  - **Classification** — utility/callee TU (no `msgtab` entry); reached only from the still-C ident I/O path. **L1 is the gate.**
  - **L1** — `ircd-testkit/tests/authports_diff.rs`, 10 cases, zero-diff vs `cref_*`. Two independent heap `aClient`s + per-world `ircstp`(+backing `stats`)/`istat`/`highest_fd`/`local[]` (the `cref_*` twins), serialized on `GLOBALS_LOCK` (the P7 L1 shared-global convention). fd I/O over socketpairs. **`send_authports`**: both worlds' `fd` point at one *real* connected IPv6-loopback socket (`connected_inet6`) so `getsockname`/`getpeername` populate `sin6_port` identically — an AF_UNIX socketpair leaves the port bytes untouched, so C reads uninitialised stack while Rust reads its zeroed buffer (the one false diff this caught, fixed in the harness, not the port). Each world writes to its own `authfd` whose bytes are read back and compared. Cases: success (identical written bytes + `FLAGS_WRAUTH` cleared, `FLAGS_AUTH` untouched), getsockname-error (`fd=-1` → `is_abad++`, `authfd=-1`, flags cleared), and the `authfd==highest_fd` walk to a non-NULL `local[]` floor. **`read_authports`**: each world's `authfd` is a socketpair read-end fed an identical canned reply. Cases: valid `USERID`(→`is_asuc++`, username `bob`, free path), `OTHER`(→`-bob`), bad reply with `\n`(→`is_abad++`, no `GOTID`), `ERROR` reply, **partial read with no `\n`/`\r`**(→ early return: `authfd` still open, `count` advanced, no counter change — the inverse/round-trip case), EOF (`read`==0 → `is_abad++`), and a pre-existing heap `auth` (→ freed + `istat` decremented). Asserts byte/field identical `username[11]`, `auth` (string or the `auth==&username` predicate), `flags`, `count`, `authfd`, and the `is_asuc`/`is_abad` + `is_auth`/`is_authmem` deltas.
  - **L2 / S2S** — none. No `msgtab` entry; the ident path needs a live ident server the `ircd-golden` harness doesn't run (`-t -s`, `adfd<0`). Formats no remote-user wire fields, no `IsServer` branch → no S2S. Existing golden suite stays byte-identical (`golden_registration` re-run green as the no-regression check).

- **2026-06-06 — P7x (`s_auth.c` ident initiator `start_auth`) merged.** Ported `start_auth` (s_auth.c:544) to `ircd-common/src/s_auth.rs` — the function that initiates the RFC1413 (ident) query carried out by the P7w pair `send_authports`/`read_authports`.
  - **Cluster choice** — leaf-first: the last ident-protocol leaf in s_auth.c. Remaining C in s_auth.c after this = `read_iauth` (iauth-pipe parser) + the variadic `sendto_iauth`/`vsendto_iauth` (va_list → P8 trampolines).
  - **Guard** — `-DPORT_S_AUTH_START_AUTH_P7x` added to the existing `s_auth_link.o` recipe (alongside `_P7u`/`_P7v`/`_P7w`). The C body is `#ifndef`-guarded with an `#else` extern prototype so the still-C callers (`s_bsd.c:1272`/`1732` — `check_client`/`add_connection`) keep a declaration.
  - **Config-resolved body** — `NO_IDENT` undef → full body (not the empty stub); `USE_IAUTH` on → the `(iauth_options & XOPT_REQUIRED) && adfd<0` early-return + the `adfd>=0` iauth-handoff `abuf` block; `USE_SYSLOG` undef → the `socket()`-failure `syslog` collapses to a bare `ircstp->is_abad++`; `DEBUGMODE` undef → every `Debug((...))` no-op; `AFINET=AF_INET6` → `SOCKADDR_IN`=`sockaddr_in6`, `SIN_FAMILY`/`SIN_PORT`=`sin6_family`/`sin6_port`, `SOCK_LEN_TYPE`=`socklen_t`.
  - **Faithfulness** — `ntohs`→`u16::from_be`, `htons`→`u16::to_be`; the iauth query is built with libc `sprintf` through the exact `"%d C %s %u "`/`"%s %u"` formats + the global `ipv6string` scratch the C reused (sequenced them→us, byte-for-byte); `IsConfTLS(x)`=`x->flags & PFLAG_TLS`, `BadPtr(x)`=`!x||*x=='\0'`. The Rust ports `set_non_blocking` (P7d)/`report_error` (P7q)/`inetntop`/`inetpton` (P1) resolve through the link seam; the variadic `sendto_iauth`/`sendto_flag` are *called* via a local `extern "C"` block. `errno` via `*libc::__errno_location()` compared to `EINPROGRESS`.
  - **Classification** — utility/callee TU (no `msgtab` entry); reached only from the still-C connection path (`add_connection`→`check_client`→`start_auth`), which needs a live ident peer the `ircd-golden` harness doesn't run.
  - **L1** — `ircd-testkit/tests/start_auth_diff.rs`, 3 cases, zero-diff vs `cref_start_auth`, serialized on `GLOBALS_LOCK` (P7 shared-global convention), per-world `adfd`/`iauth_options`/`ircstp`/`highest_fd`: (1) `XOPT_REQUIRED && adfd<0` early return (authfd/flags untouched); (2) iauth handoff — `adfd`=socketpair write-end (write succeeds → `sendto_iauth` returns 0), `cptr->fd`=a shared *real* connected IPv6-loopback socket so both worlds' getpeername/getsockname read identical addrs/ports → the query bytes written to `adfd` are byte-identical, `authfd` closed, `FLAGS_XAUTH` set; (3) getpeername failure on an unconnected socket → `report_error` + `authfd=-1` (compares cptr state only; the client needs a real `name`+`STAT_CLIENT` since fd>=0 → `get_client_name` takes the MyConnect/showip branch). Not covered (noted in the test header): the `MAXCONNECTIONS-2` fd-exhaustion guard (can't force a high fd) and the bind/connect-to-113 network tail.
  - **L2 / S2S** — no new test. Utility TU with no client/golden path under the locked config (no ident peer); L1 is the gate. Existing golden suite stays byte-identical (`golden_registration` green). No S2S — no `IsServer` branch, formats no remote-user fields.
  - **Observation (out of scope, pre-existing P5)** — case 3 surfaced a `get_client_name(showip=TRUE)` divergence on a NULL `auth` pointer: the Rust port emits `tester[@]` where glibc `sprintf("%.*s", N, NULL)` emits `tester[(null)@]`. Only observable via `report_error`'s stderr (not asserted here); a latent faithfulness gap in the P5 `get_client_name` port, not P7x.

- **2026-06-06 — P7y (`s_auth.c` iauth-pipe line parser `read_iauth`) merged.**
  - **Cluster choice** — `read_iauth` (s_auth.c:174), the last non-variadic logic in s_auth.c (per [[p7-started]]). Leaf-first relative to the still-C `s_bsd.c` select/poll loop that calls it when `adfd` is readable. After this, the only C left in s_auth.c is the variadic `sendto_iauth`/`vsendto_iauth` trampolines (→ P8).
  - **Guard** — `-DPORT_S_AUTH_READ_IAUTH_P7y` added to the existing `s_auth_link.o` recipe in `ircd-sys/build.rs` (alongside `_P7u/_P7v/_P7w/_P7x`); the C body is `#ifndef`-guarded with an `#else void read_iauth(void);` prototype so the still-C callers (the event loop) keep a declaration. The cref oracle keeps the full unguarded `s_auth.o` → `cref_read_iauth` + the `cref_iauth_*` globals survive for L1.
  - **Config-resolved body** — USE_IAUTH ON (whole body live); AFINET=AF_INET6 → the per-client prefix formats `inetntop(AF_INET6, &cptr->ip, ipv6string, sizeof)`; DEBUGMODE off. No `#ifdef` inside the function. `index`→`strchr`, `bcopy(a,b,c)`→`memmove(b,a,c)` (os.h:384), `MyFree`→ libc `free`; `MyMalloc`/`mystrdup` are the ircd-common allocators. Function-`static` carry state (`obuf`/`last`/`olen`/`ia_dbg`) → private module `static mut` (the `debugbuf` precedent). File-scope globals `iauth_version` (de-static'd-by-default, not in any header → declared extern in the module), `iauth_conf`/`iauth_stats` (P7u de-static'd), `iauth_options`/`iauth_spawn` (bindgen) stay C-owned in s_auth_link.o.
  - **Classification** — utility/callee TU, no `msgtab` entry; called from the still-C event loop when a live iauth slave writes the pipe. **L1 is the gate.** No L2/S2S: the golden harness runs `-t -s` with `adfd<0` (no iauth slave), so the path is unreached there; no `IsServer` branch, formats no remote-user wire fields. Existing golden suite stays byte-identical (`golden_registration` 2/2 confirmed, no-regression).
