# P7 — I/O core + event loop + glue (per-cluster progress)

One-line summary per cluster. Full entries: [`docs/progress-log/p7.md`](docs/progress-log/p7.md).
Phase row + plan: [`PLAN.md`](PLAN.md) P7; plans under `docs/superpowers/plans/`.

- **P7a DONE: `common/bsd.c` (socket write leaf)** — ported `deliver_it` (the bottom of the send path: `send()` + WOULDBLOCK→0/`FLAGS_BLOCKED` + `sendB` accumulation + `-errno`) and the re-arming `dummy` signal stub to `ircd-common/src/bsd.rs`; both portable → **`bsd.o` dropped outright** (no `_link.o`). L1 differential (5 cases, full FLAGS_BLOCKED set/clear/untouched matrix) zero-diff vs `cref_`; L2 = existing golden suite (deliver_it is the universal write path) stays byte-identical; no S2S/no new L2 (utility TU).
- **P7b DONE: `common/packet.c` (inbound packet reassembler)** — ported `dopacket` (the only exported symbol; ZIP_LINKS/DEBUGMODE off → just the plain `while (length>0 && ch2)` line-reassembly loop: CR-or-LF framing, `receiveB`/`receiveM` counter accumulation on me/cptr/acpt with the `acpt==&me` guard, `cptr->count` partial-line carry, BUFSIZE-1 overflow cap, and the parse→FLUSH_BUFFER/IsDead→exit_client/IsServer+UNKCMD return handling) to `ircd-common/src/packet.rs`; all callees already Rust → **`packet.o` dropped outright** (no `_link.o`). L1 differential (8 cases: single LF/CR, skipped extra CR-LF, two-lines-one-buffer, partial→continuation round-trip, acpt==&me vs distinct-acpt, 600-byte overflow truncation) zero-diff vs `cref_`; serialized on a `GLOBALS_LOCK` (shared `me`/`cref_me`). L2 = existing golden suite (universal read path) stays byte-identical (`golden_registration` confirmed); no S2S/no new L2 (utility TU, no IsServer-remote-field formatting).
- **P7c DONE: `ircd.c` tune-file pair (`ircd_writetune`/`ircd_readtune`)** — ported the tune-file persistence pair (the 7 sizing globals `ww_size`/`lk_size`/`_HASHSIZE`/`_CHANNELHASHSIZE`/`_SIDSIZE`/`poolsize`/`_UIDSIZE` serialized one-decimal-per-line via `sprintf`, parsed back via `sscanf`, the `USE_HOSTHASH`/`USE_IPHASH` mirrors `_HOSTNAMEHASHSIZE`/`_IPHASHSIZE` = `_HASHSIZE`, the `BOOT_BADTUNE` silent-return-vs-`exit(1)` branch, and the `lk_size = max(lk_size, ww_size)` clamp) to `ircd-common/src/ircd.rs`. First partial port of the central `ircd.c` → `ircd_link.o` second-compile (`-DPORT_IRCD_TUNE_P7c`, carrying ircd.o's IRCD*_PATH/IAUTH machine-path defines so the surviving C is byte-identical); `c_ircd_main`/`me`/signals/`restart`/`server_reboot`/the tune callers stay C. L1 differential (`ircd_tune_diff.rs`, 9 cases: writetune byte-identical files incl. lk<ww + zero/INT_MAX/u32-max edges, readtune global round-trip incl. clamp + hash mirrors + missing-file + BOOT_BADTUNE silent return, write→read round-trip) zero-diff vs `cref_`, serialized on a `GLOBALS_LOCK`. No new L2 (utility TU, not a `msgtab` handler; `ircd_readtune` exercised at boot by the existing golden suite — `golden_registration` stays byte-identical); no S2S (no remote-field formatting). The `exit(1)` arm is untested-by-design (would kill the test process).
- **P7d DONE: `s_bsd.c` socket/file utility leaves** — first (partial) port of the central I/O TU `s_bsd.c`; ported the three pure libc-wrapper leaves that touch none of the event-loop data globals: `get_sockerr` (`getsockopt(SO_ERROR)`-or-saved-`errno`), `set_non_blocking` (`fcntl F_GETFL`→`F_SETFL|O_NONBLOCK`; failure path calls the still-C `report_error`), and `write_pidfile` (truncate+create `IRCDPID_PATH`, `sprintf("%5d\n", getpid())`) to `ircd-common/src/s_bsd.rs`. Partial port via `s_bsd_link.o` (`-DPORT_S_BSD_LEAF_P7d`, carrying s_bsd.o's `IRCDPID_PATH`/`IAUTH_PATH`/`IAUTH` machine-path defines); the event loop + `local[]`/`highest_fd`/`timeofday`/`FdAry` + listeners + `add_connection`/`read_message`/`report_error`/`get_my_name`/`add_local_domain`/`start_iauth` stay C. `IRCDPID_PATH` (a command-line define, absent from bindgen) exposed to Rust via the P6m make-`--eval`+`rustc-env` pattern → `ircd_sys::PID_PATH`. L1 differential (`s_bsd_leaves_diff.rs`, 4 cases: get_sockerr fd<0 errno-passthrough + valid-fd/no-error, set_non_blocking O_NONBLOCK-set-with-untouched-fd-inverse, write_pidfile identical-behavior) zero-diff vs `cref_`, serialized on `GLOBALS_LOCK`. No new L2 (utility TU; `write_pidfile` hit at boot, `set_non_blocking`/`get_sockerr` on every connect — covered by the existing golden boot/connect path, `golden_registration` byte-identical); no S2S (no remote-field formatting). Untested-by-design: get_sockerr's `err!=0` branch + set_non_blocking's fcntl-failure→report_error branch (need a pending-error socket / bad fd); write_pidfile's byte rendering is pinned only where `IRCDPID_PATH` is writable (its dir is absent in the sandbox → both worlds no-op identically).
- **P7e DONE: `s_bsd.c` name-resolution leaf (`add_local_domain`)** — ported the next-easiest s_bsd.c leaf after the P7d socket/file trio: `add_local_domain` (strip one trailing `.` + `size++`; if the name is unqualified, lazily `ircd_res_init()` when `!(options & RES_INIT)`, then append `"." + ircd_res.defdname` iff `defdname[0]` and `strlen(defdname)+2 <= size`) to `ircd-common/src/s_bsd.rs`. Touches none of the event-loop globals — its only dependency is the resolver state (`ircd_res`/`ircd_res_init`), already Rust since P6. Partial port via the existing `s_bsd_link.o` seam with a new guard `-DPORT_S_BSD_LEAF_P7e` (added alongside `-DPORT_S_BSD_LEAF_P7d`); `get_my_name` (its only in-TU caller, needs `gethostname`/`gethostbyname`/`mysk`) stays C. RED confirmed the undefined symbol referenced by the now-Rust `s_conf.rs` + still-C `s_bsd.c` (`get_my_name`/`connect_server`); after GREEN `nm` shows `add_local_domain` as `T` from Rust. L1 differential (`add_local_domain_diff.rs`, 6 cases: trailing-dot-strip/no-append, unqualified-append, the size-guard boundary len+1-vs-len+2 inverse, empty-defdname-no-append, the `size++`-enables-append faithfulness check, and the init-trigger branch via `$LOCALDOMAIN` for determinism — both worlds run their P6-verified-equivalent `ircd_res_init`) zero-diff vs `cref_add_local_domain`, isolated worlds (Rust reads the real `ircd_res`, oracle reads `cref_ircd_res`), serialized on `GLOBALS_LOCK`. No new L2 (callee TU, not a `msgtab` handler; runs at boot via `s_conf.c` read_conf + on `connect_server` — `golden_registration` byte-identical); no S2S (no remote-field formatting).
