# P7 — I/O core + event loop + glue (per-cluster progress)

One-line summary per cluster. Full entries: [`docs/progress-log/p7.md`](docs/progress-log/p7.md).
Phase row + plan: [`PLAN.md`](PLAN.md) P7; plans under `docs/superpowers/plans/`.

- **P7a DONE: `common/bsd.c` (socket write leaf)** — ported `deliver_it` (the bottom of the send path: `send()` + WOULDBLOCK→0/`FLAGS_BLOCKED` + `sendB` accumulation + `-errno`) and the re-arming `dummy` signal stub to `ircd-common/src/bsd.rs`; both portable → **`bsd.o` dropped outright** (no `_link.o`). L1 differential (5 cases, full FLAGS_BLOCKED set/clear/untouched matrix) zero-diff vs `cref_`; L2 = existing golden suite (deliver_it is the universal write path) stays byte-identical; no S2S/no new L2 (utility TU).
- **P7b DONE: `common/packet.c` (inbound packet reassembler)** — ported `dopacket` (the only exported symbol; ZIP_LINKS/DEBUGMODE off → just the plain `while (length>0 && ch2)` line-reassembly loop: CR-or-LF framing, `receiveB`/`receiveM` counter accumulation on me/cptr/acpt with the `acpt==&me` guard, `cptr->count` partial-line carry, BUFSIZE-1 overflow cap, and the parse→FLUSH_BUFFER/IsDead→exit_client/IsServer+UNKCMD return handling) to `ircd-common/src/packet.rs`; all callees already Rust → **`packet.o` dropped outright** (no `_link.o`). L1 differential (8 cases: single LF/CR, skipped extra CR-LF, two-lines-one-buffer, partial→continuation round-trip, acpt==&me vs distinct-acpt, 600-byte overflow truncation) zero-diff vs `cref_`; serialized on a `GLOBALS_LOCK` (shared `me`/`cref_me`). L2 = existing golden suite (universal read path) stays byte-identical (`golden_registration` confirmed); no S2S/no new L2 (utility TU, no IsServer-remote-field formatting).
- **P7c DONE: `ircd.c` tune-file pair (`ircd_writetune`/`ircd_readtune`)** — ported the tune-file persistence pair (the 7 sizing globals `ww_size`/`lk_size`/`_HASHSIZE`/`_CHANNELHASHSIZE`/`_SIDSIZE`/`poolsize`/`_UIDSIZE` serialized one-decimal-per-line via `sprintf`, parsed back via `sscanf`, the `USE_HOSTHASH`/`USE_IPHASH` mirrors `_HOSTNAMEHASHSIZE`/`_IPHASHSIZE` = `_HASHSIZE`, the `BOOT_BADTUNE` silent-return-vs-`exit(1)` branch, and the `lk_size = max(lk_size, ww_size)` clamp) to `ircd-common/src/ircd.rs`. First partial port of the central `ircd.c` → `ircd_link.o` second-compile (`-DPORT_IRCD_TUNE_P7c`, carrying ircd.o's IRCD*_PATH/IAUTH machine-path defines so the surviving C is byte-identical); `c_ircd_main`/`me`/signals/`restart`/`server_reboot`/the tune callers stay C. L1 differential (`ircd_tune_diff.rs`, 9 cases: writetune byte-identical files incl. lk<ww + zero/INT_MAX/u32-max edges, readtune global round-trip incl. clamp + hash mirrors + missing-file + BOOT_BADTUNE silent return, write→read round-trip) zero-diff vs `cref_`, serialized on a `GLOBALS_LOCK`. No new L2 (utility TU, not a `msgtab` handler; `ircd_readtune` exercised at boot by the existing golden suite — `golden_registration` stays byte-identical); no S2S (no remote-field formatting). The `exit(1)` arm is untested-by-design (would kill the test process).
- **P7d DONE: `s_bsd.c` socket/file utility leaves** — first (partial) port of the central I/O TU `s_bsd.c`; ported the three pure libc-wrapper leaves that touch none of the event-loop data globals: `get_sockerr` (`getsockopt(SO_ERROR)`-or-saved-`errno`), `set_non_blocking` (`fcntl F_GETFL`→`F_SETFL|O_NONBLOCK`; failure path calls the still-C `report_error`), and `write_pidfile` (truncate+create `IRCDPID_PATH`, `sprintf("%5d\n", getpid())`) to `ircd-common/src/s_bsd.rs`. Partial port via `s_bsd_link.o` (`-DPORT_S_BSD_LEAF_P7d`, carrying s_bsd.o's `IRCDPID_PATH`/`IAUTH_PATH`/`IAUTH` machine-path defines); the event loop + `local[]`/`highest_fd`/`timeofday`/`FdAry` + listeners + `add_connection`/`read_message`/`report_error`/`get_my_name`/`add_local_domain`/`start_iauth` stay C. `IRCDPID_PATH` (a command-line define, absent from bindgen) exposed to Rust via the P6m make-`--eval`+`rustc-env` pattern → `ircd_sys::PID_PATH`. L1 differential (`s_bsd_leaves_diff.rs`, 4 cases: get_sockerr fd<0 errno-passthrough + valid-fd/no-error, set_non_blocking O_NONBLOCK-set-with-untouched-fd-inverse, write_pidfile identical-behavior) zero-diff vs `cref_`, serialized on `GLOBALS_LOCK`. No new L2 (utility TU; `write_pidfile` hit at boot, `set_non_blocking`/`get_sockerr` on every connect — covered by the existing golden boot/connect path, `golden_registration` byte-identical); no S2S (no remote-field formatting). Untested-by-design: get_sockerr's `err!=0` branch + set_non_blocking's fcntl-failure→report_error branch (need a pending-error socket / bad fd); write_pidfile's byte rendering is pinned only where `IRCDPID_PATH` is writable (its dir is absent in the sandbox → both worlds no-op identically).
- **P7e DONE: `s_bsd.c` name-resolution leaf (`add_local_domain`)** — ported the next-easiest s_bsd.c leaf after the P7d socket/file trio: `add_local_domain` (strip one trailing `.` + `size++`; if the name is unqualified, lazily `ircd_res_init()` when `!(options & RES_INIT)`, then append `"." + ircd_res.defdname` iff `defdname[0]` and `strlen(defdname)+2 <= size`) to `ircd-common/src/s_bsd.rs`. Touches none of the event-loop globals — its only dependency is the resolver state (`ircd_res`/`ircd_res_init`), already Rust since P6. Partial port via the existing `s_bsd_link.o` seam with a new guard `-DPORT_S_BSD_LEAF_P7e` (added alongside `-DPORT_S_BSD_LEAF_P7d`); `get_my_name` (its only in-TU caller, needs `gethostname`/`gethostbyname`/`mysk`) stays C. RED confirmed the undefined symbol referenced by the now-Rust `s_conf.rs` + still-C `s_bsd.c` (`get_my_name`/`connect_server`); after GREEN `nm` shows `add_local_domain` as `T` from Rust. L1 differential (`add_local_domain_diff.rs`, 6 cases: trailing-dot-strip/no-append, unqualified-append, the size-guard boundary len+1-vs-len+2 inverse, empty-defdname-no-append, the `size++`-enables-append faithfulness check, and the init-trigger branch via `$LOCALDOMAIN` for determinism — both worlds run their P6-verified-equivalent `ircd_res_init`) zero-diff vs `cref_add_local_domain`, isolated worlds (Rust reads the real `ircd_res`, oracle reads `cref_ircd_res`), serialized on `GLOBALS_LOCK`. No new L2 (callee TU, not a `msgtab` handler; runs at boot via `s_conf.c` read_conf + on `connect_server` — `golden_registration` byte-identical); no S2S (no remote-field formatting).