  - **L1** — `ircd-testkit/tests/read_iauth_diff.rs`, 10 cases, zero-diff vs `cref_`, serialized on `GLOBALS_LOCK`. Drives `read_iauth`/`cref_read_iauth` on independent per-world copies of every touched global (`adfd`/`iauth_options`/`iauth_spawn`/`iauth_version`/`iauth_conf`/`iauth_stats`/`istat`/`me`/`local[]`/`timeofday`); each world's `adfd` is the read end of its own non-blocking socketpair fed the identical protocol bytes; `timeofday`/`iauth_spawn` pinned so the `s`-header `myctime`/spawn line is byte-identical. Cases: O-options (incl. flagless reset), V replace+free, A/a conf add+clear (inverse pair), s/S stats reset+append (inverse pair), U/u per-client ident (fresh `auth==username` self-pointer → no-free path), U-with-pre-existing-heap-`auth` (istat-decrement + free, allocated through each world's own `MyMalloc`/`cref_MyMalloc` to avoid crossing allocator twins), gone-client / port-mismatch / garbage negatives (client untouched), and the obuf/olen partial-line carry round-trip (split feed == one-shot).
  - **Finding** — the per-client prefix check formats the client IP through the ported `inetntop`, which expands `::1`→`0:0:0:0:0:0:0:1` (a faithful quirk of `support.c`'s `::`-expander). In production the iauth daemon echoes the same expanded form (start_auth builds the query with the same `inetntop`), so the prefix matches; the L1 input lines must carry the expanded IPv6 form, not `::1`. Initial test used `::1` → both worlds correctly took the mismatch branch (differential green, expectation wrong) — surfaced the quirk.
  - **Not covered (noted)** — the recv-error "lost slave" branch (`close(adfd)`+`start_iauth`) and the `D`/`K`/`k` finish/kill paths (`register_user`/`exit_client`, need a fully-registered client + the event loop) — deterministic only at L2/soak with a live iauth.

- **2026-06-06 — P7z (`s_bsd.c` `check_client`) merged.** Ported the ordinary-client access check `check_client` (s_bsd.c:909) to `ircd-common/src/s_bsd.rs`; guard `-DPORT_S_BSD_CHECK_CLIENT_P7z` on the `s_bsd_link.o` recipe.
  - **Cluster choice** — `check_client` is a callee of the Rust `register_user` (s_user.c:557), reached when a connecting client finishes registration. It resolves the socket peer address, validates the DNS host↔ip mapping, and attaches the matching I:line. The file-`static` helper `check_init` (s_bsd.c:868) is shared with the still-C `check_server_init` (s_bsd.c:1083), so it is NOT dropped: ported as a **private Rust twin** while the C `static check_init` stays compiled. After `check_client` was `#ifdef`'d out, `check_init` has exactly one remaining caller (`check_server_init`) → GCC inlines it and drops the symbol; the build resolves cleanly. This is the P7p `set_sock_opts` precedent (a `static` callee ported as a private twin while the C `static` survives for its other caller).
  - **Config-resolved body** — `NO_OPER_REMOTE` **undef** → the trailing `FLAGS_LOCAL`/`is_loc` block (s_bsd.c:961–975) is not compiled, so `check_client` ends at `attach_Iline` and makes **no `mysk` use** (unlike `check_server_init`/`connect_server`). `UNIXPORT` undef → no `IsUnixSocket` branch in either fn; `hp = cptr->hostp` unconditionally. `DEBUGMODE` off → all `Debug(...)` no-ops. `AFINET=AF_INET6` → `sockaddr_in6`/`sin6_addr`/`sin6_port`/`in6_addr`.
  - **Faithfulness notes** — `check_init` does `getpeername(cptr->fd)` (isatty branch kept for the inetd-on-tty case → `me.sockhost`), `inetntop` into the caller's `sockname`, `bcopy` the 16-byte addr into `cptr->ip`, `cptr->port = ntohs(sin6_port)`. The IP# Mismatch arm reads **four `c_ulong`s** from `hp->h_addr` (a 16-byte addr — a latent C over-read; `%08x` truncates each to 32 bits) and writes the `inetntop` result into the real global `ipv6string` (matching the C side effect). `attach_Iline` (P6) / `inetntop` / `report_error` (P7q) are Rust; the variadic `sendto_flag` is *called* (→ P8).
  - **Classification / L1** — callee TU (no `msgtab` entry). `cref_check_client` is exported → full cross-world L1 differential (`ircd-testkit/tests/check_client_diff.rs`, 4 cases). Both worlds get **separate** aClients (check_client mutates `ip`/`port`/`hostp` + attaches confs) but **share one** real connected IPv6-loopback fd so `getpeername` is byte-identical; `conf`/`cref_conf` both empty → `attach_Iline` returns `-2 EXITC_NOILINE` (the loop never runs) — deterministic, no fixture. Cases: (1) no hostp/empty conf → ip/port filled, hostp stays NULL, -2; (2) hostp addr matches `::1` peer → hostp kept; (3 inverse) hostp addr mismatches → IP# Mismatch → hostp cleared to NULL; (4) unconnected socket → getpeername fails → check_init → report_error → -1. Asserts return + `ip`/`port`/`hostp`-nullness agree. Serialized on a `GLOBALS_LOCK` (`conf`/`ipv6string`/`me` are process globals; see the p7-l1-shared-global-race memory). Fixture finding: the getpeername-failure path → report_error → get_client_name → `mycmp(name, sockhost)` derefs `cptr->name`, so the harness client must set a non-NULL `name` (the real `make_client` sets `name = namebuf`).
  - **L2 / S2S** — L2 = existing `ircd-golden` `golden_registration` byte-identical; it drives a real client through registration with a real I:line, exercising the **success** path (return 0) that L1's empty-conf cases don't. No S2S: `check_client` has no `IsServer(cptr)` branch and formats no remote-user fields (servers go through `check_server_init`/`check_server`).

- **2026-06-06 — P7aa (`s_bsd.c` `check_server_init` + `check_server`) merged.** The server-side access-check cluster — the sibling of the P7z `check_client`, reached from the Rust `m_server`/`completed_connection` on a server link.
  - **Cluster choice** — `check_server_init` (s_bsd.c:992) is the entry point; it tail-calls `check_server` (s_bsd.c:1076), so the two form one connected component over the C/N-line lookup. Ported together under one guard `-DPORT_S_BSD_CHECK_SERVER_P7aa`.
  - **Guard / check_init** — both functions `#ifndef`'d out of `s_bsd_link.o`. The file-`static` `check_init` (s_bsd.c:868, ported as a private Rust twin in P7z) had its two callers `check_client` (P7z) and `check_server` (P7aa); with both now ported, the C `static check_init` + its forward prototype (s_bsd.c:64) lose their last C caller, so they are guarded out under the same `PORT_S_BSD_CHECK_SERVER_P7aa` symbol (no unused-static warning). The Rust port reuses the existing P7z `check_init` twin.
  - **Config-resolved body** — `UNIXPORT` undef → every `IsUnixSocket`/`#ifdef UNIXPORT` branch dropped (the `get_sockhost` unix guards collapse to always-run; no `IsUnixSocket(cptr)` in the addr-validation or conf scan); `DEBUGMODE` off → all `Debug(...)` no-ops; `AFINET=AF_INET6`. `CFLAG`/`NFLAG`/`SCH_DEBUG` added as module consts.
  - **Faithfulness** — the `check_serverback` goto becomes a `loop` (validate `hp` then `break`; the goto fires only in the `else if (cptr->hostp)` re-entry); the alias walk `for(i=0,name=h_name; name; name=h_aliases[i++])` becomes a `while !name.is_null()` reading `h_aliases[i]` then `i+=1`; the `IP# Mismatch` arm reads four `c_ulong`s from `hp->h_addr` (the same faithful over-read as `check_client`); the async-DNS stack `Link` is built via `std::mem::zeroed()` + `lin.value.aconf`/`lin.flags = ASYNC_CONF`; `AND16(c_conf->ipnum)==255` (unresolved sentinel) reuses the `send_ping` fold and copies `cptr->ip` into the conf's ipnum (dynamic-ip C-line rewrite). `index`→`libc::strchr`; `sprintf("%s@%s")` via a local variadic extern.
  - **Callees** — `attach_confs`/`find_conf`/`find_conf_host`/`find_conf_ip`/`attach_conf`/`det_confs_butmask`/`count_cnlines` (P6 s_conf), `get_sockhost` (P5 s_misc), `gethost_byname` (P6 res), `add_local_domain` (P7e), `inetntop`/`strncpyzt` (P1/local) all Rust; `sendto_flag` is *called* (variadic → P8). `nextdnscheck` global write via bindgen extern.