- **P7f DONE: `s_bsd.c` delayed-close leaf (`delay_close`)** — ported the `DELAY_CLOSE`-gated (=15) `delay_close` (s_bsd.c:3359): a private static time-sorted linked list of fds awaiting a delayed `close()`, swept per call (expired entries, or — under fd pressure when `is_delayclosewait > (MAXCLIENTS-is_localc)>>1` — the oldest quarter; `fd==-2` from `m_close` forces close-all), then `fd>=0` is queued at `timeofday+15` (with `set_non_blocking`+`shutdown(SHUT_RD)`); returns the head entry's scheduled time or 0. Faithful: the unsigned `int-u_long` threshold (wraps), the `time<now || tmpdel-- >0` short-circuit (tmpdel only decrements when not expired), the 46-byte (43 chars+`\r\n`+NUL) "Too rapid connections" error sent to the *new* fd. Same `s_bsd_link.o` seam, new guard `-DPORT_S_BSD_DELAY_CLOSE_P7f`; reads the still-C `istat` (ircd.c) + `timeofday` (s_bsd.c) globals, calls the Rust `set_non_blocking` (P7d) + `MyMalloc` (P2). L1 differential (`delay_close_diff.rs`, 6 cases: queue-one + inverse time-eviction, unexpired-stays early-break, `fd==-2` close-all drain, overflow drop-oldest-quarter, chronological-head ordering) zero-diff vs `cref_delay_close`, isolated worlds (real `istat`/`timeofday` vs `cref_*`), serialized on `GLOBALS_LOCK` (incl. a `reset()` to drain the persistent static lists between tests). No new L2 (callee, not a `msgtab` handler — hit by the io_loop `delay_close(-1)`/`m_close`/connection-close paths; `golden_registration` byte-identical); no S2S (no remote-field formatting).
- **P7g DONE: `s_bsd.c` fd-teardown leaf (`close_client_fd`)** — ported the descriptor-teardown leaf `close_client_fd` (s_bsd.c:1270): closes `authfd` then `fd` (flushing its sendQ first via the Rust `flush_connections`, removing it from `fdas`/`fdall` via the Rust `del_fd` + clearing `local[fd]`), then drains `sendQ`/`recvQ` (`DBufClear`→`dbuf_delete`) and zeroes `passwd`. Config-resolved: `SO_LINGER` defined (the linger blocks compile, fired only when `exitc==EXITC_PING`), `ZIP_LINKS` off (`zip_free` omitted). All real callees already Rust (`flush_connections` P3, `del_fd` P2, `dbuf_delete` P1); only `report_error` stays C (already an `extern "C"` decl since P7d; fires solely on a `setsockopt(SO_LINGER)` failure). Same `s_bsd_link.o` seam, new guard `-DPORT_S_BSD_CLOSE_FD_P7g`; reads the still-C `local[]`/`fdas`/`fdall` globals. L1 differential (`close_client_fd_diff.rs`, 6 cases: client both-fds, server + listener `IsServer||IsListener` fdas+fdall arm, fd<0 only-authfd-closed, both-fds<0 no-op, and the inverse-of-insert recvQ-drain + passwd-zero) zero-diff vs `cref_close_client_fd`, isolated worlds (real `local`/`fdas`/`fdall` + Rust `flush_connections`/`del_fd` vs `cref_*`), serialized on `GLOBALS_LOCK`; inverse invariants checked (fd actually closed via EBADF, `local[fd]==NULL`, array slot freed). `exitc=0` everywhere → the `SO_LINGER`/`report_error` branches untested-by-design; the sendQ flush-then-clear (live socket I/O) is L2. No new L2 (callee, not a `msgtab` handler — hit on every disconnect via `close_connection`/`exit_client`; `golden_registration` incl. quit/reuse byte-identical); no S2S (no remote-field formatting).
- **P7h DONE: `s_bsd.c` connection-teardown leaf (`close_connection`)** — ported the bookkeeping layer directly above the P7g `close_client_fd`: `close_connection` (s_bsd.c:1341) bumps the per-class `ircstp` stats (`is_sv`/`is_cl`/`is_ni` + byte/time accumulators), drops outstanding DNS queries (`del_queries`), reschedules server reconnect (`find_conf_exact`→`nextconnect` with the `HANGONGOODLINK`/`HANGONRETRYDELAY` clamp), schedules a hang-on retry for an aborted handshake/connect, notifies iauth (`sendto_iauth "%d D"`) + decrements the P-line acceptor's `clients` refcount (recursing into `close_connection(acpt)` when the acceptor itself goes illegal), tears the descriptors down via the Rust `close_client_fd`, unlinks an illegal listener from `ListenerLL`, then `det_confs_butmask(cptr,0)` + `cptr->from = NULL`. Config-resolved: `USE_IAUTH` ON → the `sendto_iauth` block compiles; DEBUGMODE off. All callees already resolvable (`del_queries`/`find_conf_exact`/`det_confs_butmask` Rust since P6; `sendto_iauth` the variadic C trampoline; `close_client_fd` Rust P7g). Same `s_bsd_link.o` seam, new guard `-DPORT_S_BSD_CLOSE_CONN_P7h`; reads the still-C `ircstp`/`nextconnect`/`ListenerLL`/`timeofday`/`me` globals. L1 differential (`close_connection_diff.rs`, 6 cases: server/client/unknown stats accounting, handshake+connecting `nextconnect = now+30`, P-line acceptor refcount 5→4, illegal-listener `ListenerLL` unlink with the inverse — node gone, head intact, `from` NULL, confs detached) zero-diff vs `cref_close_connection`, isolated worlds (real `ircstp`/`nextconnect`/`ListenerLL`/`local`/`fdas`/`fdall`/`me`/`istat` vs `cref_*`), serialized on `GLOBALS_LOCK`; `me.fd`/`adfd` pinned to -1 (inner `flush_connections` else-branch + `sendto_iauth` no-op). No new L2 (callee, not a `msgtab` handler — hit on every disconnect via `exit_client`; `golden_registration` incl. quit/reuse byte-identical); no S2S (formats no remote-user fields). Untested-by-design: the recursive `close_connection(acpt)` (needs a fully-illegal acceptor conf) + the `find_conf_exact` reconnect-reschedule arm (NULL with no conf loaded) + the `sendto_iauth` wire emission (L2, variadic trampoline).
- **P7i DONE: `s_bsd.c` listener-list teardown leaf (`close_listeners`)** — ported the layer directly above P7g/P7h: `close_listeners` (s_bsd.c:427) walks the `ListenerLL` doubly-linked list and tears down every listener whose conf has gone illegal (`IsIllegal(aconf)`) — `clients>0` → the Rust `close_client_fd` (fd torn, node stays in the list), `clients≤0` → the Rust `close_connection` (fd torn + node unlinked + confs detached + `from` cleared); legal listeners untouched; the `bcptr = acptr->next` save handles the in-loop unlink. UNIXPORT off (config.h:339) → the `IsUnixSocket`/`unlink` block vanishes; both callees already Rust (P7g/P7h) → no new externs (reuses the existing `conf_is_illegal` helper). Same `s_bsd_link.o` seam, new guard `-DPORT_S_BSD_CLOSE_LISTENERS_P7i`; the only caller is the now-Rust `s_conf.rs` rehash (`s_conf.c:1315`). L1 differential (`close_listeners_diff.rs`, 5 cases: illegal-clients=0 unlinked, illegal-clients>0 stays-linked inverse, legal untouched (fd still open via fcntl), mixed 3-node middle-removed with the two legals relinked, all-illegal drains the list) zero-diff vs `cref_close_listeners`, isolated worlds, serialized on `GLOBALS_LOCK`. No new L2 (callee, not a `msgtab` handler — hit by rehash; `golden_registration` byte-identical); no S2S (no remote-field formatting).
- **P7j DONE: `s_bsd.c` listener-reactivation leaf (`activate_delayed_listeners`)** — ported the counterpart to P7i's `close_listeners`: `activate_delayed_listeners` (s_bsd.c:526) walks the `ListenerLL` list and, for every listener flagged `FLAGS_LISTENINACTIVE`, calls `listen(fd, LISTENQUEUE=128)`, clears the inactive bit, and counts it; if any were reactivated it emits one `sendto_flag(SCH_NOTICE, "%d listeners activated", cnt)` notice. No `#ifdef`s (DEBUGMODE off → no `Debug`); `listen()`'s return is ignored exactly as C. Same `s_bsd_link.o` seam, new guard `-DPORT_S_BSD_ACTIVATE_DELAYED_P7j`; no new still-C externs (`sendto_flag` is the existing variadic trampoline via `ircd_sys::bindings`, safe in L1 — short-circuits on NULL `svc_ptr`; `LISTENQUEUE` reproduced as a const since it's absent from bindgen). RED confirmed the undefined symbol referenced by the now-Rust `s_serv.rs` (`m_set`/burst) + `s_misc.rs` (`check_split`); after GREEN `nm` shows it `T` from Rust. L1 differential (`activate_delayed_listeners_diff.rs`, 5 cases: single-inactive→activated (inactive bit clear + socket actually listening via `SO_ACCEPTCONN`), single-active untouched (inverse), mixed `[active,inactive,active]` only-middle, empty no-op, all-inactive) zero-diff vs `cref_activate_delayed_listeners`, isolated worlds over real TCP-socket fds, serialized on `GLOBALS_LOCK`; inverse invariant — listeners never removed, already-active nodes untouched. No new L2 (callee, not a `msgtab` handler — hit by server-burst/rehash; `golden_registration` byte-identical); no S2S (formats only an integer count, no remote-user fields).
