
- **2026‑06‑06 — P7m (`s_bsd.c` `send_ping`, UDP CPING‑output leaf) merged.** Ported the next s_bsd.c leaf after the P7d–P7l socket/file/teardown/listener/refuse/CPING‑setup leaves: the output half of the server‑to‑server CPING (UDP ping) feature, the sibling to P7l's `setup_ping`.
  - **Cluster choice.** `send_ping` (s_bsd.c:3077) is a self‑contained leaf — its only non‑libc dependency is the `udpfd` C global it `sendto`s over (and which stays C, shared with `setup_ping`/`polludp`). No ircd callees → no atomic cluster move. The CPING‑*input* siblings `check_ping`/`polludp` (both `static`, no `cref_` oracle) stay C; they share `udpfd` only.
  - **Guard / seam.** Partial port via the existing `s_bsd_link.o` second‑compile, new guard `-DPORT_S_BSD_SEND_PING_P7m` added alongside the P7d–P7l guards in `ircd-sys/build.rs`; the C body (s_bsd.c:3077‑3117) wrapped in `#ifndef PORT_S_BSD_SEND_PING_P7m`. RED confirmed `send_ping` undefined — referenced by the still‑C `ircd.c:405` (`try_connections` CPING path); after GREEN `nm target/debug/ircd` shows it `T` from Rust. The cref oracle keeps the full unguarded `s_bsd.o` → `cref_send_ping`.
  - **Config‑resolved body.** `AFINET`=`AF_INET6` (`common/os.h:680`) → `sin` is a `libc::sockaddr_in6`, `SIN_PORT`/`SIN_FAMILY`/`SIN_ADDR` map to `sin6_*`. `IN6ADDRSZ`=16 → `bcopy(aconf->ipnum.s6_addr, sin.sin6_addr.s6_addr, 16)`. DEBUGMODE/USE_SYSLOG off → the `Debug` line vanishes. `PING_CPING`=0x02 (`struct_def.h:411`, bindgen const) → `pi.pi_id = htonl(2)` (a `u_long`, network order).
  - **Faithfulness.** The C guard `if (!aconf->ipnum.s6_addr || AND16(...)==255 || !cp->port)` — the first disjunct is the address of an array field, so it is **always false** in C; reproduced as the two real gates only (`AND16==255` ≡ all 16 bytes `0xff` via `iter().fold(0xff, &)`, the unresolved `minus_one` sentinel; and `cp->port==0`). All `aCPing` counters (`ping`/`seq`/`lseq`/`recvd`) are `u_long` → unsigned arithmetic (`cp->seq * conFreq > 1200`, `cp->ping -= cp->ping/cp->recvd`). `pi.pi_seq = cp->lseq++` is post‑increment (the packet carries the pre‑increment value). The window block does `seq++` then conditional `seq--` (net 0 when it fires), with `recvd--` only when `recvd == seq` (post‑`++`). `sin.SIN_PORT = htons(cp->port)` = `(*cp).port.to_be()`.
  - **Classification.** Callee/utility TU (no `msgtab` entry) — reached from the server‑connect / `try_connections` CPING path, not a client command. Formats **no remote‑user fields** (only a binary UDP datagram to the configured peer) → no S2S.
  - **L1.** `send_ping_diff.rs`, 7 cases, isolated worlds (Rust reads the real `udpfd`; oracle reads `cref_udpfd`), serialized on `GLOBALS_LOCK`. Each case `open_udp()`s a fresh UDP socket as that world's `udpfd`, binds a non‑blocking `::1:<ephemeral>` receiver, points the conf's destination port at it, drives `send_ping`, and `recvfrom`s the datagram. Compares Rust‑vs‑oracle the deterministic `aCPing` post‑state (`seq`/`lseq`/`recvd`/`ping`) byte‑identical + the world‑independent packet fields (`pi_id == htonl(2)`, `pi_seq == pre‑increment lseq`); `pi_cp` (a live pointer) and `pi_tv` (`gettimeofday`) are nondeterministic/world‑specific → excluded. Cases: (1) basic send, no window → `lseq` 0→1, `seq` 0→1, packet with `pi_seq=0`; (2) unresolved ipnum (all `0xff`, `AND16==255`) → early return, counters untouched, no packet (inverse of 1); (3) `cp->port==0` → early return; (4) `conFreq==0` → early return; (5) window `recvd>0` (`seq=12`→13, `13*100>1200` → `ping 1000 - 1000/5 = 800`, `recvd`≠`seq` stays, `seq--`→12); (6) window `recvd==0` (`ping`→0); (7) window `recvd==seq` post‑`++` (`recvd--` also fires: `ping 1300-100=1200`, `recvd 13→12`). Zero‑diff vs `cref_send_ping`.
  - **Untested‑by‑design.** `pi_tv` (`gettimeofday`) + `pi_cp` (a live pointer) are nondeterministic/world‑specific → excluded from the packet comparison. The `sendto` failure path is `(void)`‑ignored by C → unobservable.
  - **L2 / S2S.** No new L2: callee, hit by the server‑connect CPING path; `golden_registration` (incl. `register_quit_reuse_releases_nick`) stays byte‑identical. No S2S: formats no remote‑user wire fields.

- **2026‑06‑06 — P7n (`s_bsd.c` listener-(re)construction wrappers `open_listener`/`reopen_listeners`) merged.** The next `s_bsd.c` leaf after the P7d–P7m socket/file/teardown/listener/CPING leaves — the layer directly above the still-C socket constructor `inetport`. Ported `open_listener` (s_bsd.c:467) + `reopen_listeners` (s_bsd.c:512) to `ircd-common/src/s_bsd.rs`.