  - **Classification** — utility/callee TU (no `msgtab` entry). L1 is the differential gate; the C+N **success** path (return 0, attach, `get_sockhost`) is exercised by the existing L2-S2S golden suite, not a new L2 file.
  - **L1** — `ircd-testkit/tests/check_server_diff.rs`, 6 cases zero-diff vs `cref_`: `check_server_init` with `IsUnknown` + empty conf → `attach_confs` NULL → -1 (before `check_server`); `IsHandshake`, NULL confs → `find_conf` NULL → `sendto_flag`+`det_confs_butmask` → -1; `check_server` unconnected fd → `check_init` `getpeername` fails → -2; connected ::1 fd no-hostp / hostp-addr-match / hostp-addr-mismatch → all `find_conf_*` miss → -1, asserting post-state `ip`/`port`/`sockhost` agree. Separate aClients per world (the fns mutate `ip`/`port`/`sockhost`/`confs`), one shared real ::1-loopback fd so `getpeername` is byte-identical; serialized on `GLOBALS_LOCK` (`conf`/`me`/`ipv6string`/`nextdnscheck` are process globals; the [[p7-l1-shared-global-race]] memory). hostents use a dotted `h_name` so `add_local_domain` is a no-op (no resolver/env dependency), with each addr padded to 32 bytes for the mismatch over-read.
  - **S2S** — no new file: `golden_s2s_link`/`_eob`/`_who` (and the rest of the S2S suite) link a real `Peer` that the Rust ircd accepts through `check_server_init`/`check_server` (`s2s.conf` carries the C/N lines), so a regression in the success/attach path fails the burst diff. All ran green; `golden_registration` (local client) also green.

- **2026-06-06 — P7bb (`s_bsd.c` `add_connection` + `check_clones`) merged.**
  - **Cluster choice** — the inbound-connection acceptor `add_connection` (s_bsd.c:1638), the next leaf bottom-up after the P7d–P7aa socket/teardown/listener/access-check leaves: it is called from the still-C `read_listener` for each fd `accept()`ed off a listener. Its only caller-private callee `check_clones` (s_bsd.c:1572, `CLONE_CHECK`) is ported alongside it.
  - **Guard** — `-DPORT_S_BSD_ADD_CONN_P7bb` wraps two regions under one macro: `check_clones` (inside the surrounding `#ifdef CLONE_CHECK`) and `add_connection`. The P7k `add_connection_refuse` sitting between them keeps its own guard. `add_unixconnection` (`#ifdef UNIXPORT`) is not compiled.
  - **`check_clones` as a private twin** — `static` in C → no `cref_` symbol → cannot be L1-diffed directly; ported as a module-private Rust `fn` with a `static mut BACKLOG` matching the C function-local `struct abacklog` list (age out `pt+CLONE_PERIOD<timeofday`, prepend `{ip,now}`, count same-ip nodes). `MyMalloc` (P2) / libc `free` (the `MyFree` macro). Observed only through `add_connection`'s clone-reject path. The P7p `set_sock_opts` / P7z `check_init` precedent.
  - **Config-resolved body** — `NO_DNS_LOOKUP` set (build.rs `EXTRA_CFLAGS`): the `else` arm just sets `acptr->hostp = NULL`, and the `USE_IAUTH && !NO_DNS_LOOKUP` alias-forwarding block (`%d A`/`%d N` to iauth) is compiled out. `CLONE_CHECK` on (CLONE_MAX=10, CLONE_PERIOD=2) → the clone branch compiles; `DELAY_CLOSE`=15 → clone reject uses `nextdelayclose = delay_close(fd)` then `add_connection_refuse(fd,acptr,1)`. `UNIXPORT` undef, `AFINET=AF_INET6` (`sin6_*`, 16-byte `in6_addr`), `linux` → the getpeername-fail arm guards `report_error` behind `errno != ENOTCONN`.
  - **Callees** — `make_client`/`add_client_to_list`/`add_fd` (P2), `inetntop` (P1), `report_error` (P7q), `add_connection_refuse` (P7k), `delay_close` (P7f), `set_non_blocking` (P7d), `set_sock_opts` (P7p private twin), `start_auth` (P7x) all Rust; `get_sockhost`/`get_client_host`/`sendto_flog` stay C (non-variadic bindgen externs); `sendto_flag` is *called* (variadic, → P8). `local`/`highest_fd`/`fdall`/`nextdelayclose`/`ipv6string`/`timeofday` are bindgen statics.
  - **Classification** — utility/callee TU (not a `msgtab` handler): reached from `read_listener`. Universally exercised by L2.
  - **L1** — `ircd-testkit/tests/add_connection_diff.rs`, 3 tests, zero-diff vs `cref_`. `start_auth` neutralized in both worlds by `iauth_options=XOPT_REQUIRED`+`adfd=-1` (its top early-return) so its socket side effects drop out of the diff. `normal_accept_then_clone_flood` (case 1 + 4 merged so the process-`static` backlog starts pristine): first accept over a SHARED connected ::1 fd → compare full surviving post-state (return non-null, `ip`=::1, `port`, `sockhost`, `fd`, `acpt`, `hostp`=NULL, `local[fd]`, `highest_fd`, `aconf->clients`=1); then per world calls #2..#10 succeed and the 11th (count=11>CLONE_MAX) is clone-refused (exercising the backlog twin). `getpeername_failure_refuses` + `illegal_conf_refuses`: the two refuse inverses (NULL + `ircstp->is_ref`+1 + `clients` untouched + fd closed; own fd per world since the path closes it). Serialized on `GLOBALS_LOCK` (`local`/`highest_fd`/`fdall`/`ipv6string`/`timeofday`/`ircstp`/`iauth_options`/`adfd`/the backlog are process globals; the p7-l1-shared-global-race hazard).
  - **L2** — no new test. `add_connection` is the universal inbound acceptor — every `ircd-golden` client connection already flows through it; `golden_registration` (success path) byte-identical, `golden_s2s_link` green (incoming server links also go through it before `m_server`/`check_server_init`).
  - **S2S** — none. `add_connection` formats no remote-user fields and has no `IsServer(cptr)` branch (the client has no name/type yet).

- **2026-06-06 — P7cc (`s_bsd.c` `connect_server` + static `connect_inet`) merged.** The outbound server-connection setup (s_bsd.c:2511) — the counterpart of the inbound `add_connection` (P7bb). Ported to `ircd-common/src/s_bsd.rs`; guard `-DPORT_S_BSD_CONNECT_SERVER_P7cc` on the `s_bsd_link.o` recipe. `connect_server` now resolves from Rust; the still-C `do_dns_async`/`try_connections` and the Rust `m_connect` call it via the `s_bsd_ext.h` prototype.
  - **Cluster choice** — the next leaf bottom-up after the P7d–P7bb socket/teardown/listener/access-check leaves. `connect_server`'s only caller-private callee is the file-`static` `connect_inet` (s_bsd.c:2674), ported alongside as a private Rust twin (no `cref_` oracle for a `static`).
  - **`set_sock_opts` lifecycle** — ported as a private Rust twin back in P7p, while the C `static` was kept for its remaining compiled caller. Survey: 268 (`inetport`, P7p — guarded out), 1731 (`add_connection`, P7bb — guarded out), 1802 (`add_unixconnection`, UNIXPORT off — not compiled), 2595 (`connect_server` — the last one). With `connect_server` ported, the C `static set_sock_opts` + its forward proto (s_bsd.c:69) have zero compiled callers → both guarded out under `PORT_S_BSD_CONNECT_SERVER_P7cc` (the P7aa `check_init` precedent); the Rust port uses the existing P7p twin.
  - **Config-resolved body** — `UNIXPORT` undef → `connect_unix` not compiled, the `*aconf->host == '/'` branch drops → always `connect_inet`; `AFINET = AF_INET6` → `sockaddr_in6`/`sin6_*`/16-byte `in6_addr`; `DEBUGMODE` off → all `Debug(...)` no-ops (the leading `inet_ntop` into `ipv6string` is inside `Debug(...)` → not evaluated). `mysk` (P7s de-static'd) is the outbound-bind source; `minus_one` the all-`0xff` sentinel.
  - **FINDING (faithful)** — `connect_server`'s DNS-resolution block (s_bsd.c:2538-2558, guarded by `if (!aconf->ipnum.S_ADDR && *aconf->host != '/')`) is **dead code** under AF_INET6. `S_ADDR` = `s6_addr`, an embedded array; `!aconf->ipnum.s6_addr` is the address of that array → always non-NULL → always false. The block never runs (the same `!ipnum.s6_addr` array-address quirk noted in `send_ping`/P7m); `hp` is used directly. Omitted in the port with a comment.