- **P7k DONE: `s_bsd.c` `add_connection_refuse` (connection-refuse leaf)** — ported the refuse-path companion to `add_connection` (stays C): `DELAY_CLOSE` on → the `delay=0` reset is not compiled, so `delay` is honored verbatim; `close(fd)` unless delayed, `ircstp->is_ref++`, `acptr->fd = -2`, then `free_client` (Rust, P2). Partial-ported via `s_bsd_link.o` (`-DPORT_S_BSD_ADD_CONN_REFUSE_P7k`). L1 differential (3 cases: delay==0 closes the fd, delay==1 leaves it open — the inverse pair, two refuses accumulate `is_ref`) zero-diff vs `cref_`; `acptr` is freed inside the call (UAF post-state) so the test compares side effects (`is_ref` delta + fd fate), and `acptr->fd=-2` is untested-by-design (no surviving reader). No L2/no S2S (callee, not a `msgtab` handler; formats no remote-user fields).
- **P7l DONE: `s_bsd.c` `setup_ping` (UDP CPING-socket setup leaf)** — ported the one-shot setup half of the server-to-server CPING feature: bind the single shared `udpfd` UDP socket. Idempotent (`udpfd != -1` → return it, ignore `aconf`); config-resolved (`AFINET`=`AF_INET6` → `from` is a `sockaddr_in6`, the `SIN_*` macros map to `sin6_*`; `SETSOCKOPT` length is `sizeof(int)`=4 not `sizeof(*p)`; `FNDELAY`=`O_NONBLOCK`; DEBUGMODE/USE_SYSLOG off → no `Debug`/`syslog`). Faithful assign-then-test: `udpfd` set from `socket()` before the `==-1` check, each later failure does `close(fd); udpfd=-1`. Bind addr from a numeric `aconf->passwd` via the Rust `inetpton` (P1, falls back to `minus_one`=all-`0xff`) else `in6addr_any`. Partial port via `s_bsd_link.o` (`-DPORT_S_BSD_SETUP_PING_P7l`); `udpfd` stays a C global (the still-C `read_message`/`polludp`/`check_ping` read it) → Rust reads/writes the bindgen extern; the CPING-output siblings `send_ping`/`check_ping`/`polludp` stay C (share `udpfd` only, which stays C). RED confirmed the undefined symbol referenced by the now-Rust `s_conf.rs` rehash (`s_conf.c:2041`); after GREEN `nm` shows `setup_ping` `T` from Rust. L1 differential (`setup_ping_diff.rs`, 3 cases: fresh setup opens a non-blocking `SOCK_DGRAM` recorded in `udpfd`, idempotent second call returns the same fd unchanged — the inverse-of-state path, numeric-passwd `"::1"` drives the `inetpton` bind-addr branch) zero-diff vs `cref_setup_ping`, isolated worlds (real `udpfd` vs `cref_udpfd`), serialized on `GLOBALS_LOCK` with a `reset()` closing the prior socket between cases; compares the fd's *properties* (valid/non-blocking/`SOCK_DGRAM`) not its integer value (worlds open distinct sockets). No new L2 (callee, not a `msgtab` handler — hit by `s_conf.rs` rehash when a `connect{}` block has a port; `golden_registration` byte-identical); no S2S (formats no remote-user fields). Untested-by-design: the `setsockopt`/`bind`/`fcntl` failure arms (need an induced syscall failure; both worlds take the success path identically).
- **P7m DONE: `s_bsd.c` `send_ping` (UDP CPING-output leaf)** — ported the output half of the server-to-server CPING (UDP ping) feature, the sibling to P7l's `setup_ping`: advance the per-`connect{}` sliding-window RTT statistics on the conf's `aCPing` (`lseq++`, `seq++`-then-conditional-`--`, the `seq*conFreq>1200` window adjusting `ping`/`recvd`) and `sendto` a `Ping` datagram (`pi_cp`/`pi_id=htonl(PING_CPING)`/`pi_seq`/`pi_tv`) over the shared `udpfd`. Config-resolved (`AFINET`=`AF_INET6` → `sin` is `sockaddr_in6`; `IN6ADDRSZ`=16; DEBUGMODE/USE_SYSLOG off → no `Debug`/`syslog`; `PING_CPING`=0x02). Faithful: the C guard's first disjunct `!aconf->ipnum.s6_addr` is an array address → always false, so only `AND16(ipnum)==255` (all-0xff unresolved sentinel) and `cp->port==0` gate; all `aCPing` counters are `u_long` → unsigned window arithmetic; `cp->lseq++` post-increments (the packet carries the old value). Partial port via the existing `s_bsd_link.o` seam, new guard `-DPORT_S_BSD_SEND_PING_P7m`; `udpfd` stays a C global (shared with the still-C `setup_ping`/`polludp`), Rust reads the bindgen extern → no new still-C externs (true leaf). L1 differential (`send_ping_diff.rs`, 7 cases: basic send with packet check, the three early returns — unresolved ipnum/zero port/zero conFreq, window recvd>0/recvd==0/recvd==seq) zero-diff vs `cref_send_ping`, isolated worlds (real `udpfd` vs `cref_udpfd`) each binding a `::1` UDP receiver to `recvfrom` the datagram; compares the deterministic `aCPing` post-state + the world-independent packet fields (`pi_id`/`pi_seq`), excluding `pi_cp` (live pointer) + `pi_tv` (gettimeofday); serialized on `GLOBALS_LOCK`. No new L2 (callee, not a `msgtab` handler — reached from the server-connect CPING path; `golden_registration` byte-identical); no S2S (formats no remote-user wire fields). Untested-by-design: `pi_tv`/`pi_cp` nondeterministic; the `sendto` failure path is `(void)`-ignored by C → unobservable.
- **P7n DONE: `s_bsd.c` `open_listener`/`reopen_listeners` (listener (re)construction wrappers)** — ported the layer directly above the still-C socket constructor `inetport`: `open_listener` (s_bsd.c:467) (re)opens one listener (early-return on `!IsListener || fd>0`; UNIXPORT off → only the inet branch; a delayed-listen P-line before the first rejoin sets `dolisten=0` + `FLAGS_LISTENINACTIVE`; dispatches to the still-C `inetport` + the Rust `add_fd` (P2)/`set_non_blocking` (P7d), registering a created fd in `fdas`/`fdall`), and `reopen_listeners` (s_bsd.c:512) walks `ListenerLL` reopening every legal closed-fd listener. Partial port via the existing `s_bsd_link.o` seam (`-DPORT_S_BSD_OPEN_LISTENER_P7n`); `inetport` (real socket/bind/listen, with its static `set_sock_opts`) stays C. L1 differential (`open_listener_diff.rs`, 6 cases: normal→listening, delayed-before-rejoin→inactive/not-listening, delayed-after-rejoin→listens (inverse), `!IsListener` no-op, `fd>0` no-op, `reopen_listeners` skips illegal + already-open) zero-diff vs `cref_` (observable fd properties — valid/`SO_ACCEPTCONN`/`O_NONBLOCK` — + flags/`fdas`/`fdall`/`local[fd]`, since each world opens its own socket), serialized on `GLOBALS_LOCK`. No new L2 (callee, hit at boot/rehash; `golden_registration` byte-identical); no S2S (no remote-user wire fields).