  - **Cluster choice.** The cleanest remaining s_bsd leaf with no static-callee blocker: `reopen_listeners` is a pure `ListenerLL` walk → `open_listener`; `open_listener` dispatches to the still-C `inetport` (real socket/bind/listen, keeps its static callee `set_sock_opts` with internal linkage in the surviving C) plus the already-Rust `add_fd` (P2) and `set_non_blocking` (P7d). The strangler seam holds with `inetport` staying C, called via the bindgen extern — porting the layer *above* a still-C leaf is allowed (symbols resolve either direction). The other remaining s_bsd symbols are the event-loop core (`read_message`/`add_connection`), listener *construction* (`inetport`/`add_listener` — real syscalls + the static `set_sock_opts`), sender-only (`report_error`), process setup (`init_sys`/`daemonize`/`start_iauth`), connection auth (`check_client`/`check_server`/`check_server_init`), real-DNS (`get_my_name`), or `static` (no `cref_` oracle).
  - **Guard / seam.** Same `s_bsd_link.o` partial-compile; added `-DPORT_S_BSD_OPEN_LISTENER_P7n` to the recipe in `ircd-sys/build.rs` (alongside the P7d–P7m guards) and wrapped the two C bodies (s_bsd.c:467-525) in a single `#ifndef PORT_S_BSD_OPEN_LISTENER_P7n`. RED confirmed both symbols undefined — `open_listener` referenced by the still-C `add_listener` (s_bsd.c:347), `reopen_listeners` by the now-Rust `s_conf.rs` rehash (line 2927); after GREEN `nm target/debug/ircd` shows both `T` from Rust. The cref oracle keeps the full unguarded `s_bsd.o` → `cref_open_listener`/`cref_reopen_listeners`.
  - **Config-resolved body.** `UNIXPORT` OFF (config.h:339) → `open_listener`'s `*aconf->host == '/'` unix-socket branch is not compiled; only the inet branch survives. No other `#ifdef`s. Macros reproduced inline: `IsListener(x)` (existing `is_listener` helper), `IsConfDelayed(aconf)` = `aconf->flags & PFLAG_DELAYED` (bindgen const, `flags` is `c_long`), `SetListenerInactive(x)` = `flags |= FLAGS_LISTENINACTIVE` (bindgen const), `IsIllegal(aconf)` (existing `conf_is_illegal` helper). `firstrejoindone`/`ListenerLL`/`fdas`/`fdall`/`inetport`/`add_fd` are bindgen externs (`inetport`/`firstrejoindone` stay C; `add_fd` resolves to the Rust list port).
  - **Faithfulness.** `open_listener` early-returns on `!IsListener(cptr) || cptr->fd > 0` — note `> 0` (not `>= 0`), so fd 0 does not early-return. The delayed branch sets `dolisten = 0` AND marks the listener inactive, so `inetport` skips `listen()` (socket created, not accepting). `inetport` returning non-zero resets `cptr->fd = -1` ("to allow further inetport calls"); only when `cptr->fd >= 0` afterward is the fd registered in `fdas`/`fdall` + flipped non-blocking.
  - **Classification.** Callee/utility TU (no `msgtab` entry) — `reopen_listeners` reached from `rehash` (`s_conf.rs`), `open_listener` from `add_listener`/`reopen_listeners`. → L1 is the gate; no S2S (formats no remote-user wire fields).
  - **L1.** `open_listener_diff.rs`, 6 cases, isolated worlds (Rust port reads/mutates the real `ListenerLL`/`local`/`fdas`/`fdall`/`me`/`firstrejoindone` + calls the real C `inetport` and the Rust `add_fd`/`set_non_blocking`; oracle uses `cref_*` + `cref_inetport`), serialized on `GLOBALS_LOCK`. Each world opens its **own** socket via `inetport` (fd integers differ) → the comparison is on the fd's observable properties (`fd_valid` via `fcntl F_GETFD`, `listening` via `SO_ACCEPTCONN`, `nonblocking` via `O_NONBLOCK`), the `FLAGS_LISTENINACTIVE` bit, `fdas`/`fdall` membership, `local[fd]==cptr`, and `port`. Listener built with `ip=NULL`, `port=0` (no bind → no addr-family hazard; `inetport` still does `socket`/`getsockname`/`listen`), `ipmask="0.0.0.0"`; `me.name` pointed at `me.namebuf` and pinned to `"irc.test"` in both worlds so `inetport`'s `ME`-based `sockhost` is identical. Cases: (1) normal listener → listening, non-blocking, registered, not inactive; (2) delayed + `firstrejoindone==0` → `dolisten=0`: created but NOT listening, `FLAGS_LISTENINACTIVE` set, still registered + non-blocking; (3) delayed + `firstrejoindone==1` (inverse of 2) → behaves normal (listening, flag clear); (4) `!IsListener` → no-op (fd stays -1, nothing registered); (5) `fd>0` early-return → fd untouched, not registered; (6) `reopen_listeners` over `[illegal fd<0, legal fd<0, legal fd>0]` → only the legal-fd<0 node is opened, the illegal + already-open nodes skipped (the open node's per-world pipe fd compared against its own recorded start value, not cross-world). Zero-diff vs `cref_*`.