  - **Faithfulness** — the `free_server:` goto becomes a `connect_server_free(cptr)` helper returning -1; `SetConnecting` = `status = STAT_CONNECTING (-4)`; `connect_inet`'s `static struct SOCKADDR server` is a module `static mut MaybeUninit<sockaddr_in6>` (bzero'd every call, the C `static` semantics); the dup-IP scan compares network-order `server.sin6_port` to the host-order `acptr->port` (a faithful C quirk); `index`→`strchr`(unused — DNS block dead), `htons`→`u16::to_be`. `dummy` (P7a) is the `SIGALRM` handler.
  - **Callees** — `find_server` (P4), `make_client`/`make_server`/`free_client`/`free_server`/`add_fd`/`add_client_to_list` (P2), `attach_confs_host`/`find_conf_host`/`det_confs_butmask` (P6), `get_sockhost`/`get_client_name` (P5), `set_non_blocking` (P7d), `set_sock_opts` (P7p twin), `inetpton` (P1) all Rust; the variadic `sendto_flag`/`sendto_one` are *called* (→ P8). `mysk`/`minus_one`/`portnum`/`highest_fd`/`local`/`fdall`/`nextping`/`timeofday`/`istat`/`me` are bindgen statics.
  - **Classification / L1** — utility/callee TU (not a `msgtab` handler; reached from `m_connect`/`try_connections`/`do_dns_async`). `cref_connect_server` exported → cross-world differential (`ircd-testkit/tests/connect_server_diff.rs`, 3 cases zero-diff). The success path does a live `socket`/`bind`/`connect` to a configured peer → not deterministic at L1. Cases: (1) `server_already_present` — `find_server` hit → `SCH_NOTICE` + return -1 before any `make_client`/socket work (`by`=NULL); (2) `server_already_present_remote_by` — remote `IsPerson` `by` (fd<0 → `!MyClient`) so the extra `sendto_one(by,...)` arm fires; (3 inverse/cleanup) `connect_inet_failure_refused` — empty hash → `make_client`/`make_server` → `connect_inet` `socket`+`bind`(unconfigured zeroed `mysk` → AF_UNSPEC) fails → `return NULL` → `free_server` cleanup → -1; asserts `highest_fd` unchanged + the hash left clean. Per-world `inithashtables()` (else `hashtab` is NULL → segv); serialized on `GLOBALS_LOCK` (the [[p7-l1-shared-global-race]] hazard). Findings: `hash_find_server`'s suffix-mask search overwrites `'.'`→`'*'` in-place → the conf/lookup strings must be writable heap (not `c"…"` literals); a remote `by` needs `acpt` set (self) or `send_message` null-derefs `(*to).acpt`.
  - **L2 / S2S** — no new file. The existing `ircd-golden`/`boot_s2s` harness dials **into** the ircd (`TcpStream::connect` = inbound `add_connection`), so it does not exercise `connect_server`'s outbound dial; deferred to the event-loop/CONNECT L2 (the `read_message` cluster). Regression check: `golden_registration` + `golden_s2s_link` byte-identical (the port doesn't touch inbound paths). No remote-user field formatting → no S2S-specific path.
===PLAN-P7-progress tail===
- **P7a DONE: `common/bsd.c` (socket write leaf)** — ported `deliver_it` (the bottom of the send path: `send()` + WOULDBLOCK→0/`FLAGS_BLOCKED` + `sendB` accumulation + `-errno`) and the re-arming `dummy` signal stub to `ircd-common/src/bsd.rs`; both portable → **`bsd.o` dropped outright** (no `_link.o`). L1 differential (5 cases, full FLAGS_BLOCKED set/clear/untouched matrix) zero-diff vs `cref_`; L2 = existing golden suite (deliver_it is the universal write path) stays byte-identical; no S2S/no new L2 (utility TU).
- **P7b DONE: `common/packet.c` (inbound packet reassembler)** — ported `dopacket` (the only exported symbol; ZIP_LINKS/DEBUGMODE off → just the plain `while (length>0 && ch2)` line-reassembly loop: CR-or-LF framing, `receiveB`/`receiveM` counter accumulation on me/cptr/acpt with the `acpt==&me` guard, `cptr->count` partial-line carry, BUFSIZE-1 overflow cap, and the parse→FLUSH_BUFFER/IsDead→exit_client/IsServer+UNKCMD return handling) to `ircd-common/src/packet.rs`; all callees already Rust → **`packet.o` dropped outright** (no `_link.o`). L1 differential (8 cases: single LF/CR, skipped extra CR-LF, two-lines-one-buffer, partial→continuation round-trip, acpt==&me vs distinct-acpt, 600-byte overflow truncation) zero-diff vs `cref_`; serialized on a `GLOBALS_LOCK` (shared `me`/`cref_me`). L2 = existing golden suite (universal read path) stays byte-identical (`golden_registration` confirmed); no S2S/no new L2 (utility TU, no IsServer-remote-field formatting).
- **P7c DONE: `ircd.c` tune-file pair (`ircd_writetune`/`ircd_readtune`)** — ported the tune-file persistence pair (the 7 sizing globals `ww_size`/`lk_size`/`_HASHSIZE`/`_CHANNELHASHSIZE`/`_SIDSIZE`/`poolsize`/`_UIDSIZE` serialized one-decimal-per-line via `sprintf`, parsed back via `sscanf`, the `USE_HOSTHASH`/`USE_IPHASH` mirrors `_HOSTNAMEHASHSIZE`/`_IPHASHSIZE` = `_HASHSIZE`, the `BOOT_BADTUNE` silent-return-vs-`exit(1)` branch, and the `lk_size = max(lk_size, ww_size)` clamp) to `ircd-common/src/ircd.rs`. First partial port of the central `ircd.c` → `ircd_link.o` second-compile (`-DPORT_IRCD_TUNE_P7c`, carrying ircd.o's IRCD*_PATH/IAUTH machine-path defines so the surviving C is byte-identical); `c_ircd_main`/`me`/signals/`restart`/`server_reboot`/the tune callers stay C. L1 differential (`ircd_tune_diff.rs`, 9 cases: writetune byte-identical files incl. lk<ww + zero/INT_MAX/u32-max edges, readtune global round-trip incl. clamp + hash mirrors + missing-file + BOOT_BADTUNE silent return, write→read round-trip) zero-diff vs `cref_`, serialized on a `GLOBALS_LOCK`. No new L2 (utility TU, not a `msgtab` handler; `ircd_readtune` exercised at boot by the existing golden suite — `golden_registration` stays byte-identical); no S2S (no remote-field formatting). The `exit(1)` arm is untested-by-design (would kill the test process).
- **P7d DONE: `s_bsd.c` socket/file utility leaves** — first (partial) port of the central I/O TU `s_bsd.c`; ported the three pure libc-wrapper leaves that touch none of the event-loop data globals: `get_sockerr` (`getsockopt(SO_ERROR)`-or-saved-`errno`), `set_non_blocking` (`fcntl F_GETFL`→`F_SETFL|O_NONBLOCK`; failure path calls the still-C `report_error`), and `write_pidfile` (truncate+create `IRCDPID_PATH`, `sprintf("%5d\n", getpid())`) to `ircd-common/src/s_bsd.rs`. Partial port via `s_bsd_link.o` (`-DPORT_S_BSD_LEAF_P7d`, carrying s_bsd.o's `IRCDPID_PATH`/`IAUTH_PATH`/`IAUTH` machine-path defines); the event loop + `local[]`/`highest_fd`/`timeofday`/`FdAry` + listeners + `add_connection`/`read_message`/`report_error`/`get_my_name`/`add_local_domain`/`start_iauth` stay C. `IRCDPID_PATH` (a command-line define, absent from bindgen) exposed to Rust via the P6m make-`--eval`+`rustc-env` pattern → `ircd_sys::PID_PATH`. L1 differential (`s_bsd_leaves_diff.rs`, 4 cases: get_sockerr fd<0 errno-passthrough + valid-fd/no-error, set_non_blocking O_NONBLOCK-set-with-untouched-fd-inverse, write_pidfile identical-behavior) zero-diff vs `cref_`, serialized on `GLOBALS_LOCK`. No new L2 (utility TU; `write_pidfile` hit at boot, `set_non_blocking`/`get_sockerr` on every connect — covered by the existing golden boot/connect path, `golden_registration` byte-identical); no S2S (no remote-field formatting). Untested-by-design: get_sockerr's `err!=0` branch + set_non_blocking's fcntl-failure→report_error branch (need a pending-error socket / bad fd); write_pidfile's byte rendering is pinned only where `IRCDPID_PATH` is writable (its dir is absent in the sandbox → both worlds no-op identically).