- **P7o DONE: `s_bsd.c` `add_listener` (listener-constructor wrapper)** — ported the layer directly above the now-Rust `open_listener` (P7n): `add_listener` (s_bsd.c:330) builds the `me`-like listener-stub `aClient` via the Rust `make_client`/`make_link` (P2) — `FLAGS_LISTEN`, `SetMe` (STAT_ME), self `acpt`/`from`, `name = ME` (= `me.name`), `firsttime = time(NULL)`, a one-element `confs` link carrying the passed `aconf` — opens the socket via the Rust `open_listener`, then prepends the client to `ListenerLL` (back-linking the old head's `prev` when non-empty); returns 0. No `#ifdef`s. Partial port via the existing `s_bsd_link.o` seam, new guard `-DPORT_S_BSD_ADD_LISTENER_P7o`; all callees already Rust → no new still-C externs (`add_listener` referenced by the now-Rust `s_conf.rs` initconf). L1 differential (`add_listener_diff.rs`, 3 cases: into empty `ListenerLL` → sole node listening+registered with prev/next NULL, prepend before an existing node → new head + old head's `prev` back-linked (inverse), two consecutive calls → chain order + back-links) zero-diff vs `cref_add_listener`, isolated worlds (each opens its own socket / `make_client` allocates its own pointer → compares observable facts not raw fd/pointer values; `me.name` pinned to `irc.test` so `inetport`'s `ME`-based sockhost matches; `firsttime=time(NULL)` asserted non-zero, not compared), serialized on `GLOBALS_LOCK`. No new L2 (callee, hit at boot/rehash via `s_conf.c` initconf; `golden_registration` byte-identical); no S2S (formats no remote-user wire fields).
- **P7p DONE: `s_bsd.c` `inetport` (listener socket constructor)** — ported the layer directly below the now-Rust `open_listener` (P7n): the real socket constructor `inetport` (s_bsd.c:210). Creates an `AF_INET6` (`AFINET`) stream socket, optionally `bind()`s it (`if (port)` → `in6addr_any` when ip is unset/non-numeric, else the Rust `inetpton` with the all-`0xff` `minus_one` fallback), applies its `static` callee `set_sock_opts`, fills `cptr` (`auth` = the ipmask canonicalized to `"a.b.c.d"` via `DupString`/`MyMalloc`; `sockhost` = `"<ip-or-ME>.<port>"` via `sprintf "%-.42s.%u"`; `ip` = the `getsockname` result; `port`), registers `local[fd] = cptr`, bumps `highest_fd`, and (when `dolisten`) `listen(fd, 128)`; returns 0, or -1 on a refused (`!ipmask`/bad ipmask) or failed (`socket`/`bind`/`getsockname`) open. `set_sock_opts` is `static` (no `cref_` oracle) → ported as a **private Rust twin** (config-resolved: SO_REUSEADDR=1, SO_RCVBUF/SO_SNDBUF/SO_SNDLOWAT=8192, `sizeof(int)` optlen; SO_DEBUG `&& 0` + SO_USELOOPBACK-undefined-on-Linux skipped); the C `static set_sock_opts` **stays compiled** for its other callers `check_server_init`/`connect_server`. Partial port via the existing `s_bsd_link.o` seam, new guard `-DPORT_S_BSD_INETPORT_P7p`; `report_error` + the variadic `sendto_flag` stay C, `local`/`highest_fd`/`me`/`minus_one`/`replies` read via bindgen externs. The `cptr == &me` inetd-on-fd-0 KLUDGE (writes `replies[RPL_MYPORTIS]` to fd 0) reproduced faithfully but never fires for a listener stub. L1 differential (`inetport_diff.rs`, 6 cases: normal port=0 listening (full compare — sockhost `irc.test.0`/auth `0.0.0.0`/port/socket-options/`local[fd]`/`highest_fd` bump), dolisten=0 not-listening (the listen inverse), NULL-ipmask + invalid-ipmask `256.0.0.0` refuse (return -1 before any socket, the error inverse), wildcard `in6addr_any` bind → `::` ip, `::1` `inetpton` bind → `::1` ip — the two bind cases serialized per world over one probed free port) zero-diff vs `cref_inetport`, isolated worlds (each opens its own socket → compares observable fd properties + world-independent struct fields, never the raw fd), serialized on `GLOBALS_LOCK`. No L2/no S2S (callee, hit at boot/rehash via `open_listener`; `golden_registration` byte-identical; formats no remote-user wire fields).
- **P7q DONE: `s_bsd.c` `report_error` (error-reporting output leaf)** — ported the genuine clean leaf left in the central I/O TU: `report_error` (s_bsd.c:151) calls **no** other `s_bsd.c` function, so it ports in isolation, and the linker now resolves its 27 internal call sites (every still‑C `report_error("…", cptr)` + the already‑Rust leaves that called it via `extern "C"`) to the Rust definition. Derives `host` via `get_client_name` (or `""` when `cptr==NULL`), refines `errtmp` from the socket's pending `SO_ERROR` (the getsockopt readout, mirroring P7d's `get_sockerr`), fires the `SCH_ERROR` local‑opers notice (`sendto_flag`), sends a NOTICE back through a half‑open (`Connecting`/`Handshake`) server link's **remote** `byuid` introducer (`find_uid`→`sendto_one`, the `:%s NOTICE %s :` + `text` `strcpy`/`strncat` construction), then echoes the formatted error to `stderr` while `serverbooting`. Config‑resolved: `SO_ERROR` defined (getsockopt compiles), `DEBUGMODE`/`USE_SYSLOG` off (no `Debug`/`syslog`). The variadic `sendto_flag`/`sendto_one`/`fprintf` are *called*, not defined — legal in stable Rust (the trampolines stay C until P8). Partial port via the existing `s_bsd_link.o` seam, new guard `-DPORT_S_BSD_REPORT_ERROR_P7q`; reads the still‑C `serverbooting`/glibc `stderr`, calls the Rust `get_client_name` (P5)/`find_uid` (P4). L1 differential (`report_error_diff.rs`, 4 cases: `serverbooting=1`+`cptr=NULL` formatted stderr echo, the `serverbooting=0` inverse gate → no output, `cptr` non‑NULL `host=get_client_name`, varied format/errno) captures fd 2 via a pipe redirect and asserts byte‑identical Rust‑vs‑`cref` stderr; serialized on `GLOBALS_LOCK` (sets `serverbooting`/`cref_serverbooting` + `errno` per case). No new L2 (output callee, not a `msgtab` handler — the `SCH_ERROR` error path is exercised by the existing golden suite; `golden_registration` byte‑identical); no S2S in L1. Untested‑by‑design: the `SO_ERROR` readout (needs a pending‑error socket; `fd<0` skips it identically), the `sendto_flag` wire emission (L2, variadic), the `bysptr` remote NOTICE (S2S — needs a connecting peer with a remote `byuid`).
- **P7r DONE: `s_bsd.c` `init_sys` (fd-table boot leaf)** — ported the cleanest remaining leaf in the central I/O TU: `init_sys` (s_bsd.c:693), called once from `ircd.c` `main` at boot. Config-resolved to a libc-only body: `RLIMIT_FD_MAX` is **not defined on Linux** → the whole `getrlimit`/`setrlimit` + `exit(-1)` rlimit block is excluded; `USE_POLL=1` → the sequent `setdtablesize` block is excluded; Linux → the `setlinebuf(stderr)` branch. So the only callees are libc (`setlinebuf`/`bzero`/`close`) and the only state is the already-exported `fdas`/`fdall`/`local` globals (no shared private static with still-C code — unlike `get_my_name`/`mysk`). Body: line-buffer stderr, `bzero` the two `fdarray`s + `highest=-1`, NULL `local[0..MAXCONNECTIONS=50]` while `close()`ing fds `3..50` (0/1/2 kept — stderr stays open until `daemonize`). Partial port via the existing `s_bsd_link.o` seam, new guard `-DPORT_S_BSD_INIT_SYS_P7r`; `fdas`/`fdall` via bindgen externs, `local[]` via the existing `local_base()` helper. RED confirmed the undefined symbol referenced by still-C `ircd.c:1010`; after GREEN `nm` shows `init_sys` `T` from Rust. L1 differential (`init_sys_diff.rs`, 3 cases: fresh-init zeroes arrays + NULLs local + inverse-of-dirty invariant, closes fds 3..N, keeps 0/1/2 open) zero-diff vs `cref_init_sys` — **fork-isolated** per world (the close loop is destructive to the test process's fds → each world runs in a forked child, results returned via `mmap(MAP_SHARED|MAP_ANONYMOUS)` which survives the close loop), serialized on `GLOBALS_LOCK`. No new L2 (boot callee, not a `msgtab` handler — the existing golden suite boots through it, `golden_registration` byte-identical); no S2S (formats no remote-user fields). Untested-by-design: `setlinebuf(stderr)` (unobservable); the rlimit/`exit` arms don't compile under the locked config.
