  - **Config-resolved body** — `NO_IDENT` undef → full body (not the empty stub); `USE_IAUTH` on → the `(iauth_options & XOPT_REQUIRED) && adfd<0` early-return + the `adfd>=0` iauth-handoff `abuf` block; `USE_SYSLOG` undef → the `socket()`-failure `syslog` collapses to a bare `ircstp->is_abad++`; `DEBUGMODE` undef → every `Debug((...))` no-op; `AFINET=AF_INET6` → `SOCKADDR_IN`=`sockaddr_in6`, `SIN_FAMILY`/`SIN_PORT`=`sin6_family`/`sin6_port`, `SOCK_LEN_TYPE`=`socklen_t`.
  - **Faithfulness** — `ntohs`→`u16::from_be`, `htons`→`u16::to_be`; the iauth query is built with libc `sprintf` through the exact `"%d C %s %u "`/`"%s %u"` formats + the global `ipv6string` scratch the C reused (sequenced them→us, byte-for-byte); `IsConfTLS(x)`=`x->flags & PFLAG_TLS`, `BadPtr(x)`=`!x||*x=='\0'`. The Rust ports `set_non_blocking` (P7d)/`report_error` (P7q)/`inetntop`/`inetpton` (P1) resolve through the link seam; the variadic `sendto_iauth`/`sendto_flag` are *called* via a local `extern "C"` block. `errno` via `*libc::__errno_location()` compared to `EINPROGRESS`.
  - **Classification** — utility/callee TU (no `msgtab` entry); reached only from the still-C connection path (`add_connection`→`check_client`→`start_auth`), which needs a live ident peer the `ircd-golden` harness doesn't run.
  - **L1** — `ircd-testkit/tests/start_auth_diff.rs`, 3 cases, zero-diff vs `cref_start_auth`, serialized on `GLOBALS_LOCK` (P7 shared-global convention), per-world `adfd`/`iauth_options`/`ircstp`/`highest_fd`: (1) `XOPT_REQUIRED && adfd<0` early return (authfd/flags untouched); (2) iauth handoff — `adfd`=socketpair write-end (write succeeds → `sendto_iauth` returns 0), `cptr->fd`=a shared *real* connected IPv6-loopback socket so both worlds' getpeername/getsockname read identical addrs/ports → the query bytes written to `adfd` are byte-identical, `authfd` closed, `FLAGS_XAUTH` set; (3) getpeername failure on an unconnected socket → `report_error` + `authfd=-1` (compares cptr state only; the client needs a real `name`+`STAT_CLIENT` since fd>=0 → `get_client_name` takes the MyConnect/showip branch). Not covered (noted in the test header): the `MAXCONNECTIONS-2` fd-exhaustion guard (can't force a high fd) and the bind/connect-to-113 network tail.
  - **L2 / S2S** — no new test. Utility TU with no client/golden path under the locked config (no ident peer); L1 is the gate. Existing golden suite stays byte-identical (`golden_registration` green). No S2S — no `IsServer` branch, formats no remote-user fields.
  - **Observation (out of scope, pre-existing P5)** — case 3 surfaced a `get_client_name(showip=TRUE)` divergence on a NULL `auth` pointer: the Rust port emits `tester[@]` where glibc `sprintf("%.*s", N, NULL)` emits `tester[(null)@]`. Only observable via `report_error`'s stderr (not asserted here); a latent faithfulness gap in the P5 `get_client_name` port, not P7x.

- **2026-06-06 — P7y (`s_auth.c` iauth-pipe line parser `read_iauth`) merged.**
  - **Cluster choice** — `read_iauth` (s_auth.c:174), the last non-variadic logic in s_auth.c (per [[p7-started]]). Leaf-first relative to the still-C `s_bsd.c` select/poll loop that calls it when `adfd` is readable. After this, the only C left in s_auth.c is the variadic `sendto_iauth`/`vsendto_iauth` trampolines (→ P8).
  - **Guard** — `-DPORT_S_AUTH_READ_IAUTH_P7y` added to the existing `s_auth_link.o` recipe in `ircd-sys/build.rs` (alongside `_P7u/_P7v/_P7w/_P7x`); the C body is `#ifndef`-guarded with an `#else void read_iauth(void);` prototype so the still-C callers (the event loop) keep a declaration. The cref oracle keeps the full unguarded `s_auth.o` → `cref_read_iauth` + the `cref_iauth_*` globals survive for L1.
  - **Config-resolved body** — USE_IAUTH ON (whole body live); AFINET=AF_INET6 → the per-client prefix formats `inetntop(AF_INET6, &cptr->ip, ipv6string, sizeof)`; DEBUGMODE off. No `#ifdef` inside the function. `index`→`strchr`, `bcopy(a,b,c)`→`memmove(b,a,c)` (os.h:384), `MyFree`→ libc `free`; `MyMalloc`/`mystrdup` are the ircd-common allocators. Function-`static` carry state (`obuf`/`last`/`olen`/`ia_dbg`) → private module `static mut` (the `debugbuf` precedent). File-scope globals `iauth_version` (de-static'd-by-default, not in any header → declared extern in the module), `iauth_conf`/`iauth_stats` (P7u de-static'd), `iauth_options`/`iauth_spawn` (bindgen) stay C-owned in s_auth_link.o.