- **P7f DONE: `s_bsd.c` delayed-close leaf (`delay_close`)** — ported the `DELAY_CLOSE`-gated (=15) `delay_close` (s_bsd.c:3359): a private static time-sorted linked list of fds awaiting a delayed `close()`, swept per call (expired entries, or — under fd pressure when `is_delayclosewait > (MAXCLIENTS-is_localc)>>1` — the oldest quarter; `fd==-2` from `m_close` forces close-all), then `fd>=0` is queued at `timeofday+15` (with `set_non_blocking`+`shutdown(SHUT_RD)`); returns the head entry's scheduled time or 0. Faithful: the unsigned `int-u_long` threshold (wraps), the `time<now || tmpdel-- >0` short-circuit (tmpdel only decrements when not expired), the 46-byte (43 chars+`\r\n`+NUL) "Too rapid connections" error sent to the *new* fd. Same `s_bsd_link.o` seam, new guard `-DPORT_S_BSD_DELAY_CLOSE_P7f`; reads the still-C `istat` (ircd.c) + `timeofday` (s_bsd.c) globals, calls the Rust `set_non_blocking` (P7d) + `MyMalloc` (P2). L1 differential (`delay_close_diff.rs`, 6 cases: queue-one + inverse time-eviction, unexpired-stays early-break, `fd==-2` close-all drain, overflow drop-oldest-quarter, chronological-head ordering) zero-diff vs `cref_delay_close`, isolated worlds (real `istat`/`timeofday` vs `cref_*`), serialized on `GLOBALS_LOCK` (incl. a `reset()` to drain the persistent static lists between tests). No new L2 (callee, not a `msgtab` handler — hit by the io_loop `delay_close(-1)`/`m_close`/connection-close paths; `golden_registration` byte-identical); no S2S (no remote-field formatting).
- **P7g DONE: `s_bsd.c` fd-teardown leaf (`close_client_fd`)** — ported the descriptor-teardown leaf `close_client_fd` (s_bsd.c:1270): closes `authfd` then `fd` (flushing its sendQ first via the Rust `flush_connections`, removing it from `fdas`/`fdall` via the Rust `del_fd` + clearing `local[fd]`), then drains `sendQ`/`recvQ` (`DBufClear`→`dbuf_delete`) and zeroes `passwd`. Config-resolved: `SO_LINGER` defined (the linger blocks compile, fired only when `exitc==EXITC_PING`), `ZIP_LINKS` off (`zip_free` omitted). All real callees already Rust (`flush_connections` P3, `del_fd` P2, `dbuf_delete` P1); only `report_error` stays C (already an `extern "C"` decl since P7d; fires solely on a `setsockopt(SO_LINGER)` failure). Same `s_bsd_link.o` seam, new guard `-DPORT_S_BSD_CLOSE_FD_P7g`; reads the still-C `local[]`/`fdas`/`fdall` globals. L1 differential (`close_client_fd_diff.rs`, 6 cases: client both-fds, server + listener `IsServer||IsListener` fdas+fdall arm, fd<0 only-authfd-closed, both-fds<0 no-op, and the inverse-of-insert recvQ-drain + passwd-zero) zero-diff vs `cref_close_client_fd`, isolated worlds (real `local`/`fdas`/`fdall` + Rust `flush_connections`/`del_fd` vs `cref_*`), serialized on `GLOBALS_LOCK`; inverse invariants checked (fd actually closed via EBADF, `local[fd]==NULL`, array slot freed). `exitc=0` everywhere → the `SO_LINGER`/`report_error` branches untested-by-design; the sendQ flush-then-clear (live socket I/O) is L2. No new L2 (callee, not a `msgtab` handler — hit on every disconnect via `close_connection`/`exit_client`; `golden_registration` incl. quit/reuse byte-identical); no S2S (no remote-field formatting).
- **P7h DONE: `s_bsd.c` connection-teardown leaf (`close_connection`)** — ported the bookkeeping layer directly above the P7g `close_client_fd`: `close_connection` (s_bsd.c:1341) bumps the per-class `ircstp` stats (`is_sv`/`is_cl`/`is_ni` + byte/time accumulators), drops outstanding DNS queries (`del_queries`), reschedules server reconnect (`find_conf_exact`→`nextconnect` with the `HANGONGOODLINK`/`HANGONRETRYDELAY` clamp), schedules a hang-on retry for an aborted handshake/connect, notifies iauth (`sendto_iauth "%d D"`) + decrements the P-line acceptor's `clients` refcount (recursing into `close_connection(acpt)` when the acceptor itself goes illegal), tears the descriptors down via the Rust `close_client_fd`, unlinks an illegal listener from `ListenerLL`, then `det_confs_butmask(cptr,0)` + `cptr->from = NULL`. Config-resolved: `USE_IAUTH` ON → the `sendto_iauth` block compiles; DEBUGMODE off. All callees already resolvable (`del_queries`/`find_conf_exact`/`det_confs_butmask` Rust since P6; `sendto_iauth` the variadic C trampoline; `close_client_fd` Rust P7g). Same `s_bsd_link.o` seam, new guard `-DPORT_S_BSD_CLOSE_CONN_P7h`; reads the still-C `ircstp`/`nextconnect`/`ListenerLL`/`timeofday`/`me` globals. L1 differential (`close_connection_diff.rs`, 6 cases: server/client/unknown stats accounting, handshake+connecting `nextconnect = now+30`, P-line acceptor refcount 5→4, illegal-listener `ListenerLL` unlink with the inverse — node gone, head intact, `from` NULL, confs detached) zero-diff vs `cref_close_connection`, isolated worlds (real `ircstp`/`nextconnect`/`ListenerLL`/`local`/`fdas`/`fdall`/`me`/`istat` vs `cref_*`), serialized on `GLOBALS_LOCK`; `me.fd`/`adfd` pinned to -1 (inner `flush_connections` else-branch + `sendto_iauth` no-op). No new L2 (callee, not a `msgtab` handler — hit on every disconnect via `exit_client`; `golden_registration` incl. quit/reuse byte-identical); no S2S (formats no remote-user fields). Untested-by-design: the recursive `close_connection(acpt)` (needs a fully-illegal acceptor conf) + the `find_conf_exact` reconnect-reschedule arm (NULL with no conf loaded) + the `sendto_iauth` wire emission (L2, variadic trampoline).
- **P7i DONE: `s_bsd.c` listener-list teardown leaf (`close_listeners`)** — ported the layer directly above P7g/P7h: `close_listeners` (s_bsd.c:427) walks the `ListenerLL` doubly-linked list and tears down every listener whose conf has gone illegal (`IsIllegal(aconf)`) — `clients>0` → the Rust `close_client_fd` (fd torn, node stays in the list), `clients≤0` → the Rust `close_connection` (fd torn + node unlinked + confs detached + `from` cleared); legal listeners untouched; the `bcptr = acptr->next` save handles the in-loop unlink. UNIXPORT off (config.h:339) → the `IsUnixSocket`/`unlink` block vanishes; both callees already Rust (P7g/P7h) → no new externs (reuses the existing `conf_is_illegal` helper). Same `s_bsd_link.o` seam, new guard `-DPORT_S_BSD_CLOSE_LISTENERS_P7i`; the only caller is the now-Rust `s_conf.rs` rehash (`s_conf.c:1315`). L1 differential (`close_listeners_diff.rs`, 5 cases: illegal-clients=0 unlinked, illegal-clients>0 stays-linked inverse, legal untouched (fd still open via fcntl), mixed 3-node middle-removed with the two legals relinked, all-illegal drains the list) zero-diff vs `cref_close_listeners`, isolated worlds, serialized on `GLOBALS_LOCK`. No new L2 (callee, not a `msgtab` handler — hit by rehash; `golden_registration` byte-identical); no S2S (no remote-field formatting).