- **P7s DONE: `s_bsd.c` `get_my_name` (server-own-hostname resolver) + de-static `mysk`** — ported the most leaf-like remaining `s_bsd.c` function after P7d–P7r: `get_my_name` (s_bsd.c:2940), which at boot resolves the server's canonical hostname into `me.name` (`gethostname` → `add_local_domain` → `gethostbyname(cname)||gethostbyname(name)` + the `h_aliases` walk, picking the `mycmp(ME)` match) and initialises the outgoing-bind source address `mysk` (`bzero` + `sin6_family=AF_INET6`/`sin6_port=0`, then the M-line `find_me()->passwd` via `inetpton` with the `minus_one` all-`0xff` fallback when it's a digit-led non-v6). Its only in-TU callee `add_local_domain` is already Rust (P7e); all other callees are libc or already-Rust (`find_me` P6, `inetpton`/`mycmp` P1, `minus_one`/`me` bindgen). The single blocker — the file-private `static struct SOCKADDR_IN mysk` (s_bsd.c:55) shared with the still-C `check_client` (localhost detect) / `connect_inet` (outgoing bind) — was broken by **de-static'ing `mysk`** (a behaviour-preserving storage-class change: single TU, no other `mysk`), which also makes the cref archive export `cref_mysk` (the `objcopy` prefix-rename only follows global symbols — the L1 static-symbol limit), giving the L1 test a full cross-world `mysk` compare. Config-resolved: `HAVE_GETIPNODEBYNAME` undef → plain `gethostbyname`; `DEBUGMODE` off; the `mysk.SIN_ADDR` write at s_bsd.c:3012 is dead `#if 0`. Partial port via the existing `s_bsd_link.o` seam, new guard `-DPORT_S_BSD_GET_MY_NAME_P7s`; `gethostbyname` declared via a local extern (absent from the libc crate). L1 differential (`get_my_name_diff.rs`, 6 cases: M-conf NULL-passwd addr-zero, non-digit-passwd addr-zero inverse, valid `2001:db8::1` → parsed addr, digit-but-invalid `9zz` → minus_one, resolvable `localhost` cname → gethostbyname+alias-loop, empty cname → BadPtr early return) zero-diff vs `cref_get_my_name` — both worlds call the same libc `gethostname`/`gethostbyname` (identical results in one run) + a shared `conf`/`cref_conf` M-conf, and the shared-but-isolated `me`/`cref_me` ME is pinned to `irc.test`; asserts the `name` output buffer + the full 28-byte `mysk`/`cref_mysk` agree, serialized on `GLOBALS_LOCK`. No L2/no S2S (boot callee, not a `msgtab` handler; the existing golden boot exercises it — `golden_registration` byte-identical; formats no remote-user wire fields). Untested-by-design: the resolved hostname is host-dependent (the test asserts the two worlds *agree*, not a fixed string); the `gethostname == -1` early return needs an induced failure (both worlds take the success path identically).
- **P7t DONE: `ircd.c` `calculate_preference` (AC preference leaf)** — ported `calculate_preference` (ircd.c:387, the auto-connect preference recompute called periodically from `io_loop`): walks the global `conf` list, fires the already-Rust `send_ping` (P7m) on every AC-able `connect{}` C-line (`CONF_CONNECT_SERVER|CONF_ZCONNECT_SERVER` + `port>0`), then derives `pref` from that conf's `aCPing` window stats (or the `-1` sentinel when `seq==0`/`recvd==0`). Partial-port via the existing `ircd_link.o` second-compile, new guard `-DPORT_IRCD_CALC_PREF_P7t` (the C body `#ifndef`-guarded with an `#else extern` prototype so the still-C `io_loop` caller keeps a declaration). Faithfulness: calls the **libc `pow` symbol** (not `f64::powf` — last-ULP drift would corrupt the `(u_int)(f*100.0)` truncation); final cast reproduces C `double→u_int→int pref`. L1 differential (5 cases: skips, recvd==0 sentinel, full-window compute, mixed list) zero-diff vs `cref_` (isolated `conf`/`cref_conf` worlds, serialized on `GLOBALS_LOCK`). L2 = existing golden boot stays byte-identical (locked config has no `connect{}` C-lines → loop body is a no-op); no S2S (utility, no remote-user wire fields). Note: the `cp==NULL` sentinel clause is dead defensive code — `send_ping` dereferences `cp->port` first.
- **P7u DONE: `s_auth.c` iauth `/STATS` reporters** (`report_iauth_conf`/`report_iauth_stats`) — opened the last P7 TU by porting its two cleanest leaves: list-walking reporters that emit `RPL_STATSIAUTH`/`RPL_STATSDEBUG` per `iauth_conf`/`iauth_stats` `LineItem` node via the variadic `sendto_one` (`report_iauth_conf` gated on `adfd >= 0`). De-static'd the two file-static list heads (the P7s `mysk` precedent) so the still-C `read_iauth` writer keeps them while the Rust readers reference them via extern; partial-ported via new `s_auth_link.o` (`-DPORT_S_AUTH_REPORT_P7u`). L1 sendQ-capture differential zero-diff (6 cases incl. adfd<0 + empty-list inverses); golden byte-identical (no iauth in golden → reporters are no-ops); no S2S (no remote-user fields).
- **P7v DONE: `s_auth.c` `set_clean_username` (last pure-logic leaf)** — ported `set_clean_username` (s_auth.c:44; derives `cptr->username` ≤USERLEN+NUL from the raw ident reply `cptr->auth`: dirty-prefix `-` on `[`/`@`/over-length/leading-`:`/embedded-whitespace, copy ≤USERLEN chars dropping `@`/`[`/whitespace, then free+redirect `auth` at the interior `username` buffer when equal else bump `istat.is_auth`/`is_authmem`) to `ircd-common/src/s_auth.rs`. De-static'd (behaviour-preserving — single TU) so `nm -g` emits `cref_set_clean_username` and the still-C callers (`read_iauth`/`start_auth`) resolve to the Rust def once the body is `#ifndef PORT_S_AUTH_CLEAN_USERNAME_P7v`-guarded out of `s_auth_link.o`. L1 differential (9 cases: free path clean-fits/exact-USERLEN/empty, istat path `@`/`[`/over-length/leading-`:`/interior-whitespace, inverses trailing-whitespace-not-dirty-but-unequal + NULL-auth early-return) zero-diff vs `cref_` on the full `username[11]` buffer + `is_auth`/`is_authmem` deltas + the `auth==&username` self-pointer predicate; serialized on `GLOBALS_LOCK` (shared `istat`). L1 is the gate (utility/callee TU, reached only from the still-C iauth/ident I/O the golden harness doesn't run); `golden_registration` stays byte-identical (no-regression); no S2S (no remote-user fields).

- **P7w DONE: `s_auth.c` ident-protocol I/O pair `send_authports`/`read_authports`** — ported the RFC1413 ident query/reply pair to `ircd-common/src/s_auth.rs` (the leaf relative to the still-C `start_auth` + the `s_bsd.c` event loop at `s_bsd.c:2363`/`2368`). `send_authports`: `getsockname`/`getpeername(fd)`→`"theirport , ourport\r\n"`→`write(authfd)`, with the `authsenderr` failure path (`ircstp->is_abad++`, close `authfd`, `highest_fd` walk past NULL `local[]`, `authfd=-1`, clear `FLAGS_AUTH|FLAGS_WRAUTH`); success clears only `FLAGS_WRAUTH`. `read_authports`: `read` buffered across partial reads via `cptr->count`, `sscanf` the `"%hd , %hd : USERID : %*[^:]: %512s"` grammar, set `auth` (`OTHER`→`-`-prefixed `MyMalloc`, else `mystrdup`) + `set_clean_username` (P7v sibling) + `FLAGS_GOTID`; no `\n`/`\r` yet → early return; bad/empty → `is_abad++`. Config-resolved (USE_SYSLOG/DEBUGMODE off → no syslog/`get_client_name`/`Debug`; AFINET=AF_INET6 → `sockaddr_in6`/`sin6_port`; BUFSIZE=512). `index`→`strchr`, `rindex`→`strrchr`, `MyFree`→`free`, `ntohs`→`u16::from_be`; `sscanf` driven through libc with the exact C format. Seam: `-DPORT_S_AUTH_AUTHPORTS_P7w` on `s_auth_link.o`; both already global in `s_auth_ext.h` → no de-static, the prototype comes from the header. **L1** (`authports_diff.rs`, 10 cases) zero-diff vs `cref_`: `send_authports` over a *real* IPv6-loopback connected socket (so `getsockname`/`getpeername` populate `sin6_port` — an AF_UNIX socketpair leaves the port bytes untouched, a false diff) + the error/`highest_fd`-walk paths; `read_authports` over socketpair read-ends covering valid/OTHER/bad/ERROR/partial-early-return/EOF + the pre-auth free + `istat` decrement. Serialized on `GLOBALS_LOCK`. No L2/no S2S (utility TU, no `msgtab` entry, no live ident peer in the golden harness, no remote-user fields); existing golden suite (`golden_registration`) stays byte-identical.