- **P7e DONE: `s_bsd.c` name-resolution leaf (`add_local_domain`)** — ported the next-easiest s_bsd.c leaf after the P7d socket/file trio: `add_local_domain` (strip one trailing `.` + `size++`; if the name is unqualified, lazily `ircd_res_init()` when `!(options & RES_INIT)`, then append `"." + ircd_res.defdname` iff `defdname[0]` and `strlen(defdname)+2 <= size`) to `ircd-common/src/s_bsd.rs`. Touches none of the event-loop globals — its only dependency is the resolver state (`ircd_res`/`ircd_res_init`), already Rust since P6. Partial port via the existing `s_bsd_link.o` seam with a new guard `-DPORT_S_BSD_LEAF_P7e` (added alongside `-DPORT_S_BSD_LEAF_P7d`); `get_my_name` (its only in-TU caller, needs `gethostname`/`gethostbyname`/`mysk`) stays C. RED confirmed the undefined symbol referenced by the now-Rust `s_conf.rs` + still-C `s_bsd.c` (`get_my_name`/`connect_server`); after GREEN `nm` shows `add_local_domain` as `T` from Rust. L1 differential (`add_local_domain_diff.rs`, 6 cases: trailing-dot-strip/no-append, unqualified-append, the size-guard boundary len+1-vs-len+2 inverse, empty-defdname-no-append, the `size++`-enables-append faithfulness check, and the init-trigger branch via `$LOCALDOMAIN` for determinism — both worlds run their P6-verified-equivalent `ircd_res_init`) zero-diff vs `cref_add_local_domain`, isolated worlds (Rust reads the real `ircd_res`, oracle reads `cref_ircd_res`), serialized on `GLOBALS_LOCK`. No new L2 (callee TU, not a `msgtab` handler; runs at boot via `s_conf.c` read_conf + on `connect_server` — `golden_registration` byte-identical); no S2S (no remote-field formatting).
- **P7f DONE: `s_bsd.c` delayed-close leaf (`delay_close`)** — ported the `DELAY_CLOSE`-gated (=15) `delay_close` (s_bsd.c:3359): a private static time-sorted linked list of fds awaiting a delayed `close()`, swept per call (expired entries, or — under fd pressure when `is_delayclosewait > (MAXCLIENTS-is_localc)>>1` — the oldest quarter; `fd==-2` from `m_close` forces close-all), then `fd>=0` is queued at `timeofday+15` (with `set_non_blocking`+`shutdown(SHUT_RD)`); returns the head entry's scheduled time or 0. Faithful: the unsigned `int-u_long` threshold (wraps), the `time<now || tmpdel-- >0` short-circuit (tmpdel only decrements when not expired), the 46-byte (43 chars+`\r\n`+NUL) "Too rapid connections" error sent to the *new* fd. Same `s_bsd_link.o` seam, new guard `-DPORT_S_BSD_DELAY_CLOSE_P7f`; reads the still-C `istat` (ircd.c) + `timeofday` (s_bsd.c) globals, calls the Rust `set_non_blocking` (P7d) + `MyMalloc` (P2). L1 differential (`delay_close_diff.rs`, 6 cases: queue-one + inverse time-eviction, unexpired-stays early-break, `fd==-2` close-all drain, overflow drop-oldest-quarter, chronological-head ordering) zero-diff vs `cref_delay_close`, isolated worlds (real `istat`/`timeofday` vs `cref_*`), serialized on `GLOBALS_LOCK` (incl. a `reset()` to drain the persistent static lists between tests). No new L2 (callee, not a `msgtab` handler — hit by the io_loop `delay_close(-1)`/`m_close`/connection-close paths; `golden_registration` byte-identical); no S2S (no remote-field formatting).
- **P7g DONE: `s_bsd.c` fd-teardown leaf (`close_client_fd`)** — ported the descriptor-teardown leaf `close_client_fd` (s_bsd.c:1270): closes `authfd` then `fd` (flushing its sendQ first via the Rust `flush_connections`, removing it from `fdas`/`fdall` via the Rust `del_fd` + clearing `local[fd]`), then drains `sendQ`/`recvQ` (`DBufClear`→`dbuf_delete`) and zeroes `passwd`. Config-resolved: `SO_LINGER` defined (the linger blocks compile, fired only when `exitc==EXITC_PING`), `ZIP_LINKS` off (`zip_free` omitted). All real callees already Rust (`flush_connections` P3, `del_fd` P2, `dbuf_delete` P1); only `report_error` stays C (already an `extern "C"` decl since P7d; fires solely on a `setsockopt(SO_LINGER)` failure). Same `s_bsd_link.o` seam, new guard `-DPORT_S_BSD_CLOSE_FD_P7g`; reads the still-C `local[]`/`fdas`/`fdall` globals. L1 differential (`close_client_fd_diff.rs`, 6 cases: client both-fds, server + listener `IsServer||IsListener` fdas+fdall arm, fd<0 only-authfd-closed, both-fds<0 no-op, and the inverse-of-insert recvQ-drain + passwd-zero) zero-diff vs `cref_close_client_fd`, isolated worlds (real `local`/`fdas`/`fdall` + Rust `flush_connections`/`del_fd` vs `cref_*`), serialized on `GLOBALS_LOCK`; inverse invariants checked (fd actually closed via EBADF, `local[fd]==NULL`, array slot freed). `exitc=0` everywhere → the `SO_LINGER`/`report_error` branches untested-by-design; the sendQ flush-then-clear (live socket I/O) is L2. No new L2 (callee, not a `msgtab` handler — hit on every disconnect via `close_connection`/`exit_client`; `golden_registration` incl. quit/reuse byte-identical); no S2S (no remote-field formatting).
- **P7h DONE: `s_bsd.c` connection-teardown leaf (`close_connection`)** — ported the bookkeeping layer directly above the P7g `close_client_fd`: `close_connection` (s_bsd.c:1341) bumps the per-class `ircstp` stats (`is_sv`/`is_cl`/`is_ni` + byte/time accumulators), drops outstanding DNS queries (`del_queries`), reschedules server reconnect (`find_conf_exact`→`nextconnect` with the `HANGONGOODLINK`/`HANGONRETRYDELAY` clamp), schedules a hang-on retry for an aborted handshake/connect, notifies iauth (`sendto_iauth "%d D"`) + decrements the P-line acceptor's `clients` refcount (recursing into `close_connection(acpt)` when the acceptor itself goes illegal), tears the descriptors down via the Rust `close_client_fd`, unlinks an illegal listener from `ListenerLL`, then `det_confs_butmask(cptr,0)` + `cptr->from = NULL`. Config-resolved: `USE_IAUTH` ON → the `sendto_iauth` block compiles; DEBUGMODE off. All callees already resolvable (`del_queries`/`find_conf_exact`/`det_confs_butmask` Rust since P6; `sendto_iauth` the variadic C trampoline; `close_client_fd` Rust P7g). Same `s_bsd_link.o` seam, new guard `-DPORT_S_BSD_CLOSE_CONN_P7h`; reads the still-C `ircstp`/`nextconnect`/`ListenerLL`/`timeofday`/`me` globals. L1 differential (`close_connection_diff.rs`, 6 cases: server/client/unknown stats accounting, handshake+connecting `nextconnect = now+30`, P-line acceptor refcount 5→4, illegal-listener `ListenerLL` unlink with the inverse — node gone, head intact, `from` NULL, confs detached) zero-diff vs `cref_close_connection`, isolated worlds (real `ircstp`/`nextconnect`/`ListenerLL`/`local`/`fdas`/`fdall`/`me`/`istat` vs `cref_*`), serialized on `GLOBALS_LOCK`; `me.fd`/`adfd` pinned to -1 (inner `flush_connections` else-branch + `sendto_iauth` no-op). No new L2 (callee, not a `msgtab` handler — hit on every disconnect via `exit_client`; `golden_registration` incl. quit/reuse byte-identical); no S2S (formats no remote-user fields). Untested-by-design: the recursive `close_connection(acpt)` (needs a fully-illegal acceptor conf) + the `find_conf_exact` reconnect-reschedule arm (NULL with no conf loaded) + the `sendto_iauth` wire emission (L2, variadic trampoline).