  - **Untested-by-design.** `inetport`'s failure arms (socket/bind failure → `report_error` + `cptr->fd=-1`) need an induced syscall failure; both worlds take the success path identically. The `cptr == &me` `write(0,…)` KLUDGE inside `inetport` is not reached (our cptr != `me`).
  - **L2 / S2S.** No new L2: hit at boot/rehash by the existing golden suite (`golden_registration` byte-identical, 0 warnings). No S2S: formats no remote-user wire fields.

- **2026‑06‑06 — P7o (`s_bsd.c` `add_listener`, listener-constructor wrapper) merged.** The next `s_bsd.c` leaf after the P7d–P7n socket/file/teardown/listener/CPING leaves — the listener *constructor* directly above the now-Rust `open_listener` (P7n). Ported `add_listener` (s_bsd.c:330) to `ircd-common/src/s_bsd.rs`.
  - **Cluster choice.** The natural next leaf: `add_listener` is a thin constructor whose every callee is already Rust — `make_client`/`make_link` (P2) and `open_listener` (P7n, which itself calls the still-C `inetport` + the Rust `add_fd`/`set_non_blocking`). Its whole effect is the new listener-stub `aClient`'s fields + the socket open (delegated to `open_listener`) + the `ListenerLL` prepend → fully observable as list + per-node post-state. The remaining s_bsd symbols are the event-loop core (`read_message`/`add_connection`), the real socket constructor (`inetport` + its static `set_sock_opts`), sender-only (`report_error`), process setup (`init_sys`/`daemonize`/`start_iauth`), connection auth (`check_client`/`check_server`/`check_server_init` + the static `check_init`), real-DNS (`get_my_name`), or `static` (no `cref_` oracle).
  - **Guard / seam.** Same `s_bsd_link.o` partial-compile; added `-DPORT_S_BSD_ADD_LISTENER_P7o` to the recipe in `ircd-sys/build.rs` (alongside the P7d–P7n guards) and wrapped the C body (s_bsd.c:330-358) in `#ifndef PORT_S_BSD_ADD_LISTENER_P7o`. RED confirmed `add_listener` undefined — referenced only by the now-Rust `s_conf.rs` initconf (`s_conf.c:2287`); after GREEN `nm target/debug/ircd` shows it `T` from Rust. The cref oracle keeps the full unguarded `s_bsd.o` → `cref_add_listener`.
  - **Config-resolved body.** No `#ifdef`s in `add_listener` itself (the adjacent `#ifdef UNIXPORT unixport` block is a separate function, untouched). Macros reproduced inline: `FLAGS_LISTEN` (bindgen const, `flags` is `c_long`), `ME` = `me.name` (read the bindgen `me` global's `name`), `SetMe(cptr)` = `cptr->status = STAT_ME` (`Status_STAT_ME`). `make_client(NULL)` allocates a `CLIENT_LOCAL` client (fd = -1, so `open_listener` does not early-return); `make_link()` is the one-element confs link.
  - **Faithfulness.** The order matters: `make_client` already sets `name = namebuf` + `firsttime = timeofday`; `add_listener` overwrites `name = ME` and `firsttime = time(NULL)` (wall clock, not the event-loop `timeofday`). `open_listener` is called *before* the list splice. The prepend is the verbatim C: `if (ListenerLL) ListenerLL->prev = cptr; cptr->next = ListenerLL; cptr->prev = NULL; ListenerLL = cptr;`.
  - **Classification.** Callee/utility TU (no `msgtab` entry) — the listener constructor, called from `s_conf.c` initconf (boot) and rehash. → L1 is the gate; no S2S (formats no remote-user wire fields).
  - **L1.** `add_listener_diff.rs`, 3 cases, isolated worlds (Rust port reads/mutates the real `ListenerLL`/`local`/`fdas`/`fdall`/`me` + calls the real C `inetport` via the Rust `open_listener`; oracle uses `cref_*` + `cref_inetport`), serialized on `GLOBALS_LOCK`. Each world opens its **own** socket (fd integers differ) and `make_client` allocates its **own** client pointer → the comparison is on observable facts: the listener's `flags`/`status`, `acpt`/`from` self-pointers (as bools), `name` string, `confs->value.aconf` identity (matches the conf handed in) + `confs->next == NULL`, the `ListenerLL` prepend linkage (`prev == NULL`, `next == old head`), and the fd's properties (`fd_valid` via `fcntl F_GETFD`, `listening` via `SO_ACCEPTCONN`, `nonblocking` via `O_NONBLOCK`) + `fdas`/`fdall`/`local[fd]==cptr` membership + `port`. `me.name` pinned to `"irc.test"` in both worlds so `inetport`'s `ME`-based `sockhost` is identical. `firsttime = time(NULL)` is nondeterministic across the two calls → asserted non-zero, excluded from the cross-world compare. Cases: (1) into empty `ListenerLL` → sole node, `FLAGS_LISTEN`/`STAT_ME`/self pointers/`ME` name/`confs->aconf`, listening + non-blocking + registered, prev/next NULL; (2) prepend before an existing node → new head with `prev == NULL`, `next == old head`, and the inverse invariant — the old head's `prev` now points back at the new node; (3) two consecutive calls → head is the 2nd, `head->next == 1st`, `1st->next == NULL`, with both back-links. Zero-diff vs `cref_add_listener`.