- **P7j DONE: `s_bsd.c` listener-reactivation leaf (`activate_delayed_listeners`)** — ported the counterpart to P7i's `close_listeners`: `activate_delayed_listeners` (s_bsd.c:526) walks the `ListenerLL` list and, for every listener flagged `FLAGS_LISTENINACTIVE`, calls `listen(fd, LISTENQUEUE=128)`, clears the inactive bit, and counts it; if any were reactivated it emits one `sendto_flag(SCH_NOTICE, "%d listeners activated", cnt)` notice. No `#ifdef`s (DEBUGMODE off → no `Debug`); `listen()`'s return is ignored exactly as C. Same `s_bsd_link.o` seam, new guard `-DPORT_S_BSD_ACTIVATE_DELAYED_P7j`; no new still-C externs (`sendto_flag` is the existing variadic trampoline via `ircd_sys::bindings`, safe in L1 — short-circuits on NULL `svc_ptr`; `LISTENQUEUE` reproduced as a const since it's absent from bindgen). RED confirmed the undefined symbol referenced by the now-Rust `s_serv.rs` (`m_set`/burst) + `s_misc.rs` (`check_split`); after GREEN `nm` shows it `T` from Rust. L1 differential (`activate_delayed_listeners_diff.rs`, 5 cases: single-inactive→activated (inactive bit clear + socket actually listening via `SO_ACCEPTCONN`), single-active untouched (inverse), mixed `[active,inactive,active]` only-middle, empty no-op, all-inactive) zero-diff vs `cref_activate_delayed_listeners`, isolated worlds over real TCP-socket fds, serialized on `GLOBALS_LOCK`; inverse invariant — listeners never removed, already-active nodes untouched. No new L2 (callee, not a `msgtab` handler — hit by server-burst/rehash; `golden_registration` byte-identical); no S2S (formats only an integer count, no remote-user fields).
- **P7k DONE: `s_bsd.c` `add_connection_refuse` (connection-refuse leaf)** — ported the refuse-path companion to `add_connection` (stays C): `DELAY_CLOSE` on → the `delay=0` reset is not compiled, so `delay` is honored verbatim; `close(fd)` unless delayed, `ircstp->is_ref++`, `acptr->fd = -2`, then `free_client` (Rust, P2). Partial-ported via `s_bsd_link.o` (`-DPORT_S_BSD_ADD_CONN_REFUSE_P7k`). L1 differential (3 cases: delay==0 closes the fd, delay==1 leaves it open — the inverse pair, two refuses accumulate `is_ref`) zero-diff vs `cref_`; `acptr` is freed inside the call (UAF post-state) so the test compares side effects (`is_ref` delta + fd fate), and `acptr->fd=-2` is untested-by-design (no surviving reader). No L2/no S2S (callee, not a `msgtab` handler; formats no remote-user fields).
- **P7l DONE: `s_bsd.c` `setup_ping` (UDP CPING-socket setup leaf)** — ported the one-shot setup half of the server-to-server CPING feature: bind the single shared `udpfd` UDP socket. Idempotent (`udpfd != -1` → return it, ignore `aconf`); config-resolved (`AFINET`=`AF_INET6` → `from` is a `sockaddr_in6`, the `SIN_*` macros map to `sin6_*`; `SETSOCKOPT` length is `sizeof(int)`=4 not `sizeof(*p)`; `FNDELAY`=`O_NONBLOCK`; DEBUGMODE/USE_SYSLOG off → no `Debug`/`syslog`). Faithful assign-then-test: `udpfd` set from `socket()` before the `==-1` check, each later failure does `close(fd); udpfd=-1`. Bind addr from a numeric `aconf->passwd` via the Rust `inetpton` (P1, falls back to `minus_one`=all-`0xff`) else `in6addr_any`. Partial port via `s_bsd_link.o` (`-DPORT_S_BSD_SETUP_PING_P7l`); `udpfd` stays a C global (the still-C `read_message`/`polludp`/`check_ping` read it) → Rust reads/writes the bindgen extern; the CPING-output siblings `send_ping`/`check_ping`/`polludp` stay C (share `udpfd` only, which stays C). RED confirmed the undefined symbol referenced by the now-Rust `s_conf.rs` rehash (`s_conf.c:2041`); after GREEN `nm` shows `setup_ping` `T` from Rust. L1 differential (`setup_ping_diff.rs`, 3 cases: fresh setup opens a non-blocking `SOCK_DGRAM` recorded in `udpfd`, idempotent second call returns the same fd unchanged — the inverse-of-state path, numeric-passwd `"::1"` drives the `inetpton` bind-addr branch) zero-diff vs `cref_setup_ping`, isolated worlds (real `udpfd` vs `cref_udpfd`), serialized on `GLOBALS_LOCK` with a `reset()` closing the prior socket between cases; compares the fd's *properties* (valid/non-blocking/`SOCK_DGRAM`) not its integer value (worlds open distinct sockets). No new L2 (callee, not a `msgtab` handler — hit by `s_conf.rs` rehash when a `connect{}` block has a port; `golden_registration` byte-identical); no S2S (formats no remote-user fields). Untested-by-design: the `setsockopt`/`bind`/`fcntl` failure arms (need an induced syscall failure; both worlds take the success path identically).
- **P7m DONE: `s_bsd.c` `send_ping` (UDP CPING-output leaf)** — ported the output half of the server-to-server CPING (UDP ping) feature, the sibling to P7l's `setup_ping`: advance the per-`connect{}` sliding-window RTT statistics on the conf's `aCPing` (`lseq++`, `seq++`-then-conditional-`--`, the `seq*conFreq>1200` window adjusting `ping`/`recvd`) and `sendto` a `Ping` datagram (`pi_cp`/`pi_id=htonl(PING_CPING)`/`pi_seq`/`pi_tv`) over the shared `udpfd`. Config-resolved (`AFINET`=`AF_INET6` → `sin` is `sockaddr_in6`; `IN6ADDRSZ`=16; DEBUGMODE/USE_SYSLOG off → no `Debug`/`syslog`; `PING_CPING`=0x02). Faithful: the C guard's first disjunct `!aconf->ipnum.s6_addr` is an array address → always false, so only `AND16(ipnum)==255` (all-0xff unresolved sentinel) and `cp->port==0` gate; all `aCPing` counters are `u_long` → unsigned window arithmetic; `cp->lseq++` post-increments (the packet carries the old value). Partial port via the existing `s_bsd_link.o` seam, new guard `-DPORT_S_BSD_SEND_PING_P7m`; `udpfd` stays a C global (shared with the still-C `setup_ping`/`polludp`), Rust reads the bindgen extern → no new still-C externs (true leaf). L1 differential (`send_ping_diff.rs`, 7 cases: basic send with packet check, the three early returns — unresolved ipnum/zero port/zero conFreq, window recvd>0/recvd==0/recvd==seq) zero-diff vs `cref_send_ping`, isolated worlds (real `udpfd` vs `cref_udpfd`) each binding a `::1` UDP receiver to `recvfrom` the datagram; compares the deterministic `aCPing` post-state + the world-independent packet fields (`pi_id`/`pi_seq`), excluding `pi_cp` (live pointer) + `pi_tv` (gettimeofday); serialized on `GLOBALS_LOCK`. No new L2 (callee, not a `msgtab` handler — reached from the server-connect CPING path; `golden_registration` byte-identical); no S2S (formats no remote-user wire fields). Untested-by-design: `pi_tv`/`pi_cp` nondeterministic; the `sendto` failure path is `(void)`-ignored by C → unobservable.