- **P7i DONE: `s_bsd.c` listener-list teardown leaf (`close_listeners`)** — ported the layer directly above P7g/P7h: `close_listeners` (s_bsd.c:427) walks the `ListenerLL` doubly-linked list and tears down every listener whose conf has gone illegal (`IsIllegal(aconf)`) — `clients>0` → the Rust `close_client_fd` (fd torn, node stays in the list), `clients≤0` → the Rust `close_connection` (fd torn + node unlinked + confs detached + `from` cleared); legal listeners untouched; the `bcptr = acptr->next` save handles the in-loop unlink. UNIXPORT off (config.h:339) → the `IsUnixSocket`/`unlink` block vanishes; both callees already Rust (P7g/P7h) → no new externs (reuses the existing `conf_is_illegal` helper). Same `s_bsd_link.o` seam, new guard `-DPORT_S_BSD_CLOSE_LISTENERS_P7i`; the only caller is the now-Rust `s_conf.rs` rehash (`s_conf.c:1315`). L1 differential (`close_listeners_diff.rs`, 5 cases: illegal-clients=0 unlinked, illegal-clients>0 stays-linked inverse, legal untouched (fd still open via fcntl), mixed 3-node middle-removed with the two legals relinked, all-illegal drains the list) zero-diff vs `cref_close_listeners`, isolated worlds, serialized on `GLOBALS_LOCK`. No new L2 (callee, not a `msgtab` handler — hit by rehash; `golden_registration` byte-identical); no S2S (no remote-field formatting).
- **P7j DONE: `s_bsd.c` listener-reactivation leaf (`activate_delayed_listeners`)** — ported the counterpart to P7i's `close_listeners`: `activate_delayed_listeners` (s_bsd.c:526) walks the `ListenerLL` list and, for every listener flagged `FLAGS_LISTENINACTIVE`, calls `listen(fd, LISTENQUEUE=128)`, clears the inactive bit, and counts it; if any were reactivated it emits one `sendto_flag(SCH_NOTICE, "%d listeners activated", cnt)` notice. No `#ifdef`s (DEBUGMODE off → no `Debug`); `listen()`'s return is ignored exactly as C. Same `s_bsd_link.o` seam, new guard `-DPORT_S_BSD_ACTIVATE_DELAYED_P7j`; no new still-C externs (`sendto_flag` is the existing variadic trampoline via `ircd_sys::bindings`, safe in L1 — short-circuits on NULL `svc_ptr`; `LISTENQUEUE` reproduced as a const since it's absent from bindgen). RED confirmed the undefined symbol referenced by the now-Rust `s_serv.rs` (`m_set`/burst) + `s_misc.rs` (`check_split`); after GREEN `nm` shows it `T` from Rust. L1 differential (`activate_delayed_listeners_diff.rs`, 5 cases: single-inactive→activated (inactive bit clear + socket actually listening via `SO_ACCEPTCONN`), single-active untouched (inverse), mixed `[active,inactive,active]` only-middle, empty no-op, all-inactive) zero-diff vs `cref_activate_delayed_listeners`, isolated worlds over real TCP-socket fds, serialized on `GLOBALS_LOCK`; inverse invariant — listeners never removed, already-active nodes untouched. No new L2 (callee, not a `msgtab` handler — hit by server-burst/rehash; `golden_registration` byte-identical); no S2S (formats only an integer count, no remote-user fields).
- **P7k DONE: `s_bsd.c` `add_connection_refuse` (connection-refuse leaf)** — ported the refuse-path companion to `add_connection` (stays C): `DELAY_CLOSE` on → the `delay=0` reset is not compiled, so `delay` is honored verbatim; `close(fd)` unless delayed, `ircstp->is_ref++`, `acptr->fd = -2`, then `free_client` (Rust, P2). Partial-ported via `s_bsd_link.o` (`-DPORT_S_BSD_ADD_CONN_REFUSE_P7k`). L1 differential (3 cases: delay==0 closes the fd, delay==1 leaves it open — the inverse pair, two refuses accumulate `is_ref`) zero-diff vs `cref_`; `acptr` is freed inside the call (UAF post-state) so the test compares side effects (`is_ref` delta + fd fate), and `acptr->fd=-2` is untested-by-design (no surviving reader). No L2/no S2S (callee, not a `msgtab` handler; formats no remote-user fields).
- **P7l DONE: `s_bsd.c` `setup_ping` (UDP CPING-socket setup leaf)** — ported the one-shot setup half of the server-to-server CPING feature: bind the single shared `udpfd` UDP socket. Idempotent (`udpfd != -1` → return it, ignore `aconf`); config-resolved (`AFINET`=`AF_INET6` → `from` is a `sockaddr_in6`, the `SIN_*` macros map to `sin6_*`; `SETSOCKOPT` length is `sizeof(int)`=4 not `sizeof(*p)`; `FNDELAY`=`O_NONBLOCK`; DEBUGMODE/USE_SYSLOG off → no `Debug`/`syslog`). Faithful assign-then-test: `udpfd` set from `socket()` before the `==-1` check, each later failure does `close(fd); udpfd=-1`. Bind addr from a numeric `aconf->passwd` via the Rust `inetpton` (P1, falls back to `minus_one`=all-`0xff`) else `in6addr_any`. Partial port via `s_bsd_link.o` (`-DPORT_S_BSD_SETUP_PING_P7l`); `udpfd` stays a C global (the still-C `read_message`/`polludp`/`check_ping` read it) → Rust reads/writes the bindgen extern; the CPING-output siblings `send_ping`/`check_ping`/`polludp` stay C (share `udpfd` only, which stays C). RED confirmed the undefined symbol referenced by the now-Rust `s_conf.rs` rehash (`s_conf.c:2041`); after GREEN `nm` shows `setup_ping` `T` from Rust. L1 differential (`setup_ping_diff.rs`, 3 cases: fresh setup opens a non-blocking `SOCK_DGRAM` recorded in `udpfd`, idempotent second call returns the same fd unchanged — the inverse-of-state path, numeric-passwd `"::1"` drives the `inetpton` bind-addr branch) zero-diff vs `cref_setup_ping`, isolated worlds (real `udpfd` vs `cref_udpfd`), serialized on `GLOBALS_LOCK` with a `reset()` closing the prior socket between cases; compares the fd's *properties* (valid/non-blocking/`SOCK_DGRAM`) not its integer value (worlds open distinct sockets). No new L2 (callee, not a `msgtab` handler — hit by `s_conf.rs` rehash when a `connect{}` block has a port; `golden_registration` byte-identical); no S2S (formats no remote-user fields). Untested-by-design: the `setsockopt`/`bind`/`fcntl` failure arms (need an induced syscall failure; both worlds take the success path identically).
- **P7m DONE: `s_bsd.c` `send_ping` (UDP CPING-output leaf)** — ported the output half of the server-to-server CPING (UDP ping) feature, the sibling to P7l's `setup_ping`: advance the per-`connect{}` sliding-window RTT statistics on the conf's `aCPing` (`lseq++`, `seq++`-then-conditional-`--`, the `seq*conFreq>1200` window adjusting `ping`/`recvd`) and `sendto` a `Ping` datagram (`pi_cp`/`pi_id=htonl(PING_CPING)`/`pi_seq`/`pi_tv`) over the shared `udpfd`. Config-resolved (`AFINET`=`AF_INET6` → `sin` is `sockaddr_in6`; `IN6ADDRSZ`=16; DEBUGMODE/USE_SYSLOG off → no `Debug`/`syslog`; `PING_CPING`=0x02). Faithful: the C guard's first disjunct `!aconf->ipnum.s6_addr` is an array address → always false, so only `AND16(ipnum)==255` (all-0xff unresolved sentinel) and `cp->port==0` gate; all `aCPing` counters are `u_long` → unsigned window arithmetic; `cp->lseq++` post-increments (the packet carries the old value). Partial port via the existing `s_bsd_link.o` seam, new guard `-DPORT_S_BSD_SEND_PING_P7m`; `udpfd` stays a C global (shared with the still-C `setup_ping`/`polludp`), Rust reads the bindgen extern → no new still-C externs (true leaf). L1 differential (`send_ping_diff.rs`, 7 cases: basic send with packet check, the three early returns — unresolved ipnum/zero port/zero conFreq, window recvd>0/recvd==0/recvd==seq) zero-diff vs `cref_send_ping`, isolated worlds (real `udpfd` vs `cref_udpfd`) each binding a `::1` UDP receiver to `recvfrom` the datagram; compares the deterministic `aCPing` post-state + the world-independent packet fields (`pi_id`/`pi_seq`), excluding `pi_cp` (live pointer) + `pi_tv` (gettimeofday); serialized on `GLOBALS_LOCK`. No new L2 (callee, not a `msgtab` handler — reached from the server-connect CPING path; `golden_registration` byte-identical); no S2S (formats no remote-user wire fields). Untested-by-design: `pi_tv`/`pi_cp` nondeterministic; the `sendto` failure path is `(void)`-ignored by C → unobservable.
