so
it looks to me:
CLEARNET SIDE:
the IP HASH is generated from the plaintext IP address of a given user
that IP HASH will follow that exact plaintext IP site-wide
that IP HASH uses 'secure_salt_trip' and will change with salt rotations
everywhere in the system where the plaintext IP address would be "visible" it is replaced by the IP HASH to maintain anonymity
the Administrator account would be able to see ALL clearnet side plaintext IPs if they chose too
the poster_id (UID) is ALSO generated from the plaintext IP address (not the hash)
that poster_id (UID) is board AND thread specific
that poster_id (UID) ALSO uses 'secure_salt_trip' and will change with salt rotations
TOR SIDE:
EVERY user accessing 8kun.onion gets a "this is a TOR poster flag"
EVERY "this is a TOR user" flagged user gets the same IP Hash
EVERY "this is a TOR user" flagged user gets the same poster_id (UID)
it is currently unknown how the TOR SIDE is implemented in the code base