  - **Classification** — utility/callee TU, no `msgtab` entry; called from the still-C event loop when a live iauth slave writes the pipe. **L1 is the gate.** No L2/S2S: the golden harness runs `-t -s` with `adfd<0` (no iauth slave), so the path is unreached there; no `IsServer` branch, formats no remote-user wire fields. Existing golden suite stays byte-identical (`golden_registration` 2/2 confirmed, no-regression).
  - **L1** — `ircd-testkit/tests/read_iauth_diff.rs`, 10 cases, zero-diff vs `cref_`, serialized on `GLOBALS_LOCK`. Drives `read_iauth`/`cref_read_iauth` on independent per-world copies of every touched global (`adfd`/`iauth_options`/`iauth_spawn`/`iauth_version`/`iauth_conf`/`iauth_stats`/`istat`/`me`/`local[]`/`timeofday`); each world's `adfd` is the read end of its own non-blocking socketpair fed the identical protocol bytes; `timeofday`/`iauth_spawn` pinned so the `s`-header `myctime`/spawn line is byte-identical. Cases: O-options (incl. flagless reset), V replace+free, A/a conf add+clear (inverse pair), s/S stats reset+append (inverse pair), U/u per-client ident (fresh `auth==username` self-pointer → no-free path), U-with-pre-existing-heap-`auth` (istat-decrement + free, allocated through each world's own `MyMalloc`/`cref_MyMalloc` to avoid crossing allocator twins), gone-client / port-mismatch / garbage negatives (client untouched), and the obuf/olen partial-line carry round-trip (split feed == one-shot).
  - **Finding** — the per-client prefix check formats the client IP through the ported `inetntop`, which expands `::1`→`0:0:0:0:0:0:0:1` (a faithful quirk of `support.c`'s `::`-expander). In production the iauth daemon echoes the same expanded form (start_auth builds the query with the same `inetntop`), so the prefix matches; the L1 input lines must carry the expanded IPv6 form, not `::1`. Initial test used `::1` → both worlds correctly took the mismatch branch (differential green, expectation wrong) — surfaced the quirk.
  - **Not covered (noted)** — the recv-error "lost slave" branch (`close(adfd)`+`start_iauth`) and the `D`/`K`/`k` finish/kill paths (`register_user`/`exit_client`, need a fully-registered client + the event loop) — deterministic only at L2/soak with a live iauth.

- **2026-06-06 — P7z (`s_bsd.c` `check_client`) merged.** Ported the ordinary-client access check `check_client` (s_bsd.c:909) to `ircd-common/src/s_bsd.rs`; guard `-DPORT_S_BSD_CHECK_CLIENT_P7z` on the `s_bsd_link.o` recipe.
  - **Cluster choice** — `check_client` is a callee of the Rust `register_user` (s_user.c:557), reached when a connecting client finishes registration. It resolves the socket peer address, validates the DNS host↔ip mapping, and attaches the matching I:line. The file-`static` helper `check_init` (s_bsd.c:868) is shared with the still-C `check_server_init` (s_bsd.c:1083), so it is NOT dropped: ported as a **private Rust twin** while the C `static check_init` stays compiled. After `check_client` was `#ifdef`'d out, `check_init` has exactly one remaining caller (`check_server_init`) → GCC inlines it and drops the symbol; the build resolves cleanly. This is the P7p `set_sock_opts` precedent (a `static` callee ported as a private twin while the C `static` survives for its other caller).
  - **Config-resolved body** — `NO_OPER_REMOTE` **undef** → the trailing `FLAGS_LOCAL`/`is_loc` block (s_bsd.c:961–975) is not compiled, so `check_client` ends at `attach_Iline` and makes **no `mysk` use** (unlike `check_server_init`/`connect_server`). `UNIXPORT` undef → no `IsUnixSocket` branch in either fn; `hp = cptr->hostp` unconditionally. `DEBUGMODE` off → all `Debug(...)` no-ops. `AFINET=AF_INET6` → `sockaddr_in6`/`sin6_addr`/`sin6_port`/`in6_addr`.
  - **Faithfulness notes** — `check_init` does `getpeername(cptr->fd)` (isatty branch kept for the inetd-on-tty case → `me.sockhost`), `inetntop` into the caller's `sockname`, `bcopy` the 16-byte addr into `cptr->ip`, `cptr->port = ntohs(sin6_port)`. The IP# Mismatch arm reads **four `c_ulong`s** from `hp->h_addr` (a 16-byte addr — a latent C over-read; `%08x` truncates each to 32 bits) and writes the `inetntop` result into the real global `ipv6string` (matching the C side effect). `attach_Iline` (P6) / `inetntop` / `report_error` (P7q) are Rust; the variadic `sendto_flag` is *called* (→ P8).