- **P7x DONE: `s_auth.c` ident initiator `start_auth`** — ported the RFC1413 query initiator (`-DPORT_S_AUTH_START_AUTH_P7x` on the `s_auth_link.o` recipe): opens the non-blocking `authfd` socket, derives local/peer addrs from `getpeername`/`getsockname(cptr->fd)`, optionally overrides the bind source from the P-line TLS `source_ip`, then either hands off to iauth (`adfd>=0`: build `"<fd> C <themip> <themport> <usip> <usport>"` via `inetntop`+`ipv6string`+libc `sprintf`, `sendto_iauth`; success → `close authfd`/`authfd=-1`/`FLAGS_XAUTH`/return) or `bind`/`connect`s to `[peer]:113` (arm `FLAGS_WRAUTH|FLAGS_AUTH`, bump `highest_fd`). Config-resolved: NO_IDENT off (full body), USE_IAUTH on (early-return + handoff), USE_SYSLOG/DEBUGMODE off (no syslog/Debug), AFINET=AF_INET6. Calls the Rust `set_non_blocking`/`report_error`/`inetntop`/`inetpton`; *calls* the variadic `sendto_iauth`/`sendto_flag` (stay C). L1 differential (3 cases: `XOPT_REQUIRED && adfd<0` early return; iauth-handoff query bytes byte-identical over a shared real IPv6-loopback `cptr->fd`; getpeername-failure `authfd`-reset) zero-diff vs `cref_`, serialized on `GLOBALS_LOCK`. Utility/callee TU (no `msgtab`) — L1 is the gate; golden suite stays byte-identical (`golden_registration` confirmed); no S2S (no `IsServer`/remote-field path).
- **P7y DONE: `s_auth.c` iauth-pipe line parser `read_iauth`** — ported the last non-variadic logic in s_auth.c (s_auth.c:174; the slave-auth pipe drain: persistent `obuf`/`olen` partial-line carry + per-opcode dispatch `>`/`G`/`O`/`V`/`a`/`A`/`s`/`S`/`U`/`u`/`o`/`D`/`K`/`k`/garbage) to `ircd-common/src/s_auth.rs`; guarded the C body out via `-DPORT_S_AUTH_READ_IAUTH_P7y` on the `s_auth_link.o` recipe (`#else extern` proto for the still-C callers); the file-scope globals `iauth_version`/`iauth_conf`/`iauth_stats`/`iauth_options`/`iauth_spawn` stay C-owned in s_auth_link.o, referenced via extern; the variadic `sendto_iauth`/`sendto_flag` are CALLED (stay C). L1 differential (10 cases: O-options incl. flagless-reset, V replace+free, A/a conf add+clear, s/S stats reset+append, U/u ident, U with istat-decrement via per-world `MyMalloc`/`cref_MyMalloc`, gone/mismatch/garbage negatives, obuf/olen partial-line carry round-trip) zero-diff vs `cref_`; serialized on `GLOBALS_LOCK`. **Finding:** the per-client prefix uses the ported `inetntop` which expands `::1`→`0:0:0:0:0:0:0:1` (a faithful support.c quirk), so the iauth line must carry the expanded IPv6 form. No L2/S2S (utility TU, no `msgtab` entry, no `IsServer`/remote-field formatting; reached only via a live iauth slave the golden harness doesn't run). **Only `sendto_iauth`/`vsendto_iauth` (variadic → P8) remain C in s_auth.c.**
- **P7z DONE: `s_bsd.c` `check_client` (ordinary-client access check)** — ported `check_client` (the access check run from the Rust `register_user`): resolve the `getpeername` peer addr → `cptr->ip`/`port` (via a private Rust twin of the file-`static` `check_init`), verify the DNS host↔ip mapping both ways (IP# Mismatch → clear `hostp`), then `attach_Iline`. `NO_OPER_REMOTE`/`UNIXPORT` undef → no trailing `FLAGS_LOCAL` block / no unix branch (so no `mysk` use). `check_init` stays compiled in `s_bsd_link.o` for the still-C `check_server_init` (GCC inlines it into that sole remaining caller) — the P7p `set_sock_opts` private-twin precedent. Guard `-DPORT_S_BSD_CHECK_CLIENT_P7z`. L1 4-case zero-diff (`check_client_diff.rs`: no-hostp/empty-conf→-2, hostp-addr-match→kept, hostp-mismatch→cleared, getpeername-fail→-1) over a shared real IPv6-loopback fd + empty `conf`/`cref_conf`; L2 = existing `golden_registration` (the success path: real I:line → 0 → client registers) byte-identical; no S2S (no `IsServer` branch — servers go through `check_server_init`/`check_server`).
- **P7aa DONE: `s_bsd.c` `check_server_init` + `check_server` (server-side access check)** — ported the sibling of P7z `check_client` (`-DPORT_S_BSD_CHECK_SERVER_P7aa`): `check_server_init` attaches the C/N lines for the server name, confirms a C+N pair for a dialed link (`IsConnecting`/`IsHandshake`), fires an async DNS lookup of the conf host (`count_cnlines` + a stack `Link{value.aconf, flags=ASYNC_CONF}` + `gethost_byname`, `nextdnscheck=1`), then defers to `check_server`; `check_server` runs `check_init` (the P7z private Rust twin), validates the resolved host↔ip mapping (`IP# Mismatch` → drop `hp`, faithful four-`c_ulong` over-read), searches C/N lines by hostname/sockhost/ip#, `det_confs_butmask`, then on a C+N match `attach_conf`s both + the `AND16(ipnum)==255` dynamic-ip adoption + `get_sockhost(c_conf->host)`. Both dropped from `s_bsd_link.o`; the file-`static` `check_init` (+ its prototype) loses its last C caller so it is guarded out under the same `P7aa` symbol. Config-resolved: `UNIXPORT`/`DEBUGMODE` off. Callees (`attach_confs`/`find_conf`/`find_conf_host`/`find_conf_ip`/`attach_conf`/`det_confs_butmask`/`count_cnlines`/`gethost_byname`/`get_sockhost`/`add_local_domain`) are Rust; `sendto_flag` is *called* (variadic → P8). L1 6-case zero-diff (`check_server_diff.rs`: init unknown/handshake deny; check_server bad-socket→-2; connected ::1 no-hostp/hostp-match/hostp-mismatch→-1 with agreeing ip/port/sockhost); the C+N **success** path (return 0/attach) is covered by the existing L2-S2S golden suite (`golden_s2s_link`/`_eob`/`_who` link a real peer the Rust ircd accepts through `check_server_init` — all green). No new L2 file.
- **P7bb DONE: `s_bsd.c` `add_connection` (inbound-connection acceptor) + private `check_clones` twin** — port the per-`accept()` local-client constructor (`make_client` → resolve peer addr into `ip`/`port`/`sockhost` → clone-rate check → register fd in `local[]`/`fdall`/client list → `start_auth`) plus its file-`static` clone-rate callee `check_clones` (`CLONE_CHECK`; persistent backlog list, ported as a private Rust twin — no `cref_` oracle) via `-DPORT_S_BSD_ADD_CONN_P7bb`. Config-resolved: `NO_DNS_LOOKUP` (hostp=NULL, no async lookup, `USE_IAUTH` alias-forwarding block compiled out), `DELAY_CLOSE`/`CLONE_CHECK` on, `UNIXPORT` off, `AF_INET6`. L1 differential (normal accept post-state + clone flood over the backlog + the getpeername-fail/IsIllegal refuse inverses; `start_auth` neutralized via `iauth_options=XOPT_REQUIRED`+`adfd=-1`) zero-diff vs `cref_`; L2 = `golden_registration` (every client connection flows through it) byte-identical, `golden_s2s_link` green (incoming server links too); no new S2S (formats no remote-user fields, no `IsServer` branch).