  - **Untested-by-design.** `firsttime = time(NULL)` (wall clock) is nondeterministic → asserted non-zero, not compared. `inetport`'s failure arms (socket/bind failure → `report_error` + `fd = -1`) need an induced syscall failure; both worlds take the success path identically (covered transitively by P7n's open_listener test notes).
  - **L2 / S2S.** No new L2: `add_listener` runs at boot (and rehash) via `s_conf.c` initconf; the existing golden suite exercises it — `golden_registration` (incl. `register_quit_reuse_releases_nick`) stays byte-identical (0 warnings). No S2S: it formats no remote-user wire fields.

- **2026‑06‑06 — P7p (`s_bsd.c` `inetport`, listener socket constructor) merged.** The next `s_bsd.c` leaf after the P7d–P7o socket/file/teardown/listener/CPING leaves — the real socket constructor directly below the now-Rust `open_listener` (P7n). Ported `inetport` (s_bsd.c:210) + a private twin of its `static` callee `set_sock_opts` to `ircd-common/src/s_bsd.rs`.
  - **Cluster choice.** `inetport` is the layer `open_listener` (P7n) and `add_listener` (P7o) call; porting it completes the listener-construction stack bottom-up. Its only `static` callee `set_sock_opts` (s_bsd.c:1468) has no `cref_` oracle, so it is ported as a **private (non-`#[no_mangle]`) Rust fn** alongside `inetport`; the C `static set_sock_opts` is **not** removed — it stays compiled for its other in-TU callers `check_server_init`/`connect_server` (a static + a private-Rust twin coexist with no symbol clash; the duplicate vanishes when those two callers are ported). `inetport`'s effects are fully L1-observable (the created fd's properties + the `cptr` field writes), the same harness shape as P7n/P7o. The remaining s_bsd symbols are the event-loop core (`read_message`/`add_connection`), connection auth (`check_client`/`check_server`/`check_server_init` + the static `check_init`), sender-only (`report_error`), process setup (`init_sys`/`daemonize`/`start_iauth`), real-DNS (`get_my_name`), or `static` (no `cref_` oracle).
  - **Guard / seam.** Same `s_bsd_link.o` partial-compile; added `-DPORT_S_BSD_INETPORT_P7p` to the recipe in `ircd-sys/build.rs` (alongside the P7d–P7o guards) and wrapped the C `inetport` body (s_bsd.c:210-323) in `#ifndef PORT_S_BSD_INETPORT_P7p` (the adjacent `static set_sock_opts` left untouched). RED confirmed `inetport` undefined — referenced by the now-Rust `open_listener` (`s_bsd.rs:605`) and the still-C `ircd.c:1107`; after GREEN `nm target/debug/ircd` shows `inetport` `T` from Rust, and the C `set_sock_opts` survives as a `t` local (with the mangled `ircd_common::s_bsd::set_sock_opts` private twin). The cref oracle keeps the full unguarded `s_bsd.o` → `cref_inetport`.
  - **Config-resolved body.** `AFINET` = `AF_INET6` (`os.h:680`) → `server` is a `libc::sockaddr_in6`, `SIN_FAMILY`/`SIN_PORT` map to `sin6_*`; `SOCKADDR_IN` = `sockaddr_in6`. `__CYGWIN32__` off → no in-body `set_non_blocking`. `LISTENQUEUE` = 128 (config const, not in bindgen). `ME` = `me.name`. `cptr->ip` is the bindgen `in6_addr` (a `__in6_u.__u6_addr8` union, not libc's `.s6_addr`). `cptr->port` is a `u_short`. `set_sock_opts` config-resolution: SO_REUSEADDR (opt=1) + SO_RCVBUF/SO_SNDBUF/SO_SNDLOWAT (opt=8192) all compile; SO_DEBUG is `#if … && 0` (never); SO_USELOOPBACK is **not defined on Linux** (skipped). The `SETSOCKOPT` macro (`sys_def.h:29`) passes `sizeof(int)`=4 as the option length for every call (`sizeof(o3)` where `o3` is the value arg), not `sizeof(*p)`. SO_SNDLOWAT is set quietly (no `report_error` on failure); the others `report_error` on failure (kept C).
  - **Faithfulness.** Order matters: the NULL-ipmask refuse and the `ad[i]>>8` invalid-ipmask refuse both `return -1` **before** the `sockhost`/`auth`/`socket` writes (so on those paths `fd` stays -1, `auth` NULL). The `if (cptr->fd == -1)` socket-open is conditional (an already-open fd is reused). The `cptr == &me` KLUDGE (`sprintf(buf, replies[RPL_MYPORTIS], ME, "*", ntohs(port)); write(0, buf, …)`) is reproduced verbatim via the bindgen `replies` incomplete-array + `RPL_MYPORTIS` const, but is unreachable for a listener stub (`cptr != &me`). `DupString(cptr->auth, ipname)` = `MyMalloc(strlen+1)` (Rust P2) + `strcpy`. The ipmask canonicalization (`sscanf "%d.%d.%d.%d"` → `sprintf` back) and the `sprintf "%-.42s.%u"` sockhost are done via `libc::sscanf`/`libc::sprintf` for byte-exactness. The bind addr: `in6addr_any` when `!ip || (!isxdigit(*ip) && *ip != ':')`, else `inetpton` (Rust P1) with the 16-byte `minus_one` fallback on parse failure.
  - **Classification.** Callee/utility TU (no `msgtab` entry) — `inetport` is reached from `open_listener` (boot/rehash) and the inetd `me`-listener path. → L1 is the gate; no S2S (formats no remote-user wire fields).
