engine: track the server tree so a hub SQUIT cascades

SQUIT arrives once for a splitting server (by SID), but a hub takes its
whole subtree with it — users behind downstream servers were left as stale
state. The parser now distinguishes a sourced downstream SERVER (tracked
with its parent) from the unsourced uplink handshake, the engine keeps the
SID->parent tree, and a SQUIT forgets every user across the departed
server's subtree. Tree is rebuilt each link. Wire formats verified against
the InspIRCd 4 m_spanningtree source.

src/engine/mod.rs

@@ -783,6 +783,7 @@ impl Engine {
         self.bot_idents.clear();
         self.bot_channels.clear();
         self.network.clear_bots();
+        self.network.clear_servers(); // the burst re-introduces the server tree
         self.next_bot_index = 0;
         let mut out = vec![NetAction::Burst];
         for svc in &self.services {
@@ -1068,11 +1069,17 @@ impl Engine {
                 self.forget_user(&uid);
                 Vec::new()
             }
+            NetEvent::ServerLink { sid, parent } => {
+                self.network.server_link(&sid, &parent);
+                Vec::new()
+            }
             NetEvent::ServerSplit { server } => {
-                // Every user behind the departed server is gone in one message;
-                // forget them so their sessions, slots and memberships don't linger.
-                for uid in self.network.uids_on_server(&server) {
-                    self.forget_user(&uid);
+                // A hub's SQUIT arrives once but takes its whole subtree with it;
+                // forget every user behind the departed server and its descendants.
+                for sid in self.network.server_split(&server) {
+                    for uid in self.network.uids_on_server(&sid) {
+                        self.forget_user(&uid);
+                    }
                 }
                 Vec::new()
             }

src/engine/state.rs

@@ -20,6 +20,9 @@ pub struct Network {
     // `users` so a reconnect can clear them wholesale without disturbing the
     // uplink-sourced user map.
     bots: HashMap<String, String>,
+    // Downstream server tree: SID -> the SID that introduced it. Lets a hub's
+    // SQUIT cascade to every server (and user) behind it. Rebuilt each link.
+    servers: HashMap<String, String>,
     // Shared, namespaced stat counters any service contributes to (ephemeral,
     // ordered for a stable snapshot). Read by StatServ and the gRPC Stats API.
     stats: BTreeMap<String, u64>,
@@ -186,6 +189,37 @@ impl Network {
         self.users.keys().filter(|u| u.starts_with(sid)).cloned().collect()
     }
 
+    // Record a downstream server and the SID that introduced it (its parent).
+    pub fn server_link(&mut self, sid: &str, parent: &str) {
+        self.servers.insert(sid.to_string(), parent.to_string());
+    }
+
+    // Forget the server subtree behind (and including) `sid` — its own SID plus
+    // every server introduced beneath it — and return the whole set so their users
+    // can be forgotten too. A hub's SQUIT arrives once but takes its children with it.
+    pub fn server_split(&mut self, sid: &str) -> Vec<String> {
+        let mut subtree = vec![sid.to_string()];
+        let mut i = 0;
+        while i < subtree.len() {
+            let parent = subtree[i].clone();
+            for (child, up) in &self.servers {
+                if up == &parent && !subtree.contains(child) {
+                    subtree.push(child.clone());
+                }
+            }
+            i += 1;
+        }
+        for s in &subtree {
+            self.servers.remove(s);
+        }
+        subtree
+    }
+
+    // Drop the whole server tree (on a fresh link, before the burst rebuilds it).
+    pub fn clear_servers(&mut self) {
+        self.servers.clear();
+    }
+
     pub fn user_nick_change(&mut self, uid: &str, nick: String) {
         if let Some(user) = self.users.get_mut(uid) {
             self.seen.insert(lc(&nick), Seen { nick: nick.clone(), ts: now(), what: format!("changing nick from {}", user.nick) });

src/engine/tests.rs

@@ -451,6 +451,30 @@
         assert_eq!(e.network.account_of("0XYAAAAAB"), Some("bob"), "users on other servers are kept");
     }
 
+    // A hub's SQUIT cascades: users behind the hub AND behind every server in its
+    // subtree are forgotten, while unrelated servers' users are kept.
+    #[test]
+    fn squit_cascades_to_the_whole_subtree() {
+        let mut e = engine_with("squitcascade", "alice", "sesame");
+        e.db.register("bob", "hunter2", None).unwrap();
+        e.db.register("carol", "pw", None).unwrap();
+        // 0HB is a hub under our uplink; 0LF is a leaf behind the hub.
+        e.handle(NetEvent::ServerLink { sid: "0HB".into(), parent: "42S".into() });
+        e.handle(NetEvent::ServerLink { sid: "0LF".into(), parent: "0HB".into() });
+        e.handle(NetEvent::UserConnect { uid: "0HBAAAAAA".into(), nick: "alice".into(), host: "h".into() , ip: "0.0.0.0".into() });
+        e.handle(NetEvent::UserConnect { uid: "0LFAAAAAA".into(), nick: "bob".into(), host: "h".into() , ip: "0.0.0.0".into() });
+        e.handle(NetEvent::UserConnect { uid: "0OKAAAAAA".into(), nick: "carol".into(), host: "h".into() , ip: "0.0.0.0".into() });
+        e.handle(NetEvent::Privmsg { from: "0HBAAAAAA".into(), to: "42SAAAAAA".into(), text: "IDENTIFY sesame".into() });
+        e.handle(NetEvent::Privmsg { from: "0LFAAAAAA".into(), to: "42SAAAAAA".into(), text: "IDENTIFY hunter2".into() });
+        e.handle(NetEvent::Privmsg { from: "0OKAAAAAA".into(), to: "42SAAAAAA".into(), text: "IDENTIFY pw".into() });
+
+        // The hub splits — it and everything behind it are gone.
+        e.handle(NetEvent::ServerSplit { server: "0HB".into() });
+        assert!(e.network.account_of("0HBAAAAAA").is_none(), "hub user forgotten");
+        assert!(e.network.account_of("0LFAAAAAA").is_none(), "user on a leaf behind the hub forgotten");
+        assert_eq!(e.network.account_of("0OKAAAAAA"), Some("carol"), "unrelated server's user kept");
+    }
+
     // A netburst that replays a user's accountname restores their services login
     // (so a services restart doesn't silently log everyone out); empty = logout.
     #[test]