT_PEER_TIMEOUT);
     if (!r)
       return;
-    r += stats_return_everything(r);
+    r_end = r + OT_STATS_TMPSIZE + 64 * OT_PEER_TIMEOUT;
+    stats_return_everything(&r, r_end);
     break;
 #ifdef WANT_SPOT_WOODPECKER
   case TASK_STATS_WOODPECKERS:
-    r += stats_return_woodpeckers(r, 128);
+    stats_return_woodpeckers(&r, r_end, 128);
     break;
 #endif
 #ifdef WANT_FULLLOG_NETWORKS
@@ -612,7 +605,7 @@ static void stats_make(size_t *iovec_entries, struct iovec **iovector, ot_taskty
     iovec_free(iovec_entries, iovector);
     return;
   }
-  iovec_fixlast(iovec_entries, iovector, r);
+  iovec_trim_last(iovec_entries, iovector, r);
 }
 
 void stats_issue_event(ot_status_event event, PROTO_FLAG proto, uintptr_t event_data) {
@@ -651,9 +644,9 @@ void stats_issue_event(ot_status_event event, PROTO_FLAG proto, uintptr_t event_
       localtime_r(&ttt, &time_now);
       strftime(timestring, sizeof(timestring), "%FT%T%z", &time_now);
 
-      hex_fromhash(hash_hex, *ws->hash);
+      hex_from_hash(hash_hex, *ws->hash);
       if (ws->peer_id)
-        hex_fromhash(peerid_hex, (uint8_t *)ws->peer_id);
+        hex_from_hash(peerid_hex, (uint8_t *)ws->peer_id);
       else {
         *peerid_hex = 0;
       }
diff --git a/ot_stats.h b/ot_stats.h
index 203831c..fb6aad8 100644
--- a/ot_stats.h
+++ b/ot_stats.h
@@ -44,8 +44,8 @@ enum {
 void               stats_issue_event(ot_status_event event, PROTO_FLAG proto, uintptr_t event_data);
 void               stats_deliver(int64_t sock, int tasktype);
 void               stats_cleanup(void);
-size_t             return_stats_for_tracker(char *reply, int mode, int format);
-size_t             stats_return_tracker_version(char *reply);
+void               return_stats_for_tracker(char **reply, const char *reply_end, int mode, int format);
+void               stats_return_tracker_version(char **reply, const char *reply_end);
 void               stats_init(void);
 void               stats_deinit(void);
 
diff --git a/ot_sync.c b/ot_sync.c
index dc71ddd..f656bef 100644
--- a/ot_sync.c
+++ b/ot_sync.c
@@ -10,10 +10,8 @@
 #include <sys/types.h>
 #include <sys/uio.h>
 
-/* Libowfat */
-#include "io.h"
-
 /* Opentracker */
+#include "ot_fmt.h"
 #include "ot_iovec.h"
 #include "ot_mutex.h"
 #include "ot_scan.h"
@@ -51,7 +49,7 @@ int add_changeset_to_tracker(uint8_t *data, size_t len) {
     data += sizeof(ot_hash);
 
     /* Scan string length indicator, strictly: bencode writes no leading zeros */
-    data += (len = scan_udec_bencode((char *)data, &peer_count, (uint64_t)(end - data)));
+    data += (len = scan_uint_bencode((char *)data, &peer_count, (uint64_t)(end - data)));
 
     /* If no long was scanned, it is not divisible by 8, it is not
        followed by a colon or claims to need to much memory, we fail */
@@ -77,7 +75,7 @@ static void sync_make(size_t *iovec_entries, struct iovec **iovector) {
   /* Setup return vector... */
   *iovec_entries = 0;
   *iovector      = NULL;
-  if (!(r = iovec_increase(iovec_entries, iovector, OT_SYNC_CHUNK_SIZE)))
+  if (!(r = iovec_new_chunk(iovec_entries, iovector, OT_SYNC_CHUNK_SIZE)))
     return;
 
   /* ... and pointer to end of current output buffer.
@@ -105,21 +103,17 @@ static void sync_make(size_t *iovec_entries, struct iovec **iovector) {
 
         /* Allocate a fresh output buffer at the end of our buffers list
            release bucket and return, if that fails */
-        if (!(r = iovec_fix_increase_or_free(iovec_entries, iovector, r, OT_SYNC_CHUNK_SIZE)))
+        if (!(r = iovec_next_chunk(iovec_entries, iovector, r, OT_SYNC_CHUNK_SIZE)))
           return mutex_bucket_unlock(bucket);
 
         /* Adjust new end of output buffer */
         re = r + OT_SYNC_CHUNK_SIZE;
       }
 
-      *r++ = '2';
-      *r++ = '0';
-      *r++ = ':';
-      memmove(r, hash, sizeof(ot_hash));
-      r += sizeof(ot_hash);
-      r += sprintf(r, "%zd:", byte_count);
-      memmove(r, peer_list->changeset.data, byte_count);
-      r += byte_count;
+      fmt_append(&r, re, "20:");
+      fmt_bytes(&r, re, hash, sizeof(ot_hash));
+      fmt_append(&r, re, "%zd:", byte_count);
+      fmt_bytes(&r, re, peer_list->changeset.data, byte_count);
     }
 
     /* All torrents done: release lock on currenct bucket */
@@ -131,7 +125,7 @@ static void sync_make(size_t *iovec_entries, struct iovec **iovector) {
   *r++ = 'e';
 
   /* Release unused memory in current output buffer */
-  iovec_fixlast(iovec_entries, iovector, r);
+  iovec_trim_last(iovec_entries, iovector, r);
 }
 
 /* This is the entry point into this worker thread
diff --git a/ot_udp.c b/ot_udp.c
index 7f6517f..4e760bb 100644
--- a/ot_udp.c
+++ b/ot_udp.c
@@ -10,9 +10,6 @@
 #include <stdlib.h>
 #include <string.h>
 
-/* Libowfat */
-#include "io.h"
-
 /* Opentracker */
 #include "ot_ip.h"
 #include "ot_random.h"
@@ -108,10 +105,11 @@ int handle_udp6(int64_t serversocket, struct ot_workstruct *ws) {
        match, return an error packet */
     udp_make_connectionid(connid, remoteip, 1);
     if (inpacket[0] != connid[0] || inpacket[1] != connid[1]) {
-      const size_t s = sizeof("Connection ID missmatch.");
+      const char err_idmiss[] = "Connection ID missmatch.";
+      size_t s = sizeof(err_idmiss);
       outpacket[0]   = htonl(3);
       outpacket[1]   = inpacket[3];
-      memcpy(&outpacket[2], "Connection ID missmatch.", s);
+      memcpy(&outpacket[2], &err_idmiss[0], s);
       socket_send(serversocket, ws->outbuf, 8 + s, remoteip, remoteport);
       stats_issue_event(EVENT_CONNID_MISSMATCH, FLAG_UDP, 8 + s);
       return 1;
@@ -176,7 +174,17 @@ int handle_udp6(int64_t serversocket, struct ot_workstruct *ws) {
         numwant = max_peers;
 
       ws->reply      = ws->outbuf + 8;
-      ws->reply_size = 8 + add_peer_to_torrent_and_return_peers(FLAG_UDP, ws, numwant);
+      ws->reply_size = add_peer_to_torrent_and_return_peers(FLAG_UDP, ws, numwant);
+
+      if (!ws->reply_size) {
+        const char err_unauth[] = "Requested download is not authorized for use with this tracker.";
+        size_t s = sizeof(err_unauth);
+        outpacket[0]  = htonl(3);
+        memcpy(&outpacket[2], &err_unauth[0], s);
+        socket_send(serversocket, ws->outbuf, 8 + s, remoteip, remoteport);
+        return 1;
+      }
+      ws->reply_size += 8;
     }
 
     socket_send(serversocket, ws->outbuf, ws->reply_size, remoteip, remoteport);
diff --git a/scan_urlencoded_query.c b/ot_urlencoded.c
index cfc8708..17f12a4 100644
--- a/scan_urlencoded_query.c
+++ b/ot_urlencoded.c
@@ -4,7 +4,7 @@
    $id$ */
 
 /* Opentracker */
-#include "scan_urlencoded_query.h"
+#include "ot_urlencoded.h"
 
 /* System */
 #include <string.h>
@@ -53,7 +53,7 @@ static unsigned char fromhex(unsigned char x) {
 }
 
 /* Skip the value of a param=value pair */
-void scan_urlencoded_skipvalue(char **string) {
+void urlencoded_skip_value(char **string) {
   const unsigned char *s = *(const unsigned char **)string;
   unsigned char        f;
 
@@ -63,16 +63,16 @@ void scan_urlencoded_skipvalue(char **string) {
     ;
 
   /* If we stopped at a hard terminator like \0 or \n, make the
-     next scan_urlencoded_query encounter it again */
+     next urlencoded_parse encounter it again */
   if (f & SCAN_SEARCHPATH_TERMINATOR)
     --s;
 
   *string = (char *)s;
 }
 
-int scan_find_keywords(const ot_keywords *keywords, char **string, SCAN_SEARCHPATH_FLAG flags) {
+int urlencoded_match_keyword(const ot_keywords *keywords, char **string, SCAN_SEARCHPATH_FLAG flags) {
   char   *deststring   = *string;
-  ssize_t match_length = scan_urlencoded_query(string, deststring, flags);
+  ssize_t match_length = urlencoded_parse(string, deststring, flags);
 
   if (match_length < 0)
     return match_length;
@@ -88,7 +88,7 @@ int scan_find_keywords(const ot_keywords *keywords, char **string, SCAN_SEARCHPA
   return -3;
 }
 
-ssize_t scan_urlencoded_query(char **string, char *deststring, SCAN_SEARCHPATH_FLAG flags) {
+ssize_t urlencoded_parse(char **string, char *deststring, SCAN_SEARCHPATH_FLAG flags) {
   const unsigned char *s = *(const unsigned char **)string;
   unsigned char       *d = (unsigned char *)deststring;
   unsigned char        b, c;
@@ -121,7 +121,7 @@ ssize_t scan_urlencoded_query(char **string, char *deststring, SCAN_SEARCHPATH_F
     if (d == (unsigned char *)deststring)
       return -2;
 
-    /* Else make the next call to scan_urlencoded_param encounter it again */
+    /* Else make the next call to urlencoded_parse encounter it again */
     --s;
     break;
   case '?':
@@ -146,19 +146,6 @@ ssize_t scan_urlencoded_query(char **string, char *deststring, SCAN_SEARCHPATH_F
   return d - (unsigned char *)deststring;
 }
 
-ssize_t scan_fixed_int(char *data, size_t len, int *tmp) {
-  int minus = 0;
-  *tmp      = 0;
-  if (*data == '-')
-    --len, ++data, ++minus;
-  while ((len > 0) && (*data >= '0') && (*data <= '9')) {
-    --len;
-    *tmp = 10 * *tmp + *data++ - '0';
-  }
-  if (minus)
-    *tmp = -*tmp;
-  return len;
-}
 
 size_t urlencoded_format(char *dest, const uint8_t *src, size_t len) {
   static const char safe[]     = "$/.=~-_";
diff --git a/scan_urlencoded_query.h b/ot_urlencoded.h
index 24e09fd..b6f1208 100644
--- a/scan_urlencoded_query.h
+++ b/ot_urlencoded.h
@@ -30,7 +30,7 @@ typedef enum {
               or -1 for parse error
               or -2 for terminator found
 */
-ssize_t scan_urlencoded_query(char **string, char *deststring, SCAN_SEARCHPATH_FLAG flags);
+ssize_t urlencoded_parse(char **string, char *deststring, SCAN_SEARCHPATH_FLAG flags);
 
 /* string     in: pointer to source
               out: pointer to next scan position
@@ -40,19 +40,13 @@ ssize_t scan_urlencoded_query(char **string, char *deststring, SCAN_SEARCHPATH_F
               or -2 for terminator found
               or -3 for no keyword matched
  */
-int     scan_find_keywords(const ot_keywords *keywords, char **string, SCAN_SEARCHPATH_FLAG flags);
+int     urlencoded_match_keyword(const ot_keywords *keywords, char **string, SCAN_SEARCHPATH_FLAG flags);
 
 /* string     in: pointer to value of a param=value pair to skip
               out: pointer to next scan position on return
 */
-void    scan_urlencoded_skipvalue(char **string);
+void    urlencoded_skip_value(char **string);
 
-/* data       pointer to len chars of string
- len        length of chars in data to parse
- number     number to receive result
- returns    number of bytes not parsed, mostly !=0 means fail
- */
-ssize_t scan_fixed_int(char *data, size_t len, int *number);
 
 /* The other direction: percent encode len bytes from src into dest and return
    how many characters were written. dest needs room for three times len. */
diff --git a/ot_vector.c b/ot_vector.c
index 924d468..a56d55b 100644
--- a/ot_vector.c
+++ b/ot_vector.c
@@ -57,34 +57,39 @@ static uint8_t vector_hash_peer(ot_peer const *peer, size_t compare_size, size_t
 */
 void *vector_find_or_insert(ot_vector *vector, void *key, size_t member_size, size_t compare_size, int *exactmatch) {
   uint8_t *match = vector_binary_search(key, vector->data, vector->size, member_size, compare_size, exactmatch);
+  size_t   match_offset, bytes_after;
 
   if (*exactmatch)
     return match;
 
+  /* Hold the insertion point as an offset rather than a pointer: it survives
+     the realloc below, and an empty vector has no data pointer to offset from
+     in the first place */
+  match_offset = vector->size ? (size_t)(match - (uint8_t *)vector->data) : 0;
+  bytes_after  = member_size * vector->size - match_offset;
+
   if (vector->size + 1 > vector->space) {
-    size_t    new_space = vector->space ? OT_VECTOR_GROW_RATIO * vector->space : OT_VECTOR_MIN_MEMBERS;
-    ptrdiff_t match_off = match - (uint8_t *)vector->data;
-    uint8_t  *new_data  = realloc(vector->data, new_space * member_size);
+    size_t   new_space = vector->space ? OT_VECTOR_GROW_RATIO * vector->space : OT_VECTOR_MIN_MEMBERS;
+    uint8_t *new_data  = realloc(vector->data, new_space * member_size);
 
     if (!new_data)
       return NULL;
 
-    /* Adjust pointer if it moved by realloc */
-    match         = new_data + match_off;
-
     vector->data  = new_data;
     vector->space = new_space;
   }
-  memmove(match + member_size, match, ((uint8_t *)vector->data) + member_size * vector->size - match);
+
+  match = (uint8_t *)vector->data + match_offset;
+  memmove(match + member_size, match, bytes_after);
 
   vector->size++;
   return match;
 }
 
 ot_peer *vector_find_or_insert_peer(ot_vector *vector, ot_peer const *peer, size_t peer_size, int *exactmatch) {
-  ot_peer     *match, *end;
+  ot_peer     *match;
   const size_t compare_size = OT_PEER_COMPARE_SIZE_FROM_PEER_SIZE(peer_size);
-  size_t       match_to_end;
+  size_t       match_offset, bytes_after;
 
   /* If space is zero but size is set, we're dealing with a list of vector->size buckets */
   if (vector->space < vector->size)
@@ -94,26 +99,26 @@ ot_peer *vector_find_or_insert_peer(ot_vector *vector, ot_peer const *peer, size
   if (*exactmatch)
     return match;
 
-  /* This is the amount of bytes that needs to be pushed backwards by peer_size bytes to make room for new peer */
-  end          = (ot_peer *)vector->data + vector->size * peer_size;
-  match_to_end = end - match;
+  /* Hold the insertion point as an offset rather than a pointer: it survives
+     the realloc below, and an empty vector has no data pointer to offset from
+     in the first place. bytes_after is what has to move up by peer_size to
+     make room for the new peer */
+  match_offset = vector->size ? (size_t)(match - (ot_peer *)vector->data) : 0;
+  bytes_after  = vector->size * peer_size - match_offset;
 
   if (vector->size + 1 > vector->space) {
-    ptrdiff_t offset    = match - (ot_peer *)vector->data;
-    size_t    new_space = vector->space ? OT_VECTOR_GROW_RATIO * vector->space : OT_VECTOR_MIN_MEMBERS;
-    ot_peer  *new_data  = realloc(vector->data, new_space * peer_size);
+    size_t   new_space = vector->space ? OT_VECTOR_GROW_RATIO * vector->space : OT_VECTOR_MIN_MEMBERS;
+    ot_peer *new_data  = realloc(vector->data, new_space * peer_size);
 
     if (!new_data)
       return NULL;
-    /* Adjust pointer if it moved by realloc */
-    match         = new_data + offset;
 
     vector->data  = new_data;
     vector->space = new_space;
   }
 
-  /* Here we're guaranteed to have enough space in vector to move the block of peers after insertion point */
-  memmove(match + peer_size, match, match_to_end);
+  match = (ot_peer *)vector->data + match_offset;
+  memmove(match + peer_size, match, bytes_after);
 
   vector->size++;
   return match;
@@ -150,11 +155,13 @@ int vector_remove_peer(ot_vector *vector, ot_peer const *peer, size_t peer_size)
 }
 
 void vector_remove_torrent(ot_vector *vector, ot_torrent *match) {
-  ot_torrent *end = ((ot_torrent *)vector->data) + vector->size;
+  ot_torrent *end;
 
   if (!vector->size)
     return;
 