- **P7cc DONE: `s_bsd.c` `connect_server` + static `connect_inet`** — the outbound server-connection setup (counterpart of P7bb `add_connection`): refuse if already linked, else build a client/server stub, `connect_inet` (`socket`/`bind` to `mysk` + dup-IP scan), `connect()`, re-attach+verify C/N lines, register the fd. `connect_inet` ported as a private Rust twin; `set_sock_opts` (last compiled C caller now gone) guarded out under the same `-DPORT_S_BSD_CONNECT_SERVER_P7cc`. Finding: the DNS block is dead under AF_INET6 (`!aconf->ipnum.S_ADDR` = array address, always false). L1 3-case zero-diff (already-present ±remote `by`, connect_inet-failure cleanup); no new L2 (golden/S2S dials *into* the ircd → outbound dial deferred to the event-loop/CONNECT L2).
- **P7dd DONE: `s_bsd.c` `start_iauth` (iauth subprocess respawn)** — the deepest boot-subtree leaf (`daemonize` calls it). (Re)spawns the external iauth helper over an `AF_UNIX` `socketpair`, recording the parent end in `adfd`: `BOOT_NOIAUTH` + `adfd>=0` + 90s-throttle guards, then `socketpair` → Rust `set_non_blocking` both ends → `setsockopt(SO_SNDBUF/RCVBUF, IAUTH_BUFFER=65535)` → `fork` (← `vfork`; identical here, libc deprecates vfork) → child close-loop/`dup2`/`execl(IAUTH_PATH, IAUTH)` → parent close; the non-first-call live-client burst as `"<fd> O"` lines. Statics `last`/`first`/`iauth_pid` → module-private; `IAUTH_PATH`/`IAUTH` expanded by build.rs into `ircd_sys::IAUTH_PATH`/`IAUTH` (the `PID_PATH` precedent). Guard `-DPORT_S_BSD_START_IAUTH_P7dd` on `s_bsd_link.o`. L1 3-case zero-diff (NOIAUTH + already-running early returns + the spawn post-state — `adfd` nonblocking, `iauth_spawn++` — with bounded child reaping); burst + full spawn end-to-end → L2/soak (golden boots `-t -s` = `BOOT_NOIAUTH`); no S2S.
- **P7ee DONE: `s_bsd.c` `daemonize` (boot detach + resolver/iauth init)** — ported the layer directly above the P7dd `start_iauth` (called once from `ircd.c` `main` at boot), now a clean leaf since its only non-libc callees `init_resolver` (P6) and `start_iauth` (P7dd) are Rust. Config-resolved: `TIOCNOTTY` defined on Linux (the ioctl block compiles); the `setpgrp` arm is the `#else` `setpgrp(0, getpid())` branch (glibc `setpgrp(void)` ignores the args; declared 2-arg to mirror the source). Faithful: `bootopt & BOOT_TTY` → short-circuit straight to `init_dgram` (no fork/no fd close); else `fclose(stdout)`/`close(1)`, (unless `BOOT_DEBUG`) `fclose(stderr)`/`close(2)`, and on a console/tty-not-inetd `fork()` (parent `exit(0)`s to detach) → `TIOCNOTTY` ioctl → `setpgrp` → `fclose(stdin)`/`close(0)`; then always `resfd = init_resolver(0x1f)` + `start_iauth(0)`. Partial port via the `s_bsd_link.o` seam (`-DPORT_S_BSD_DAEMONIZE_P7ee`). L1 differential (`daemonize_diff.rs`, 1 case: the `BOOT_TTY|BOOT_NOIAUTH` short-circuit — `init_resolver` opens a valid `resfd` socket, `start_iauth(0)` reached-but-no-op under `BOOT_NOIAUTH` leaving `adfd=-1` — the inverse check; both worlds identical) zero-diff vs `cref_daemonize`, serialized on `GLOBALS_LOCK`. **Mostly untestable by design:** the detach path forks (parent `exit(0)`s) + closes 0/1/2 — calling it destroys the harness, and even fork-isolation can't measure a function whose job is to detach; the only differentially-safe path (and the only one any harness takes — golden boots `-t` = `BOOT_TTY`) is the `BOOT_TTY` short-circuit. No new L2 (boot callee; `golden_registration` byte-identical via this path); no S2S (no remote-user fields). **Only `read_message` (+ its statics `polludp`/`check_ping`) remains C in `s_bsd.c`.**
- **P7ff DONE: `s_bsd.c` event-loop cluster `read_message` + 8 statics** (`completed_connection`/`read_listener`/`read_packet`/`client_packet`/`ircd_no_fakelag`/`do_dns_async`/`polludp`/`check_ping`) — the body of `io_loop` and the last *logic* in `s_bsd.c`: build the read/write fd_set over `fdp`+`udpfd`/`resfd`/`adfd` → `select()` → dispatch resolver/UDP/iauth reads + auth-fd I/O + listener `accept()`s + writable sendQ flushes + readable packets + dead-socket `exit_client`. `USE_POLL` off → the `select()` path; the 8 statics → module-private Rust twins (no `cref_` oracle); guard `-DPORT_S_BSD_READ_MESSAGE_P7ff`. **With `read_message` ported, `s_bsd_link.o` has zero functions left — only the data globals.** L1 = the differentially-safe empty-loop path (`read_message_diff.rs`, 2 cases zero-diff); L2 = the *entire* `golden_*`+`golden_s2s_*` suite byte-identical (every byte flows through it; only the known `golden_s2s_s_serv_stats` reference-C uninitialised-sendq flake fails — [[p5-s2s-stats-flake]]); destructive accept/read/write/exit + `polludp`/`do_dns_async` are L2-only by design.
- **P7gg DONE: `ircd.c` `try_connections` (auto-connect timer)** — ported the static io_loop AC timer (walks `conf`, picks the best AC-able `connect{}` C-line by lowest-hold/best-`pref`/highest-class, splices the winner to the list tail, penalises its `hold`, then defers or dials via `connect_server`); de-static'd (mysk precedent) so the cref archive exports `cref_try_connections`, guarded `-DPORT_IRCD_TRY_CONNECTIONS_P7gg` in `ircd_link.o` with an `#else extern` proto for the still-C io_loop caller. `DISABLE_DOUBLE_CONNECTS` undef → dup-IP scan dead. L1 8-case zero-diff (all non-`connect_server` paths incl. the tail-splice + deferred-notice via `iconf.aconnect=0`); the dial path is L2-only (golden dials *into* the ircd — P7cc precedent); no S2S.
- **P7hh DONE: `ircd.c` `check_pings` (io_loop ping/timeout sweep)** — ported the static io_loop timer helper (ircd.c:525): walks `local[highest_fd..0]`, pings idle registered links (`FLAGS_PINGSENT` state machine), times out unresponsive ones (`exit_client`; servers get a "No response … closing link" notice; DNS/auth waiters reset or handed to iauth via `sendto_iauth`), and folds the soonest next-check time into the return value. De-static'd under `-DPORT_IRCD_CHECK_PINGS_P7hh` (the try_connections P7gg precedent) on the `ircd_link.o` recipe; `#else extern` proto for the still-C io_loop caller. Config-resolved: TIMEDKLINES off → `kflag` permanently 0 (find_kill/kill-notice + static `lkill` gone, timeout arm always "Ping timeout"); USE_IAUTH on; DEBUGMODE off. C `goto ping_timeout` modelled by guarding the if/else on the negated recently-active condition; `bysptr` kept outside the loop (never reset). L1 (`check_pings_diff.rs`, 7 cases) zero-diff vs `cref_check_pings` over isolated worlds (real `local`/`highest_fd`/`me` vs `cref_*`), serialized on `GLOBALS_LOCK`: empty, listener-skip, recently-active-no-ping, the PINGSENT ping-send branch (its inverse), young-unregistered, already-pinged-idle-below-2*ping, mixed multi-fd sweep — asserts per-client (flags,lasttime)+return. The `exit_client` timeout paths are L2-gated (destructive+variadic, the read_message/P7ff precedent). L2 = the ircd-golden suite runs check_pings every io_loop tick; `golden_registration`+`golden_channel_join` byte-identical, only the documented `stats_t` reference-C garbage flake remains. No S2S (no command-driven remote-field formatting).