- **P7n DONE: `s_bsd.c` `open_listener`/`reopen_listeners` (listener (re)construction wrappers)** — ported the layer directly above the still-C socket constructor `inetport`: `open_listener` (s_bsd.c:467) (re)opens one listener (early-return on `!IsListener || fd>0`; UNIXPORT off → only the inet branch; a delayed-listen P-line before the first rejoin sets `dolisten=0` + `FLAGS_LISTENINACTIVE`; dispatches to the still-C `inetport` + the Rust `add_fd` (P2)/`set_non_blocking` (P7d), registering a created fd in `fdas`/`fdall`), and `reopen_listeners` (s_bsd.c:512) walks `ListenerLL` reopening every legal closed-fd listener. Partial port via the existing `s_bsd_link.o` seam (`-DPORT_S_BSD_OPEN_LISTENER_P7n`); `inetport` (real socket/bind/listen, with its static `set_sock_opts`) stays C. L1 differential (`open_listener_diff.rs`, 6 cases: normal→listening, delayed-before-rejoin→inactive/not-listening, delayed-after-rejoin→listens (inverse), `!IsListener` no-op, `fd>0` no-op, `reopen_listeners` skips illegal + already-open) zero-diff vs `cref_` (observable fd properties — valid/`SO_ACCEPTCONN`/`O_NONBLOCK` — + flags/`fdas`/`fdall`/`local[fd]`, since each world opens its own socket), serialized on `GLOBALS_LOCK`. No new L2 (callee, hit at boot/rehash; `golden_registration` byte-identical); no S2S (no remote-user wire fields).
- **P7o DONE: `s_bsd.c` `add_listener` (listener-constructor wrapper)** — ported the layer directly above the now-Rust `open_listener` (P7n): `add_listener` (s_bsd.c:330) builds the `me`-like listener-stub `aClient` via the Rust `make_client`/`make_link` (P2) — `FLAGS_LISTEN`, `SetMe` (STAT_ME), self `acpt`/`from`, `name = ME` (= `me.name`), `firsttime = time(NULL)`, a one-element `confs` link carrying the passed `aconf` — opens the socket via the Rust `open_listener`, then prepends the client to `ListenerLL` (back-linking the old head's `prev` when non-empty); returns 0. No `#ifdef`s. Partial port via the existing `s_bsd_link.o` seam, new guard `-DPORT_S_BSD_ADD_LISTENER_P7o`; all callees already Rust → no new still-C externs (`add_listener` referenced by the now-Rust `s_conf.rs` initconf). L1 differential (`add_listener_diff.rs`, 3 cases: into empty `ListenerLL` → sole node listening+registered with prev/next NULL, prepend before an existing node → new head + old head's `prev` back-linked (inverse), two consecutive calls → chain order + back-links) zero-diff vs `cref_add_listener`, isolated worlds (each opens its own socket / `make_client` allocates its own pointer → compares observable facts not raw fd/pointer values; `me.name` pinned to `irc.test` so `inetport`'s `ME`-based sockhost matches; `firsttime=time(NULL)` asserted non-zero, not compared), serialized on `GLOBALS_LOCK`. No new L2 (callee, hit at boot/rehash via `s_conf.c` initconf; `golden_registration` byte-identical); no S2S (formats no remote-user wire fields).
- **P7p DONE: `s_bsd.c` `inetport` (listener socket constructor)** — ported the layer directly below the now-Rust `open_listener` (P7n): the real socket constructor `inetport` (s_bsd.c:210). Creates an `AF_INET6` (`AFINET`) stream socket, optionally `bind()`s it (`if (port)` → `in6addr_any` when ip is unset/non-numeric, else the Rust `inetpton` with the all-`0xff` `minus_one` fallback), applies its `static` callee `set_sock_opts`, fills `cptr` (`auth` = the ipmask canonicalized to `"a.b.c.d"` via `DupString`/`MyMalloc`; `sockhost` = `"<ip-or-ME>.<port>"` via `sprintf "%-.42s.%u"`; `ip` = the `getsockname` result; `port`), registers `local[fd] = cptr`, bumps `highest_fd`, and (when `dolisten`) `listen(fd, 128)`; returns 0, or -1 on a refused (`!ipmask`/bad ipmask) or failed (`socket`/`bind`/`getsockname`) open. `set_sock_opts` is `static` (no `cref_` oracle) → ported as a **private Rust twin** (config-resolved: SO_REUSEADDR=1, SO_RCVBUF/SO_SNDBUF/SO_SNDLOWAT=8192, `sizeof(int)` optlen; SO_DEBUG `&& 0` + SO_USELOOPBACK-undefined-on-Linux skipped); the C `static set_sock_opts` **stays compiled** for its other callers `check_server_init`/`connect_server`. Partial port via the existing `s_bsd_link.o` seam, new guard `-DPORT_S_BSD_INETPORT_P7p`; `report_error` + the variadic `sendto_flag` stay C, `local`/`highest_fd`/`me`/`minus_one`/`replies` read via bindgen externs. The `cptr == &me` inetd-on-fd-0 KLUDGE (writes `replies[RPL_MYPORTIS]` to fd 0) reproduced faithfully but never fires for a listener stub. L1 differential (`inetport_diff.rs`, 6 cases: normal port=0 listening (full compare — sockhost `irc.test.0`/auth `0.0.0.0`/port/socket-options/`local[fd]`/`highest_fd` bump), dolisten=0 not-listening (the listen inverse), NULL-ipmask + invalid-ipmask `256.0.0.0` refuse (return -1 before any socket, the error inverse), wildcard `in6addr_any` bind → `::` ip, `::1` `inetpton` bind → `::1` ip — the two bind cases serialized per world over one probed free port) zero-diff vs `cref_inetport`, isolated worlds (each opens its own socket → compares observable fd properties + world-independent struct fields, never the raw fd), serialized on `GLOBALS_LOCK`. No L2/no S2S (callee, hit at boot/rehash via `open_listener`; `golden_registration` byte-identical; formats no remote-user wire fields).
- **P7q DONE: `s_bsd.c` `report_error` (error-reporting output leaf)** — ported the genuine clean leaf left in the central I/O TU: `report_error` (s_bsd.c:151) calls **no** other `s_bsd.c` function, so it ports in isolation, and the linker now resolves its 27 internal call sites (every still‑C `report_error("…", cptr)` + the already‑Rust leaves that called it via `extern "C"`) to the Rust definition. Derives `host` via `get_client_name` (or `""` when `cptr==NULL`), refines `errtmp` from the socket's pending `SO_ERROR` (the getsockopt readout, mirroring P7d's `get_sockerr`), fires the `SCH_ERROR` local‑opers notice (`sendto_flag`), sends a NOTICE back through a half‑open (`Connecting`/`Handshake`) server link's **remote** `byuid` introducer (`find_uid`→`sendto_one`, the `:%s NOTICE %s :` + `text` `strcpy`/`strncat` construction), then echoes the formatted error to `stderr` while `serverbooting`. Config‑resolved: `SO_ERROR` defined (getsockopt compiles), `DEBUGMODE`/`USE_SYSLOG` off (no `Debug`/`syslog`). The variadic `sendto_flag`/`sendto_one`/`fprintf` are *called*, not defined — legal in stable Rust (the trampolines stay C until P8). Partial port via the existing `s_bsd_link.o` seam, new guard `-DPORT_S_BSD_REPORT_ERROR_P7q`; reads the still‑C `serverbooting`/glibc `stderr`, calls the Rust `get_client_name` (P5)/`find_uid` (P4). L1 differential (`report_error_diff.rs`, 4 cases: `serverbooting=1`+`cptr=NULL` formatted stderr echo, the `serverbooting=0` inverse gate → no output, `cptr` non‑NULL `host=get_client_name`, varied format/errno) captures fd 2 via a pipe redirect and asserts byte‑identical Rust‑vs‑`cref` stderr; serialized on `GLOBALS_LOCK` (sets `serverbooting`/`cref_serverbooting` + `errno` per case). No new L2 (output callee, not a `msgtab` handler — the `SCH_ERROR` error path is exercised by the existing golden suite; `golden_registration` byte‑identical); no S2S in L1. Untested‑by‑design: the `SO_ERROR` readout (needs a pending‑error socket; `fd<0` skips it identically), the `sendto_flag` wire emission (L2, variadic), the `bysptr` remote NOTICE (S2S — needs a connecting peer with a remote `byuid`).