  - **Classification / L1** — callee TU (no `msgtab` entry). `cref_check_client` is exported → full cross-world L1 differential (`ircd-testkit/tests/check_client_diff.rs`, 4 cases). Both worlds get **separate** aClients (check_client mutates `ip`/`port`/`hostp` + attaches confs) but **share one** real connected IPv6-loopback fd so `getpeername` is byte-identical; `conf`/`cref_conf` both empty → `attach_Iline` returns `-2 EXITC_NOILINE` (the loop never runs) — deterministic, no fixture. Cases: (1) no hostp/empty conf → ip/port filled, hostp stays NULL, -2; (2) hostp addr matches `::1` peer → hostp kept; (3 inverse) hostp addr mismatches → IP# Mismatch → hostp cleared to NULL; (4) unconnected socket → getpeername fails → check_init → report_error → -1. Asserts return + `ip`/`port`/`hostp`-nullness agree. Serialized on a `GLOBALS_LOCK` (`conf`/`ipv6string`/`me` are process globals; see the p7-l1-shared-global-race memory). Fixture finding: the getpeername-failure path → report_error → get_client_name → `mycmp(name, sockhost)` derefs `cptr->name`, so the harness client must set a non-NULL `name` (the real `make_client` sets `name = namebuf`).
  - **L2 / S2S** — L2 = existing `ircd-golden` `golden_registration` byte-identical; it drives a real client through registration with a real I:line, exercising the **success** path (return 0) that L1's empty-conf cases don't. No S2S: `check_client` has no `IsServer(cptr)` branch and formats no remote-user fields (servers go through `check_server_init`/`check_server`).

- **2026-06-06 — P7aa (`s_bsd.c` `check_server_init` + `check_server`) merged.** The server-side access-check cluster — the sibling of the P7z `check_client`, reached from the Rust `m_server`/`completed_connection` on a server link.
  - **Cluster choice** — `check_server_init` (s_bsd.c:992) is the entry point; it tail-calls `check_server` (s_bsd.c:1076), so the two form one connected component over the C/N-line lookup. Ported together under one guard `-DPORT_S_BSD_CHECK_SERVER_P7aa`.
  - **Guard / check_init** — both functions `#ifndef`'d out of `s_bsd_link.o`. The file-`static` `check_init` (s_bsd.c:868, ported as a private Rust twin in P7z) had its two callers `check_client` (P7z) and `check_server` (P7aa); with both now ported, the C `static check_init` + its forward prototype (s_bsd.c:64) lose their last C caller, so they are guarded out under the same `PORT_S_BSD_CHECK_SERVER_P7aa` symbol (no unused-static warning). The Rust port reuses the existing P7z `check_init` twin.
  - **Config-resolved body** — `UNIXPORT` undef → every `IsUnixSocket`/`#ifdef UNIXPORT` branch dropped (the `get_sockhost` unix guards collapse to always-run; no `IsUnixSocket(cptr)` in the addr-validation or conf scan); `DEBUGMODE` off → all `Debug(...)` no-ops; `AFINET=AF_INET6`. `CFLAG`/`NFLAG`/`SCH_DEBUG` added as module consts.
  - **Faithfulness** — the `check_serverback` goto becomes a `loop` (validate `hp` then `break`; the goto fires only in the `else if (cptr->hostp)` re-entry); the alias walk `for(i=0,name=h_name; name; name=h_aliases[i++])` becomes a `while !name.is_null()` reading `h_aliases[i]` then `i+=1`; the `IP# Mismatch` arm reads four `c_ulong`s from `hp->h_addr` (the same faithful over-read as `check_client`); the async-DNS stack `Link` is built via `std::mem::zeroed()` + `lin.value.aconf`/`lin.flags = ASYNC_CONF`; `AND16(c_conf->ipnum)==255` (unresolved sentinel) reuses the `send_ping` fold and copies `cptr->ip` into the conf's ipnum (dynamic-ip C-line rewrite). `index`→`libc::strchr`; `sprintf("%s@%s")` via a local variadic extern.
  - **Callees** — `attach_confs`/`find_conf`/`find_conf_host`/`find_conf_ip`/`attach_conf`/`det_confs_butmask`/`count_cnlines` (P6 s_conf), `get_sockhost` (P5 s_misc), `gethost_byname` (P6 res), `add_local_domain` (P7e), `inetntop`/`strncpyzt` (P1/local) all Rust; `sendto_flag` is *called* (variadic → P8). `nextdnscheck` global write via bindgen extern.
  - **Classification** — utility/callee TU (no `msgtab` entry). L1 is the differential gate; the C+N **success** path (return 0, attach, `get_sockhost`) is exercised by the existing L2-S2S golden suite, not a new L2 file.
  - **L1** — `ircd-testkit/tests/check_server_diff.rs`, 6 cases zero-diff vs `cref_`: `check_server_init` with `IsUnknown` + empty conf → `attach_confs` NULL → -1 (before `check_server`); `IsHandshake`, NULL confs → `find_conf` NULL → `sendto_flag`+`det_confs_butmask` → -1; `check_server` unconnected fd → `check_init` `getpeername` fails → -2; connected ::1 fd no-hostp / hostp-addr-match / hostp-addr-mismatch → all `find_conf_*` miss → -1, asserting post-state `ip`/`port`/`sockhost` agree. Separate aClients per world (the fns mutate `ip`/`port`/`sockhost`/`confs`), one shared real ::1-loopback fd so `getpeername` is byte-identical; serialized on `GLOBALS_LOCK` (`conf`/`me`/`ipv6string`/`nextdnscheck` are process globals; the [[p7-l1-shared-global-race]] memory). hostents use a dotted `h_name` so `add_local_domain` is a no-op (no resolver/env dependency), with each addr padded to 32 bytes for the mismatch over-read.