  - **L1.** `inetport_diff.rs`, 6 cases, isolated worlds (the Rust port reads/mutates the real `local`/`highest_fd`/`me` and calls the real `inetpton`/`MyMalloc`; the oracle uses the `cref_*` copies + `cref_inetport`), serialized on `GLOBALS_LOCK`. `me.name` pinned to `"irc.test"` in both worlds so the `ME`-based sockhost matches. Because each world opens its own socket (fd integers differ), the `Obs` compares the fd's observable properties (`fd_valid` via `fcntl F_GETFD`, `listening` via `SO_ACCEPTCONN`, the three socket options via `getsockopt SO_REUSEADDR/SO_RCVBUF/SO_SNDBUF`) + the world-independent struct fields (`sockhost`, `auth`, `port`, `ip` 16 bytes, `local[fd]==cptr`, the -1/0 return), never the raw fd; `highest_fd` is asserted per-world to equal the new fd. Cases: (1) normal port=0 listener (dolisten=1) → full compare: ret 0, listening, sockhost `irc.test.0`, auth `0.0.0.0`, port 0, registered, `highest_fd` bumped; (2) dolisten=0 (the `listen()` inverse) → socket created + opts set but NOT listening, still registered; (3) NULL ipmask → return -1 before any socket (the refuse inverse), fd untouched, auth NULL; (4) invalid ipmask `256.0.0.0` (`256>>8 != 0`) → return -1 before sockhost/auth/socket; (5) wildcard bind (ip=NULL, port=P) → `in6addr_any`, getsockname → `::`, `cptr->ip` all-zero, sockhost `irc.test.<P>`; (6) `::1` bind (`*ip == ':'` → the `inetpton` branch) → bind `::1`, getsockname → `::1`, `cptr->ip` = `::1`, sockhost `::1.<P>`. The two bind cases (5,6) are serialized per world (run + observe + close Rust, then cref) over one `probe_free_port()`'d port, since both worlds would otherwise collide on it. Zero-diff vs `cref_inetport`; sibling P7d–P7o L1 tests + `golden_registration` re-run green.
  - **Untested-by-design.** The `socket`/`bind`/`getsockname` failure arms (→ `report_error` + close + return -1) need an induced syscall failure; both worlds take the success path identically. The `cptr == &me` KLUDGE (`write(0, …)`) and the `fd >= MAXCLIENTS` overflow refuse are unreachable for a listener stub. `set_sock_opts`'s `report_error` arms fire only on a `setsockopt` failure (none here).
  - **L2 / S2S.** No new L2: `inetport` runs at boot (and rehash) via `open_listener`; the existing golden suite exercises it — `golden_registration` (incl. `register_quit_reuse_releases_nick`) stays byte-identical (0 warnings). No S2S: it formats no remote-user wire fields.

- **2026‑06‑06 — P7q (`s_bsd.c` `report_error`, error-reporting output leaf) merged.** The genuine clean leaf left in the central I/O TU.
  - **Cluster choice.** `report_error` (s_bsd.c:151) calls **no** other `s_bsd.c` function → it ports in isolation. The 27 internal call sites (the still‑C `add_connection`/`check_*`/`connect_server`/`read_message` + the already‑Rust P7d–P7p leaves that called it via an `extern "C"` decl) now resolve to the Rust definition. The remaining unported s_bsd.c functions (`add_connection`, `read_message`, `connect_server`, `get_my_name`, `init_sys`/`daemonize`/`start_iauth`, the `check_*` conf cluster) are all either event-loop cores, fork/destructive glue, or clustered via the file-private `static mysk` (`get_my_name`↔`connect_server`↔`check_client`) — none is a clean standalone leaf, so `report_error` was the right next pick.
  - **Guard / seam.** Partial port via the existing `s_bsd_link.o` second-compile, new guard `-DPORT_S_BSD_REPORT_ERROR_P7q` (added alongside P7d–P7p in `ircd-sys/build.rs`). The Rust port replaces the old `extern "C" { fn report_error }` decl in `s_bsd.rs`.
  - **Config‑resolved body.** `SO_ERROR` defined → the getsockopt readout compiles (mirrors P7d's `get_sockerr`); `DEBUGMODE` off → no `Debug`; `USE_SYSLOG` off → no `syslog`. `text` is a printf **format** taking two `%s` (`host`, `strerror`). Faithful: `errtmp = errno` first; `host = get_client_name(cptr, FALSE)` or `""`; the `!IsMe && fd>=0` SO_ERROR refinement; `sendto_flag(SCH_ERROR, text, host, strerror)`; the `Connecting||Handshake` + `serv->byuid[0]` + remote‑`bysptr` NOTICE (`:%s NOTICE %s :` via `strcpy`+`strncat`, then `sendto_one(bysptr, fmbuf, ME, bysptr->name, host, strerror)`); the `serverbooting` `fprintf(stderr, text, host, strerror)` + `fprintf(stderr, "\n")` echo. The variadic `sendto_flag`/`sendto_one`/`fprintf` are **called** (legal in stable Rust), not defined — the trampolines stay C until P8. `stderr` is glibc's `extern FILE *stderr` symbol (not the macro). Added inline `is_me`/`my_connect` helpers + a `SCH_ERROR` const.
  - **Classification.** Utility / output leaf — **no `msgtab` entry**. Effects: the `SCH_ERROR` opers notice (variadic wire, L2), the remote `bysptr` NOTICE (S2S), and the `serverbooting` stderr echo (L1‑capturable). So L1 gates the deterministic format core; the wire paths are L2/S2S/untested‑by‑design.