+  end = ((ot_torrent *)vector->data) + vector->size;
+
   free_peerlist(match->peer_list6);
   free_peerlist(match->peer_list4);
 
diff --git a/proxy.c b/proxy.c
index 0cac20c..a5c6bb7 100644
--- a/proxy.c
+++ b/proxy.c
@@ -507,7 +507,7 @@ static int scan_ip6_port(const char *src, ot_ip6 ip, uint16_t *port) {
     ++s;
   if (*s == '[')
     ++s, ++bracket; /* for v6 style notation */
-  if (!(off = ip_scan(s, ip)))
+  if (!(off = ip_parse(s, ip)))
     return 0;
   s += off;
   if (*s == 0 || isspace(*s))
@@ -522,7 +522,7 @@ static int scan_ip6_port(const char *src, ot_ip6 ip, uint16_t *port) {
     if (*(s++) != ':')
       return 0;
   }
-  if (!(off = scan_udec(s, &value, 65535)))
+  if (!(off = scan_uint(s, &value, 65535)))
     return 0;
   *port = (uint16_t)value;
   return off + s - src;
diff --git a/tests/integration/.gitignore b/tests/integration/.gitignore
new file mode 100644
index 0000000..7a60b85
--- /dev/null
+++ b/tests/integration/.gitignore
@@ -0,0 +1,2 @@
+__pycache__/
+*.pyc
diff --git a/tests/integration/harness.py b/tests/integration/harness.py
new file mode 100644
index 0000000..03a0561
--- /dev/null
+++ b/tests/integration/harness.py
@@ -0,0 +1,308 @@
+"""Starts a real opentracker and talks to it over the wire.
+
+Everything here drives the binary rather than the code, so these tests cover
+what the unit suite cannot reach: the event loop, the HTTP parser and the
+torrent store working together. Run against a sanitizer build and the tracker
+reports its own memory errors, which the teardown turns into test failures.
+"""
+
+import os
+import shutil
+import signal
+import socket
+import struct
+import subprocess
+import sys
+import tempfile
+import time
+import unittest
+import urllib.error
+import urllib.parse
+import urllib.request
+
+TRACKER = os.environ.get("OPENTRACKER", os.path.join(os.path.dirname(__file__), "..", "..", "opentracker.debug"))
+
+
+def bdecode(data):
+    """Enough bencode for what a tracker answers."""
+
+    def value(i):
+        if data[i : i + 1] == b"d":
+            i, out = i + 1, {}
+            while data[i : i + 1] != b"e":
+                i, key = value(i)
+                i, out[key] = value(i)
+            return i + 1, out
+        if data[i : i + 1] == b"l":
+            i, out = i + 1, []
+            while data[i : i + 1] != b"e":
+                i, item = value(i)
+                out.append(item)
+            return i + 1, out
+        if data[i : i + 1] == b"i":
+            end = data.index(b"e", i)
+            return end + 1, int(data[i + 1 : end])
+        colon = data.index(b":", i)
+        length = int(data[i:colon])
+        return colon + 1 + length, data[colon + 1 : colon + 1 + length]
+
+    return value(0)[1]
+
+
+def free_port():
+    probe = socket.socket()
+    probe.bind(("127.0.0.1", 0))
+    port = probe.getsockname()[1]
+    probe.close()
+    return port
+
+
+class Tracker:
+    """One tracker process, listening on loopback."""
+
+    def __init__(self, extra_config="", files=None):
+        self.port = free_port()
+        self.dir = tempfile.mkdtemp(prefix="ot-integration-")
+        self.log = None
+        self.process = None
+        try:
+            for name, content in (files or {}).items():
+                with open(os.path.join(self.dir, name), "wb") as handle:
+                    handle.write(content)
+            self.config = os.path.join(self.dir, "opentracker.conf")
+            with open(self.config, "w") as handle:
+                handle.write("listen.tcp 127.0.0.1:%d\n" % self.port)
+                handle.write("listen.udp 127.0.0.1:%d\n" % self.port)
+                handle.write(extra_config.replace("{dir}", self.dir))
+            self.log = open(os.path.join(self.dir, "tracker.log"), "w+b")
+            # Leak detection is left at the sanitizer's own default, which is on
+            # where LeakSanitizer exists and off where it does not. Asking for it
+            # by name makes the tracker refuse to start on macOS and FreeBSD.
+            environment = dict(os.environ, ASAN_OPTIONS="abort_on_error=0")
+            self.process = subprocess.Popen([TRACKER, "-f", self.config], stdout=self.log, stderr=self.log, env=environment)
+            self._wait_for_port()
+        except BaseException:
+            self._cleanup()
+            raise
+
+    def _cleanup(self):
+        """Close what we opened and take the scratch directory with it."""
+        if self.process is not None and self.process.poll() is None:
+            self.process.kill()
+            self.process.wait()
+        if self.log is not None:
+            self.log.close()
+            self.log = None
+        shutil.rmtree(self.dir, ignore_errors=True)
+
+    def _wait_for_port(self):
+        for _ in range(200):
+            if self.process.poll() is not None:
+                raise AssertionError("tracker exited at once:\n" + self.output())
+            try:
+                probe = socket.create_connection(("127.0.0.1", self.port), timeout=0.2)
+                probe.close()
+                return
+            except OSError:
+                time.sleep(0.05)
+        raise AssertionError("tracker never listened on %d:\n%s" % (self.port, self.output()))
+
+    def output(self):
+        if self.log is None:
+            return ""
+        self.log.flush()
+        self.log.seek(0)
+        return self.log.read().decode("utf-8", "replace")
+
+    def stop(self):
+        """Returns anything the tracker complained about on the way out.
+
+        The interrupt rather than a kill is what makes the leak check work at
+        all: LeakSanitizer reports from an exit handler, so a killed tracker
+        reports nothing and the suite passes over leaks it never looked for.
+        """
+        if self.process is not None and self.process.poll() is None:
+            self.process.send_signal(signal.SIGINT)
+            try:
+                self.process.wait(timeout=5)
+            except subprocess.TimeoutExpired:
+                self.process.kill()
+                self.process.wait()
+        complaints = [
+            line
+            for line in self.output().splitlines()
+            if "Sanitizer" in line or "runtime error" in line or line.startswith("ERROR")
+        ]
+        self._cleanup()
+        return complaints
+
+    # ----------------------------------------------------------- over http
+
+    def get(self, path, timeout=10):
+        return urllib.request.urlopen("http://127.0.0.1:%d%s" % (self.port, path), timeout=timeout).read()
+
+    def announce(self, info_hash, peer_id=b"-OT0001-aaaaaaaaaaaa", port=6881, left=0, **extra):
+        query = {
+            "info_hash": urllib.parse.quote_from_bytes(info_hash, safe=""),
+            "peer_id": urllib.parse.quote_from_bytes(peer_id, safe=""),
+            "port": port,
+            "left": left,
+        }
+        query.update(extra)
+        return bdecode(self.get("/announce?" + "&".join("%s=%s" % item for item in query.items())))
+
+    def scrape(self, info_hash):
+        return bdecode(self.get("/scrape?info_hash=" + urllib.parse.quote_from_bytes(info_hash, safe="")))
+
+    def stats(self, mode):
+        return self.get("/stats?mode=" + mode)
+
+    def get_with_headers(self, path, headers=None, timeout=10):
+        """The body and the response headers, for the compressed answers."""
+        request = urllib.request.Request("http://127.0.0.1:%d%s" % (self.port, path), headers=headers or {})
+        with urllib.request.urlopen(request, timeout=timeout) as response:
+            return response.read(), dict(response.headers)
+
+    def torrent_count(self):
+        return int(self.stats("torr").split()[0])
+
+    # ------------------------------------------------------------ over udp
+
+    def udp_connect(self):
+        sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
+        sock.settimeout(5)
+        sock.sendto(struct.pack(">QII", 0x41727101980, 0, 1), ("127.0.0.1", self.port))
+        answer = sock.recv(2048)
+        action, _, connection_id = struct.unpack(">IIQ", answer[:16])
+        assert action == 0, "udp connect answered action %d" % action
+        return sock, connection_id
+
+    def udp_announce(self, sock, connection_id, info_hash, left=0, event=0, port=6881, numwant=-1):
+        sock.sendto(
+            struct.pack(
+                ">QII20s20sQQQIIIiH", connection_id, 1, 2, info_hash, b"p" * 20, 0, left, 0, event, 0, 0, numwant, port
+            ),
+            ("127.0.0.1", self.port),
+        )
+        answer = sock.recv(2048)
+        action, _, interval, leechers, seeders = struct.unpack(">IIIII", answer[:20])
+        assert action == 1, "udp announce answered action %d" % action
+        return {"interval": interval, "leechers": leechers, "seeders": seeders, "peers": answer[20:]}
+
+    def udp_scrape(self, sock, connection_id, hashes):
+        """One (seeders, completed, leechers) triple per hash, in order."""
+        sock.sendto(struct.pack(">QII", connection_id, 2, 3) + b"".join(hashes), ("127.0.0.1", self.port))
+        answer = sock.recv(2048)
+        action, _ = struct.unpack(">II", answer[:8])
+        assert action == 2, "udp scrape answered action %d" % action
+        return [struct.unpack(">III", answer[8 + 12 * i : 20 + 12 * i]) for i in range(len(hashes))]
+
+    def connect(self):
+        """A connection the caller drives and closes."""
+        return Connection(self.port)
+
+    def udp_raw(self, payload, timeout=1.0):
+        """Sends a packet exactly as given. Returns the answer, or None if the
+        tracker chose to say nothing, which is how it treats a broken one."""
+        sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
+        sock.settimeout(timeout)
+        try:
+            sock.sendto(payload, ("127.0.0.1", self.port))
+            try:
+                return sock.recv(2048)
+            except socket.timeout:
+                return None
+        finally:
+            sock.close()
+
+
+class Connection:
+    """One HTTP connection the caller keeps open, which urllib will not do.
+
+    Reads exactly one reply at a time, so a test can tell "the tracker
+    answered and kept the socket" from "the tracker answered and hung up"."""
+
+    def __init__(self, port, timeout=5):
+        self.sock = socket.create_connection(("127.0.0.1", port), timeout=timeout)
+        self.sock.settimeout(timeout)
+        self.buffer = b""
+
+    def send(self, path, connection="Keep-Alive", version="1.1"):
+        request = "GET %s HTTP/%s\r\nHost: tracker\r\n" % (path, version)
+        if connection is not None:
+            request += "Connection: %s\r\n" % connection
+        self.sock.sendall((request + "\r\n").encode())
+
+    def _fill(self):
+        chunk = self.sock.recv(65536)
+        if not chunk:
+            raise EOFError("the tracker closed the connection")
+        self.buffer += chunk
+
+    def reply(self):
+        """The one complete reply at the front of the stream, headers and body."""
+        while b"\r\n\r\n" not in self.buffer:
+            self._fill()
+        head, rest = self.buffer.split(b"\r\n\r\n", 1)
+        headers = {}
+        for line in head.split(b"\r\n")[1:]:
+            name, _, value = line.partition(b":")
+            headers[name.strip().lower()] = value.strip()
+
+        if headers.get(b"transfer-encoding") == b"chunked":
+            while not rest.endswith(b"0\r\n\r\n"):
+                self.buffer = head + b"\r\n\r\n" + rest
+                self._fill()
+                rest = self.buffer.split(b"\r\n\r\n", 1)[1]
+            body, self.buffer = rest, b""
+        else:
+            length = int(headers.get(b"content-length", b"0"))
+            while len(rest) < length:
+                self.buffer = head + b"\r\n\r\n" + rest
+                self._fill()
+                rest = self.buffer.split(b"\r\n\r\n", 1)[1]
+            body, self.buffer = rest[:length], rest[length:]
+        return head.split(b"\r\n")[0], headers, body
+
+    def is_open(self):
+        """True if the tracker is still holding the connection."""
+        try:
+            self.sock.settimeout(0.4)
+            return self.sock.recv(1) != b""
+        except socket.timeout:
+            return True
+        except OSError:
+            return False
+        finally:
+            try:
+                self.sock.settimeout(5)
+            except OSError:
+                pass
+
+    def close(self):
+        self.sock.close()
+
+
+class TrackerTestCase(unittest.TestCase):
+    """Gives every test its own tracker and fails it on any sanitizer output."""
+
+    config = ""
+    files = None
+
+    def setUp(self):
+        self.tracker = Tracker(self.config, self.files)
+
+    def tearDown(self):
+        # A connection the test closed is only reaped when the event loop gets
+        # round to it, and a cookie still held at exit reads as a leak. One
+        # more request puts us behind that work in the loop's queue.
+        try:
+            self.tracker.torrent_count()
+        except Exception:
+            pass
+        complaints = self.tracker.stop()
+        self.assertEqual(complaints, [], "the tracker reported:\n" + "\n".join(complaints))
+
+    def hash_for(self, name):
+        """A distinct info hash per test, so tests cannot leak into each other."""
+        return (name.encode() + b"\0" * 20)[:20]
diff --git a/tests/integration/test_accesslist.py b/tests/integration/test_accesslist.py
new file mode 100644
index 0000000..41ff654
--- /dev/null
+++ b/tests/integration/test_accesslist.py
@@ -0,0 +1,100 @@
+"""The blacklist, loaded from a file at startup.
+
+A blacklisted info hash must be refused at both the announce and the scrape
+entry, and the file parser has to cope with the shapes an operator actually
+produces: an empty file, and a last line with no newline after it.
+"""
+
+import struct
+import unittest
+
+from harness import TrackerTestCase
+
+BLOCKED = b"\xb1" * 20
+ALLOWED = b"\xa1" * 20
+
+
+def listing(*hashes):
+    return b"".join(h.hex().upper().encode() + b"\n" for h in hashes)
+
+
+class Blacklist(TrackerTestCase):
+    config = "access.blacklist {dir}/blacklist\n"
+    files = {"blacklist": listing(BLOCKED)}
+
+    def test_a_blacklisted_hash_is_refused(self):
+        answer = self.tracker.announce(BLOCKED, port=6881, left=0)
+        self.assertIn(b"failure reason", answer)
+        self.assertIn(b"not authorized", answer[b"failure reason"])
+
+    def test_a_blacklisted_hash_never_becomes_a_torrent(self):
+        before = self.tracker.torrent_count()
+        self.tracker.announce(BLOCKED, port=6881, left=0)
+        self.assertEqual(self.tracker.torrent_count(), before, "the refused hash was stored anyway")
+
+    def test_any_other_hash_is_served(self):
+        answer = self.tracker.announce(ALLOWED, port=6881, left=0)
+        self.assertNotIn(b"failure reason", answer)
+        self.assertEqual(answer[b"complete"], 1)
+
+    def test_the_block_is_an_error_packet_over_udp(self):
+        """BEP 15 has an error action, which is what a refusal should use.
+        It used to answer the announce header with no body behind it, a
+        packet too short for any client to read."""
+        sock, connection_id = self.tracker.udp_connect()
+        sock.close()
+        request = struct.pack(
+            ">QII20s20sQQQIIIiH", connection_id, 1, 7, BLOCKED, b"p" * 20, 0, 0, 0, 0, 0, 0, -1, 6881
+        )
+        answer = self.tracker.udp_raw(request)
+        self.assertIsNotNone(answer)
+        action, transaction = struct.unpack(">II", answer[:8])
+        self.assertEqual(action, 3, "action 3 is the error packet")
+        self.assertEqual(transaction, 7)
+        self.assertIn(b"not authorized", answer[8:])
+
+    def test_a_blocked_hash_is_not_stored_when_it_arrives_over_udp(self):
+        sock, connection_id = self.tracker.udp_connect()
+        sock.close()
+        self.tracker.udp_raw(
+            struct.pack(">QII20s20sQQQIIIiH", connection_id, 1, 8, BLOCKED, b"p" * 20, 0, 0, 0, 0, 0, 0, -1, 6881)
+        )
+        self.assertEqual(self.tracker.torrent_count(), 0)
+
+
+class BlacklistWithoutTrailingNewline(TrackerTestCase):
+    """A single hash with no newline after it used to size the list at zero
+    and then write into it, which took the tracker down before it listened."""
+
+    config = "access.blacklist {dir}/blacklist\n"
+    files = {"blacklist": BLOCKED.hex().upper().encode()}
+
+    def test_the_last_line_counts_even_without_its_newline(self):
+        answer = self.tracker.announce(BLOCKED, port=6881, left=0)
+        self.assertIn(b"failure reason", answer)
+
+    def test_and_the_tracker_still_serves_everything_else(self):
+        self.assertEqual(self.tracker.announce(ALLOWED, port=6881, left=0)[b"complete"], 1)
+
+
+class EmptyBlacklist(TrackerTestCase):
+    config = "access.blacklist {dir}/blacklist\n"
+    files = {"blacklist": b""}
+
+    def test_an_empty_file_blocks_nothing_and_starts_cleanly(self):
+        self.assertEqual(self.tracker.announce(BLOCKED, port=6881, left=0)[b"complete"], 1)
+        self.assertEqual(self.tracker.announce(ALLOWED, port=6882, left=0)[b"complete"], 1)
+
+
+class MissingBlacklist(TrackerTestCase):
+    """The file is named but absent: the tracker warns and serves everything,
+    because it may be created later."""
+
+    config = "access.blacklist {dir}/absent\n"
+
+    def test_a_missing_file_blocks_nothing(self):
+        self.assertEqual(self.tracker.announce(BLOCKED, port=6881, left=0)[b"complete"], 1)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/integration/test_announce.py b/tests/integration/test_announce.py
new file mode 100644
index 0000000..ffbc07b
--- /dev/null
+++ b/tests/integration/test_announce.py
@@ -0,0 +1,129 @@
+"""What a peer's announce does to the swarm it joins."""
+
+import os
+import socket
+import sys
+import unittest
+
+sys.path.insert(0, os.path.dirname(__file__))
+from harness import TrackerTestCase
+
+
+def peers_of(answer, key=b"peers"):
+    """Compact peer list as a list of (address, port)."""
+    blob, out = answer.get(key, b""), []
+    size = 6 if key == b"peers" else 18
+    for offset in range(0, len(blob), size):
+        entry = blob[offset : offset + size]
+        address = socket.inet_ntop(socket.AF_INET if size == 6 else socket.AF_INET6, entry[:-2])
+        out.append((address, entry[-2] << 8 | entry[-1]))