  - **S2S** — no new file: `golden_s2s_link`/`_eob`/`_who` (and the rest of the S2S suite) link a real `Peer` that the Rust ircd accepts through `check_server_init`/`check_server` (`s2s.conf` carries the C/N lines), so a regression in the success/attach path fails the burst diff. All ran green; `golden_registration` (local client) also green.

- **2026-06-06 — P7bb (`s_bsd.c` `add_connection` + `check_clones`) merged.**
  - **Cluster choice** — the inbound-connection acceptor `add_connection` (s_bsd.c:1638), the next leaf bottom-up after the P7d–P7aa socket/teardown/listener/access-check leaves: it is called from the still-C `read_listener` for each fd `accept()`ed off a listener. Its only caller-private callee `check_clones` (s_bsd.c:1572, `CLONE_CHECK`) is ported alongside it.
  - **Guard** — `-DPORT_S_BSD_ADD_CONN_P7bb` wraps two regions under one macro: `check_clones` (inside the surrounding `#ifdef CLONE_CHECK`) and `add_connection`. The P7k `add_connection_refuse` sitting between them keeps its own guard. `add_unixconnection` (`#ifdef UNIXPORT`) is not compiled.
  - **`check_clones` as a private twin** — `static` in C → no `cref_` symbol → cannot be L1-diffed directly; ported as a module-private Rust `fn` with a `static mut BACKLOG` matching the C function-local `struct abacklog` list (age out `pt+CLONE_PERIOD<timeofday`, prepend `{ip,now}`, count same-ip nodes). `MyMalloc` (P2) / libc `free` (the `MyFree` macro). Observed only through `add_connection`'s clone-reject path. The P7p `set_sock_opts` / P7z `check_init` precedent.
  - **Config-resolved body** — `NO_DNS_LOOKUP` set (build.rs `EXTRA_CFLAGS`): the `else` arm just sets `acptr->hostp = NULL`, and the `USE_IAUTH && !NO_DNS_LOOKUP` alias-forwarding block (`%d A`/`%d N` to iauth) is compiled out. `CLONE_CHECK` on (CLONE_MAX=10, CLONE_PERIOD=2) → the clone branch compiles; `DELAY_CLOSE`=15 → clone reject uses `nextdelayclose = delay_close(fd)` then `add_connection_refuse(fd,acptr,1)`. `UNIXPORT` undef, `AFINET=AF_INET6` (`sin6_*`, 16-byte `in6_addr`), `linux` → the getpeername-fail arm guards `report_error` behind `errno != ENOTCONN`.
  - **Callees** — `make_client`/`add_client_to_list`/`add_fd` (P2), `inetntop` (P1), `report_error` (P7q), `add_connection_refuse` (P7k), `delay_close` (P7f), `set_non_blocking` (P7d), `set_sock_opts` (P7p private twin), `start_auth` (P7x) all Rust; `get_sockhost`/`get_client_host`/`sendto_flog` stay C (non-variadic bindgen externs); `sendto_flag` is *called* (variadic, → P8). `local`/`highest_fd`/`fdall`/`nextdelayclose`/`ipv6string`/`timeofday` are bindgen statics.
  - **Classification** — utility/callee TU (not a `msgtab` handler): reached from `read_listener`. Universally exercised by L2.
  - **L1** — `ircd-testkit/tests/add_connection_diff.rs`, 3 tests, zero-diff vs `cref_`. `start_auth` neutralized in both worlds by `iauth_options=XOPT_REQUIRED`+`adfd=-1` (its top early-return) so its socket side effects drop out of the diff. `normal_accept_then_clone_flood` (case 1 + 4 merged so the process-`static` backlog starts pristine): first accept over a SHARED connected ::1 fd → compare full surviving post-state (return non-null, `ip`=::1, `port`, `sockhost`, `fd`, `acpt`, `hostp`=NULL, `local[fd]`, `highest_fd`, `aconf->clients`=1); then per world calls #2..#10 succeed and the 11th (count=11>CLONE_MAX) is clone-refused (exercising the backlog twin). `getpeername_failure_refuses` + `illegal_conf_refuses`: the two refuse inverses (NULL + `ircstp->is_ref`+1 + `clients` untouched + fd closed; own fd per world since the path closes it). Serialized on `GLOBALS_LOCK` (`local`/`highest_fd`/`fdall`/`ipv6string`/`timeofday`/`ircstp`/`iauth_options`/`adfd`/the backlog are process globals; the p7-l1-shared-global-race hazard).
  - **L2** — no new test. `add_connection` is the universal inbound acceptor — every `ircd-golden` client connection already flows through it; `golden_registration` (success path) byte-identical, `golden_s2s_link` green (incoming server links also go through it before `m_server`/`check_server_init`).
  - **S2S** — none. `add_connection` formats no remote-user fields and has no `IsServer(cptr)` branch (the client has no name/type yet).

- **2026-06-06 — P7cc (`s_bsd.c` `connect_server` + static `connect_inet`) merged.** The outbound server-connection setup (s_bsd.c:2511) — the counterpart of the inbound `add_connection` (P7bb). Ported to `ircd-common/src/s_bsd.rs`; guard `-DPORT_S_BSD_CONNECT_SERVER_P7cc` on the `s_bsd_link.o` recipe. `connect_server` now resolves from Rust; the still-C `do_dns_async`/`try_connections` and the Rust `m_connect` call it via the `s_bsd_ext.h` prototype.