- **P7r DONE: `s_bsd.c` `init_sys` (fd-table boot leaf)** — ported the cleanest remaining leaf in the central I/O TU: `init_sys` (s_bsd.c:693), called once from `ircd.c` `main` at boot. Config-resolved to a libc-only body: `RLIMIT_FD_MAX` is **not defined on Linux** → the whole `getrlimit`/`setrlimit` + `exit(-1)` rlimit block is excluded; `USE_POLL=1` → the sequent `setdtablesize` block is excluded; Linux → the `setlinebuf(stderr)` branch. So the only callees are libc (`setlinebuf`/`bzero`/`close`) and the only state is the already-exported `fdas`/`fdall`/`local` globals (no shared private static with still-C code — unlike `get_my_name`/`mysk`). Body: line-buffer stderr, `bzero` the two `fdarray`s + `highest=-1`, NULL `local[0..MAXCONNECTIONS=50]` while `close()`ing fds `3..50` (0/1/2 kept — stderr stays open until `daemonize`). Partial port via the existing `s_bsd_link.o` seam, new guard `-DPORT_S_BSD_INIT_SYS_P7r`; `fdas`/`fdall` via bindgen externs, `local[]` via the existing `local_base()` helper. RED confirmed the undefined symbol referenced by still-C `ircd.c:1010`; after GREEN `nm` shows `init_sys` `T` from Rust. L1 differential (`init_sys_diff.rs`, 3 cases: fresh-init zeroes arrays + NULLs local + inverse-of-dirty invariant, closes fds 3..N, keeps 0/1/2 open) zero-diff vs `cref_init_sys` — **fork-isolated** per world (the close loop is destructive to the test process's fds → each world runs in a forked child, results returned via `mmap(MAP_SHARED|MAP_ANONYMOUS)` which survives the close loop), serialized on `GLOBALS_LOCK`. No new L2 (boot callee, not a `msgtab` handler — the existing golden suite boots through it, `golden_registration` byte-identical); no S2S (formats no remote-user fields). Untested-by-design: `setlinebuf(stderr)` (unobservable); the rlimit/`exit` arms don't compile under the locked config.
- **P7s DONE: `s_bsd.c` `get_my_name` (server-own-hostname resolver) + de-static `mysk`** — ported the most leaf-like remaining `s_bsd.c` function after P7d–P7r: `get_my_name` (s_bsd.c:2940), which at boot resolves the server's canonical hostname into `me.name` (`gethostname` → `add_local_domain` → `gethostbyname(cname)||gethostbyname(name)` + the `h_aliases` walk, picking the `mycmp(ME)` match) and initialises the outgoing-bind source address `mysk` (`bzero` + `sin6_family=AF_INET6`/`sin6_port=0`, then the M-line `find_me()->passwd` via `inetpton` with the `minus_one` all-`0xff` fallback when it's a digit-led non-v6). Its only in-TU callee `add_local_domain` is already Rust (P7e); all other callees are libc or already-Rust (`find_me` P6, `inetpton`/`mycmp` P1, `minus_one`/`me` bindgen). The single blocker — the file-private `static struct SOCKADDR_IN mysk` (s_bsd.c:55) shared with the still-C `check_client` (localhost detect) / `connect_inet` (outgoing bind) — was broken by **de-static'ing `mysk`** (a behaviour-preserving storage-class change: single TU, no other `mysk`), which also makes the cref archive export `cref_mysk` (the `objcopy` prefix-rename only follows global symbols — the L1 static-symbol limit), giving the L1 test a full cross-world `mysk` compare. Config-resolved: `HAVE_GETIPNODEBYNAME` undef → plain `gethostbyname`; `DEBUGMODE` off; the `mysk.SIN_ADDR` write at s_bsd.c:3012 is dead `#if 0`. Partial port via the existing `s_bsd_link.o` seam, new guard `-DPORT_S_BSD_GET_MY_NAME_P7s`; `gethostbyname` declared via a local extern (absent from the libc crate). L1 differential (`get_my_name_diff.rs`, 6 cases: M-conf NULL-passwd addr-zero, non-digit-passwd addr-zero inverse, valid `2001:db8::1` → parsed addr, digit-but-invalid `9zz` → minus_one, resolvable `localhost` cname → gethostbyname+alias-loop, empty cname → BadPtr early return) zero-diff vs `cref_get_my_name` — both worlds call the same libc `gethostname`/`gethostbyname` (identical results in one run) + a shared `conf`/`cref_conf` M-conf, and the shared-but-isolated `me`/`cref_me` ME is pinned to `irc.test`; asserts the `name` output buffer + the full 28-byte `mysk`/`cref_mysk` agree, serialized on `GLOBALS_LOCK`. No L2/no S2S (boot callee, not a `msgtab` handler; the existing golden boot exercises it — `golden_registration` byte-identical; formats no remote-user wire fields). Untested-by-design: the resolved hostname is host-dependent (the test asserts the two worlds *agree*, not a fixed string); the `gethostname == -1` early return needs an induced failure (both worlds take the success path identically).
- **P7t DONE: `ircd.c` `calculate_preference` (AC preference leaf)** — ported `calculate_preference` (ircd.c:387, the auto-connect preference recompute called periodically from `io_loop`): walks the global `conf` list, fires the already-Rust `send_ping` (P7m) on every AC-able `connect{}` C-line (`CONF_CONNECT_SERVER|CONF_ZCONNECT_SERVER` + `port>0`), then derives `pref` from that conf's `aCPing` window stats (or the `-1` sentinel when `seq==0`/`recvd==0`). Partial-port via the existing `ircd_link.o` second-compile, new guard `-DPORT_IRCD_CALC_PREF_P7t` (the C body `#ifndef`-guarded with an `#else extern` prototype so the still-C `io_loop` caller keeps a declaration). Faithfulness: calls the **libc `pow` symbol** (not `f64::powf` — last-ULP drift would corrupt the `(u_int)(f*100.0)` truncation); final cast reproduces C `double→u_int→int pref`. L1 differential (5 cases: skips, recvd==0 sentinel, full-window compute, mixed list) zero-diff vs `cref_` (isolated `conf`/`cref_conf` worlds, serialized on `GLOBALS_LOCK`). L2 = existing golden boot stays byte-identical (locked config has no `connect{}` C-lines → loop body is a no-op); no S2S (utility, no remote-user wire fields). Note: the `cp==NULL` sentinel clause is dead defensive code — `send_ping` dereferences `cp->port` first.
- **P7u DONE: `s_auth.c` iauth `/STATS` reporters** (`report_iauth_conf`/`report_iauth_stats`) — opened the last P7 TU by porting its two cleanest leaves: list-walking reporters that emit `RPL_STATSIAUTH`/`RPL_STATSDEBUG` per `iauth_conf`/`iauth_stats` `LineItem` node via the variadic `sendto_one` (`report_iauth_conf` gated on `adfd >= 0`). De-static'd the two file-static list heads (the P7s `mysk` precedent) so the still-C `read_iauth` writer keeps them while the Rust readers reference them via extern; partial-ported via new `s_auth_link.o` (`-DPORT_S_AUTH_REPORT_P7u`). L1 sendQ-capture differential zero-diff (6 cases incl. adfd<0 + empty-list inverses); golden byte-identical (no iauth in golden → reporters are no-ops); no S2S (no remote-user fields).