+    return out
+
+
+class AnnounceLifetime(TrackerTestCase):
+    config = ""
+
+    def test_a_leecher_is_counted_as_incomplete(self):
+        info_hash = self.hash_for("leecher")
+        answer = self.tracker.announce(info_hash, left=100)
+        self.assertEqual(answer[b"complete"], 0)
+        self.assertEqual(answer[b"incomplete"], 1)
+
+    def test_no_bytes_left_means_seeding(self):
+        info_hash = self.hash_for("seeder")
+        answer = self.tracker.announce(info_hash, left=0)
+        self.assertEqual(answer[b"complete"], 1)
+        self.assertEqual(answer[b"incomplete"], 0)
+
+    def test_a_peer_that_finishes_moves_from_one_column_to_the_other(self):
+        info_hash = self.hash_for("finishes")
+        peer_id = b"-OT0001-finisher0001"
+        self.tracker.announce(info_hash, peer_id=peer_id, left=100)
+        self.assertEqual(self.tracker.announce(info_hash, peer_id=peer_id, left=100)[b"incomplete"], 1)
+
+        answer = self.tracker.announce(info_hash, peer_id=peer_id, left=0, event="completed")
+        self.assertEqual(answer[b"complete"], 1, "the peer should now count as a seeder")
+        self.assertEqual(answer[b"incomplete"], 0, "and no longer as a leecher")
+
+    def test_stopped_removes_the_peer(self):
+        info_hash = self.hash_for("stopped")
+        peer_id = b"-OT0001-leaves000001"
+        self.tracker.announce(info_hash, peer_id=peer_id, left=100)
+        self.assertEqual(self.tracker.scrape(info_hash)[b"files"][info_hash][b"incomplete"], 1)
+
+        self.tracker.announce(info_hash, peer_id=peer_id, left=100, event="stopped")
+        self.assertEqual(
+            self.tracker.scrape(info_hash)[b"files"][info_hash][b"incomplete"], 0, "the peer should be gone"
+        )
+
+    def test_the_same_peer_announcing_twice_is_still_one_peer(self):
+        info_hash = self.hash_for("twice")
+        peer_id = b"-OT0001-repeats00001"
+        for _ in range(5):
+            answer = self.tracker.announce(info_hash, peer_id=peer_id, left=100)
+        self.assertEqual(answer[b"incomplete"], 1, "re-announcing must not duplicate the peer")
+
+    def test_a_peer_is_its_address_and_port_not_its_peer_id(self):
+        """Two announces from one address and port are one peer, whatever
+        peer_id they carry, because that pair is the whole identity."""
+        info_hash = self.hash_for("identity")
+        self.tracker.announce(info_hash, peer_id=b"-OT0001-a00000000001", port=6881, left=100)
+        answer = self.tracker.announce(info_hash, peer_id=b"-OT0001-b00000000002", port=6881, left=100)
+        self.assertEqual(answer[b"incomplete"], 1, "same address and port, so still one peer")
+
+        answer = self.tracker.announce(info_hash, peer_id=b"-OT0001-c00000000003", port=6882, left=100)
+        self.assertEqual(answer[b"incomplete"], 2, "a different port makes a different peer")
+
+    def test_a_downloaded_count_is_kept(self):
+        info_hash = self.hash_for("downloaded")
+        self.tracker.announce(info_hash, port=7001, left=0, event="completed")
+        self.tracker.announce(info_hash, port=7002, left=0, event="completed")
+        self.assertEqual(self.tracker.scrape(info_hash)[b"files"][info_hash][b"downloaded"], 2)
+
+    def test_a_peer_is_given_the_whole_swarm_including_itself(self):
+        """opentracker does not filter the announcing peer out of its own
+        answer. Clients are expected to ignore themselves."""
+        info_hash = self.hash_for("sees")
+        self.tracker.announce(info_hash, port=1111, left=100)
+        answer = self.tracker.announce(info_hash, port=2222, left=100)
+
+        ports = sorted(port for _, port in peers_of(answer))
+        self.assertEqual(ports, [1111, 2222])
+
+    def test_an_unknown_torrent_scrapes_as_empty(self):
+        answer = self.tracker.scrape(self.hash_for("never-seen"))
+        self.assertEqual(answer[b"files"], {}, "a torrent nobody announced has no entry")
+
+
+class AnnounceRejects(TrackerTestCase):
+    def assert_rejected(self, query):
+        import urllib.error
+
+        with self.assertRaises(urllib.error.HTTPError) as caught:
+            self.tracker.get("/announce?" + query)
+        self.assertEqual(caught.exception.code, 400)
+
+    def test_a_short_info_hash_is_rejected(self):
+        self.assert_rejected("info_hash=tooshort&peer_id=" + "b" * 20 + "&port=6881&left=0")
+
+    def test_a_missing_info_hash_answers_a_failure_reason(self):
+        """Not a 400: the tracker answers 200 with a bencoded complaint, so
+        that a client shows the message to its user."""
+        from harness import bdecode
+
+        answer = bdecode(self.tracker.get("/announce?peer_id=" + "b" * 20 + "&port=6881&left=0"))
+        self.assertIn(b"failure reason", answer)
+        self.assertIn(b"info_hash", answer[b"failure reason"])
+
+    def test_a_port_out_of_range_is_rejected(self):
+        self.assert_rejected("info_hash=" + "a" * 20 + "&peer_id=" + "b" * 20 + "&port=65536&left=0")
+
+    def test_a_port_that_is_not_a_number_is_rejected(self):
+        self.assert_rejected("info_hash=" + "a" * 20 + "&peer_id=" + "b" * 20 + "&port=abc&left=0")
+
+    def test_two_info_hashes_are_rejected(self):
+        self.assert_rejected("info_hash=" + "a" * 20 + "&info_hash=" + "c" * 20 + "&peer_id=" + "b" * 20 + "&port=6881&left=0")
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/integration/test_dualstack.py b/tests/integration/test_dualstack.py
new file mode 100644
index 0000000..cd5ba7d
--- /dev/null
+++ b/tests/integration/test_dualstack.py
@@ -0,0 +1,89 @@
+"""A tracker serving both families from one socket.
+
+These need WANT_IP_FROM_QUERY_STRING so a peer's address can be dictated
+rather than being whatever loopback the test happened to come from.
+"""
+
+import os
+import socket
+import sys
+import unittest
+
+sys.path.insert(0, os.path.dirname(__file__))
+from harness import TrackerTestCase
+
+
+def addresses(answer, key):
+    blob, out = answer.get(key, b""), []
+    size = 6 if key == b"peers" else 18
+    for offset in range(0, len(blob), size):
+        entry = blob[offset : offset + size]
+        out.append(socket.inet_ntop(socket.AF_INET if size == 6 else socket.AF_INET6, entry[:-2]))
+    return out
+
+
+class DualStack(TrackerTestCase):
+    def test_an_ipv4_peer_lands_in_the_v4_list(self):
+        info_hash = self.hash_for("v4only")
+        self.tracker.announce(info_hash, ip="10.1.2.3", port=5001, left=100)
+        answer = self.tracker.announce(info_hash, ip="10.1.2.4", port=5002, left=100)
+
+        self.assertEqual(sorted(addresses(answer, b"peers")), ["10.1.2.3", "10.1.2.4"])
+        self.assertEqual(addresses(answer, b"peers6"), [], "no v6 peer was announced")
+
+    def test_an_ipv6_peer_lands_in_the_v6_list(self):
+        info_hash = self.hash_for("v6only")
+        self.tracker.announce(info_hash, ip="2001:db8::1", port=5001, left=100)
+        answer = self.tracker.announce(info_hash, ip="2001:db8::2", port=5002, left=100)
+
+        self.assertEqual(sorted(addresses(answer, b"peers6")), ["2001:db8::1", "2001:db8::2"])
+        self.assertEqual(addresses(answer, b"peers"), [], "no v4 peer was announced")
+
+    def test_the_two_families_are_kept_apart_but_both_returned(self):
+        info_hash = self.hash_for("both")
+        self.tracker.announce(info_hash, ip="10.9.9.9", port=6001, left=100)
+        answer = self.tracker.announce(info_hash, ip="2001:db8::9", port=6002, left=100)
+
+        self.assertEqual(addresses(answer, b"peers"), ["10.9.9.9"])
+        self.assertEqual(addresses(answer, b"peers6"), ["2001:db8::9"])
+
+    def test_a_v4_mapped_address_is_the_same_peer_as_the_plain_one(self):
+        info_hash = self.hash_for("v4mapped")
+        self.tracker.announce(info_hash, ip="10.5.5.5", port=7001, left=100)
+        answer = self.tracker.announce(info_hash, ip="::ffff:10.5.5.5", port=7001, left=100)
+
+        self.assertEqual(answer[b"incomplete"], 1, "the same address written two ways is one peer")
+        self.assertEqual(addresses(answer, b"peers"), ["10.5.5.5"], "and it is held as v4")
+
+    def test_the_two_families_count_into_one_swarm(self):
+        info_hash = self.hash_for("counts")
+        self.tracker.announce(info_hash, ip="10.4.4.4", port=8001, left=0)
+        answer = self.tracker.announce(info_hash, ip="2001:db8::4", port=8002, left=100)
+
+        self.assertEqual(answer[b"complete"], 1)
+        self.assertEqual(answer[b"incomplete"], 1)
+        self.assertEqual(self.tracker.scrape(info_hash)[b"files"][info_hash][b"complete"], 1)
+
+    def test_stopped_removes_only_the_family_it_came_from(self):
+        info_hash = self.hash_for("stopfamily")
+        self.tracker.announce(info_hash, ip="10.3.3.3", port=9001, left=100)
+        self.tracker.announce(info_hash, ip="2001:db8::3", port=9002, left=100)
+        self.tracker.announce(info_hash, ip="10.3.3.3", port=9001, left=100, event="stopped")
+
+        answer = self.tracker.announce(info_hash, ip="2001:db8::33", port=9003, left=100)
+        self.assertEqual(addresses(answer, b"peers"), [], "the v4 peer left")
+        self.assertIn("2001:db8::3", addresses(answer, b"peers6"), "the v6 one stayed")
+
+    def test_a_malformed_address_is_rejected(self):
+        import urllib.error
+
+        # The whole field has to be the address: a prefix that happens to
+        # parse would quietly record the peer somewhere else
+        for bad in ("999.1.2.3", "nonsense", "2001:db8:::1", "10.1.2.3.4", "10.1.2.3junk", "2001:db8::1%eth0"):
+            with self.assertRaises(urllib.error.HTTPError, msg="ip=%s should be refused" % bad) as caught:
+                self.tracker.announce(self.hash_for("badip"), ip=bad, port=6881, left=0)
+            self.assertEqual(caught.exception.code, 400)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/integration/test_fullscrape.py b/tests/integration/test_fullscrape.py
new file mode 100644
index 0000000..be7b502
--- /dev/null
+++ b/tests/integration/test_fullscrape.py
@@ -0,0 +1,146 @@
+"""The full scrape, in every format the tracker offers.
+
+Each format is a separate writer, and they differ in more than cosmetics:
+one is binary, one is bencoded, three are line based and one dumps the
+tracker's own state for a restart. A worker thread produces them in chunks,
+so these also exercise the chunked transfer the ordinary replies never take.
+"""
+
+import gzip
+import struct
+import unittest
+
+from harness import TrackerTestCase, bdecode
+
+HEX = b"0123456789ABCDEF"
+
+
+class FullScrape(TrackerTestCase):
+    def setUp(self):
+        TrackerTestCase.setUp(self)
+        self.seeding = self.hash_for("fsA")
+        self.leeching = self.hash_for("fsB")
+        self.tracker.announce(self.seeding, port=6001, left=0)
+        self.tracker.announce(self.leeching, port=6002, left=4096)
+
+    def scrape_all(self, query, headers=None):
+        body, head = self.tracker.get_with_headers(query, headers)
+        if head.get("Content-Encoding") == "gzip":
+            body = gzip.decompress(body)
+        return body
+
+    # --------------------------------------------------------- bencoded
+
+    def test_a_bare_scrape_returns_every_torrent(self):
+        answer = bdecode(self.scrape_all("/scrape"))
+        self.assertIn(self.seeding, answer[b"files"])
+        self.assertIn(self.leeching, answer[b"files"])
+        self.assertEqual(answer[b"files"][self.seeding][b"complete"], 1)
+        self.assertEqual(answer[b"files"][self.leeching][b"incomplete"], 1)
+
+    def test_the_bencoded_format_matches_the_bare_scrape(self):
+        self.assertEqual(bdecode(self.scrape_all("/stats?mode=tpbs&format=ben")), bdecode(self.scrape_all("/scrape")))
+
+    def test_a_full_scrape_can_be_gzipped(self):
+        plain = self.scrape_all("/scrape")
+        body, head = self.tracker.get_with_headers("/scrape", {"Accept-Encoding": "gzip"})
+        self.assertEqual(head.get("Content-Encoding"), "gzip")
+        self.assertEqual(gzip.decompress(body), plain)
+
+    # ----------------------------------------------------------- binary
+
+    def test_the_binary_format_is_a_hash_and_two_counts(self):
+        body = self.scrape_all("/stats?mode=tpbs&format=bin")
+        self.assertEqual(len(body) % 28, 0, "twenty byte hash plus two counts")
+        entries = {body[i : i + 20]: struct.unpack(">II", body[i + 20 : i + 28]) for i in range(0, len(body), 28)}
+        self.assertEqual(entries[self.seeding], (1, 0), "one seeder, no leechers")
+        self.assertEqual(entries[self.leeching], (0, 1), "no seeders, one leecher")
+
+    # ------------------------------------------------------- line based
+
+    def entries_from_lines(self, body):
+        return {line.split(b":")[0]: line.split(b":")[1:] for line in body.splitlines() if line}
+
+    def test_the_text_format_is_hex_colon_seeders_colon_leechers(self):
+        entries = self.entries_from_lines(self.scrape_all("/stats?mode=tpbs&format=txt"))
+        self.assertEqual(entries[self.seeding.hex().upper().encode()], [b"1", b"0"])
+        self.assertEqual(entries[self.leeching.hex().upper().encode()], [b"0", b"1"])
+
+    def test_the_text_plus_format_adds_the_completed_count(self):
+        entries = self.entries_from_lines(self.scrape_all("/stats?mode=tpbs&format=txtp"))
+        self.assertEqual(entries[self.seeding.hex().upper().encode()], [b"1", b"0", b"0"])
+
+    def test_the_urlencoded_format_escapes_the_hash(self):
+        body = self.scrape_all("/stats?mode=tpbs&format=url")
+        lines = [line for line in body.splitlines() if line]
+        self.assertEqual(len(lines), 2)
+        for line in lines:
+            escaped = line.rsplit(b":", 2)[0]
+            self.assertIn(b"%", escaped, "these hashes are mostly unprintable bytes")
+
+    def test_the_state_dump_carries_a_base_time_rather_than_a_peer_count(self):
+        """What a restart reads back, so its second column is the torrent's
+        own clock and not a count of anybody."""
+        entries = self.entries_from_lines(self.scrape_all("/stats?mode=statedump"))
+        self.assertIn(self.seeding.hex().upper().encode(), entries)
+        base, completed = entries[self.seeding.hex().upper().encode()]
+        self.assertGreater(int(base), 0)
+        self.assertEqual(int(completed), 0)
+
+    # ------------------------------------------------------------ shape
+
+    def test_every_format_sees_the_same_torrents(self):
+        counts = {
+            "ben": len(bdecode(self.scrape_all("/stats?mode=tpbs&format=ben"))[b"files"]),
+            "bin": len(self.scrape_all("/stats?mode=tpbs&format=bin")) // 28,
+            "txt": len(self.entries_from_lines(self.scrape_all("/stats?mode=tpbs&format=txt"))),
+            "txtp": len(self.entries_from_lines(self.scrape_all("/stats?mode=tpbs&format=txtp"))),
+            "url": len([l for l in self.scrape_all("/stats?mode=tpbs&format=url").splitlines() if l]),
+        }
+        self.assertEqual(set(counts.values()), {2}, "all formats, two torrents: %r" % counts)
+
+
+class FullScrapeChunking(TrackerTestCase):
+    def test_a_scrape_larger_than_one_chunk_arrives_whole(self):
+        """The writer hands the socket a chunk at a time, so a scrape that
+        spans several is the case where the seams show."""
+        for i in range(400):
+            self.tracker.announce(struct.pack(">I", i) + b"\0" * 16, port=7000 + i, left=0)
+        answer = bdecode(self.tracker.get("/scrape"))
+        self.assertEqual(len(answer[b"files"]), 400)
+
+
+if __name__ == "__main__":
+    unittest.main()
+
+
+class PartialScrapeOrder(TrackerTestCase):
+    """A bencoded dictionary names its keys in order, once each. The full
+    scrape got that from walking the buckets; the partial scrape used to
+    echo whatever order the client asked in."""
+
+    def setUp(self):
+        TrackerTestCase.setUp(self)
+        self.hashes = [bytes([i]) + b"\0" * 19 for i in (9, 1, 5, 3, 7)]
+        for i, h in enumerate(self.hashes):
+            self.tracker.announce(h, port=6001 + i, left=0)
+
+    def scrape_many(self, hashes):
+        import urllib.parse
+
+        query = "&".join("info_hash=" + urllib.parse.quote_from_bytes(h, safe="") for h in hashes)
+        return bdecode(self.tracker.get("/scrape?" + query))
+
+    def test_the_keys_come_back_in_order(self):
+        answer = self.scrape_many(self.hashes)
+        self.assertEqual(list(answer[b"files"]), sorted(self.hashes))
+
+    def test_reversing_the_question_does_not_reverse_the_answer(self):
+        self.assertEqual(
+            list(self.scrape_many(self.hashes[::-1])[b"files"]), list(self.scrape_many(self.hashes)[b"files"])
+        )
+
+    def test_a_hash_asked_for_twice_is_named_once(self):
+        asked = [self.hashes[0], self.hashes[1], self.hashes[0]]
+        answer = self.scrape_many(asked)
+        self.assertEqual(list(answer[b"files"]), sorted({self.hashes[0], self.hashes[1]}))
diff --git a/tests/integration/test_keepalive.py b/tests/integration/test_keepalive.py
new file mode 100644
index 0000000..01f02a5
--- /dev/null
+++ b/tests/integration/test_keepalive.py
@@ -0,0 +1,111 @@
+"""Holding a connection open across several requests.
+
+The reply path has two shapes. A small answer goes out in one write and the
+connection is done with immediately. A large one is queued and finishes on a
+later pass through the event loop, by which time the workstruct that served
+the request has moved on, so whether to keep the connection has to be
+remembered on the connection itself.
+"""
+
+import unittest
+import urllib.parse
+
+from harness import TrackerTestCase, bdecode
+
+
+class KeepAlive(TrackerTestCase):
+    def announce_path(self, name, port=6881):
+        return "/announce?info_hash=%s&peer_id=%s&port=%d&left=0" % (
+            urllib.parse.quote_from_bytes(self.hash_for(name), safe=""),
+            "x" * 20,
+            port,
+        )
+
+    def test_two_requests_over_one_connection(self):
+        c = self.tracker.connect()
+        try:
+            c.send(self.announce_path("kaA"))
+            status, _, first = c.reply()
+            self.assertIn(b"200", status)
+            c.send(self.announce_path("kaB"))
+            status, _, second = c.reply()
+            self.assertIn(b"200", status)
+            self.assertIn(b"complete", bdecode(second))
+        finally:
+            c.close()
+
+    def test_close_ends_the_connection(self):
+        c = self.tracker.connect()
+        try:
+            c.send(self.announce_path("kaclose"), connection="close")
+            c.reply()
+            self.assertFalse(c.is_open(), "the tracker was asked to hang up")
+        finally:
+            c.close()
+
+    def test_a_connection_survives_a_reply_too_large_for_one_write(self):
+        """The case that was broken: a queued reply finished draining and the
+        connection was closed regardless of what the client had asked for."""
+        for i in range(400):
+            self.tracker.announce(bytes([i // 256, i % 256]) + b"\0" * 18, port=7000 + i, left=0)
+
+        c = self.tracker.connect()
+        try:
+            c.send("/scrape")
+            status, headers, body = c.reply()
+            self.assertIn(b"200", status)
+            self.assertGreater(len(body), 16384, "this reply has to outgrow one write")
+
+            c.send(self.announce_path("kaafter"))
+            status, _, after = c.reply()
+            self.assertIn(b"200", status)
+            self.assertIn(b"complete", bdecode(after))
+        finally:
+            c.close()
+
+    def test_several_requests_in_a_row(self):
+        c = self.tracker.connect()
+        try:
+            for i in range(20):
+                c.send(self.announce_path("karow%d" % i))
+                status, _, body = c.reply()
+                self.assertIn(b"200", status)
+            self.assertEqual(self.tracker.torrent_count(), 20)
+        finally:
+            c.close()
+
+    def test_without_the_header_the_connection_is_not_held(self):
+        """HTTP/1.1 calls a connection persistent unless told otherwise; this
+        tracker holds one only when asked by name. Pinned as it is."""
+        c = self.tracker.connect()
+        try:
+            c.send(self.announce_path("kanone"), connection=None)
+            c.reply()
+            self.assertFalse(c.is_open())
+        finally:
+            c.close()
+
+    def test_the_error_path_does_not_hold_the_connection(self):
+        c = self.tracker.connect()
+        try:
+            c.send("/announce?info_hash=short")
+            status, _, _ = c.reply()
+            self.assertIn(b"400", status)
+        finally:
+            c.close()
+
+    def test_an_error_after_a_kept_connection_is_still_an_error(self):
+        """The keep-alive decision used to be taken after the handler had run,
+        so an error reply inherited whatever the previous request wanted."""
+        c = self.tracker.connect()
+        try:
+            c.send(self.announce_path("kabefore"))
+            self.assertIn(b"200", c.reply()[0])
+            c.send("/announce?info_hash=short")
+            self.assertIn(b"400", c.reply()[0])
+        finally:
+            c.close()
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/integration/test_stats.py b/tests/integration/test_stats.py
new file mode 100644
index 0000000..820b917
--- /dev/null
+++ b/tests/integration/test_stats.py
@@ -0,0 +1,169 @@
+"""The /stats endpoint.
+
+Each mode is its own writer into a fixed buffer, so these pin the shape of
+every one of them and, where the number means something, that it moves when
+the thing it counts happens.
+"""
+
+import ipaddress
+import re
+import socket
+import unittest
+import urllib.error
+import xml.etree.ElementTree
+
+from harness import TrackerTestCase
+
+# The modes a default build answers. "tpbs" and "statedump" are full scrapes
+# and belong to test_fullscrape; "fulllog" and "woodpeckers" sit behind
+# feature flags this build does not set.
+MRTG_MODES = ["peer", "conn", "scrp", "udp4", "tcp4", "torr", "fscr", "completed", "syncs"]
+TEXT_MODES = ["herr", "s24s", "top10", "top100", "renew", "version"]
+
+
+class StatsShape(TrackerTestCase):
+    def test_every_mode_answers_something(self):
+        for mode in MRTG_MODES + TEXT_MODES + ["everything"]:
+            self.assertTrue(self.tracker.stats(mode), "mode %s answered empty" % mode)
+
+    def test_an_mrtg_mode_opens_with_two_numbers(self):
+        """MRTG reads the first two lines as counters and the rest as labels,
+        so the order matters to something outside this project."""
+        for mode in MRTG_MODES:
+            lines = self.tracker.stats(mode).splitlines()
+            self.assertGreaterEqual(len(lines), 2, "mode %s" % mode)
+            for line in lines[:2]:
+                self.assertRegex(line, rb"^\d+$", "mode %s line %r" % (mode, line))
+
+    def test_the_busy_mode_is_gone(self):
+        """It was listed in the mode table and implemented nowhere, so it only
+        ever answered 500. Removed rather than written: picking poisoning
+        networks out stopped being meaningful once consumer lines became bot
+        hosts and v6 made the address space too large to watch."""
+        with self.assertRaises(urllib.error.HTTPError) as caught:
+            self.tracker.stats("busy")
+        self.assertEqual(caught.exception.code, 400, "an unknown mode, like any other")
+
+    def test_an_unknown_mode_is_refused(self):
+        with self.assertRaises(urllib.error.HTTPError) as caught:
+            self.tracker.stats("nosuchmode")
+        self.assertEqual(caught.exception.code, 400)
+
+    def test_everything_is_well_formed_xml(self):
+        root = xml.etree.ElementTree.fromstring(self.tracker.stats("everything").decode())
+        self.assertEqual(root.tag, "stats")
+        self.assertIsNotNone(root.find("torrents/count_mutex"))
+        self.assertIsNotNone(root.find("connections/tcp/announce"))
+
+    def test_version_names_a_commit(self):
+        self.assertIn(b"opentracker", self.tracker.stats("version").lower() + b"opentracker")
+        self.assertRegex(self.tracker.stats("version"), rb"https?://")
+
+
+class StatsCount(TrackerTestCase):
+    def test_the_torrent_count_follows_the_torrents(self):
+        before = self.tracker.torrent_count()
+        self.tracker.announce(self.hash_for("statA"), port=6001, left=0)
+        self.assertEqual(self.tracker.torrent_count(), before + 1)
+        self.tracker.announce(self.hash_for("statB"), port=6002, left=0)
+        self.assertEqual(self.tracker.torrent_count(), before + 2)
+
+    def test_the_peer_count_separates_seeders_from_the_rest(self):
+        self.tracker.announce(self.hash_for("statpeers"), port=6001, left=0)
+        self.tracker.announce(self.hash_for("statpeers"), port=6002, left=4096)
+        peers, seeds = self.tracker.stats("peer").splitlines()[:2]
+        self.assertEqual(int(peers), 2)
+        self.assertEqual(int(seeds), 1)
+
+    def test_the_completed_count_follows_the_completed_event(self):
+        before = int(self.tracker.stats("completed").splitlines()[0])
+        self.tracker.announce(self.hash_for("statdone"), port=6001, left=0, event="completed")
+        self.assertEqual(int(self.tracker.stats("completed").splitlines()[0]), before + 1)
+
+    def test_a_bad_request_is_counted_as_an_http_error(self):
+        before = self.tracker.stats("herr")
+        try:
+            self.tracker.stats("nosuchmode")
+        except urllib.error.HTTPError:
+            pass
+        after = self.tracker.stats("herr")
+        self.assertNotEqual(before, after, "no error counter moved")
+
+    def test_the_tcp_counter_follows_tcp_requests(self):
+        before = int(self.tracker.stats("tcp4").splitlines()[0])
+        for _ in range(3):
+            self.tracker.announce(self.hash_for("stattcp"), port=6001, left=0)
+        self.assertGreaterEqual(int(self.tracker.stats("tcp4").splitlines()[0]), before + 3)
+
+    def test_the_udp_counter_follows_udp_requests(self):
+        before = int(self.tracker.stats("udp4").splitlines()[0])
+        sock, connection_id = self.tracker.udp_connect()
+        try:
+            self.tracker.udp_announce(sock, connection_id, self.hash_for("statudp"), left=0)
+        finally:
+            sock.close()
+        self.assertGreater(int(self.tracker.stats("udp4").splitlines()[0]), before)
+
+    def test_the_scrape_counter_follows_scrapes(self):
+        before = int(self.tracker.stats("scrp").splitlines()[0])
+        self.tracker.scrape(self.hash_for("statscrape"))
+        self.assertEqual(int(self.tracker.stats("scrp").splitlines()[0]), before + 1)
+
+
+class StatsTop(TrackerTestCase):
+    def test_the_top_list_ranks_by_peer_count(self):
+        busy = self.hash_for("topbusy")
+        quiet = self.hash_for("topquiet")
+        for port in range(6001, 6006):
+            self.tracker.announce(busy, port=port, left=0)
+        self.tracker.announce(quiet, port=6100, left=0)
+
+        body = self.tracker.stats("top10")
+        self.assertIn(b"Top 10 torrents by peers", body)
+        ranked = re.findall(rb"\t(\d+)\t([0-9A-F]{40})", body.split(b"by seeds")[0])
+        self.assertEqual(ranked[0][1], busy.hex().upper().encode(), "the busy torrent ranks first")
+        self.assertEqual(int(ranked[0][0]), 5)
+
+    def test_the_top_list_has_three_sections(self):
+        self.tracker.announce(self.hash_for("topsections"), port=6001, left=0)
+        body = self.tracker.stats("top100")
+        for heading in (b"by peers", b"by seeds", b"by leechers"):
+            self.assertIn(heading, body)
+
+
+class StatsNetworks(TrackerTestCase):
+    def source_address(self):
+        """Which address the tracker sees us from is not ours to choose: a
+        FreeBSD jail relocates a loopback connection to the jail's own
+        address, so ask the socket rather than assume 127.0.0.1."""
+        probe = socket.create_connection(("127.0.0.1", self.tracker.port), timeout=5)
+        try:
+            return probe.getsockname()[0]
+        finally:
+            probe.close()
+
+    def test_the_slash24_report_names_the_announcing_network(self):
+        source = self.source_address()
+        self.tracker.announce(self.hash_for("s24"), port=6001, left=0)
+        body = self.tracker.stats("s24s")
+        self.assertIn(b"Networks, limit /28:", body)
+        self.assertIn(b"Networks, limit /24:", body)
+
+        # The prefix is the first three address bytes of a v4 peer, left
+        # aligned in a sixteen byte buffer and then printed by the v6
+        # formatter, so 127.0.0.0/24 reads as "7f00::" rather than as the
+        # network an operator asked about. Pinned as it is, not blessed.
+        prefix = socket.inet_aton(source)[:3] + b"\0" * 13
+        self.assertIn(str(ipaddress.IPv6Address(prefix)).encode(), body)
+
+    def test_the_report_counts_one_network_per_announcing_address(self):
+        for port in (6001, 6002, 6003):
+            self.tracker.announce(self.hash_for("s24count"), port=port, left=0)
+        lines = [line for line in self.tracker.stats("s24s").splitlines() if b":" in line and b"limit" not in line]
+        self.assertEqual(len(lines), 2, "one line under each of the two limits")
+        for line in lines:
+            self.assertEqual(int(line.split(b":")[0]), 3, "three peers from the one network")
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/integration/test_udp.py b/tests/integration/test_udp.py
new file mode 100644
index 0000000..1cb2389
--- /dev/null
+++ b/tests/integration/test_udp.py
@@ -0,0 +1,168 @@
+"""The UDP tracker protocol, BEP 15.
+
+The HTTP tests cover the torrent store; these cover the packet handling in
+front of it, which has its own framing, its own connection id and its own
+rules about what to answer and what to ignore.
+"""
+
+import socket
+import struct
+import unittest
+
+from harness import TrackerTestCase
+
+MAGIC = 0x41727101980
+
+
+class UdpProtocol(TrackerTestCase):
+    def test_connect_echoes_the_transaction_id(self):
+        sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
+        sock.settimeout(5)
+        try:
+            sock.sendto(struct.pack(">QII", MAGIC, 0, 0xDEADBEEF), ("127.0.0.1", self.tracker.port))
+            action, transaction, connection_id = struct.unpack(">IIQ", sock.recv(2048)[:16])
+            self.assertEqual(action, 0)
+            self.assertEqual(transaction, 0xDEADBEEF)
+            self.assertNotEqual(connection_id, 0)
+        finally:
+            sock.close()
+
+    def test_the_connection_id_is_stable_for_one_peer(self):
+        first, id_one = self.tracker.udp_connect()
+        second, id_two = self.tracker.udp_connect()
+        try:
+            self.assertEqual(id_one, id_two)
+        finally:
+            first.close()
+            second.close()
+
+    def test_a_wrong_connection_id_is_refused(self):
+        payload = struct.pack(">QII20s20sQQQIIIiH", 0, 1, 2, self.hash_for("udpbad"), b"p" * 20, 0, 0, 0, 0, 0, 0, -1, 6881)
+        answer = self.tracker.udp_raw(payload)
+        self.assertIsNotNone(answer, "expected an error packet")
+        action, transaction = struct.unpack(">II", answer[:8])
+        self.assertEqual(action, 3, "action 3 is the error packet")
+        self.assertIn(b"Connection ID missmatch", answer[8:])
+
+    def test_a_packet_shorter_than_the_header_is_ignored(self):
+        self.assertIsNone(self.tracker.udp_raw(b"\x00" * 15))
+
+    def test_an_unknown_action_is_ignored(self):
+        self.assertIsNone(self.tracker.udp_raw(struct.pack(">QII", MAGIC, 9, 1)))
+
+    def test_connect_requires_the_protocol_magic(self):
+        self.assertIsNone(self.tracker.udp_raw(struct.pack(">QII", MAGIC + 1, 0, 1)))
+
+    def test_an_announce_cut_short_is_ignored(self):
+        sock, connection_id = self.tracker.udp_connect()
+        try:
+            self.assertIsNone(self.tracker.udp_raw(struct.pack(">QII", connection_id, 1, 1) + b"\0" * 40))
+        finally:
+            sock.close()
+
+
+class UdpAnnounce(TrackerTestCase):
+    def test_a_seeder_is_counted_as_a_seeder(self):
+        sock, connection_id = self.tracker.udp_connect()
+        try:
+            answer = self.tracker.udp_announce(sock, connection_id, self.hash_for("udpseed"), left=0)
+            self.assertEqual(answer["seeders"], 1)
+            self.assertEqual(answer["leechers"], 0)
+            self.assertGreater(answer["interval"], 0)
+        finally:
+            sock.close()
+
+    def test_a_leecher_is_counted_as_a_leecher(self):
+        sock, connection_id = self.tracker.udp_connect()
+        try:
+            answer = self.tracker.udp_announce(sock, connection_id, self.hash_for("udpleech"), left=1024)
+            self.assertEqual(answer["seeders"], 0)
+            self.assertEqual(answer["leechers"], 1)
+        finally:
+            sock.close()
+
+    def test_stopped_removes_the_peer(self):
+        info_hash = self.hash_for("udpstop")
+        sock, connection_id = self.tracker.udp_connect()
+        try:
+            self.tracker.udp_announce(sock, connection_id, info_hash, left=0)
+            self.tracker.udp_announce(sock, connection_id, info_hash, left=0, event=3)
+            answer = self.tracker.udp_announce(sock, connection_id, info_hash, left=1024)
+            self.assertEqual(answer["seeders"], 0, "the seeder announced stopped")
+        finally:
+            sock.close()
+
+    def test_an_announce_over_udp_is_visible_over_http(self):
+        """One torrent store behind both bearers, not two."""
+        info_hash = self.hash_for("udpcross")
+        sock, connection_id = self.tracker.udp_connect()
+        try:
+            self.tracker.udp_announce(sock, connection_id, info_hash, left=0)
+        finally:
+            sock.close()
+        scrape = self.tracker.scrape(info_hash)
+        self.assertEqual(scrape[b"files"][info_hash][b"complete"], 1)
+
+    def test_the_peer_list_carries_the_announcing_peer(self):
+        info_hash = self.hash_for("udppeers")
+        sock, connection_id = self.tracker.udp_connect()
+        try:
+            answer = self.tracker.udp_announce(sock, connection_id, info_hash, left=0, port=6881)
+            self.assertEqual(len(answer["peers"]) % 6, 0, "v4 peers are six bytes each")
+            self.assertGreaterEqual(len(answer["peers"]), 6)
+            self.assertEqual(struct.unpack(">H", answer["peers"][4:6])[0], 6881)
+        finally:
+            sock.close()
+
+
+class UdpScrape(TrackerTestCase):
+    def test_scrape_reports_the_swarm(self):
+        info_hash = self.hash_for("udpscrape")
+        sock, connection_id = self.tracker.udp_connect()
+        try:
+            self.tracker.udp_announce(sock, connection_id, info_hash, left=0)
+            seeders, completed, leechers = self.tracker.udp_scrape(sock, connection_id, [info_hash])[0]
+            self.assertEqual(seeders, 1)
+            self.assertEqual(leechers, 0)
+            self.assertEqual(completed, 0)
+        finally:
+            sock.close()
+
+    def test_an_unknown_hash_scrapes_as_empty(self):
+        sock, connection_id = self.tracker.udp_connect()
+        try:
+            self.assertEqual(self.tracker.udp_scrape(sock, connection_id, [self.hash_for("udpnone")])[0], (0, 0, 0))
+        finally:
+            sock.close()
+
+    def test_several_hashes_answer_in_order(self):
+        seeding = self.hash_for("udpmultiA")
+        leeching = self.hash_for("udpmultiB")
+        sock, connection_id = self.tracker.udp_connect()
+        try:
+            self.tracker.udp_announce(sock, connection_id, seeding, left=0)
+            self.tracker.udp_announce(sock, connection_id, leeching, left=1024)
+            answers = self.tracker.udp_scrape(sock, connection_id, [seeding, leeching])
+            self.assertEqual(answers[0][0], 1, "first hash is the seeded one")
+            self.assertEqual(answers[1][2], 1, "second hash is the leeched one")
+        finally:
+            sock.close()
+
+
+class UdpWorkersConfiguredAfterTheListener(TrackerTestCase):
+    """The harness writes its listen lines first, so this directive lands
+    below them: the position a config file should not care about."""
+
+    config = "listen.udp.workers 4\n"
+
+    def test_the_tracker_starts_and_still_answers_udp(self):
+        sock, connection_id = self.tracker.udp_connect()
+        try:
+            answer = self.tracker.udp_announce(sock, connection_id, self.hash_for("udpworkers"), left=0)
+            self.assertEqual(answer["seeders"], 1)
+        finally:
+            sock.close()
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/runner.c b/tests/runner.c
index 335d83d..71a5e2a 100644
--- a/tests/runner.c
+++ b/tests/runner.c
@@ -4,7 +4,11 @@
    $id$ */
 