  - **L1.** `report_error_diff.rs`, 4 cases, isolated worlds (Rust reads the real `serverbooting` + calls Rust `get_client_name`; oracle uses `cref_serverbooting` + `cref_get_client_name`), serialized on `GLOBALS_LOCK`. A `capture_stderr` helper dup/pipe‑redirects fd 2 around each call, `fflush(NULL)` before+after, reads the pipe, restores fd 2. The same heap `aClient` (`calloc`‑zeroed, `fd=-1` → `!MyConnect` → `host=name`, no SO_ERROR, `status=STAT_CLIENT` → no bysptr) is passed to both worlds (read‑only). Each case sets both worlds' `serverbooting` + `errno`. Cases: (1) `serverbooting=1`+`cptr=NULL` → `host=""`, `errno=ECONNREFUSED` → formatted `"…:Connection refused\n"`; (2) **inverse / the gate** — `serverbooting=0` → **no** stderr output (both empty); (3) `serverbooting=1`+`cptr` non‑NULL → `host=get_client_name=name`, `errno=EHOSTUNREACH`; (4) host embedded mid‑string + varied errno (`ETIMEDOUT`/`EPIPE`). Zero‑diff vs `cref_report_error`.
  - **Verification.** `cargo build` (workspace, 0 warnings); `nm target/debug/ircd | grep ' T report_error'` → defined from Rust; L1 zero‑diff; L2 `golden_registration` (boot path exercises `report_error` on errors) byte‑identical.
  - **No new L2 / no S2S.** Output callee, not a `msgtab` handler — the `SCH_ERROR` error notice is covered by the existing golden suite. Untested‑by‑design: the `SO_ERROR` getsockopt readout (needs a pending‑error socket; `fd<0` skips it identically), the `sendto_flag` SCH_ERROR wire emission (L2, variadic), the `bysptr` remote NOTICE (S2S — needs a `Connecting`/`Handshake` server whose `byuid` resolves to a remote introducer).

- **2026-06-06 — P7r (`s_bsd.c` `init_sys`, fd-table boot leaf) merged.** Ported the cleanest remaining leaf in the central I/O TU `s_bsd.c`.
  - **Cluster choice** — after the P7d–P7q leaves, the genuinely-clean leaves are nearly exhausted; `init_sys` is the last one that calls **no** other `s_bsd.c` function and shares **no** private static with still-C code (it touches only the already-exported `fdas`/`fdall`/`local` globals). Contrast: `get_my_name` shares the private `mysk` static with still-C `check_init`/`connect_server` (a shared-static connected component, deferred); `daemonize`/`start_iauth` are blocked on the still-C iauth spawn.
  - **Config-resolved body** — two `#ifdef`s collapse the source: `RLIMIT_FD_MAX` is **not defined on Linux** (verified via `gcc -E`) → the entire `getrlimit`/`setrlimit` of `RLIMIT_FD_MAX`+`RLIMIT_CORE` block (with its `exit(-1)` arms) does not compile; `USE_POLL=1` (setup.h:390) → the `#if !defined(USE_POLL)` sequent `setdtablesize` block is excluded; Linux (not PCS/DYNIXPTX/SVR3/HPUX/SVR4) → the `setlinebuf(stderr)` branch. Resolved body: `setlinebuf(stderr)`; `bzero(&fdas)`/`bzero(&fdall)` + `fdas.highest=fdall.highest=-1`; `local[0]=local[1]=local[2]=NULL`; `for (fd=3; fd<MAXCONNECTIONS=50; fd++){ local[fd]=NULL; close(fd); }`. Callees: libc only.
  - **Mechanism** — partial port via the existing `s_bsd_link.o` second-compile seam, new guard `-DPORT_S_BSD_INIT_SYS_P7r` in `ircd-sys/build.rs`; `init_sys` wrapped in `#ifndef PORT_S_BSD_INIT_SYS_P7r` in `ircd/s_bsd.c`. Rust port in `ircd-common/src/s_bsd.rs`: `setlinebuf` via a local extern (reusing the module's `stderr` extern), `fdas`/`fdall` via `addr_of_mut!(ircd_sys::bindings::fdas/fdall)` + `write_bytes(_,0,1)`, `local[]` via the existing `local_base()` helper, `MAXCONNECTIONS` from bindgen.
  - **Classification** — boot callee, not a `msgtab` handler.
  - **L1** — `init_sys_diff.rs`, 3 cases, zero-diff vs `cref_init_sys`. The close loop closes fds `3..49` in the calling process → **destructive to cargo's test fds**, so each world runs in a **forked child** and returns its post-state through an `mmap(MAP_SHARED|MAP_ANONYMOUS)` region (memory, not an fd → survives the close loop); the parent `waitpid`s and asserts Rust-child == cref-child == expected. Each child pre-dirties its globals (`highest=7`, `fd[]` non-zero, `local[0]/[5]/[N-1]` sentinels) so the test proves the body **wrote** (inverse-of-dirty), opens a sentinel fd dup'd onto fd 10, and reports: `fdas`/`fdall.highest` (=-1), non-NULL `local[]` count (=0), `fd[]` fully zeroed, sentinel-fd-closed, fds 1/2 still open. Isolated worlds (real `fdas`/`fdall`/`local` vs `cref_*`), serialized on `GLOBALS_LOCK`.