- **P7v DONE: `s_auth.c` `set_clean_username` (last pure-logic leaf)** — ported `set_clean_username` (s_auth.c:44; derives `cptr->username` ≤USERLEN+NUL from the raw ident reply `cptr->auth`: dirty-prefix `-` on `[`/`@`/over-length/leading-`:`/embedded-whitespace, copy ≤USERLEN chars dropping `@`/`[`/whitespace, then free+redirect `auth` at the interior `username` buffer when equal else bump `istat.is_auth`/`is_authmem`) to `ircd-common/src/s_auth.rs`. De-static'd (behaviour-preserving — single TU) so `nm -g` emits `cref_set_clean_username` and the still-C callers (`read_iauth`/`start_auth`) resolve to the Rust def once the body is `#ifndef PORT_S_AUTH_CLEAN_USERNAME_P7v`-guarded out of `s_auth_link.o`. L1 differential (9 cases: free path clean-fits/exact-USERLEN/empty, istat path `@`/`[`/over-length/leading-`:`/interior-whitespace, inverses trailing-whitespace-not-dirty-but-unequal + NULL-auth early-return) zero-diff vs `cref_` on the full `username[11]` buffer + `is_auth`/`is_authmem` deltas + the `auth==&username` self-pointer predicate; serialized on `GLOBALS_LOCK` (shared `istat`). L1 is the gate (utility/callee TU, reached only from the still-C iauth/ident I/O the golden harness doesn't run); `golden_registration` stays byte-identical (no-regression); no S2S (no remote-user fields).

- **P7w DONE: `s_auth.c` ident-protocol I/O pair `send_authports`/`read_authports`** — ported the RFC1413 ident query/reply pair to `ircd-common/src/s_auth.rs` (the leaf relative to the still-C `start_auth` + the `s_bsd.c` event loop at `s_bsd.c:2363`/`2368`). `send_authports`: `getsockname`/`getpeername(fd)`→`"theirport , ourport\r\n"`→`write(authfd)`, with the `authsenderr` failure path (`ircstp->is_abad++`, close `authfd`, `highest_fd` walk past NULL `local[]`, `authfd=-1`, clear `FLAGS_AUTH|FLAGS_WRAUTH`); success clears only `FLAGS_WRAUTH`. `read_authports`: `read` buffered across partial reads via `cptr->count`, `sscanf` the `"%hd , %hd : USERID : %*[^:]: %512s"` grammar, set `auth` (`OTHER`→`-`-prefixed `MyMalloc`, else `mystrdup`) + `set_clean_username` (P7v sibling) + `FLAGS_GOTID`; no `\n`/`\r` yet → early return; bad/empty → `is_abad++`. Config-resolved (USE_SYSLOG/DEBUGMODE off → no syslog/`get_client_name`/`Debug`; AFINET=AF_INET6 → `sockaddr_in6`/`sin6_port`; BUFSIZE=512). `index`→`strchr`, `rindex`→`strrchr`, `MyFree`→`free`, `ntohs`→`u16::from_be`; `sscanf` driven through libc with the exact C format. Seam: `-DPORT_S_AUTH_AUTHPORTS_P7w` on `s_auth_link.o`; both already global in `s_auth_ext.h` → no de-static, the prototype comes from the header. **L1** (`authports_diff.rs`, 10 cases) zero-diff vs `cref_`: `send_authports` over a *real* IPv6-loopback connected socket (so `getsockname`/`getpeername` populate `sin6_port` — an AF_UNIX socketpair leaves the port bytes untouched, a false diff) + the error/`highest_fd`-walk paths; `read_authports` over socketpair read-ends covering valid/OTHER/bad/ERROR/partial-early-return/EOF + the pre-auth free + `istat` decrement. Serialized on `GLOBALS_LOCK`. No L2/no S2S (utility TU, no `msgtab` entry, no live ident peer in the golden harness, no remote-user fields); existing golden suite (`golden_registration`) stays byte-identical.
- **P7x DONE: `s_auth.c` ident initiator `start_auth`** — ported the RFC1413 query initiator (`-DPORT_S_AUTH_START_AUTH_P7x` on the `s_auth_link.o` recipe): opens the non-blocking `authfd` socket, derives local/peer addrs from `getpeername`/`getsockname(cptr->fd)`, optionally overrides the bind source from the P-line TLS `source_ip`, then either hands off to iauth (`adfd>=0`: build `"<fd> C <themip> <themport> <usip> <usport>"` via `inetntop`+`ipv6string`+libc `sprintf`, `sendto_iauth`; success → `close authfd`/`authfd=-1`/`FLAGS_XAUTH`/return) or `bind`/`connect`s to `[peer]:113` (arm `FLAGS_WRAUTH|FLAGS_AUTH`, bump `highest_fd`). Config-resolved: NO_IDENT off (full body), USE_IAUTH on (early-return + handoff), USE_SYSLOG/DEBUGMODE off (no syslog/Debug), AFINET=AF_INET6. Calls the Rust `set_non_blocking`/`report_error`/`inetntop`/`inetpton`; *calls* the variadic `sendto_iauth`/`sendto_flag` (stay C). L1 differential (3 cases: `XOPT_REQUIRED && adfd<0` early return; iauth-handoff query bytes byte-identical over a shared real IPv6-loopback `cptr->fd`; getpeername-failure `authfd`-reset) zero-diff vs `cref_`, serialized on `GLOBALS_LOCK`. Utility/callee TU (no `msgtab`) — L1 is the gate; golden suite stays byte-identical (`golden_registration` confirmed); no S2S (no `IsServer`/remote-field path).
- **P7y DONE: `s_auth.c` iauth-pipe line parser `read_iauth`** — ported the last non-variadic logic in s_auth.c (s_auth.c:174; the slave-auth pipe drain: persistent `obuf`/`olen` partial-line carry + per-opcode dispatch `>`/`G`/`O`/`V`/`a`/`A`/`s`/`S`/`U`/`u`/`o`/`D`/`K`/`k`/garbage) to `ircd-common/src/s_auth.rs`; guarded the C body out via `-DPORT_S_AUTH_READ_IAUTH_P7y` on the `s_auth_link.o` recipe (`#else extern` proto for the still-C callers); the file-scope globals `iauth_version`/`iauth_conf`/`iauth_stats`/`iauth_options`/`iauth_spawn` stay C-owned in s_auth_link.o, referenced via extern; the variadic `sendto_iauth`/`sendto_flag` are CALLED (stay C). L1 differential (10 cases: O-options incl. flagless-reset, V replace+free, A/a conf add+clear, s/S stats reset+append, U/u ident, U with istat-decrement via per-world `MyMalloc`/`cref_MyMalloc`, gone/mismatch/garbage negatives, obuf/olen partial-line carry round-trip) zero-diff vs `cref_`; serialized on `GLOBALS_LOCK`. **Finding:** the per-client prefix uses the ported `inetntop` which expands `::1`→`0:0:0:0:0:0:0:1` (a faithful support.c quirk), so the iauth line must carry the expanded IPv6 form. No L2/S2S (utility TU, no `msgtab` entry, no `IsServer`/remote-field formatting; reached only via a live iauth slave the golden harness doesn't run). **Only `sendto_iauth`/`vsendto_iauth` (variadic → P8) remain C in s_auth.c.**
=====DOCS LOG TAIL=====
  - **L2 / S2S.** No new L2: the only callers are unreachable under the golden harness's `-t -s` boot (no iauth slave, no ident peer); `golden_registration` stays byte-identical (no-regression). No S2S — the function formats no remote-user fields / has no `IsServer` branch.