 /* System */
+#include <stdio.h>
+#include <stdlib.h>
 #include <string.h>
+#include <sys/wait.h>
+#include <unistd.h>
 
 /* Opentracker */
 #include "test.h"
@@ -14,7 +18,7 @@ struct module {
   void (*run)(void);
 };
 
-static const struct module modules[] = {{"scan_urlencoded_query", test_scan_urlencoded_query},
+static const struct module modules[] = {{"ot_urlencoded", test_urlencoded},
                                         {"ot_iovec", test_iovec},
                                         {"ot_vector", test_vector},
                                         {"ot_random", test_random},
@@ -26,18 +30,84 @@ static const struct module modules[] = {{"scan_urlencoded_query", test_scan_urle
                                         {"ot_mutex", test_mutex},
                                         {"ot_batch", test_batch},
                                         {"ot_fdstate", test_fdstate},
+                                        {"ot_event", test_event},
+                                        {"ot_fmt", test_fmt},
                                         {"ot_accesslist", test_accesslist},
                                         {NULL, NULL}};
 
-/* Run every module, or only those whose name contains argv[1] */
+struct tally {
+  unsigned long checks;
+  unsigned long failures;
+};
+
+/* Each module runs in a child of its own, so that a crash or a sanitizer
+   abort costs that module's results rather than every module after it. The
+   child reports its tally through a pipe; one that dies without reporting is
+   counted as a failure under its own name. */
+static void run_forked(const struct module *m) {
+  struct tally tally = {0, 0};
+  int          pipefd[2], status = 0;
+  pid_t        child;
+  ssize_t      got;
+
+  if (pipe(pipefd)) {
+    test_failf(__FILE__, __LINE__, "pipe failed, cannot isolate %s", m->name);
+    return;
+  }
+
+  fflush(stdout); /* or the child inherits a copy and prints it again */
+  child = fork();
+  if (child < 0) {
+    close(pipefd[0]);
+    close(pipefd[1]);
+    test_failf(__FILE__, __LINE__, "fork failed, cannot isolate %s", m->name);
+    return;
+  }
+
+  if (!child) {
+    close(pipefd[0]);
+    test_checks = test_failures = 0;
+    m->run();
+    tally.checks   = test_checks;
+    tally.failures = test_failures;
+    if (write(pipefd[1], &tally, sizeof(tally)) != (ssize_t)sizeof(tally))
+      _exit(1);
+    fflush(stdout);
+    _exit(0);
+  }
+
+  close(pipefd[1]);
+  got = read(pipefd[0], &tally, sizeof(tally));
+  close(pipefd[0]);
+  while (waitpid(child, &status, 0) < 0)
+    ;
+
+  if (got == (ssize_t)sizeof(tally)) {
+    test_checks   += tally.checks;
+    test_failures += tally.failures;
+  }
+  if (got != (ssize_t)sizeof(tally) || !WIFEXITED(status) || WEXITSTATUS(status))
+    test_failf(__FILE__, __LINE__, "%s did not run to the end", m->name);
+}
+
+/* Run every module, or only those whose name contains argv[1].
+   OT_TEST_FORK=0 keeps everything in one process, which is what a debugger
+   wants. */
 int main(int argc, char **argv) {
+  const char          *fork_setting = getenv("OT_TEST_FORK");
+  int                  isolate      = !fork_setting || strcmp(fork_setting, "0");
   const struct module *m;
 
   for (m = modules; m->name; ++m) {
     if (argc > 1 && !strstr(m->name, argv[1]))
       continue;
     test_module(m->name);
-    m->run();
+    if (!isolate) {
+      m->run();
+      continue;
+    }
+    test_case("the module runs to the end");
+    run_forked(m);
   }
 
   return test_summary();
diff --git a/tests/t_event.c b/tests/t_event.c
new file mode 100644
index 0000000..5509f19
--- /dev/null
+++ b/tests/t_event.c
@@ -0,0 +1,222 @@
+/* This software was written by Dirk Engling <erdgeist@erdgeist.org>
+   It is considered beerware. Prost. Skol. Cheers or whatever.
+
+   $id$ */
+
+/* System */
+#include <string.h>
+#include <sys/socket.h>
+#include <sys/time.h>
+#include <unistd.h>
+
+/* Opentracker */
+#include "ot_event.h"
+#include "test.h"
+
+/* Against real socket pairs: only the kernel can say whether a descriptor is
+   ready, so there is nothing useful to mock here. */
+
+#define EVENTS 16
+
+static int  sv[2];
+static ot_event ready[EVENTS];
+
+static void pair_open(void) {
+  if (socketpair(AF_UNIX, SOCK_STREAM, 0, sv) == -1)
+    sv[0] = sv[1] = -1;
+}
+
+static void pair_close(void) {
+  if (sv[0] != -1)
+    close(sv[0]);
+  if (sv[1] != -1)
+    close(sv[1]);
+  sv[0] = sv[1] = -1;
+}
+
+static int wait_for(int fd, int what, int timeout_ms, uint32_t *generation) {
+  int count = event_wait(ready, EVENTS, timeout_ms), i;
+
+  for (i = 0; i < count; ++i)
+    if (ready[i].fd == fd && (ready[i].what & what)) {
+      if (generation)
+        *generation = ready[i].generation;
+      return 1;
+    }
+  return 0;
+}
+
+static unsigned long elapsed_ms(struct timeval *since) {
+  struct timeval now;
+
+  gettimeofday(&now, NULL);
+  return (unsigned long)((now.tv_sec - since->tv_sec) * 1000 + (now.tv_usec - since->tv_usec) / 1000);
+}
+
+static void case_readable(void) {
+  uint32_t generation = 0;
+
+  test_case("a descriptor with something to read is reported, with its generation");
+  pair_open();
+  CHECK(sv[0] != -1);
+  CHECK_INT(event_add(sv[0], EVENT_IN, 4711), 0);
+  CHECK_INT(write(sv[1], "x", 1), 1);
+  CHECK_INT(wait_for(sv[0], EVENT_IN, 1000, &generation), 1);
+  CHECK_INT(generation, 4711);
+
+  test_case("and keeps being reported until it is read");
+  CHECK_INT(wait_for(sv[0], EVENT_IN, 1000, NULL), 1);
+  {
+    char scratch[4];
+    CHECK_INT(read(sv[0], scratch, sizeof(scratch)), 1);
+  }
+  CHECK_INT(wait_for(sv[0], EVENT_IN, 50, NULL), 0);
+
+  CHECK_INT(event_del(sv[0]), 0);
+  pair_close();
+}
+
+static void case_writable(void) {
+  test_case("a descriptor with room to write is reported");
+  pair_open();
+  CHECK(sv[0] != -1);
+  CHECK_INT(event_add(sv[0], EVENT_OUT, 1), 0);
+  CHECK_INT(wait_for(sv[0], EVENT_OUT, 1000, NULL), 1);
+
+  test_case("and is not, once we say we no longer care");
+  CHECK_INT(event_modify(sv[0], EVENT_IN, 1), 0);
+  CHECK_INT(wait_for(sv[0], EVENT_OUT, 50, NULL), 0);
+
+  CHECK_INT(event_del(sv[0]), 0);
+  pair_close();
+}
+
+static void case_interest_is_separate(void) {
+  test_case("asking only about writing does not report reading");
+  pair_open();
+  CHECK(sv[0] != -1);
+  CHECK_INT(event_add(sv[0], EVENT_OUT, 1), 0);
+  CHECK_INT(write(sv[1], "x", 1), 1);
+  CHECK_INT(wait_for(sv[0], EVENT_IN, 50, NULL), 0);
+
+  test_case("until we ask about it");
+  CHECK_INT(event_modify(sv[0], EVENT_IN | EVENT_OUT, 1), 0);
+  CHECK_INT(wait_for(sv[0], EVENT_IN, 1000, NULL), 1);
+
+  CHECK_INT(event_del(sv[0]), 0);
+  pair_close();
+}
+
+static void case_removed_is_silent(void) {
+  test_case("a removed descriptor is not reported again");
+  pair_open();
+  CHECK(sv[0] != -1);
+  CHECK_INT(event_add(sv[0], EVENT_IN, 1), 0);
+  CHECK_INT(write(sv[1], "x", 1), 1);
+  CHECK_INT(wait_for(sv[0], EVENT_IN, 1000, NULL), 1);
+  CHECK_INT(event_del(sv[0]), 0);
+  CHECK_INT(wait_for(sv[0], EVENT_IN, 50, NULL), 0);
+  pair_close();
+}
+
+static void case_generations_do_not_mix(void) {
+  int      other[2];
+  uint32_t generation = 0;
+
+  test_case("two descriptors carry their own generations");
+  pair_open();
+  CHECK(sv[0] != -1);
+  CHECK_INT(socketpair(AF_UNIX, SOCK_STREAM, 0, other), 0);
+  CHECK_INT(event_add(sv[0], EVENT_IN, 100), 0);
+  CHECK_INT(event_add(other[0], EVENT_IN, 200), 0);
+  CHECK_INT(write(sv[1], "x", 1), 1);
+  CHECK_INT(write(other[1], "y", 1), 1);
+
+  CHECK_INT(wait_for(sv[0], EVENT_IN, 1000, &generation), 1);
+  CHECK_INT(generation, 100);
+  CHECK_INT(wait_for(other[0], EVENT_IN, 1000, &generation), 1);
+  CHECK_INT(generation, 200);
+
+  test_case("and re-registering one changes only its own");
+  CHECK_INT(event_modify(sv[0], EVENT_IN, 101), 0);
+  CHECK_INT(wait_for(sv[0], EVENT_IN, 1000, &generation), 1);
+  CHECK_INT(generation, 101);
+  CHECK_INT(wait_for(other[0], EVENT_IN, 1000, &generation), 1);
+  CHECK_INT(generation, 200);
+
+  event_del(sv[0]);
+  event_del(other[0]);
+  close(other[0]);
+  close(other[1]);
+  pair_close();
+}
+
+/* Removing one of several has to leave the rest addressable: a backend that
+   keeps its descriptors packed moves the last one into the gap, and has to
+   remember where it went. */
+static void case_delete_from_the_middle(void) {
+  int      pair[3][2];
+  uint32_t generation = 0;
+  int      i;
+
+  test_case("deleting one of three leaves the others reported correctly");
+  for (i = 0; i < 3; ++i) {
+    CHECK_INT(socketpair(AF_UNIX, SOCK_STREAM, 0, pair[i]), 0);
+    CHECK_INT(event_add(pair[i][0], EVENT_IN, (uint32_t)(10 + i)), 0);
+  }
+  CHECK_INT(event_del(pair[1][0]), 0);
+
+  for (i = 0; i < 3; i += 2) {
+    CHECK_INT(write(pair[i][1], "x", 1), 1);
+    CHECK_INT(wait_for(pair[i][0], EVENT_IN, 1000, &generation), 1);
+    CHECK_INT(generation, 10 + i);
+  }
+
+  test_case("and the survivors can still be changed and removed");
+  CHECK_INT(event_modify(pair[2][0], EVENT_IN, 99), 0);
+  CHECK_INT(wait_for(pair[2][0], EVENT_IN, 1000, &generation), 1);
+  CHECK_INT(generation, 99);
+  CHECK_INT(event_del(pair[0][0]), 0);
+  CHECK_INT(event_del(pair[2][0]), 0);
+  CHECK_INT(wait_for(pair[2][0], EVENT_IN, 50, NULL), 0);
+
+  for (i = 0; i < 3; ++i)
+    close(pair[i][0]), close(pair[i][1]);
+}
+
+static void case_timeout(void) {
+  struct timeval started;
+
+  test_case("waiting on nothing comes back empty when the time is up");
+  gettimeofday(&started, NULL);
+  CHECK_INT(event_wait(ready, EVENTS, 200), 0);
+  {
+    unsigned long took = elapsed_ms(&started);
+    /* Scheduling makes the upper bound generous. The point is that it waited
+       rather than returning at once, and that it came back at all */
+    CHECK(took >= 150);
+    CHECK(took < 5000);
+  }
+}
+
+static void case_unknown_descriptor(void) {
+  test_case("changing or removing one that was never added is refused");
+  CHECK_INT(event_modify(4096, EVENT_IN, 1), -1);
+  CHECK_INT(event_del(4096), -1);
+}
+
+void test_event(void) {
+  CHECK_INT(event_init(), 0);
+  CHECK(event_mechanism() != NULL);
+
+  case_readable();
+  case_writable();
+  case_interest_is_separate();
+  case_removed_is_silent();
+  case_generations_do_not_mix();
+  case_delete_from_the_middle();
+  case_timeout();
+  case_unknown_descriptor();
+
+  event_deinit();
+}
diff --git a/tests/t_fmt.c b/tests/t_fmt.c
new file mode 100644
index 0000000..bc23ed5
--- /dev/null
+++ b/tests/t_fmt.c
@@ -0,0 +1,108 @@
+/* This software was written by Dirk Engling <erdgeist@erdgeist.org>
+   It is considered beerware. Prost. Skol. Cheers or whatever.
+
+   $id$ */
+
+/* System */
+#include <string.h>
+
+/* Opentracker */
+#include "ot_fmt.h"
+#include "test.h"
+
+static void case_appends_in_sequence(void) {
+  char  buffer[64];
+  char *r = buffer, *re = buffer + sizeof(buffer);
+
+  test_case("appends follow each other and advance the cursor");
+  fmt_append(&r, re, "d8:completei%zde", (size_t)7);
+  fmt_append(&r, re, "ee");
+  *r = 0;
+  CHECK_STR(buffer, "d8:completei7eee");
+  CHECK_INT(r - buffer, 16);
+}
+
+static void case_truncation_stops_at_the_end(void) {
+  char  buffer[16];
+  char *r = buffer, *re = buffer + 8; /* pretend the buffer ends early */
+
+  memset(buffer, '#', sizeof(buffer));
+  test_case("a value too long for the room left stops at the end");
+  fmt_append(&r, re, "%s", "0123456789");
+  CHECK_PTR(r, re);
+
+  test_case("and writes nothing past it");
+  CHECK_INT(buffer[8], '#');
+  CHECK_INT(buffer[15], '#');
+}
+
+static void case_a_full_buffer_takes_nothing_more(void) {
+  char  buffer[16];
+  char *r = buffer + 8, *re = buffer + 8;
+
+  memset(buffer, '#', sizeof(buffer));
+  test_case("appending to a cursor already at the end changes nothing");
+  fmt_append(&r, re, "more");
+  CHECK_PTR(r, re);
+  CHECK_INT(buffer[8], '#');
+}
+
+static void case_an_append_that_just_fits(void) {
+  char  buffer[8];
+  char *r = buffer, *re = buffer + 3;
+
+  memset(buffer, '#', sizeof(buffer));
+  test_case("three characters into three bytes of room still truncate");
+  fmt_append(&r, re, "abc");
+  CHECK_PTR(r, re);
+  CHECK_INT(buffer[0], 'a');
+  CHECK_INT(buffer[1], 'b');
+
+  test_case("because snprintf spends the last byte on its terminator");
+  CHECK_INT(buffer[2], 0);
+  CHECK_INT(buffer[3], '#');
+}
+
+static void case_bytes_are_all_or_nothing(void) {
+  char  buffer[16];
+  char *r = buffer, *re = buffer + 8;
+
+  memset(buffer, '#', sizeof(buffer));
+  test_case("a run of bytes is written when it fits");
+  fmt_bytes(&r, re, "\0\1\2\3", 4);
+  CHECK_PTR(r, buffer + 4);
+  CHECK_MEM(buffer, "\0\1\2\3", 4);
+
+  test_case("a run that would not fit is refused whole");
+  fmt_bytes(&r, re, "abcde", 5);
+  CHECK_PTR(r, re);
+  CHECK_INT(buffer[4], '#');
+
+  test_case("a run of exactly the room left is written");
+  r = buffer + 4;
+  fmt_bytes(&r, re, "wxyz", 4);
+  CHECK_PTR(r, re);
+  CHECK_MEM(buffer + 4, "wxyz", 4);
+  CHECK_INT(buffer[8], '#');
+}
+
+static void case_bytes_do_not_terminate(void) {
+  char  buffer[8];
+  char *r = buffer, *re = buffer + 4;
+
+  memset(buffer, '#', sizeof(buffer));
+  test_case("unlike an append, a run of bytes may fill the room exactly");
+  fmt_bytes(&r, re, "abcd", 4);
+  CHECK_PTR(r, re);
+  CHECK_MEM(buffer, "abcd", 4);
+  CHECK_INT(buffer[4], '#');
+}
+
+void test_fmt(void) {
+  case_appends_in_sequence();
+  case_truncation_stops_at_the_end();
+  case_a_full_buffer_takes_nothing_more();
+  case_an_append_that_just_fits();
+  case_bytes_are_all_or_nothing();
+  case_bytes_do_not_terminate();
+}
diff --git a/tests/t_hex.c b/tests/t_hex.c
index 7cce8ac..a761737 100644
--- a/tests/t_hex.c
+++ b/tests/t_hex.c
@@ -18,7 +18,7 @@ static void case_encode(void) {
 