  - **L2 / S2S** — no new L2 (boot callee; the existing golden suite boots through it, `golden_registration` byte-identical confirmed); no S2S (formats no remote-user fields). Untested-by-design: `setlinebuf(stderr)` (unobservable line-buffering); the rlimit/`exit` arms don't compile under the locked config.

- **2026-06-06 — P7s (`s_bsd.c` `get_my_name`, server-own-hostname resolver, + de-static `mysk`) merged.** The most leaf-like remaining `s_bsd.c` function after the P7d–P7r leaves. Ported `get_my_name` (s_bsd.c:2940) to `ircd-common/src/s_bsd.rs`.
  - **Cluster choice.** After P7d–P7r the genuinely-clean s_bsd.c leaves are exhausted; the remaining exported functions are the event-loop core (`add_connection`/`read_message` + statics), the connection-auth cluster (`check_init`/`check_client`/`check_server`/`check_server_init`), `connect_server`, and the fork/iauth glue (`daemonize`/`start_iauth`). `get_my_name` is the most leaf-like: its **only** in-TU callee is `add_local_domain` (already Rust, P7e); everything else is libc (`gethostname`/`gethostbyname`/`isdigit`/`strlen`) or already-Rust (`find_me` P6, `inetpton`/`mycmp` P1, `minus_one`/`me` bindgen). NB: the `utmp_open`/`utmp_read`/`utmp_close` trio + `summon` are **not** remaining leaves — they're `#if defined(ENABLE_SUMMON) || defined(USERS_SHOWS_UTMP)` (both off) so they don't compile at all (user-confirmed).
  - **The `mysk` blocker / de-static.** `get_my_name` **writes** the file-private `static struct SOCKADDR_IN mysk` (s_bsd.c:55); the still-C `check_client` (s_bsd.c:965, localhost detection) and `connect_inet` (s_bsd.c:2687/2692, outgoing bind) **read** it. To split the writer (→ Rust) from the C readers, `mysk` needs a linkable symbol → changed `static struct SOCKADDR_IN mysk;` → `struct SOCKADDR_IN mysk;` (file-scope global) **unconditionally** (behaviour-preserving: single TU, no other `mysk`; storage-class only). This also makes the cref archive export `cref_mysk` (the `objcopy --prefix-symbols` rename only follows *global* symbols — the L1 static-symbol limit), so the L1 test gets a full cross-world `mysk` comparison. `mysk` stays **C-owned** (defined in `s_bsd_link.o`); Rust references it via a local `extern "C" { static mut mysk: libc::sockaddr_in6; }`.
  - **Guard / seam.** Partial port via the existing `s_bsd_link.o` second-compile, new guard `-DPORT_S_BSD_GET_MY_NAME_P7s` added alongside P7d–P7r in `ircd-sys/build.rs`; the C body (s_bsd.c:2940-3023) wrapped in `#ifndef PORT_S_BSD_GET_MY_NAME_P7s`. RED confirmed `get_my_name` undefined — referenced by the still-C `ircd.c:702` (boot); after GREEN `nm target/debug/ircd` shows `get_my_name` `T` from Rust and `mysk` a `B` global. The cref oracle keeps the full unguarded `s_bsd.o` → `cref_get_my_name` + `cref_mysk`.
  - **Config-resolved body.** `HAVE_GETIPNODEBYNAME` **undef** (setup.h:53) → the plain `gethostbyname(cname) || gethostbyname(name)` branch (no `getipnodebyname`/`freehostent`). `DEBUGMODE` off → no `Debug` at 3015. The `mysk.SIN_ADDR` write at s_bsd.c:3012 is inside a `#if 0 … #endif` (dead) → **not** ported. `SOCKADDR_IN` = `sockaddr_in6` (`AFINET`=`AF_INET6`); `tmp[HOSTLEN+1]` (=64) is a module-private `static mut`; `ME` = `me.name`; `BadPtr(cname)` = `cname.is_null() || *cname == 0`; `strncpyzt` = `strncpy` + force-NUL.
  - **Faithfulness.** `mysk` is `bzero`'d first → full-struct byte compare is valid (padding/flowinfo/scope_id stay zero). The passwd branch fires only when `aconf->passwd && isdigit(*passwd)` (so `"2001:db8::1"` qualifies but `"::1"` does not — leading char must be a digit); `inetpton` failure → `bcopy(minus_one, …, 16)`. The alias loop is `for (hname=h_name, i=0; hname; hname=h_aliases[i++])` → Rust reads `h_aliases[i]` then `i += 1` (post-increment). `gethostbyname` is declared via a local extern (absent from the libc crate).
  - **Classification.** Boot callee / utility TU (no `msgtab` entry) — called from `ircd.c` boot + `connect_server`. → L1 is the gate; no S2S (formats no remote-user wire fields).
  - **L1.** `get_my_name_diff.rs`, 6 cases, isolated worlds (Rust writes the real `mysk`; oracle writes `cref_mysk`), shared `conf`/`cref_conf` M-conf list + shared read-only `cptr`, `me`/`cref_me` ME pinned to `irc.test`, separate `name` output buffers, serialized on `GLOBALS_LOCK`. Determinism: `gethostname`/`gethostbyname` are non-deterministic across runs but **identical across the two worlds in one run** → the differential holds whatever DNS returns; the test asserts the two worlds *agree* (`name` bytes + the full 28-byte `mysk`==`cref_mysk`), not a fixed string. Cases: (1) M-conf NULL passwd → addr stays zero (family/port set); (2) non-digit passwd `"abc"` → isdigit false → addr zero (inverse); (3) valid `"2001:db8::1"` → inetpton fills `20 01 0d b8 … 01`; (4) digit-but-invalid `"9zz"` → inetpton fails → `mysk` addr all-`0xff` (minus_one); (5) `cname="localhost"` → drives the `gethostbyname` + alias-loop branch; (6) `cname=""` → `BadPtr` early return after `add_local_domain`. Zero-diff vs `cref_get_my_name`.