  - **Cluster choice** — the next leaf bottom-up after the P7d–P7bb socket/teardown/listener/access-check leaves. `connect_server`'s only caller-private callee is the file-`static` `connect_inet` (s_bsd.c:2674), ported alongside as a private Rust twin (no `cref_` oracle for a `static`).
  - **`set_sock_opts` lifecycle** — ported as a private Rust twin back in P7p, while the C `static` was kept for its remaining compiled caller. Survey: 268 (`inetport`, P7p — guarded out), 1731 (`add_connection`, P7bb — guarded out), 1802 (`add_unixconnection`, UNIXPORT off — not compiled), 2595 (`connect_server` — the last one). With `connect_server` ported, the C `static set_sock_opts` + its forward proto (s_bsd.c:69) have zero compiled callers → both guarded out under `PORT_S_BSD_CONNECT_SERVER_P7cc` (the P7aa `check_init` precedent); the Rust port uses the existing P7p twin.
  - **Config-resolved body** — `UNIXPORT` undef → `connect_unix` not compiled, the `*aconf->host == '/'` branch drops → always `connect_inet`; `AFINET = AF_INET6` → `sockaddr_in6`/`sin6_*`/16-byte `in6_addr`; `DEBUGMODE` off → all `Debug(...)` no-ops (the leading `inet_ntop` into `ipv6string` is inside `Debug(...)` → not evaluated). `mysk` (P7s de-static'd) is the outbound-bind source; `minus_one` the all-`0xff` sentinel.
  - **FINDING (faithful)** — `connect_server`'s DNS-resolution block (s_bsd.c:2538-2558, guarded by `if (!aconf->ipnum.S_ADDR && *aconf->host != '/')`) is **dead code** under AF_INET6. `S_ADDR` = `s6_addr`, an embedded array; `!aconf->ipnum.s6_addr` is the address of that array → always non-NULL → always false. The block never runs (the same `!ipnum.s6_addr` array-address quirk noted in `send_ping`/P7m); `hp` is used directly. Omitted in the port with a comment.
  - **Faithfulness** — the `free_server:` goto becomes a `connect_server_free(cptr)` helper returning -1; `SetConnecting` = `status = STAT_CONNECTING (-4)`; `connect_inet`'s `static struct SOCKADDR server` is a module `static mut MaybeUninit<sockaddr_in6>` (bzero'd every call, the C `static` semantics); the dup-IP scan compares network-order `server.sin6_port` to the host-order `acptr->port` (a faithful C quirk); `index`→`strchr`(unused — DNS block dead), `htons`→`u16::to_be`. `dummy` (P7a) is the `SIGALRM` handler.
  - **Callees** — `find_server` (P4), `make_client`/`make_server`/`free_client`/`free_server`/`add_fd`/`add_client_to_list` (P2), `attach_confs_host`/`find_conf_host`/`det_confs_butmask` (P6), `get_sockhost`/`get_client_name` (P5), `set_non_blocking` (P7d), `set_sock_opts` (P7p twin), `inetpton` (P1) all Rust; the variadic `sendto_flag`/`sendto_one` are *called* (→ P8). `mysk`/`minus_one`/`portnum`/`highest_fd`/`local`/`fdall`/`nextping`/`timeofday`/`istat`/`me` are bindgen statics.
  - **Classification / L1** — utility/callee TU (not a `msgtab` handler; reached from `m_connect`/`try_connections`/`do_dns_async`). `cref_connect_server` exported → cross-world differential (`ircd-testkit/tests/connect_server_diff.rs`, 3 cases zero-diff). The success path does a live `socket`/`bind`/`connect` to a configured peer → not deterministic at L1. Cases: (1) `server_already_present` — `find_server` hit → `SCH_NOTICE` + return -1 before any `make_client`/socket work (`by`=NULL); (2) `server_already_present_remote_by` — remote `IsPerson` `by` (fd<0 → `!MyClient`) so the extra `sendto_one(by,...)` arm fires; (3 inverse/cleanup) `connect_inet_failure_refused` — empty hash → `make_client`/`make_server` → `connect_inet` `socket`+`bind`(unconfigured zeroed `mysk` → AF_UNSPEC) fails → `return NULL` → `free_server` cleanup → -1; asserts `highest_fd` unchanged + the hash left clean. Per-world `inithashtables()` (else `hashtab` is NULL → segv); serialized on `GLOBALS_LOCK` (the [[p7-l1-shared-global-race]] hazard). Findings: `hash_find_server`'s suffix-mask search overwrites `'.'`→`'*'` in-place → the conf/lookup strings must be writable heap (not `c"…"` literals); a remote `by` needs `acpt` set (self) or `send_message` null-derefs `(*to).acpt`.
  - **L2 / S2S** — no new file. The existing `ircd-golden`/`boot_s2s` harness dials **into** the ircd (`TcpStream::connect` = inbound `add_connection`), so it does not exercise `connect_server`'s outbound dial; deferred to the event-loop/CONNECT L2 (the `read_message` cluster). Regression check: `golden_registration` + `golden_s2s_link` byte-identical (the port doesn't touch inbound paths). No remote-user field formatting → no S2S-specific path.