- **2026-06-06 — P7w (`s_auth.c` ident-protocol I/O pair `send_authports`/`read_authports`) merged.** The RFC1413 ident query/reply pair — the leaf relative to the still-C `start_auth` + the `s_bsd.c` event loop (`s_bsd.c:2363`/`2368`, the `FLAGS_WRAUTH`/auth-readable arms). Ported to `ircd-common/src/s_auth.rs` alongside the P7u reporters + P7v `set_clean_username`.
  - **Cluster choice** — leaf-first: these are leaves relative to `start_auth` (which opens the ident connection) and the still-C select/poll loop. They share no file-`static` with the rest of `s_auth.c` (the `iauth_*` statics belong to `read_iauth`) → independent cluster. The remaining s_auth C = `read_iauth` (iauth-pipe parser), `start_auth` (connection setup), the variadic `sendto_iauth`/`vsendto_iauth`.
  - **Config-resolved body** — `USE_SYSLOG` undef → the get{sock,peer}name-error `syslog(...)` block (the only `get_client_name` call) drops to a bare `goto authsenderr`; `DEBUGMODE` undef → every `Debug((...))` a no-op (its `inet_ntop`/`ipv6string` arg never evaluated); `AFINET=AF_INET6` → `SOCKADDR_IN`=`sockaddr_in6`, `SIN_PORT`=`sin6_port`, `SOCKADDR`=`sockaddr`, `SOCK_LEN_TYPE`=`socklen_t`; `BUFSIZE=512` (`cptr->buffer` is `[char;512]`, `count` an `int`); flags `FLAGS_AUTH=0x200`/`FLAGS_WRAUTH=0x400`/`FLAGS_GOTID=0x1000`, `ClearAuth`=`flags&=~FLAGS_AUTH`.
  - **`send_authports`** — `getsockname`/`getpeername(fd)` (short-circuit `||` preserved), `sprintf`→Rust `format!("{} , {}\r\n", ntohs(them.sin6_port), ntohs(us.sin6_port))`, single `write(authfd)`. A short write or a get{sock,peer}name failure is `authsenderr`: `ircstp->is_abad++`, `close(authfd)`, walk `highest_fd` down while `local[highest_fd]` is NULL, `authfd=-1`, clear `FLAGS_AUTH|FLAGS_WRAUTH`. Success → clear only `FLAGS_WRAUTH`.
  - **`read_authports`** — `read(authfd, buffer+count, sizeof(buffer)-1-count)` (buffered across partial reads via `count`), then `libc::sscanf(buffer, "%hd , %hd : USERID : %*[^:]: %512s", &remp, &locp, ruser)` (driven through libc with the exact C format → bit-identical parse). On a match: extract `system` (the `: <type> :` field via `strrchr` + leading-`isspace` skip + `strncpyzt`) and `ruser` (copy non-space/non-`:` chars). No match but `len!=0` and a `\n`/`\r` present → clear `ruser`; no `\n`/`\r` yet → **early return** (keep reading). Then `close(authfd)` + `highest_fd` walk + `count=0` + `authfd=-1` + `ClearAuth`; `!locp||!remp||!*ruser` → `is_abad++`, else `is_asuc++`; free the old `auth` (+`istat` decrement) when it's not the interior `username` pointer, set `auth` (`OTHER`→`MyMalloc`+`'-'`+`strcpy`, else `mystrdup`), `set_clean_username`, `FLAGS_GOTID`.
  - **Seam** — `-DPORT_S_AUTH_AUTHPORTS_P7w` added to the `s_auth_link.o` second-compile; both bodies `#ifndef`-guarded out of `s_auth.c`. Both are already global in `s_auth_ext.h` (unlike the static `set_clean_username`), so the C callers' prototype comes from the header → **no de-static, no `#else` prototype** needed (the P7u `report_iauth_*` precedent). RED confirmed: `cargo build -p ircd-rs` → exactly `send_authports`/`read_authports` undefined (from `s_bsd.c:2363`/`2368`); GREEN: `nm target/debug/ircd` shows both as `T` (from Rust). `index`→`strchr`, `rindex`→`strrchr`, `MyFree`→`free`, `ntohs`→`u16::from_be`; globals `ircstp`/`highest_fd`/`local[]`/`istat` + `mystrdup`/`MyMalloc` are the ircd-common defs.
  - **Classification** — utility/callee TU (no `msgtab` entry); reached only from the still-C ident I/O path. **L1 is the gate.**
  - **L1** — `ircd-testkit/tests/authports_diff.rs`, 10 cases, zero-diff vs `cref_*`. Two independent heap `aClient`s + per-world `ircstp`(+backing `stats`)/`istat`/`highest_fd`/`local[]` (the `cref_*` twins), serialized on `GLOBALS_LOCK` (the P7 L1 shared-global convention). fd I/O over socketpairs. **`send_authports`**: both worlds' `fd` point at one *real* connected IPv6-loopback socket (`connected_inet6`) so `getsockname`/`getpeername` populate `sin6_port` identically — an AF_UNIX socketpair leaves the port bytes untouched, so C reads uninitialised stack while Rust reads its zeroed buffer (the one false diff this caught, fixed in the harness, not the port). Each world writes to its own `authfd` whose bytes are read back and compared. Cases: success (identical written bytes + `FLAGS_WRAUTH` cleared, `FLAGS_AUTH` untouched), getsockname-error (`fd=-1` → `is_abad++`, `authfd=-1`, flags cleared), and the `authfd==highest_fd` walk to a non-NULL `local[]` floor. **`read_authports`**: each world's `authfd` is a socketpair read-end fed an identical canned reply. Cases: valid `USERID`(→`is_asuc++`, username `bob`, free path), `OTHER`(→`-bob`), bad reply with `\n`(→`is_abad++`, no `GOTID`), `ERROR` reply, **partial read with no `\n`/`\r`**(→ early return: `authfd` still open, `count` advanced, no counter change — the inverse/round-trip case), EOF (`read`==0 → `is_abad++`), and a pre-existing heap `auth` (→ freed + `istat` decremented). Asserts byte/field identical `username[11]`, `auth` (string or the `auth==&username` predicate), `flags`, `count`, `authfd`, and the `is_asuc`/`is_abad` + `is_auth`/`is_authmem` deltas.
  - **L2 / S2S** — none. No `msgtab` entry; the ident path needs a live ident server the `ircd-golden` harness doesn't run (`-t -s`, `adfd<0`). Formats no remote-user wire fields, no `IsServer` branch → no S2S. Existing golden suite stays byte-identical (`golden_registration` re-run green as the no-regression check).

- **2026-06-06 — P7x (`s_auth.c` ident initiator `start_auth`) merged.** Ported `start_auth` (s_auth.c:544) to `ircd-common/src/s_auth.rs` — the function that initiates the RFC1413 (ident) query carried out by the P7w pair `send_authports`/`read_authports`.
  - **Cluster choice** — leaf-first: the last ident-protocol leaf in s_auth.c. Remaining C in s_auth.c after this = `read_iauth` (iauth-pipe parser) + the variadic `sendto_iauth`/`vsendto_iauth` (va_list → P8 trampolines).
  - **Guard** — `-DPORT_S_AUTH_START_AUTH_P7x` added to the existing `s_auth_link.o` recipe (alongside `_P7u`/`_P7v`/`_P7w`). The C body is `#ifndef`-guarded with an `#else` extern prototype so the still-C callers (`s_bsd.c:1272`/`1732` — `check_client`/`add_connection`) keep a declaration.