- **P7n DONE: `s_bsd.c` `open_listener`/`reopen_listeners` (listener (re)construction wrappers)** — ported the layer directly above the still-C socket constructor `inetport`: `open_listener` (s_bsd.c:467) (re)opens one listener (early-return on `!IsListener || fd>0`; UNIXPORT off → only the inet branch; a delayed-listen P-line before the first rejoin sets `dolisten=0` + `FLAGS_LISTENINACTIVE`; dispatches to the still-C `inetport` + the Rust `add_fd` (P2)/`set_non_blocking` (P7d), registering a created fd in `fdas`/`fdall`), and `reopen_listeners` (s_bsd.c:512) walks `ListenerLL` reopening every legal closed-fd listener. Partial port via the existing `s_bsd_link.o` seam (`-DPORT_S_BSD_OPEN_LISTENER_P7n`); `inetport` (real socket/bind/listen, with its static `set_sock_opts`) stays C. L1 differential (`open_listener_diff.rs`, 6 cases: normal→listening, delayed-before-rejoin→inactive/not-listening, delayed-after-rejoin→listens (inverse), `!IsListener` no-op, `fd>0` no-op, `reopen_listeners` skips illegal + already-open) zero-diff vs `cref_` (observable fd properties — valid/`SO_ACCEPTCONN`/`O_NONBLOCK` — + flags/`fdas`/`fdall`/`local[fd]`, since each world opens its own socket), serialized on `GLOBALS_LOCK`. No new L2 (callee, hit at boot/rehash; `golden_registration` byte-identical); no S2S (no remote-user wire fields).
- **P7o DONE: `s_bsd.c` `add_listener` (listener-constructor wrapper)** — ported the layer directly above the now-Rust `open_listener` (P7n): `add_listener` (s_bsd.c:330) builds the `me`-like listener-stub `aClient` via the Rust `make_client`/`make_link` (P2) — `FLAGS_LISTEN`, `SetMe` (STAT_ME), self `acpt`/`from`, `name = ME` (= `me.name`), `firsttime = time(NULL)`, a one-element `confs` link carrying the passed `aconf` — opens the socket via the Rust `open_listener`, then prepends the client to `ListenerLL` (back-linking the old head's `prev` when non-empty); returns 0. No `#ifdef`s. Partial port via the existing `s_bsd_link.o` seam, new guard `-DPORT_S_BSD_ADD_LISTENER_P7o`; all callees already Rust → no new still-C externs (`add_listener` referenced by the now-Rust `s_conf.rs` initconf). L1 differential (`add_listener_diff.rs`, 3 cases: into empty `ListenerLL` → sole node listening+registered with prev/next NULL, prepend before an existing node → new head + old head's `prev` back-linked (inverse), two consecutive calls → chain order + back-links) zero-diff vs `cref_add_listener`, isolated worlds (each opens its own socket / `make_client` allocates its own pointer → compares observable facts not raw fd/pointer values; `me.name` pinned to `irc.test` so `inetport`'s `ME`-based sockhost matches; `firsttime=time(NULL)` asserted non-zero, not compared), serialized on `GLOBALS_LOCK`. No new L2 (callee, hit at boot/rehash via `s_conf.c` initconf; `golden_registration` byte-identical); no S2S (formats no remote-user wire fields).
- **P7p DONE: `s_bsd.c` `inetport` (listener socket constructor)** — ported the layer directly below the now-Rust `open_listener` (P7n): the real socket constructor `inetport` (s_bsd.c:210). Creates an `AF_INET6` (`AFINET`) stream socket, optionally `bind()`s it (`if (port)` → `in6addr_any` when ip is unset/non-numeric, else the Rust `inetpton` with the all-`0xff` `minus_one` fallback), applies its `static` callee `set_sock_opts`, fills `cptr` (`auth` = the ipmask canonicalized to `"a.b.c.d"` via `DupString`/`MyMalloc`; `sockhost` = `"<ip-or-ME>.<port>"` via `sprintf "%-.42s.%u"`; `ip` = the `getsockname` result; `port`), registers `local[fd] = cptr`, bumps `highest_fd`, and (when `dolisten`) `listen(fd, 128)`; returns 0, or -1 on a refused (`!ipmask`/bad ipmask) or failed (`socket`/`bind`/`getsockname`) open. `set_sock_opts` is `static` (no `cref_` oracle) → ported as a **private Rust twin** (config-resolved: SO_REUSEADDR=1, SO_RCVBUF/SO_SNDBUF/SO_SNDLOWAT=8192, `sizeof(int)` optlen; SO_DEBUG `&& 0` + SO_USELOOPBACK-undefined-on-Linux skipped); the C `static set_sock_opts` **stays compiled** for its other callers `check_server_init`/`connect_server`. Partial port via the existing `s_bsd_link.o` seam, new guard `-DPORT_S_BSD_INETPORT_P7p`; `report_error` + the variadic `sendto_flag` stay C, `local`/`highest_fd`/`me`/`minus_one`/`replies` read via bindgen externs. The `cptr == &me` inetd-on-fd-0 KLUDGE (writes `replies[RPL_MYPORTIS]` to fd 0) reproduced faithfully but never fires for a listener stub. L1 differential (`inetport_diff.rs`, 6 cases: normal port=0 listening (full compare — sockhost `irc.test.0`/auth `0.0.0.0`/port/socket-options/`local[fd]`/`highest_fd` bump), dolisten=0 not-listening (the listen inverse), NULL-ipmask + invalid-ipmask `256.0.0.0` refuse (return -1 before any socket, the error inverse), wildcard `in6addr_any` bind → `::` ip, `::1` `inetpton` bind → `::1` ip — the two bind cases serialized per world over one probed free port) zero-diff vs `cref_inetport`, isolated worlds (each opens its own socket → compares observable fd properties + world-independent struct fields, never the raw fd), serialized on `GLOBALS_LOCK`. No L2/no S2S (callee, hit at boot/rehash via `open_listener`; `golden_registration` byte-identical; formats no remote-user wire fields).
- **P7q DONE: `s_bsd.c` `report_error` (error-reporting output leaf)** — ported the genuine clean leaf left in the central I/O TU: `report_error` (s_bsd.c:151) calls **no** other `s_bsd.c` function, so it ports in isolation, and the linker now resolves its 27 internal call sites (every still‑C `report_error("…", cptr)` + the already‑Rust leaves that called it via `extern "C"`) to the Rust definition. Derives `host` via `get_client_name` (or `""` when `cptr==NULL`), refines `errtmp` from the socket's pending `SO_ERROR` (the getsockopt readout, mirroring P7d's `get_sockerr`), fires the `SCH_ERROR` local‑opers notice (`sendto_flag`), sends a NOTICE back through a half‑open (`Connecting`/`Handshake`) server link's **remote** `byuid` introducer (`find_uid`→`sendto_one`, the `:%s NOTICE %s :` + `text` `strcpy`/`strncat` construction), then echoes the formatted error to `stderr` while `serverbooting`. Config‑resolved: `SO_ERROR` defined (getsockopt compiles), `DEBUGMODE`/`USE_SYSLOG` off (no `Debug`/`syslog`). The variadic `sendto_flag`/`sendto_one`/`fprintf` are *called*, not defined — legal in stable Rust (the trampolines stay C until P8). Partial port via the existing `s_bsd_link.o` seam, new guard `-DPORT_S_BSD_REPORT_ERROR_P7q`; reads the still‑C `serverbooting`/glibc `stderr`, calls the Rust `get_client_name` (P5)/`find_uid` (P4). L1 differential (`report_error_diff.rs`, 4 cases: `serverbooting=1`+`cptr=NULL` formatted stderr echo, the `serverbooting=0` inverse gate → no output, `cptr` non‑NULL `host=get_client_name`, varied format/errno) captures fd 2 via a pipe redirect and asserts byte‑identical Rust‑vs‑`cref` stderr; serialized on `GLOBALS_LOCK` (sets `serverbooting`/`cref_serverbooting` + `errno` per case). No new L2 (output callee, not a `msgtab` handler — the `SCH_ERROR` error path is exercised by the existing golden suite; `golden_registration` byte‑identical); no S2S in L1. Untested‑by‑design: the `SO_ERROR` readout (needs a pending‑error socket; `fd<0` skips it identically), the `sendto_flag` wire emission (L2, variadic), the `bysptr` remote NOTICE (S2S — needs a connecting peer with a remote `byuid`).