- **P7ii DONE: `ircd.c` `delayed_kills` (io_loop K-line sweep)** — ported the second io_loop timer helper (sibling of P7hh `check_pings`, ircd.c:447): runs only while `rehashed > 0`, walks `local[dk_lastfd..j]` and `find_kill`s every local person, `exit_client`ing K-line matches. De-static'd under `-DPORT_IRCD_DELAYED_KILLS_P7ii` on `ircd_link.o` (the check_pings precedent; `#else extern` proto for the still-C io_loop caller). Config-resolved: MAXDELAYEDKILLS=200 > MAXCONNECTIONS=50 → `j` always clamps to 0 → the sweep always completes in one call (persistent statics reset every call; the `return rehashed` incomplete-batch path unreachable); TIMEDKLINES off → find_kill `timedklines`=0. L1 (`delayed_kills_diff.rs`, 6 cases) zero-diff vs `cref_delayed_kills` over isolated worlds (real `local`/`highest_fd`/`rehashed` vs `cref_*` + empty kconf → no kill), serialized on `GLOBALS_LOCK`: empty across rehashed∈{0,1,2}→return{0,0,1}, person-no-kline completes & survives (the inverse of the kill arm), non-person/NULL skipped, mixed sweep — asserts return + per-client (status,flags,still-in-local). The `kflag==-1` kill arm (`exit_client`, destructive) is untested-by-design AND has no L2 path (golden never rehashes → delayed_kills' body isn't reached); `golden_registration` byte-identical (no-regression). No S2S (no remote-user wire fields).
- **P7jj DONE: `ircd.c` `setup_me` boot initializer** — ported the `me`-singleton initializer (ircd.c:723, de-static'd + extern-declared, `-DPORT_IRCD_SETUP_ME_P7jj` on `ircd_link.o`) to `ircd-common/src/ircd.rs`: passwd-derived `username`/`auth`, `get_my_name` sockhost, the `STAT_ME`/`FLAGS_OPER`/`FLAGS_EOB`/`SV_UID` bits, server-name interning (`find_server_num`/`find_server_string`), `make_user`, `istat.is_users`/`is_eobservers`, client+SID hash registration, `verstr=PATCHLEVEL`, `setup_server_channels`. All callees already Rust; no variadic senders. **L2-gated, no L1** (mutates 4 shared global tables + the `me` singleton + `istat` → not L1-isolatable; the P7dd/ee/ff precedent) — golden registration/lusers/s2s_server/s2s_info/s2s_map + 3 s_misc byte-identical (stats_t = documented pre-existing reference-C garbage flake). No S2S (no command wire output).
- **P7kk DONE: `ircd.c` signal-handler + reboot cluster** (`s_die`/`s_slave`/`s_rehash`/`s_restart`/`restart`/`server_reboot`, ircd.c:73–215) — ported the SIGTERM/SIGUSR1/SIGHUP/SIGINT handlers + the `restart`→`server_reboot` shutdown path to `ircd-common/src/ircd.rs` via `-DPORT_IRCD_SIGNALS_P7kk` (single guard over the contiguous block; `#else` re-declares the two non-header handlers for the still-C `setup_signals`); de-static'd the `dorehash`/`dorestart`/`restart_iauth` flags (shared with the still-C `io_loop`; one C definition, Rust writes via a local `extern "C"` block) and `s_rehash`/`s_slave` (cref oracle). `IRCD_PATH` plumbed as `ircd_sys::SERVER_PATH` for `server_reboot`'s `execv`. L1 differential (`ircd_signals_diff.rs`, 3 tests: `s_rehash` 0→1→2→2 ratchet, `s_slave` restart_iauth set, `s_restart` dorestart-when-not-tty) zero-diff vs `cref_`, serialized on `GLOBALS_LOCK`, signal dispositions saved/restored. L2 = boot gate (setup_signals installs the Rust handlers) + `golden_s_serv_shutdown`/`_maint` (die/restart/rehash reject + rehash_success io_loop path) byte-identical; the terminating arms (`exit`/`execv`) are faithful-by-inspection. No S2S (no command-driven remote-user wire fields).
- **P7ll DONE: `ircd.c` `setup_signals` (boot signal installer)** — ported the static `setup_signals` (ircd.c:1388, called once from the still-C `main`) to `ircd-common/src/ircd.rs`, the last clean leaf before the `c_ircd_main`/`io_loop` spine; all callees are now Rust (`dummy` P7a; `s_rehash`/`s_restart`/`s_die`/`s_slave` P7kk). Config-resolved: `POSIX_SIGNALS`=1 (the `sigaction` branch), `SIGWINCH` defined, `USE_IAUTH` ON (`s_slave`+SIGCHLD/`SA_NOCLDWAIT` arms), not `__FreeBSD__`, no `RESTARTING_SYSTEMCALLS`; faithful cumulative `sa_mask` (`sigemptyset` called exactly twice). De-static'd under `-DPORT_IRCD_SETUP_SIGNALS_P7ll` (split out of the line-34 static proto group; the cref archive keeps the de-static'd body → exports `cref_setup_signals`) on the `ircd_link.o` recipe; `nm` confirms `T setup_signals` from Rust. L1 (`setup_signals_diff.rs`, 1 case) zero-diff vs `cref_`: snapshot all 8 dispositions → call Rust `setup_signals` → query → call `cref_setup_signals` → query → restore; asserts per-signal `sa_flags` + `sa_mask` byte-identical between worlds and the *world-correct* handler wired (SIG_IGN for PIPE/WINCH/CHLD identical; else Rust `dummy`/`s_rehash`/… vs `cref_dummy`/… — handler ptrs differ by design), serialized on `GLOBALS_LOCK`. L2 = the still-C `main` installs the Rust handlers on every golden boot → `golden_registration`/`golden_s_serv_shutdown`/`golden_s_serv_maint` (die/restart reject + rehash_success) byte-identical. No S2S (no command-driven remote-user wire fields).
- **P7mm DONE: `ircd.c` `io_loop` (the event-loop body)** — ported the per-tick loop body (`while(1) io_loop()` in the still-C `main` now calls the Rust symbol) to `ircd-common/src/ircd.rs` via the `ircd_link.o` seam (`-DPORT_IRCD_IO_LOOP_P7mm`, io_loop de-static'd to `extern`). Config-resolved: `DELAY_CLOSE` off (timer+delay-MIN arms dropped), `TKLINE` on (`tkline_expire` arm kept), `DEBUGMODE` off (no `Debug`/`checklists`). Calls already-Rust siblings directly (calculate_preference/try_connections/check_pings/delayed_kills/restart/ircd_writetune); `nextpreference`/`nextiarestart` via a local `extern "C"` block (absent from `*_ext.h`). No L1 (static → no `cref_io_loop` oracle); L2 = whole golden suite (every booted Rust ircd runs the loop) byte-identical — registration/channel-join/debug-stats/s2s-link confirmed.
- **P7nn DONE: `ircd.c` CLI boot helpers (`bad_command` + `open_debugfile`)** — ported the last two *non-spine* file-`static` helpers (both called only from `c_ircd_main`): `bad_command` (usage banner + `exit(-1)`; config-resolved `CMDLINE_CONFIG`/`DEBUGMODE` off → both `%s` slots `""`) and `open_debugfile` (entire body `#ifdef DEBUGMODE` → a pure no-op under the locked config). De-static'd both (+ split the proto out of the P7mm `io_loop` group) so the cref prefix-rename exports `cref_bad_command`/`cref_open_debugfile`; guarded the bodies out of `ircd_link.o` under a single new `-DPORT_IRCD_CLI_HELPERS_P7nn`. L1 differential (`ircd_cli_helpers_diff.rs`, 2 cases) zero-diff vs `cref_`: a `fork()`-isolated stdout+exit-status diff for the terminating `bad_command` (byte-identical banner + `WEXITSTATUS==255`) and the no-op-contract inverse for `open_debugfile` (fd 2 `fstat` identity unchanged — it must NOT redirect stderr). L2 = `golden_registration` byte-identical (`open_debugfile` runs no-op on every boot). No S2S (no remote-user wire fields). **Only `c_ircd_main` remains C in `ircd.c`.**