- **2026-06-06 — P7dd (`s_bsd.c` `start_iauth`) merged.** The iauth subprocess (re)spawn leaf (s_bsd.c:565) — the deepest remaining leaf in `s_bsd.c`'s boot subtree (`daemonize` calls it; `read_message` is the loop top). Ported to `ircd-common/src/s_bsd.rs`; guard `-DPORT_S_BSD_START_IAUTH_P7dd` on the `s_bsd_link.o` recipe.
  - **Cluster choice** — after P7d–P7cc ported every socket/teardown/listener/access-check/connection leaf, the three C functions left in `s_bsd.c` are `start_iauth`, `daemonize`, and `read_message` (+ its `static` siblings `polludp`/`check_ping`). `daemonize` calls `start_iauth` and `read_message` is the loop top, so `start_iauth` is the next leaf bottom-up. It is the only function that creates the `adfd` pipe the P7u–P7y `s_auth.c` readers drain.
  - **Classification** — utility/callee TU (no `msgtab` entry). Callers: `daemonize` (boot), `io_loop` (the `restart_iauth`/`nextiarestart` timer, ircd.c:1286), `rehash` (`start_iauth(2)` = kill-first, s_conf.c:1303), `s_auth.c` `read_iauth` restart requests. All reach it via `s_bsd_ext.h`. L1 is the differential gate (`extern` → `cref_start_iauth` oracle).
  - **Config-resolved body** — `USE_IAUTH` on → the whole `#if defined(USE_IAUTH)` body compiles; `IAUTH_BUFFER = 65535`; `MAXCONNECTIONS = 50` (the child fd-close bound). `IAUTH_PATH` (= `$(server_bin_dir)/$(IAUTH)`) and `IAUTH` are recursively-expanded Makefile vars passed only on `s_bsd.o`'s compile line (absent from bindgen) → build.rs expands both via `make` and hands them to the crate as `ircd_sys::IAUTH_PATH` / `ircd_sys::IAUTH` (the `PID_PATH`/`MOTD_PATH` precedent), so the Rust `execl` spawns the identical binary as reference-C.
  - **Faithfulness** — the three function `static`s (`last`/`first`/`iauth_pid`) → module-private `static mut START_IAUTH_*`; both worlds start `first = 1` so the burst-send block is skipped on the first call. `vfork()` → `libc::fork()`: behaviorally identical here (the child only runs a close loop + `dup2` + `execl`, so COW `fork` produces the same result) and Rust's libc deprecates `vfork` as memory-unsafe (the close-loop/dup2-between-vfork-and-exec is exactly the flagged pattern). The socketpair-failure arm does NOT early-return (faithful). The burst-send pointer arithmetic (`s += sprintf(s, "%d O\n", i)`, the `s > e` flush, the `*(s-1) = '\0'` newline-strip) is translated byte-for-byte over a `[c_char; BUFSIZ]` (`libc::BUFSIZ` = 8192 on gnu, matching the C `<stdio.h>` macro). `execl` CStrings are built *before* `fork`.
  - **Callees** — `read_iauth` (P7y), `set_non_blocking` (P7d) Rust; `sendto_flag`/`sendto_iauth` are *called* (variadic → P8); `socketpair`/`setsockopt`/`fork`/`dup2`/`execl`/`close`/`kill`/`_exit`/`time` are libc. `adfd`/`iauth_spawn`/`bootopt`/`highest_fd`/`local` are bindgen globals.
  - **L1** — `ircd-testkit/tests/start_iauth_diff.rs`, 3 cases zero-diff vs `cref_`, serialized on `GLOBALS_LOCK` (the [[p7-l1-shared-global-race]] hazard; each world keeps its own `adfd`/`iauth_spawn`/`bootopt`). `boot_noiauth_returns`: `BOOT_NOIAUTH` → immediate return, `adfd` stays -1, `iauth_spawn` unchanged. `already_running_returns`: not-NOIAUTH but `adfd>=0`, `rcvdsig=0` → returns untouched (the inverse). `spawn_sets_adfd`: the real meat — the socketpair + setsockopt + `set_non_blocking` + fork prefix; asserts the observable post-state agrees across worlds and the spawn happened (`adfd` opened nonblocking via `fcntl F_GETFL & O_NONBLOCK`, `iauth_spawn == 1`); the child `execl`s the absent `IAUTH_PATH` and `_exit`s, reaped via a bounded `waitpid(WNOHANG)` loop so the test can never hang. The non-first-call burst is skipped (both `first = 1`) → its differential coverage is deferred to L2/soak (needs a populated `local[]` + a second post-`first` call).
  - **L2 / S2S** — no new file. The golden harness boots `-t -s` (`BOOT_NOIAUTH`) → only `start_iauth`'s early return runs (`golden_registration` byte-identical); the full spawn is a process-lifecycle side effect whose end-to-end gate is the P7-exit L2/soak run with iauth enabled, as for `daemonize`/`server_reboot`. No `IsServer(cptr)` branch / no remote-user field formatting → no S2S path.

- **2026-06-06 — P7ee (`s_bsd.c` `daemonize`) merged.** Ported the boot detach glue `daemonize` (s_bsd.c:794), the layer directly above the P7dd `start_iauth`.
  - **Cluster choice.** Called once from `ircd.c:1152` (still C → resolves to the Rust def once dropped). Now a clean leaf: its only non-libc callees — `init_resolver` (P6, Rust) and `start_iauth` (P7dd, Rust) — are already ported. With it gone, the only still-C logic in `s_bsd.c` is the event loop (`read_message` + its statics `polludp`/`check_ping`).