  - **Verification.** `cargo build` (workspace, 0 warnings); L1 zero-diff; sibling s_bsd L1 (`s_bsd_leaves_diff`/`add_local_domain_diff`/`init_sys_diff`/`report_error_diff`/`close_connection_diff`) re-run green; `golden_registration` byte-identical (boot exercises `get_my_name`).
  - **Untested-by-design.** The resolved hostname is host-dependent (asserted as *agreement*, not a literal); the `gethostname == -1` early return needs an induced failure (both worlds take the success path identically).

- **2026-06-06 — P7t (`ircd.c` `calculate_preference`, AC preference leaf) merged.** Ported `calculate_preference` (ircd.c:387) to `ircd-common/src/ircd.rs`.
  - **Cluster choice** — the cleanest remaining exported leaf in `ircd.c`: the `s_bsd.c` clean leaves are exhausted (the rest belong to the deferred event-loop / auth / connect clusters), and `calculate_preference`'s only TU-callee, `send_ping`, was already ported in P7m. It is the periodic auto-connect (AC) preference recompute invoked from `io_loop` (ircd.c:1164) when `timeofday >= nextpreference`.
  - **Body** — walks the global `conf` list; skips non-C-lines (status lacking `CONF_CONNECT_SERVER|CONF_ZCONNECT_SERVER`) and AC-ineligible C-lines (`port <= 0`); for the rest fires `send_ping(aconf)` (advances the conf's `aCPing` sliding window) then sets `pref = -1` when there is no usable window (`cp==NULL || cp->seq==0 || cp->recvd==0`), else computes `pref = (u_int)(f*100)` from `recvd/seq`, `pow(f,20)`, `ping/recvd` with a `0.001` floor and a `100000.0` ceiling. Returns `currenttime + 60`.
  - **Config-resolved body** — no `#ifdef`s; compiles verbatim. `CONF_CONNECT_SERVER=0x08`, `CONF_ZCONNECT_SERVER=0x20`.
  - **Seam** — partial port via the existing `ircd_link.o` second-compile (which already drops the P7c tune pair); new guard `-DPORT_IRCD_CALC_PREF_P7t` added to its `make --eval` line. The C function is wrapped `#ifndef PORT_IRCD_CALC_PREF_P7t … #else extern time_t calculate_preference(time_t); #endif` — the function is in no `*_ext.h`, and `io_loop` (its sole caller, same TU, defined later) relied on the in-file definition for its implicit prototype, so the `#else` supplies the `extern` declaration. `nm target/debug/ircd` confirms `T calculate_preference` (came from Rust).
  - **Faithfulness** — calls the **libc `pow`** via a local `extern "C" { fn pow(f64,f64)->f64; }`, NOT `f64::powf`: the std intrinsic is permitted to differ from the system `pow` in the last ULP, which would diverge the `(u_int)(f*100.0)` integer truncation and break L1. The final store reproduces the C `double → u_int → int` cast chain as `(f * 100.0) as u32 as c_int` (`f` is clamped `≤ 100000.0`, so `f*100 ≤ 1e7` fits `u32`). `send_ping` is called *before* the `cp` read, faithfully — order matters because it mutates the window the pref math reads.
  - **Classification** — utility / callee TU (no `msgtab` entry; reached only from `io_loop`).
  - **L1** — `ircd-testkit/tests/calculate_preference_diff.rs`, zero-diff vs `cref_`. Two isolated worlds (Rust reads `conf`/`udpfd`; oracle reads `cref_conf`/`cref_udpfd`), each builds a parallel `conf` linked list, runs, then compares every node's `pref` + `aCPing` post-state + the `currenttime+60` return. 5 cases: non-C-line skip (pref untouched), `port<=0` skip (send_ping not even called), `recvd==0` sentinel (send_ping bumps seq/lseq, recvd stays 0 → `-1`), full-window compute (byte-identical pref), and a 5-node mixed list. `udpfd` left at `-1` (send_ping's `sendto` fails, ignored; the pref math reads only the counters mutated beforehand). Serialized on `GLOBALS_LOCK` (the P7 L1 shared-global hazard).
  - **L2** — no new test: the locked golden config defines no `connect{}` C-lines, so the loop body is a no-op on a golden boot → `golden_registration` stays byte-identical (re-confirmed). Same utility-leaf L2 posture as P7c/P7m.
  - **S2S** — none: formats no remote-user wire fields (only a numeric `pref` field and a binary UDP datagram via send_ping).
  - **Untested-by-design** — the `cp==NULL` clause of the `-1` sentinel is dead defensive code: `calculate_preference` calls `send_ping(aconf)` first, and `send_ping` unconditionally dereferences `cp->port`, so an AC-able C-line with `ping==NULL` segfaults both implementations identically. It never occurs in practice (config allocates an `aCPing` for every `connect{}` line), so the L1 test never builds such a node and the realistic sentinel is exercised via `recvd==0`.