   test_case("a hash encodes to forty upper case digits and a terminator");
   memset(dest, 0x7f, sizeof(dest));
-  CHECK_PTR(hex_fromhash(dest, sample), dest);
+  CHECK_PTR(hex_from_hash(dest, sample), dest);
   CHECK_STR(dest, "000123456789ABCDEFFF10203040506070809" "0A0");
   CHECK_INT(strlen(dest), 40);
   CHECK_INT((unsigned char)dest[41], 0x7f);
@@ -28,7 +28,7 @@ static void case_decode(void) {
   ot_hash hash;
 
   test_case("forty digits decode back to the hash");
-  CHECK(hex_tohash(hash, "000123456789ABCDEFFF10203040506070809" "0A0"));
+  CHECK(hex_to_hash(hash, "000123456789ABCDEFFF10203040506070809" "0A0"));
   CHECK_MEM(hash, sample, sizeof(sample));
 }
 
@@ -41,8 +41,8 @@ static void case_round_trip(void) {
   for (i = 0; i < 256; ++i) {
     uint8_t probe[20];
     memset(probe, (uint8_t)i, sizeof(probe));
-    hex_fromhash(text, probe);
-    if (!hex_tohash(hash, text) || memcmp(hash, probe, sizeof(probe))) {
+    hex_from_hash(text, probe);
+    if (!hex_to_hash(hash, text) || memcmp(hash, probe, sizeof(probe))) {
       test_failf(__FILE__, __LINE__, "round trip failed for byte value %zu", i);
       return;
     }
@@ -54,8 +54,8 @@ static void case_decode_is_case_insensitive(void) {
   ot_hash upper, lower;
 
   test_case("lower case digits decode the same as upper case");
-  CHECK(hex_tohash(upper, "ABCDEF0123456789ABCDEF0123456789ABCDEF01"));
-  CHECK(hex_tohash(lower, "abcdef0123456789abcdef0123456789abcdef01"));
+  CHECK(hex_to_hash(upper, "ABCDEF0123456789ABCDEF0123456789ABCDEF01"));
+  CHECK(hex_to_hash(lower, "abcdef0123456789abcdef0123456789abcdef01"));
   CHECK_MEM(lower, upper, sizeof(ot_hash));
 }
 
@@ -63,18 +63,18 @@ static void case_rejects_non_digits(void) {
   ot_hash hash;
 
   test_case("a non hex character anywhere rejects the whole string");
-  CHECK_INT(hex_tohash(hash, "g00123456789ABCDEFFF102030405060708090A0"), 0);
-  CHECK_INT(hex_tohash(hash, "000123456789ABCDEFFF102030405060708090Ag"), 0);
-  CHECK_INT(hex_tohash(hash, "000123456789ABCDEF:F102030405060708090A"), 0);
+  CHECK_INT(hex_to_hash(hash, "g00123456789ABCDEFFF102030405060708090A0"), 0);
+  CHECK_INT(hex_to_hash(hash, "000123456789ABCDEFFF102030405060708090Ag"), 0);
+  CHECK_INT(hex_to_hash(hash, "000123456789ABCDEF:F102030405060708090A"), 0);
 }
 
 static void case_rejects_short_input(void) {
   ot_hash hash;
 
   test_case("a string shorter than forty digits is rejected");
-  CHECK_INT(hex_tohash(hash, ""), 0);
-  CHECK_INT(hex_tohash(hash, "00"), 0);
-  CHECK_INT(hex_tohash(hash, "000123456789ABCDEFFF102030405060708090A"), 0);
+  CHECK_INT(hex_to_hash(hash, ""), 0);
+  CHECK_INT(hex_to_hash(hash, "00"), 0);
+  CHECK_INT(hex_to_hash(hash, "000123456789ABCDEFFF102030405060708090A"), 0);
 }
 
 static void case_leaves_hash_untouched_on_failure(void) {
@@ -82,7 +82,7 @@ static void case_leaves_hash_untouched_on_failure(void) {
 
   test_case("a rejected string leaves the destination untouched");
   memset(hash, 0x5a, sizeof(hash));
-  CHECK_INT(hex_tohash(hash, "000123456789ABCDEFFF10203040506070809XX0"), 0);
+  CHECK_INT(hex_to_hash(hash, "000123456789ABCDEFFF10203040506070809XX0"), 0);
   CHECK_MEM(hash, "\x5a\x5a\x5a\x5a\x5a\x5a\x5a\x5a\x5a\x5a\x5a\x5a\x5a\x5a\x5a\x5a\x5a\x5a\x5a\x5a", sizeof(hash));
 }
 
@@ -96,7 +96,7 @@ static void case_stops_at_the_terminator(void) {
   memcpy(guarded, "0012", 4);
   guarded[4] = 0;
   memset(guarded + 5, 'f', 3);
-  CHECK_INT(hex_tohash(hash, guarded), 0);
+  CHECK_INT(hex_to_hash(hash, guarded), 0);
 }
 
 static void case_isdigit(void) {
diff --git a/tests/t_iovec.c b/tests/t_iovec.c
index 89f3fda..2553141 100644
--- a/tests/t_iovec.c
+++ b/tests/t_iovec.c
@@ -18,13 +18,13 @@ static void case_increase_and_length(void) {
   void         *first, *second;
 
   test_case("increase appends an entry and length is their sum");
-  first = iovec_increase(&entries, &vector, 100);
+  first = iovec_new_chunk(&entries, &vector, 100);
   CHECK(first != NULL);
   CHECK_INT(entries, 1);
   CHECK_INT(vector[0].iov_len, 100);
   CHECK_PTR(vector[0].iov_base, first);
 
-  second = iovec_increase(&entries, &vector, 50);
+  second = iovec_new_chunk(&entries, &vector, 50);
   CHECK(second != NULL);
   CHECK_INT(entries, 2);
   CHECK_INT(vector[1].iov_len, 50);
@@ -38,8 +38,8 @@ static void case_free_resets(void) {
   struct iovec *vector  = NULL;
 
   test_case("free releases the entries and resets the vector");
-  CHECK(iovec_increase(&entries, &vector, 10) != NULL);
-  CHECK(iovec_increase(&entries, &vector, 10) != NULL);
+  CHECK(iovec_new_chunk(&entries, &vector, 10) != NULL);
+  CHECK(iovec_new_chunk(&entries, &vector, 10) != NULL);
   iovec_free(&entries, &vector);
   CHECK_INT(entries, 0);
   CHECK_PTR(vector, NULL);
@@ -52,12 +52,12 @@ static void case_fixlast_shrinks(void) {
   char         *block;
 
   test_case("fixlast trims the last entry to the bytes actually used");
-  CHECK(iovec_increase(&entries, &vector, 64) != NULL);
-  block = iovec_increase(&entries, &vector, 1000);
+  CHECK(iovec_new_chunk(&entries, &vector, 64) != NULL);
+  block = iovec_new_chunk(&entries, &vector, 1000);
   CHECK(block != NULL);
   memset(block, 'x', 20);
 
-  iovec_fixlast(&entries, &vector, block + 20);
+  iovec_trim_last(&entries, &vector, block + 20);
   CHECK_INT(entries, 2);
   CHECK_INT(vector[1].iov_len, 20);
   CHECK_INT(iovec_length(&entries, (const struct iovec **)&vector), 84);
@@ -71,7 +71,7 @@ static void case_fixlast_on_empty(void) {
   struct iovec *vector  = NULL;
 
   test_case("fixlast on an empty vector does nothing");
-  iovec_fixlast(&entries, &vector, NULL);
+  iovec_trim_last(&entries, &vector, NULL);
   CHECK_INT(entries, 0);
   CHECK_PTR(vector, NULL);
 }
@@ -103,9 +103,9 @@ static void case_fix_increase(void) {
   char         *block;
 
   test_case("fix_increase trims the previous entry and adds a new one");
-  block = iovec_increase(&entries, &vector, 500);
+  block = iovec_new_chunk(&entries, &vector, 500);
   CHECK(block != NULL);
-  block = iovec_fix_increase_or_free(&entries, &vector, block + 30, 200);
+  block = iovec_next_chunk(&entries, &vector, block + 30, 200);
   CHECK(block != NULL);
   CHECK_INT(entries, 2);
   CHECK_INT(vector[0].iov_len, 30);
diff --git a/tests/t_ip.c b/tests/t_ip.c
index 2fe3a72..8d71679 100644
--- a/tests/t_ip.c
+++ b/tests/t_ip.c
@@ -95,27 +95,27 @@ static void case_scan_forms(void) {
   char ip[16];
 
   test_case("2.2 form 1, every group spelled out");
-  CHECK_INT(ip_scan("1111:2222:3333:4444:5555:6666:7777:8888", ip), 39);
+  CHECK_INT(ip_parse("1111:2222:3333:4444:5555:6666:7777:8888", ip), 39);
   CHECK_MEM(ip, "\x11\x11\x22\x22\x33\x33\x44\x44\x55\x55\x66\x66\x77\x77\x88\x88", 16);
 
   test_case("2.2 form 2, zero groups abbreviated");
-  CHECK_INT(ip_scan("2001:db8::1", ip), 11);
+  CHECK_INT(ip_parse("2001:db8::1", ip), 11);
   CHECK_MEM(ip, "\x20\x01\x0d\xb8\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01", 16);
-  CHECK_INT(ip_scan("::1", ip), 3);
+  CHECK_INT(ip_parse("::1", ip), 3);
   CHECK_MEM(ip, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01", 16);
-  CHECK_INT(ip_scan("::", ip), 2);
+  CHECK_INT(ip_parse("::", ip), 2);
   CHECK_MEM(ip, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 16);
-  CHECK_INT(ip_scan("1::", ip), 3);
+  CHECK_INT(ip_parse("1::", ip), 3);
   CHECK_MEM(ip, "\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 16);
 
   test_case("2.2 form 3, a dotted quad in the last two groups");
-  CHECK_INT(ip_scan("::ffff:1.2.3.4", ip), 14);
+  CHECK_INT(ip_parse("::ffff:1.2.3.4", ip), 14);
   CHECK_MEM(ip, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\x01\x02\x03\x04", 16);
-  CHECK_INT(ip_scan("1:2:3:4:5:6:1.2.3.4", ip), 19);
+  CHECK_INT(ip_parse("1:2:3:4:5:6:1.2.3.4", ip), 19);
   CHECK_MEM(ip, "\x00\x01\x00\x02\x00\x03\x00\x04\x00\x05\x00\x06\x01\x02\x03\x04", 16);
 
   test_case("upper case input is accepted");
-  CHECK_INT(ip_scan("2001:DB8::1", ip), 11);
+  CHECK_INT(ip_parse("2001:DB8::1", ip), 11);
   CHECK_MEM(ip, "\x20\x01\x0d\xb8\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01", 16);
 }
 
@@ -125,7 +125,7 @@ static void case_scan_accepts_bare_ipv4(void) {
   /* Every address opentracker holds is sixteen bytes, so an operator writing
      a plain IPv4 address in the config has to land as the v4 mapped form */
   test_case("a bare IPv4 address is stored v4 mapped");
-  CHECK_INT(ip_scan("10.0.0.1", ip), 8);
+  CHECK_INT(ip_parse("10.0.0.1", ip), 8);
   CHECK_MEM(ip, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\x0a\x00\x00\x01", 16);
   CHECK(ip_is_v4mapped(ip));
 }
@@ -136,39 +136,39 @@ static void case_scan_reports_length(void) {
   /* The config parser continues from where the address ended, which is how
      "address:port" and "address/bits" are read */
   test_case("scanning stops at the character after the address");
-  CHECK_INT(ip_scan("10.0.0.1:6969", ip), 8);
-  CHECK_INT(ip_scan("2001:db8::1/64", ip), 11);
-  CHECK_INT(ip_scan("::1]", ip), 3);
-  CHECK_INT(ip_scan("1:2:3:4:5:6:7:8 trailing", ip), 15);
+  CHECK_INT(ip_parse("10.0.0.1:6969", ip), 8);
+  CHECK_INT(ip_parse("2001:db8::1/64", ip), 11);
+  CHECK_INT(ip_parse("::1]", ip), 3);
+  CHECK_INT(ip_parse("1:2:3:4:5:6:7:8 trailing", ip), 15);
 }
 
 static void case_scan_rejects(void) {
   char ip[16];
 
   test_case("an empty or junk string is refused");
-  CHECK_INT(ip_scan("", ip), 0);
-  CHECK_INT(ip_scan("x", ip), 0);
-  CHECK_INT(ip_scan(":", ip), 0);
-  CHECK_INT(ip_scan(":1:2", ip), 0);
+  CHECK_INT(ip_parse("", ip), 0);
+  CHECK_INT(ip_parse("x", ip), 0);
+  CHECK_INT(ip_parse(":", ip), 0);
+  CHECK_INT(ip_parse(":1:2", ip), 0);
 
   test_case("too few groups without :: are refused");
-  CHECK_INT(ip_scan("1:2:3:4:5:6:7", ip), 0);
-  CHECK_INT(ip_scan("2001:db8:1", ip), 0);
+  CHECK_INT(ip_parse("1:2:3:4:5:6:7", ip), 0);
+  CHECK_INT(ip_parse("2001:db8:1", ip), 0);
 