  - **Guard / seam.** Partial port via the existing `s_bsd_link.o` recipe, new guard `-DPORT_S_BSD_DAEMONIZE_P7ee`; the C body `#ifndef`-guarded (no `#else` proto — `daemonize` is declared in `s_bsd_ext.h`).
  - **Config-resolved body.** `TIOCNOTTY` defined on Linux → the `int fd` + ioctl block compiles. The `setpgrp` arm resolves to the `#else` `setpgrp(0, getpid())` branch (verified by preprocessing — none of `HPUX`/`SVR4`/`DYNIXPTX`/`_POSIX_SOURCE`/`SGI`/`__CYGWIN32__`/`__APPLE__` are defined); the linked glibc symbol is `setpgrp(void)` (ignores the args) — declared 2-arg in a local extern to mirror the source verbatim. `stdout`/`stderr`/`stdin` are glibc `extern FILE *` symbols (not the macros) → local externs (`stderr` reuses the module-top decl). `init_resolver` called as `crate::res::init_resolver`; `start_iauth` is the local Rust def in this module (called bare, not imported, to avoid shadowing the bindgen decl).
  - **Faithfulness.** `bootopt & BOOT_TTY` → short-circuit to `init_dgram` (no fork/no fd close); else `fclose(stdout)`/`close(1)`, (unless `BOOT_DEBUG`) `fclose(stderr)`/`close(2)`, and when `((bootopt & BOOT_CONSOLE) || isatty(0)) && !(bootopt & BOOT_INETD)` → `fork()` (the parent `exit(0)`s to detach), `open("/dev/tty")`+`ioctl(TIOCNOTTY)`+`close`, `setpgrp(0, getpid())`, `fclose(stdin)`/`close(0)`; then always `resfd = init_resolver(0x1f)` + `start_iauth(0)`.
  - **Classification / L1.** Utility/boot callee (no `msgtab` entry). **Mostly untestable by design:** the detach path forks (parent `exit(0)`s) and closes fds 0/1/2 — calling it on that path destroys the test harness, and even fork-isolation (P7r's trick) can't measure a function whose whole job is to detach. The only differentially-safe path is the `BOOT_TTY` short-circuit (`goto init_dgram`: no fork, no fd close) — which is also the only path any harness ever takes (golden boots `-t` = `BOOT_TTY`). `daemonize_diff.rs` (1 case): `bootopt = cref_bootopt = BOOT_TTY|BOOT_NOIAUTH`, `adfd=-1`, `resfd=-99` sentinel → call each world's `daemonize` → assert `resfd != -99` and `>= 0` (init_resolver opened the resolver socket), `(resfd>=0)==(cref_resfd>=0)` (both worlds succeeded identically), and the inverse: `adfd == -1` in both (`start_iauth(0)` reached but short-circuited on `BOOT_NOIAUTH`, touching nothing). Serialized on `GLOBALS_LOCK`; the opened resolver sockets are closed afterward. Untested-by-design: the entire detach path (`fclose`/`close` of 0/1/2, `fork`+parent `exit`, `TIOCNOTTY` ioctl, `setpgrp`).
  - **L2 / S2S.** No new L2 (boot callee, not a `msgtab` handler — the existing golden suite boots through the `BOOT_TTY` path of `daemonize`; `golden_registration` byte-identical, confirmed). No S2S (formats no remote-user wire fields).

- **2026-06-06 — P7ff (`s_bsd.c` `read_message` + 8 statics — the event loop) merged.** Ported the select/poll event loop `read_message` (s_bsd.c:2088) and its eight file-`static` helpers to `ircd-common/src/s_bsd.rs`; guard `-DPORT_S_BSD_READ_MESSAGE_P7ff` on the `s_bsd_link.o` recipe. This is the body of `io_loop` and the **last *logic* in `s_bsd.c`** — after it, `s_bsd_link.o` defines **zero functions**, only the data globals.
  - **Cluster choice** — `read_message` is the only non-`static` symbol left in `s_bsd_link.o`; its callees `completed_connection` (s_bsd.c:1247), `read_listener` (1835), `read_packet` (2004), `client_packet` (1938), `ircd_no_fakelag` (1930), `do_dns_async` (3324), `polludp` (3212), `check_ping` (3165) are all `static` (no `cref_` oracle) → one connected component, ported together as module-private Rust twins (the `check_init`/`set_sock_opts`/`connect_inet`/`check_clones` precedent).
  - **Config-resolved body** — `USE_POLL` **off** → the `select()`/`fd_set`/`FD_*`/`highfd` path compiles; the entire `#if defined(USE_POLL)` pfd machinery is dead and omitted. `USE_IAUTH` on (the `DoingXAuth`/`WaitingXAuth`/`adfd`/`read_iauth`/`sendto_iauth` arms + do_dns_async's iauth alias-forward block). `LISTENER_DELAY` = 1 (the listener once-per-second throttle), `LISTENER_MAXACCEPT` = 10, `MAXCLIENTS` = 45, `CLIENT_FLOOD` = 1000, `HELLO_MSG`/`IRC_VERSION` resolved as module consts. `ZIP_LINKS`/`UNIXPORT`/`DEBUGMODE` off, `DELAY_CLOSE`/`CACCEPT_DELAYED_CLOSE` on, `JAPANESE` off, `AFINET=AF_INET6`.