  - **Config-resolved body** — `NO_IDENT` undef → full body (not the empty stub); `USE_IAUTH` on → the `(iauth_options & XOPT_REQUIRED) && adfd<0` early-return + the `adfd>=0` iauth-handoff `abuf` block; `USE_SYSLOG` undef → the `socket()`-failure `syslog` collapses to a bare `ircstp->is_abad++`; `DEBUGMODE` undef → every `Debug((...))` no-op; `AFINET=AF_INET6` → `SOCKADDR_IN`=`sockaddr_in6`, `SIN_FAMILY`/`SIN_PORT`=`sin6_family`/`sin6_port`, `SOCK_LEN_TYPE`=`socklen_t`.
  - **Faithfulness** — `ntohs`→`u16::from_be`, `htons`→`u16::to_be`; the iauth query is built with libc `sprintf` through the exact `"%d C %s %u "`/`"%s %u"` formats + the global `ipv6string` scratch the C reused (sequenced them→us, byte-for-byte); `IsConfTLS(x)`=`x->flags & PFLAG_TLS`, `BadPtr(x)`=`!x||*x=='\0'`. The Rust ports `set_non_blocking` (P7d)/`report_error` (P7q)/`inetntop`/`inetpton` (P1) resolve through the link seam; the variadic `sendto_iauth`/`sendto_flag` are *called* via a local `extern "C"` block. `errno` via `*libc::__errno_location()` compared to `EINPROGRESS`.
  - **Classification** — utility/callee TU (no `msgtab` entry); reached only from the still-C connection path (`add_connection`→`check_client`→`start_auth`), which needs a live ident peer the `ircd-golden` harness doesn't run.
  - **L1** — `ircd-testkit/tests/start_auth_diff.rs`, 3 cases, zero-diff vs `cref_start_auth`, serialized on `GLOBALS_LOCK` (P7 shared-global convention), per-world `adfd`/`iauth_options`/`ircstp`/`highest_fd`: (1) `XOPT_REQUIRED && adfd<0` early return (authfd/flags untouched); (2) iauth handoff — `adfd`=socketpair write-end (write succeeds → `sendto_iauth` returns 0), `cptr->fd`=a shared *real* connected IPv6-loopback socket so both worlds' getpeername/getsockname read identical addrs/ports → the query bytes written to `adfd` are byte-identical, `authfd` closed, `FLAGS_XAUTH` set; (3) getpeername failure on an unconnected socket → `report_error` + `authfd=-1` (compares cptr state only; the client needs a real `name`+`STAT_CLIENT` since fd>=0 → `get_client_name` takes the MyConnect/showip branch). Not covered (noted in the test header): the `MAXCONNECTIONS-2` fd-exhaustion guard (can't force a high fd) and the bind/connect-to-113 network tail.
  - **L2 / S2S** — no new test. Utility TU with no client/golden path under the locked config (no ident peer); L1 is the gate. Existing golden suite stays byte-identical (`golden_registration` green). No S2S — no `IsServer` branch, formats no remote-user fields.
  - **Observation (out of scope, pre-existing P5)** — case 3 surfaced a `get_client_name(showip=TRUE)` divergence on a NULL `auth` pointer: the Rust port emits `tester[@]` where glibc `sprintf("%.*s", N, NULL)` emits `tester[(null)@]`. Only observable via `report_error`'s stderr (not asserted here); a latent faithfulness gap in the P5 `get_client_name` port, not P7x.

- **2026-06-06 — P7y (`s_auth.c` iauth-pipe line parser `read_iauth`) merged.**
  - **Cluster choice** — `read_iauth` (s_auth.c:174), the last non-variadic logic in s_auth.c (per [[p7-started]]). Leaf-first relative to the still-C `s_bsd.c` select/poll loop that calls it when `adfd` is readable. After this, the only C left in s_auth.c is the variadic `sendto_iauth`/`vsendto_iauth` trampolines (→ P8).
  - **Guard** — `-DPORT_S_AUTH_READ_IAUTH_P7y` added to the existing `s_auth_link.o` recipe in `ircd-sys/build.rs` (alongside `_P7u/_P7v/_P7w/_P7x`); the C body is `#ifndef`-guarded with an `#else void read_iauth(void);` prototype so the still-C callers (the event loop) keep a declaration. The cref oracle keeps the full unguarded `s_auth.o` → `cref_read_iauth` + the `cref_iauth_*` globals survive for L1.
  - **Config-resolved body** — USE_IAUTH ON (whole body live); AFINET=AF_INET6 → the per-client prefix formats `inetntop(AF_INET6, &cptr->ip, ipv6string, sizeof)`; DEBUGMODE off. No `#ifdef` inside the function. `index`→`strchr`, `bcopy(a,b,c)`→`memmove(b,a,c)` (os.h:384), `MyFree`→ libc `free`; `MyMalloc`/`mystrdup` are the ircd-common allocators. Function-`static` carry state (`obuf`/`last`/`olen`/`ia_dbg`) → private module `static mut` (the `debugbuf` precedent). File-scope globals `iauth_version` (de-static'd-by-default, not in any header → declared extern in the module), `iauth_conf`/`iauth_stats` (P7u de-static'd), `iauth_options`/`iauth_spawn` (bindgen) stay C-owned in s_auth_link.o.
  - **Classification** — utility/callee TU, no `msgtab` entry; called from the still-C event loop when a live iauth slave writes the pipe. **L1 is the gate.** No L2/S2S: the golden harness runs `-t -s` with `adfd<0` (no iauth slave), so the path is unreached there; no `IsServer` branch, formats no remote-user wire fields. Existing golden suite stays byte-identical (`golden_registration` 2/2 confirmed, no-regression).
  - **L1** — `ircd-testkit/tests/read_iauth_diff.rs`, 10 cases, zero-diff vs `cref_`, serialized on `GLOBALS_LOCK`. Drives `read_iauth`/`cref_read_iauth` on independent per-world copies of every touched global (`adfd`/`iauth_options`/`iauth_spawn`/`iauth_version`/`iauth_conf`/`iauth_stats`/`istat`/`me`/`local[]`/`timeofday`); each world's `adfd` is the read end of its own non-blocking socketpair fed the identical protocol bytes; `timeofday`/`iauth_spawn` pinned so the `s`-header `myctime`/spawn line is byte-identical. Cases: O-options (incl. flagless reset), V replace+free, A/a conf add+clear (inverse pair), s/S stats reset+append (inverse pair), U/u per-client ident (fresh `auth==username` self-pointer → no-free path), U-with-pre-existing-heap-`auth` (istat-decrement + free, allocated through each world's own `MyMalloc`/`cref_MyMalloc` to avoid crossing allocator twins), gone-client / port-mismatch / garbage negatives (client untouched), and the obuf/olen partial-line carry round-trip (split feed == one-shot).
  - **Finding** — the per-client prefix check formats the client IP through the ported `inetntop`, which expands `::1`→`0:0:0:0:0:0:0:1` (a faithful quirk of `support.c`'s `::`-expander). In production the iauth daemon echoes the same expanded form (start_auth builds the query with the same `inetntop`), so the prefix matches; the L1 input lines must carry the expanded IPv6 form, not `::1`. Initial test used `::1` → both worlds correctly took the mismatch branch (differential green, expectation wrong) — surfaced the quirk.
  - **Not covered (noted)** — the recv-error "lost slave" branch (`close(adfd)`+`start_iauth`) and the `D`/`K`/`k` finish/kill paths (`register_user`/`exit_client`, need a fully-registered client + the event loop) — deterministic only at L2/soak with a live iauth.