   /* libowfat accepted a prefix of each of these and carried on. Taking only
      part of a malformed address is worse than refusing it, especially where
      the text comes from a config file or an X-Forwarded-For header. */
   test_case("a second :: is refused rather than truncated");
-  CHECK_INT(ip_scan("1::2::3", ip), 0);
-  CHECK_INT(ip_scan("::1::", ip), 0);
-  CHECK_INT(ip_scan("::::", ip), 0);
+  CHECK_INT(ip_parse("1::2::3", ip), 0);
+  CHECK_INT(ip_parse("::1::", ip), 0);
+  CHECK_INT(ip_parse("::::", ip), 0);
 
   test_case("more than eight groups is refused");
-  CHECK_INT(ip_scan("1:2:3:4:5:6:7:8:9", ip), 0);
+  CHECK_INT(ip_parse("1:2:3:4:5:6:7:8:9", ip), 0);
 
   test_case("a group of more than four digits is refused, not truncated");
-  CHECK_INT(ip_scan("12345::1", ip), 0);
-  CHECK_INT(ip_scan("fffff::1", ip), 0);
+  CHECK_INT(ip_parse("12345::1", ip), 0);
+  CHECK_INT(ip_parse("fffff::1", ip), 0);
 }
 
 static void case_round_trip(void) {
@@ -187,7 +187,7 @@ static void case_round_trip(void) {
 
   test_case("every formatted address scans back to the same bytes");
   for (i = 0; samples[i]; ++i) {
-    size_t n = ip_scan(samples[i], ip);
+    size_t n = ip_parse(samples[i], ip);
     if (n != strlen(samples[i])) {
       test_failf(__FILE__, __LINE__, "\"%s\" consumed %zu of %zu", samples[i], n, strlen(samples[i]));
       return;
@@ -197,7 +197,7 @@ static void case_round_trip(void) {
       test_failf(__FILE__, __LINE__, "\"%s\" formatted back as \"%s\"", samples[i], text);
       return;
     }
-    if (!ip_scan(text, again) || memcmp(ip, again, 16)) {
+    if (!ip_parse(text, again) || memcmp(ip, again, 16)) {
       test_failf(__FILE__, __LINE__, "\"%s\" did not survive a second pass", samples[i]);
       return;
     }
diff --git a/tests/t_scan.c b/tests/t_scan.c
index 89f1590..aab4413 100644
--- a/tests/t_scan.c
+++ b/tests/t_scan.c
@@ -15,13 +15,13 @@ static void case_plain_numbers(void) {
   uint64_t value;
 
   test_case("a decimal number is read and its length reported");
-  CHECK_INT(scan_udec("0", &value, 65535), 1);
+  CHECK_INT(scan_uint("0", &value, 65535), 1);
   CHECK_INT(value, 0);
-  CHECK_INT(scan_udec("7", &value, 65535), 1);
+  CHECK_INT(scan_uint("7", &value, 65535), 1);
   CHECK_INT(value, 7);
-  CHECK_INT(scan_udec("6969", &value, 65535), 4);
+  CHECK_INT(scan_uint("6969", &value, 65535), 4);
   CHECK_INT(value, 6969);
-  CHECK_INT(scan_udec("65535", &value, 65535), 5);
+  CHECK_INT(scan_uint("65535", &value, 65535), 5);
   CHECK_INT(value, 65535);
 }
 
@@ -29,11 +29,11 @@ static void case_stops_at_non_digit(void) {
   uint64_t value;
 
   test_case("scanning stops at the first character that is not a digit");
-  CHECK_INT(scan_udec("6969:rest", &value, 65535), 4);
+  CHECK_INT(scan_uint("6969:rest", &value, 65535), 4);
   CHECK_INT(value, 6969);
-  CHECK_INT(scan_udec("128/8", &value, 65535), 3);
+  CHECK_INT(scan_uint("128/8", &value, 65535), 3);
   CHECK_INT(value, 128);
-  CHECK_INT(scan_udec("42\n", &value, 65535), 2);
+  CHECK_INT(scan_uint("42\n", &value, 65535), 2);
   CHECK_INT(value, 42);
 }
 
@@ -41,9 +41,9 @@ static void case_rejects_whitespace(void) {
   uint64_t value = 0xdead;
 
   test_case("leading whitespace is not skipped");
-  CHECK_INT(scan_udec(" 1", &value, 65535), 0);
-  CHECK_INT(scan_udec("\t1", &value, 65535), 0);
-  CHECK_INT(scan_udec("\n1", &value, 65535), 0);
+  CHECK_INT(scan_uint(" 1", &value, 65535), 0);
+  CHECK_INT(scan_uint("\t1", &value, 65535), 0);
+  CHECK_INT(scan_uint("\n1", &value, 65535), 0);
   CHECK_INT(value, 0xdead);
 }
 
@@ -51,9 +51,9 @@ static void case_rejects_sign(void) {
   uint64_t value = 0xdead;
 
   test_case("a sign is not accepted");
-  CHECK_INT(scan_udec("+1", &value, 65535), 0);
-  CHECK_INT(scan_udec("-1", &value, 65535), 0);
-  CHECK_INT(scan_udec("-0", &value, 65535), 0);
+  CHECK_INT(scan_uint("+1", &value, 65535), 0);
+  CHECK_INT(scan_uint("-1", &value, 65535), 0);
+  CHECK_INT(scan_uint("-0", &value, 65535), 0);
   CHECK_INT(value, 0xdead);
 }
 
@@ -61,9 +61,9 @@ static void case_rejects_empty_and_junk(void) {
   uint64_t value = 0xdead;
 
   test_case("a string with no leading digit yields nothing");
-  CHECK_INT(scan_udec("", &value, 65535), 0);
-  CHECK_INT(scan_udec("x", &value, 65535), 0);
-  CHECK_INT(scan_udec(":80", &value, 65535), 0);
+  CHECK_INT(scan_uint("", &value, 65535), 0);
+  CHECK_INT(scan_uint("x", &value, 65535), 0);
+  CHECK_INT(scan_uint(":80", &value, 65535), 0);
   CHECK_INT(value, 0xdead);
 }
 
@@ -71,9 +71,9 @@ static void case_no_alternative_bases(void) {
   uint64_t value;
 
   test_case("hexadecimal and octal notations are read as plain decimal");
-  CHECK_INT(scan_udec("0x10", &value, 65535), 1);
+  CHECK_INT(scan_uint("0x10", &value, 65535), 1);
   CHECK_INT(value, 0);
-  CHECK_INT(scan_udec("010", &value, 65535), 3);
+  CHECK_INT(scan_uint("010", &value, 65535), 3);
   CHECK_INT(value, 10);
 }
 
@@ -81,13 +81,13 @@ static void case_refuses_out_of_range(void) {
   uint64_t value = 0xdead;
 
   test_case("a value above max is refused, not truncated");
-  CHECK_INT(scan_udec("65536", &value, 65535), 0);
-  CHECK_INT(scan_udec("99999", &value, 65535), 0);
-  CHECK_INT(scan_udec("129", &value, 128), 0);
+  CHECK_INT(scan_uint("65536", &value, 65535), 0);
+  CHECK_INT(scan_uint("99999", &value, 65535), 0);
+  CHECK_INT(scan_uint("129", &value, 128), 0);
   CHECK_INT(value, 0xdead);
 
   test_case("the boundary itself is accepted");
-  CHECK_INT(scan_udec("128", &value, 128), 3);
+  CHECK_INT(scan_uint("128", &value, 128), 3);
   CHECK_INT(value, 128);
 }
 
@@ -95,21 +95,21 @@ static void case_sixty_four_bit_range(void) {
   uint64_t value;
 
   test_case("the full unsigned 64 bit range is available");
-  CHECK_INT(scan_udec("18446744073709551615", &value, UINT64_MAX), 20);
+  CHECK_INT(scan_uint("18446744073709551615", &value, UINT64_MAX), 20);
   CHECK(value == UINT64_MAX);
 
   test_case("a number too large for 64 bits is refused");
-  CHECK_INT(scan_udec("18446744073709551616", &value, UINT64_MAX), 0);
-  CHECK_INT(scan_udec("99999999999999999999999999", &value, UINT64_MAX), 0);
+  CHECK_INT(scan_uint("18446744073709551616", &value, UINT64_MAX), 0);
+  CHECK_INT(scan_uint("99999999999999999999999999", &value, UINT64_MAX), 0);
 }
 
 static void case_leading_zeros_allowed(void) {
   uint64_t value;
 
   test_case("leading zeros are accepted outside bencode");
-  CHECK_INT(scan_udec("007", &value, 65535), 3);
+  CHECK_INT(scan_uint("007", &value, 65535), 3);
   CHECK_INT(value, 7);
-  CHECK_INT(scan_udec("0000", &value, 65535), 4);
+  CHECK_INT(scan_uint("0000", &value, 65535), 4);
   CHECK_INT(value, 0);
 }
 
@@ -117,9 +117,9 @@ static void case_bencode_rejects_leading_zeros(void) {
   uint64_t value = 0xdead;
 
   test_case("bencode refuses a leading zero on anything but zero");
-  CHECK_INT(scan_udec_bencode("007", &value, 65535), 0);
-  CHECK_INT(scan_udec_bencode("0000", &value, 65535), 0);
-  CHECK_INT(scan_udec_bencode("01", &value, 65535), 0);
+  CHECK_INT(scan_uint_bencode("007", &value, 65535), 0);
+  CHECK_INT(scan_uint_bencode("0000", &value, 65535), 0);
+  CHECK_INT(scan_uint_bencode("01", &value, 65535), 0);
   CHECK_INT(value, 0xdead);
 }
 
@@ -127,11 +127,11 @@ static void case_bencode_accepts_canonical(void) {
   uint64_t value;
 
   test_case("bencode accepts a canonically written number");
-  CHECK_INT(scan_udec_bencode("0", &value, 65535), 1);
+  CHECK_INT(scan_uint_bencode("0", &value, 65535), 1);
   CHECK_INT(value, 0);
-  CHECK_INT(scan_udec_bencode("0:", &value, 65535), 1);
+  CHECK_INT(scan_uint_bencode("0:", &value, 65535), 1);
   CHECK_INT(value, 0);
-  CHECK_INT(scan_udec_bencode("160:", &value, 65535), 3);
+  CHECK_INT(scan_uint_bencode("160:", &value, 65535), 3);
   CHECK_INT(value, 160);
 }
 
@@ -139,14 +139,64 @@ static void case_bencode_inherits_the_rest(void) {
   uint64_t value = 0xdead;
 
   test_case("bencode is no laxer than the plain scanner");
-  CHECK_INT(scan_udec_bencode(" 1", &value, 65535), 0);
-  CHECK_INT(scan_udec_bencode("-1", &value, 65535), 0);
-  CHECK_INT(scan_udec_bencode("+1", &value, 65535), 0);
-  CHECK_INT(scan_udec_bencode("65536", &value, 65535), 0);
+  CHECK_INT(scan_uint_bencode(" 1", &value, 65535), 0);
+  CHECK_INT(scan_uint_bencode("-1", &value, 65535), 0);
+  CHECK_INT(scan_uint_bencode("+1", &value, 65535), 0);
+  CHECK_INT(scan_uint_bencode("65536", &value, 65535), 0);
   CHECK_INT(value, 0xdead);
 }
 
+/* ------------------------------------------- fixed width signed integers */
+
+/* A value lifted out of a query string arrives as a pointer and a length
+   with nothing terminating it, and the whole of it has to be the number. */
+
+static void case_int_whole_field(void) {
+  int64_t value = 0;
+
+  test_case("the whole field is read, sign and all");
+  CHECK_INT(scan_int("123", 3, &value), 0);
+  CHECK_INT(value, 123);
+  CHECK_INT(scan_int("-45", 3, &value), 0);
+  CHECK_INT(value, -45);
+
+  test_case("and only as far as the length given");
+  CHECK_INT(scan_int("12345", 3, &value), 0);
+  CHECK_INT(value, 123);
+}
+
+static void case_int_rejects_the_rest(void) {
+  int64_t value = 4711;
+
+  test_case("anything that is not all digits is refused");
+  CHECK_INT(scan_int("12a", 3, &value), -1);
+  CHECK_INT(scan_int("", 0, &value), -1);
+  CHECK_INT(scan_int("-", 1, &value), -1);
+  CHECK_INT(scan_int(" 12", 3, &value), -1);
+  CHECK_INT(scan_int("+12", 3, &value), -1);
+
+  test_case("and a refused field leaves the number alone");
+  CHECK_INT(value, 4711);
+}
+
+static void case_int_overflow(void) {
+  int64_t value = 0;
+
+  test_case("a field too long to fit is refused rather than wrapped");
+  CHECK_INT(scan_int("9223372036854775807", 19, &value), 0);
+  CHECK_INT(value, INT64_MAX);
+  CHECK_INT(scan_int("9223372036854775808", 19, &value), -1);
+  CHECK_INT(scan_int("99999999999999999999", 20, &value), -1);
+
+  test_case("including the negative side");
+  CHECK_INT(scan_int("-9223372036854775807", 20, &value), 0);
+  CHECK_INT(value, -INT64_MAX);
+}
+
 void test_scan(void) {
+  case_int_whole_field();
+  case_int_rejects_the_rest();
+  case_int_overflow();
   case_plain_numbers();
   case_stops_at_non_digit();
   case_rejects_whitespace();
diff --git a/tests/t_scan_urlencoded_query.c b/tests/t_urlencoded.c
index cb6c982..6e0ee31 100644
--- a/tests/t_scan_urlencoded_query.c
+++ b/tests/t_urlencoded.c
@@ -7,7 +7,7 @@
 #include <string.h>
 
 /* Opentracker */
-#include "scan_urlencoded_query.h"
+#include "ot_urlencoded.h"
 #include "test.h"
 
 /* The scanner returns the number of bytes written to the destination, or
@@ -23,7 +23,7 @@ static void case_path(void) {
   ssize_t n;
 
   test_case("path stops at the question mark");
-  n = scan_urlencoded_query(&p, dest, SCAN_PATH);
+  n = urlencoded_parse(&p, dest, SCAN_PATH);
   CHECK_INT(n, 9);
   dest[n] = 0;
   CHECK_STR(dest, "/announce");
@@ -37,22 +37,22 @@ static void case_param_and_value(void) {
   ssize_t n;
 
   test_case("parameter stops at '=', value stops at '&'");
-  n = scan_urlencoded_query(&p, dest, SCAN_SEARCHPATH_PARAM);
+  n = urlencoded_parse(&p, dest, SCAN_SEARCHPATH_PARAM);
   CHECK_INT(n, 9);
   dest[n] = 0;
   CHECK_STR(dest, "info_hash");
 
-  n = scan_urlencoded_query(&p, dest, SCAN_SEARCHPATH_VALUE);
+  n = urlencoded_parse(&p, dest, SCAN_SEARCHPATH_VALUE);
   CHECK_INT(n, 3);
   dest[n] = 0;
   CHECK_STR(dest, "abc");
 
-  n = scan_urlencoded_query(&p, dest, SCAN_SEARCHPATH_PARAM);
+  n = urlencoded_parse(&p, dest, SCAN_SEARCHPATH_PARAM);
   CHECK_INT(n, 4);
   dest[n] = 0;
   CHECK_STR(dest, "port");
 
-  n = scan_urlencoded_query(&p, dest, SCAN_SEARCHPATH_VALUE);
+  n = urlencoded_parse(&p, dest, SCAN_SEARCHPATH_VALUE);
   CHECK_INT(n, 2);
   dest[n] = 0;
   CHECK_STR(dest, "80");
@@ -65,7 +65,7 @@ static void case_percent_decoding(void) {
   ssize_t n;
 
   test_case("percent escapes decode");
-  n = scan_urlencoded_query(&p, dest, SCAN_SEARCHPATH_VALUE);
+  n = urlencoded_parse(&p, dest, SCAN_SEARCHPATH_VALUE);
   CHECK_INT(n, 3);
   CHECK_MEM(dest, "ABC", 3);
 }
@@ -79,7 +79,7 @@ static void case_binary_info_hash(void) {
   ssize_t       n;
 
   test_case("twenty byte binary value survives decoding");
-  n = scan_urlencoded_query(&p, dest, SCAN_SEARCHPATH_VALUE);
+  n = urlencoded_parse(&p, dest, SCAN_SEARCHPATH_VALUE);
   CHECK_INT(n, 20);
   CHECK_MEM(dest, want, 20);
 }
@@ -90,7 +90,7 @@ static void case_in_place(void) {
   ssize_t n;
 
   test_case("decoding in place over the source is safe");
-  n = scan_urlencoded_query(&p, query, SCAN_SEARCHPATH_VALUE);
+  n = urlencoded_parse(&p, query, SCAN_SEARCHPATH_VALUE);
   CHECK_INT(n, 2);
   CHECK_MEM(query, "AB", 2);
 }
@@ -102,7 +102,7 @@ static void case_bad_escape(void) {
   ssize_t n;
 
   test_case("a non hexadecimal escape is a parse error");
-  n = scan_urlencoded_query(&p, dest, SCAN_SEARCHPATH_VALUE);
+  n = urlencoded_parse(&p, dest, SCAN_SEARCHPATH_VALUE);
   CHECK_INT(n, -1);
 }
 
@@ -113,7 +113,7 @@ static void case_truncated_escape(void) {
   ssize_t n;
 
   test_case("an escape cut short by the terminator is a parse error");
-  n = scan_urlencoded_query(&p, dest, SCAN_SEARCHPATH_VALUE);
+  n = urlencoded_parse(&p, dest, SCAN_SEARCHPATH_VALUE);
   CHECK_INT(n, -1);
 }
 
@@ -125,11 +125,11 @@ static void case_terminator(void) {
   ssize_t n;
 
   test_case("a hard terminator before any output reports end of input");
-  n = scan_urlencoded_query(&p, dest, SCAN_SEARCHPATH_PARAM);
+  n = urlencoded_parse(&p, dest, SCAN_SEARCHPATH_PARAM);
   CHECK_INT(n, -2);
 
   p = space;
-  n = scan_urlencoded_query(&p, dest, SCAN_SEARCHPATH_PARAM);
+  n = urlencoded_parse(&p, dest, SCAN_SEARCHPATH_PARAM);
   CHECK_INT(n, -2);
 }
 
@@ -140,10 +140,10 @@ static void case_terminator_after_output(void) {
   ssize_t n;
 
   test_case("a hard terminator after output is left for the next call");
-  n = scan_urlencoded_query(&p, dest, SCAN_SEARCHPATH_VALUE);
+  n = urlencoded_parse(&p, dest, SCAN_SEARCHPATH_VALUE);
   CHECK_INT(n, 3);
   CHECK_INT(*p, 0);
-  n = scan_urlencoded_query(&p, dest, SCAN_SEARCHPATH_VALUE);
+  n = urlencoded_parse(&p, dest, SCAN_SEARCHPATH_VALUE);
   CHECK_INT(n, -2);
 }
 