  - **Faithfulness** — `highfd`/`delay2`/`ret` declared before the `for(res=0;;)` select-retry loop (persist across retries, never reset — the faithful C quirk). The `read_message` per-fd dispatch `goto deadsocket` becomes a `dead: bool` + structured `continue`s (both goto sites set `dead`, the deadsocket block runs once). `while(max--)` in `read_listener` → a `{ let cur = max; max -= 1; cur != 0 }` head. `client_packet`'s inner long-no-newline `while(dolen<=0)` drain + `FLAGS_NONL` break preserved. `check_ping`'s `cp->ping = (cp->rtt /= cp->lrecvd)` order kept; `pow` is the libc symbol (NOT `f64::powf` — last-ULP drift, the P7t precedent). `polludp`'s `ntohl`/`htonl` over the `u_long pi_id` truncate to 32 bits then byteswap (`u32::from_be`/`to_be as u_long`); the `#if 0` recvfrom-error report and the function `static`s `last`/`cnt`/`mlen`/`lasterr` → module `static mut`. `do_dns_async`'s `static Link ln` → a module `static mut DO_DNS_LN` (const-initialised union) so the address handed to `get_res` is stable; `hp->h_addr` macro = `h_addr_list[0]`. The private `static char readbuf[READBUF_SIZE]` (16384) → a module `static mut READBUF`.
  - **Callees** — in-module Rust: `add_connection` (P7bb), `connect_server` (P7cc), `delay_close` (P7f), `report_error` (P7q), `get_sockerr` (P7d). bindgen externs (resolve to Rust at link): `dopacket` (P7b), `exit_client`/`get_client_name` (P5), `send_queued`/`flush_connections` (P3/send), `start_auth`/`read_iauth`/`send_authports`/`read_authports` (P7w-y), `find_conf`/`is_allowed` (P6), `match_`/`inetntop` (P1), `dbuf_get`/`getmsg`/`put` (P1), `get_res`/`del_queries`/`find_bounce`/`my_name_for_link`, `restart`. Variadic (*called*, → P8): `sendto_flag`/`sendto_one`/`sendto_iauth`. The data globals `local[]`/`highest_fd`/`timeofday`/`fdas`/`fdall`/`readcalls`/`udpfd`/`resfd`/`adfd`/`ircstp`/`istat`/`iconf`/`conf`/`nextping`/`nextdelayclose`/`ipv6string`/`me` are bindgen statics (still C-owned in `s_bsd_link.o`).
  - **Classification** — utility/boot callee (no `msgtab` entry; reached from `io_loop`). `read_message` has a `cref_` oracle but is the event loop — every meaningful path `select()`s real fds, `accept()`s/`recvfrom()`s/`send()`s real sockets, and *destructively* `exit_client`s, none of which is differentially deterministic in isolation (the `daemonize`/P7ee situation). **L2 is the real gate.**
  - **L1** — `ircd-testkit/tests/read_message_diff.rs`, 2 cases zero-diff vs `cref_`, serialized on `GLOBALS_LOCK` (the [[p7-l1-shared-global-race]] hazard; `udpfd`/`resfd`/`adfd` are process globals). The one differentially-safe path: an empty `FdAry` (`highest = -1`) + `udpfd = resfd = adfd = -1` + `delay = 0` → an empty fd_set, `select(0, …, 200ms)` returns 0, no dispatch, return 0; both worlds agree (`ro = 0` and `ro = 1`). Proves the loop skeleton + the `select` call + the no-fds-ready dispatch are byte-identical.
  - **L2 / S2S** — no new file. The *entire* `ircd-golden` `golden_*` + `golden_s2s_*` suite (111 test files) runs through `read_message` (it is `io_loop`'s body) — registration, every channel/user/oper command, and the full S2S server-burst/netsplit matrix exercise the accept/read/write/exit + server-link `read_packet`/`completed_connection` paths end-to-end. Ran the full 111-file suite with `--no-fail-fast`: **192 passed, 2 failed**, both **pre-existing reference-C STATS garbage flakes** ([[p5-s2s-stats-flake]]), not P7ff regressions (the reference-C binary is frozen — a Rust edit can't change its output; the Rust side prints the correct value in both): (1) `golden_s2s_s_serv_stats` `s2s_stats_match_reference` — uninitialised peer-burst sendq (`…965524992kB sq` vs Rust `0kB sq`); (2) `golden_s_misc` `stats_t_matches_reference` — STATS t's "dropped %luSq/%luYg/%luFl" prints `ircstp->is_cklQ/is_ckly/is_cklno` (`u_int`, 4 bytes) with `%lu` (8 bytes) in the still-C variadic `sendto_one`, so reference-C `va_arg`s 4 bytes of call-frame garbage (`281470681743360Sq/…`) vs Rust `0Sq/0Yg/0Fl` — a `%lu`/`u_int` width-mismatch in s_misc.c:1079, surfaced (not caused) by P7ff.
  - **Untested-by-design (noted)** — the destructive accept/read/write/exit dispatch, `polludp`/`check_ping` (need a live UDP CPING peer), and `do_dns_async` (needs a live resolver fd) are deterministic only at L2/soak.