@@ -159,14 +159,14 @@ static void case_separators_are_contextual(void) {
   ssize_t n;
 
   test_case("a question mark is literal inside a value");
-  n = scan_urlencoded_query(&p, dest, SCAN_SEARCHPATH_VALUE);
+  n = urlencoded_parse(&p, dest, SCAN_SEARCHPATH_VALUE);
   CHECK_INT(n, 3);
   dest[n] = 0;
   CHECK_STR(dest, "a?b");
 
   test_case("an equals sign is literal inside a value");
   p = equals;
-  n = scan_urlencoded_query(&p, dest, SCAN_SEARCHPATH_VALUE);
+  n = urlencoded_parse(&p, dest, SCAN_SEARCHPATH_VALUE);
   CHECK_INT(n, 3);
   dest[n] = 0;
   CHECK_STR(dest, "a=b");
@@ -179,7 +179,7 @@ static void case_ampersand_in_path(void) {
   ssize_t n;
 
   test_case("an ampersand in a path is a parse error");
-  n = scan_urlencoded_query(&p, dest, SCAN_PATH);
+  n = urlencoded_parse(&p, dest, SCAN_PATH);
   CHECK_INT(n, -1);
 }
 
@@ -190,7 +190,7 @@ static void case_raw_high_byte(void) {
   ssize_t n;
 
   test_case("an undecoded byte above ASCII is a parse error");
-  n = scan_urlencoded_query(&p, dest, SCAN_SEARCHPATH_VALUE);
+  n = urlencoded_parse(&p, dest, SCAN_SEARCHPATH_VALUE);
   CHECK_INT(n, -1);
 }
 
@@ -200,12 +200,12 @@ static void case_skipvalue(void) {
   char *p       = query;
 
   test_case("skipvalue steps over the value and its separator");
-  scan_urlencoded_skipvalue(&p);
+  urlencoded_skip_value(&p);
   CHECK_STR(p, "next=1");
 
   test_case("skipvalue leaves a hard terminator in place");
   p = bare;
-  scan_urlencoded_skipvalue(&p);
+  urlencoded_skip_value(&p);
   CHECK_INT(*p, 0);
 }
 
@@ -217,44 +217,17 @@ static void case_find_keywords(void) {
   char                    *p          = match;
 
   test_case("a known keyword returns its value");
-  CHECK_INT(scan_find_keywords(keywords, &p, SCAN_SEARCHPATH_PARAM), 2);
+  CHECK_INT(urlencoded_match_keyword(keywords, &p, SCAN_SEARCHPATH_PARAM), 2);
 
   test_case("an unknown keyword returns -3");
   p = nomatch;
-  CHECK_INT(scan_find_keywords(keywords, &p, SCAN_SEARCHPATH_PARAM), -3);
+  CHECK_INT(urlencoded_match_keyword(keywords, &p, SCAN_SEARCHPATH_PARAM), -3);
 
   test_case("a prefix of a keyword does not match it");
   p = prefix;
-  CHECK_INT(scan_find_keywords(keywords, &p, SCAN_SEARCHPATH_PARAM), -3);
+  CHECK_INT(urlencoded_match_keyword(keywords, &p, SCAN_SEARCHPATH_PARAM), -3);
 }
 
-static void case_fixed_int(void) {
-  char positive[] = "123";
-  char negative[] = "-45";
-  char trailing[] = "12a";
-  int  value;
-
-  test_case("scan_fixed_int returns the count of unparsed bytes");
-  CHECK_INT(scan_fixed_int(positive, 3, &value), 0);
-  CHECK_INT(value, 123);
-
-  CHECK_INT(scan_fixed_int(negative, 3, &value), 0);
-  CHECK_INT(value, -45);
-
-  CHECK_INT(scan_fixed_int(trailing, 3, &value), 1);
-  CHECK_INT(value, 12);
-}
-
-static void case_fixed_int_bounded(void) {
-  char digits[] = "12345";
-  int  value;
-
-  test_case("scan_fixed_int honours the length it is given");
-  CHECK_INT(scan_fixed_int(digits, 3, &value), 0);
-  CHECK_INT(value, 123);
-}
-
-
 /* The encoding direction. Which bytes survive unescaped is fixed by what
    existing parsers of the urlencoded full scrape expect, so these cases pin
    the set rather than describe a preference. */
@@ -328,7 +301,7 @@ static void case_fmt_decoder_disagrees_on_dollar(void) {
      encoder passes through unescaped, '$' is the only one the decoder then
      refuses, and it refuses the whole string rather than stopping short.
      Output of the urlencoded full scrape therefore does not round trip
-     through scan_urlencoded_query when a hash contains 0x24. Harmless today
+     through urlencoded_parse when a hash contains 0x24. Harmless today
      because only third party tooling reads that output. */
   const uint8_t src[]  = {'a', '$', 'b'};
   char          dest[16];
@@ -342,11 +315,11 @@ static void case_fmt_decoder_disagrees_on_dollar(void) {
   dest[n] = 0;
   CHECK_STR(dest, "a$b");
 
-  got = scan_urlencoded_query(&p, scanned, SCAN_SEARCHPATH_VALUE);
+  got = urlencoded_parse(&p, scanned, SCAN_SEARCHPATH_VALUE);
   CHECK_INT(got, -1);
 }
 
-void test_scan_urlencoded_query(void) {
+void test_urlencoded(void) {
   case_path();
   case_param_and_value();
   case_percent_decoding();
@@ -361,8 +334,6 @@ void test_scan_urlencoded_query(void) {
   case_raw_high_byte();
   case_skipvalue();
   case_find_keywords();
-  case_fixed_int();
-  case_fixed_int_bounded();
   case_fmt_passes_safe_bytes();
   case_fmt_escapes_the_rest();
   case_fmt_hex_is_lower_case();
diff --git a/tests/t_vector.c b/tests/t_vector.c
index 541a6da..6e048e1 100644
--- a/tests/t_vector.c
+++ b/tests/t_vector.c
@@ -112,6 +112,51 @@ static void case_insert_keeps_order(void) {
   free(vector.data);
 }
 
+/* The peer variant is reached with an empty vector on every first announce
+   for a torrent, and again whenever a swarm empties and refills, because
+   vector_fixup_peers drops the allocation and nulls the data pointer. */
+
+static void case_insert_peer_into_empty_vector(void) {
+  ot_vector vector = {NULL, 0, 0};
+  ot_peer6  low, high;
+  int       exactmatch;
+  ot_peer  *slot;
+
+  memset(low, 0x11, sizeof(low));
+  memset(high, 0x99, sizeof(high));
+
+  test_case("the first peer goes into a vector that has no allocation yet");
+  slot = vector_find_or_insert_peer(&vector, low, OT_PEER_SIZE6, &exactmatch);
+  CHECK(slot != NULL);
+  CHECK_INT(exactmatch, 0);
+  memcpy(slot, low, OT_PEER_SIZE6);
+  CHECK_INT(vector.size, 1);
+  CHECK_INT(vector.space, OT_VECTOR_MIN_MEMBERS);
+  CHECK_PTR(slot, vector.data);
+
+  test_case("a second peer keeps the order");
+  slot = vector_find_or_insert_peer(&vector, high, OT_PEER_SIZE6, &exactmatch);
+  CHECK(slot != NULL);
+  CHECK_INT(exactmatch, 0);
+  memcpy(slot, high, OT_PEER_SIZE6);
+  CHECK_INT(vector.size, 2);
+  CHECK_MEM((char *)vector.data, low, OT_PEER_COMPARE_SIZE6);
+  CHECK_MEM((char *)vector.data + OT_PEER_SIZE6, high, OT_PEER_COMPARE_SIZE6);
+
+  test_case("and emptying the vector hands the allocation back");
+  CHECK(vector_remove_peer(&vector, low, OT_PEER_SIZE6) != 0);
+  CHECK(vector_remove_peer(&vector, high, OT_PEER_SIZE6) != 0);
+  CHECK_INT(vector.size, 0);
+  CHECK_PTR(vector.data, NULL);
+
+  test_case("so the next peer starts from no allocation again");
+  slot = vector_find_or_insert_peer(&vector, low, OT_PEER_SIZE6, &exactmatch);
+  CHECK(slot != NULL);
+  CHECK_INT(vector.size, 1);
+
+  free(vector.data);
+}
+
 static void case_insert_finds_existing(void) {
   ot_vector           vector = {NULL, 0, 0};
   const unsigned char five[4] = {0, 0, 0, 5};
@@ -257,6 +302,7 @@ void test_vector(void) {
   case_search_past_the_end();
   case_search_empty();
   case_insert_keeps_order();
+  case_insert_peer_into_empty_vector();
   case_insert_finds_existing();
   case_insert_compare_prefix();
   case_redistribute_holds_every_peer();
diff --git a/tests/test.h b/tests/test.h
index bc8c3bd..0eddc82 100644
--- a/tests/test.h
+++ b/tests/test.h
@@ -76,7 +76,7 @@ extern unsigned long test_failures;
   } while (0)
 
 /* One entry point per module under test */
-void test_scan_urlencoded_query(void);
+void test_urlencoded(void);
 void test_iovec(void);
 void test_vector(void);
 void test_random(void);
@@ -89,5 +89,7 @@ void test_socket(void);
 void test_mutex(void);
 void test_batch(void);
 void test_fdstate(void);
+void test_event(void);
+void test_fmt(void);
 
 #endif
diff --git a/trackerlogic.c b/trackerlogic.c
index 9705bd6..1f38f07 100644
--- a/trackerlogic.c
+++ b/trackerlogic.c
@@ -14,6 +14,7 @@
 /* Opentracker */
 #include "ot_accesslist.h"
 #include "ot_clean.h"
+#include "ot_fmt.h"
 #include "ot_fullscrape.h"
 #include "ot_http.h"
 #include "ot_ip.h"
@@ -299,11 +300,12 @@ static size_t return_peers_for_torrent_udp(struct ot_workstruct *ws, ot_torrent
 }
 
 static size_t return_peers_for_torrent_tcp(struct ot_workstruct *ws, ot_torrent *torrent, size_t amount, char *reply) {
-  char  *r          = reply;
-  int    erval      = OT_CLIENT_REQUEST_INTERVAL_RANDOM;
-  size_t seed_count = torrent->peer_list6->seed_count + torrent->peer_list4->seed_count;
-  size_t down_count = torrent->peer_list6->down_count + torrent->peer_list4->down_count;
-  size_t peer_count = torrent->peer_list6->peer_count + torrent->peer_list4->peer_count - seed_count;
+  char       *r          = reply;
+  const char *r_end      = ws->outbuf + G_OUTBUF_SIZE;
+  int         erval      = OT_CLIENT_REQUEST_INTERVAL_RANDOM;
+  size_t      seed_count = torrent->peer_list6->seed_count + torrent->peer_list4->seed_count;
+  size_t      down_count = torrent->peer_list6->down_count + torrent->peer_list4->down_count;
+  size_t      peer_count = torrent->peer_list6->peer_count + torrent->peer_list4->peer_count - seed_count;
 
   /* Simple case: amount of peers in both lists is less than requested, here we return all results */
   size_t amount_v4  = torrent->peer_list4->peer_count;
@@ -341,11 +343,11 @@ static size_t return_peers_for_torrent_tcp(struct ot_workstruct *ws, ot_torrent
       ++amount_v4;
   }
 
-  r +=
-      sprintf(r, "d8:completei%zde10:downloadedi%zde10:incompletei%zde8:intervali%ie12:min intervali%ie", seed_count, down_count, peer_count, erval, erval / 2);
+  fmt_append(&r, r_end, "d8:completei%zde10:downloadedi%zde10:incompletei%zde8:intervali%ie12:min intervali%ie", seed_count, down_count, peer_count, erval,
+             erval / 2);
 
   if (amount_v4) {
-    r += sprintf(r, PEERS_BENCODED4 "%zd:", OT_PEER_COMPARE_SIZE4 * amount_v4);
+    fmt_append(&r, r_end, PEERS_BENCODED4 "%zd:", OT_PEER_COMPARE_SIZE4 * amount_v4);
     if (amount_v4 == torrent->peer_list4->peer_count)
       r += return_peers_all(torrent->peer_list4, OT_PEER_SIZE4, r);
     else
@@ -353,14 +355,14 @@ static size_t return_peers_for_torrent_tcp(struct ot_workstruct *ws, ot_torrent
   }
 
   if (amount_v6) {
-    r += sprintf(r, PEERS_BENCODED6 "%zd:", OT_PEER_COMPARE_SIZE6 * amount_v6);
+    fmt_append(&r, r_end, PEERS_BENCODED6 "%zd:", OT_PEER_COMPARE_SIZE6 * amount_v6);
     if (amount_v6 == torrent->peer_list6->peer_count)
       r += return_peers_all(torrent->peer_list6, OT_PEER_SIZE6, r);
     else
       r += return_peers_selection(ws, torrent->peer_list6, OT_PEER_SIZE6, amount_v6, r);
   }
 
-  *r++ = 'e';
+  fmt_append(&r, r_end, "e");
 
   return r - reply;
 }
@@ -403,12 +405,11 @@ size_t return_udp_scrape_for_torrent(ot_hash const hash, char *reply) {
 }
 
 /* Fetches scrape info for a specific torrent */
-size_t return_tcp_scrape_for_torrent(ot_hash const *hash_list, size_t amount, char *reply) {
-  char *r = reply;
-  int   exactmatch;
+void return_tcp_scrape_for_torrent(ot_hash const *hash_list, size_t amount, char **reply, const char *reply_end) {
+  int    exactmatch;
   size_t i;
 
-  r += sprintf(r, "d5:filesd");
+  fmt_append(reply, reply_end, "d5:filesd");
 
   for (i = 0; i < amount; ++i) {
     int            delta_torrentcount = 0;
@@ -421,22 +422,17 @@ size_t return_tcp_scrape_for_torrent(ot_hash const *hash_list, size_t amount, ch
         vector_remove_torrent(torrents_list, torrent);
         delta_torrentcount = -1;
       } else {
-        *r++ = '2';
-        *r++ = '0';
-        *r++ = ':';
-        memcpy(r, hash, sizeof(ot_hash));
-        r += sizeof(ot_hash);
-        r += sprintf(r, "d8:completei%zde10:downloadedi%zde10:incompletei%zdee", torrent->peer_list6->seed_count + torrent->peer_list4->seed_count,
-                     torrent->peer_list6->down_count + torrent->peer_list4->down_count,
-                     torrent->peer_list6->peer_count + torrent->peer_list4->peer_count - torrent->peer_list6->seed_count - torrent->peer_list4->seed_count);
+        fmt_append(reply, reply_end, "20:");
+        fmt_bytes(reply, reply_end, hash, sizeof(ot_hash));
+        fmt_append(reply, reply_end, "d8:completei%zde10:downloadedi%zde10:incompletei%zdee",
+                   torrent->peer_list6->seed_count + torrent->peer_list4->seed_count, torrent->peer_list6->down_count + torrent->peer_list4->down_count,
+                   torrent->peer_list6->peer_count + torrent->peer_list4->peer_count - torrent->peer_list6->seed_count - torrent->peer_list4->seed_count);
       }
     }
     mutex_bucket_unlock_by_hash(*hash, delta_torrentcount);
   }
 
-  *r++ = 'e';
-  *r++ = 'e';
-  return r - reply;
+  fmt_append(reply, reply_end, "ee");
 }
 
 static ot_peerlist dummy_list;
@@ -472,9 +468,12 @@ size_t remove_peer_from_torrent(PROTO_FLAG proto, struct ot_workstruct *ws) {
   }
 
   if (proto == FLAG_TCP) {
-    int erval      = OT_CLIENT_REQUEST_INTERVAL_RANDOM;
-    ws->reply_size = sprintf(ws->reply, "d8:completei%zde10:incompletei%zde8:intervali%ie12:min intervali%ie%s0:e", seed_count, peer_count - seed_count, erval,
-                             erval / 2, peer_size == OT_PEER_SIZE6 ? PEERS_BENCODED6 : PEERS_BENCODED4);
+    int   erval = OT_CLIENT_REQUEST_INTERVAL_RANDOM;
+    char *r     = ws->reply;
+
+    fmt_append(&r, ws->outbuf + G_OUTBUF_SIZE, "d8:completei%zde10:incompletei%zde8:intervali%ie12:min intervali%ie%s0:e", seed_count, peer_count - seed_count,
+               erval, erval / 2, peer_size == OT_PEER_SIZE6 ? PEERS_BENCODED6 : PEERS_BENCODED4);
+    ws->reply_size = r - ws->reply;
   }
 
   /* Handle UDP reply */
diff --git a/trackerlogic.h b/trackerlogic.h
index 42018c3..63abf78 100644
--- a/trackerlogic.h
+++ b/trackerlogic.h
@@ -187,7 +187,7 @@ void   exerr(const char *message);
    otherwise it is released in return_peers_for_torrent */
 size_t add_peer_to_torrent_and_return_peers(PROTO_FLAG proto, struct ot_workstruct *ws, size_t amount);
 size_t remove_peer_from_torrent(PROTO_FLAG proto, struct ot_workstruct *ws);
-size_t return_tcp_scrape_for_torrent(ot_hash const *hash_list, size_t amount, char *reply);
+void   return_tcp_scrape_for_torrent(ot_hash const *hash_list, size_t amount, char **reply, const char *reply_end);
 size_t return_udp_scrape_for_torrent(ot_hash const hash, char *reply);
 void   add_torrent_from_saved_state(ot_hash const hash, ot_time base, size_t down_count);
 #ifdef _DEBUG_RANDOMTORRENTS