- **P7r DONE: `s_bsd.c` `init_sys` (fd-table boot leaf)** — ported the cleanest remaining leaf in the central I/O TU: `init_sys` (s_bsd.c:693), called once from `ircd.c` `main` at boot. Config-resolved to a libc-only body: `RLIMIT_FD_MAX` is **not defined on Linux** → the whole `getrlimit`/`setrlimit` + `exit(-1)` rlimit block is excluded; `USE_POLL=1` → the sequent `setdtablesize` block is excluded; Linux → the `setlinebuf(stderr)` branch. So the only callees are libc (`setlinebuf`/`bzero`/`close`) and the only state is the already-exported `fdas`/`fdall`/`local` globals (no shared private static with still-C code — unlike `get_my_name`/`mysk`). Body: line-buffer stderr, `bzero` the two `fdarray`s + `highest=-1`, NULL `local[0..MAXCONNECTIONS=50]` while `close()`ing fds `3..50` (0/1/2 kept — stderr stays open until `daemonize`). Partial port via the existing `s_bsd_link.o` seam, new guard `-DPORT_S_BSD_INIT_SYS_P7r`; `fdas`/`fdall` via bindgen externs, `local[]` via the existing `local_base()` helper. RED confirmed the undefined symbol referenced by still-C `ircd.c:1010`; after GREEN `nm` shows `init_sys` `T` from Rust. L1 differential (`init_sys_diff.rs`, 3 cases: fresh-init zeroes arrays + NULLs local + inverse-of-dirty invariant, closes fds 3..N, keeps 0/1/2 open) zero-diff vs `cref_init_sys` — **fork-isolated** per world (the close loop is destructive to the test process's fds → each world runs in a forked child, results returned via `mmap(MAP_SHARED|MAP_ANONYMOUS)` which survives the close loop), serialized on `GLOBALS_LOCK`. No new L2 (boot callee, not a `msgtab` handler — the existing golden suite boots through it, `golden_registration` byte-identical); no S2S (formats no remote-user fields). Untested-by-design: `setlinebuf(stderr)` (unobservable); the rlimit/`exit` arms don't compile under the locked config.
- **P7s DONE: `s_bsd.c` `get_my_name` (server-own-hostname resolver) + de-static `mysk`** — ported the most leaf-like remaining `s_bsd.c` function after P7d–P7r: `get_my_name` (s_bsd.c:2940), which at boot resolves the server's canonical hostname into `me.name` (`gethostname` → `add_local_domain` → `gethostbyname(cname)||gethostbyname(name)` + the `h_aliases` walk, picking the `mycmp(ME)` match) and initialises the outgoing-bind source address `mysk` (`bzero` + `sin6_family=AF_INET6`/`sin6_port=0`, then the M-line `find_me()->passwd` via `inetpton` with the `minus_one` all-`0xff` fallback when it's a digit-led non-v6). Its only in-TU callee `add_local_domain` is already Rust (P7e); all other callees are libc or already-Rust (`find_me` P6, `inetpton`/`mycmp` P1, `minus_one`/`me` bindgen). The single blocker — the file-private `static struct SOCKADDR_IN mysk` (s_bsd.c:55) shared with the still-C `check_client` (localhost detect) / `connect_inet` (outgoing bind) — was broken by **de-static'ing `mysk`** (a behaviour-preserving storage-class change: single TU, no other `mysk`), which also makes the cref archive export `cref_mysk` (the `objcopy` prefix-rename only follows global symbols — the L1 static-symbol limit), giving the L1 test a full cross-world `mysk` compare. Config-resolved: `HAVE_GETIPNODEBYNAME` undef → plain `gethostbyname`; `DEBUGMODE` off; the `mysk.SIN_ADDR` write at s_bsd.c:3012 is dead `#if 0`. Partial port via the existing `s_bsd_link.o` seam, new guard `-DPORT_S_BSD_GET_MY_NAME_P7s`; `gethostbyname` declared via a local extern (absent from the libc crate). L1 differential (`get_my_name_diff.rs`, 6 cases: M-conf NULL-passwd addr-zero, non-digit-passwd addr-zero inverse, valid `2001:db8::1` → parsed addr, digit-but-invalid `9zz` → minus_one, resolvable `localhost` cname → gethostbyname+alias-loop, empty cname → BadPtr early return) zero-diff vs `cref_get_my_name` — both worlds call the same libc `gethostname`/`gethostbyname` (identical results in one run) + a shared `conf`/`cref_conf` M-conf, and the shared-but-isolated `me`/`cref_me` ME is pinned to `irc.test`; asserts the `name` output buffer + the full 28-byte `mysk`/`cref_mysk` agree, serialized on `GLOBALS_LOCK`. No L2/no S2S (boot callee, not a `msgtab` handler; the existing golden boot exercises it — `golden_registration` byte-identical; formats no remote-user wire fields). Untested-by-design: the resolved hostname is host-dependent (the test asserts the two worlds *agree*, not a fixed string); the `gethostname == -1` early return needs an induced failure (both worlds take the success path identically).
- **P7t DONE: `ircd.c` `calculate_preference` (AC preference leaf)** — ported `calculate_preference` (ircd.c:387, the auto-connect preference recompute called periodically from `io_loop`): walks the global `conf` list, fires the already-Rust `send_ping` (P7m) on every AC-able `connect{}` C-line (`CONF_CONNECT_SERVER|CONF_ZCONNECT_SERVER` + `port>0`), then derives `pref` from that conf's `aCPing` window stats (or the `-1` sentinel when `seq==0`/`recvd==0`). Partial-port via the existing `ircd_link.o` second-compile, new guard `-DPORT_IRCD_CALC_PREF_P7t` (the C body `#ifndef`-guarded with an `#else extern` prototype so the still-C `io_loop` caller keeps a declaration). Faithfulness: calls the **libc `pow` symbol** (not `f64::powf` — last-ULP drift would corrupt the `(u_int)(f*100.0)` truncation); final cast reproduces C `double→u_int→int pref`. L1 differential (5 cases: skips, recvd==0 sentinel, full-window compute, mixed list) zero-diff vs `cref_` (isolated `conf`/`cref_conf` worlds, serialized on `GLOBALS_LOCK`). L2 = existing golden boot stays byte-identical (locked config has no `connect{}` C-lines → loop body is a no-op); no S2S (utility, no remote-user wire fields). Note: the `cp==NULL` sentinel clause is dead defensive code — `send_ping` dereferences `cp->port` first.
- **P7u DONE: `s_auth.c` iauth `/STATS` reporters** (`report_iauth_conf`/`report_iauth_stats`) — opened the last P7 TU by porting its two cleanest leaves: list-walking reporters that emit `RPL_STATSIAUTH`/`RPL_STATSDEBUG` per `iauth_conf`/`iauth_stats` `LineItem` node via the variadic `sendto_one` (`report_iauth_conf` gated on `adfd >= 0`). De-static'd the two file-static list heads (the P7s `mysk` precedent) so the still-C `read_iauth` writer keeps them while the Rust readers reference them via extern; partial-ported via new `s_auth_link.o` (`-DPORT_S_AUTH_REPORT_P7u`). L1 sendQ-capture differential zero-diff (6 cases incl. adfd<0 + empty-list inverses); golden byte-identical (no iauth in golden → reporters are no-ops); no S2S (no remote-user fields).
- **P7v DONE: `s_auth.c` `set_clean_username` (last pure-logic leaf)** — ported `set_clean_username` (s_auth.c:44; derives `cptr->username` ≤USERLEN+NUL from the raw ident reply `cptr->auth`: dirty-prefix `-` on `[`/`@`/over-length/leading-`:`/embedded-whitespace, copy ≤USERLEN chars dropping `@`/`[`/whitespace, then free+redirect `auth` at the interior `username` buffer when equal else bump `istat.is_auth`/`is_authmem`) to `ircd-common/src/s_auth.rs`. De-static'd (behaviour-preserving — single TU) so `nm -g` emits `cref_set_clean_username` and the still-C callers (`read_iauth`/`start_auth`) resolve to the Rust def once the body is `#ifndef PORT_S_AUTH_CLEAN_USERNAME_P7v`-guarded out of `s_auth_link.o`. L1 differential (9 cases: free path clean-fits/exact-USERLEN/empty, istat path `@`/`[`/over-length/leading-`:`/interior-whitespace, inverses trailing-whitespace-not-dirty-but-unequal + NULL-auth early-return) zero-diff vs `cref_` on the full `username[11]` buffer + `is_auth`/`is_authmem` deltas + the `auth==&username` self-pointer predicate; serialized on `GLOBALS_LOCK` (shared `istat`). L1 is the gate (utility/callee TU, reached only from the still-C iauth/ident I/O the golden harness doesn't run); `golden_registration` stays byte-identical (no-regression); no S2S (no remote-user fields).

- **P7w DONE: `s_auth.c` ident-protocol I/O pair `send_authports`/`read_authports`** — ported the RFC1413 ident query/reply pair to `ircd-common/src/s_auth.rs` (the leaf relative to the still-C `start_auth` + the `s_bsd.c` event loop at `s_bsd.c:2363`/`2368`). `send_authports`: `getsockname`/`getpeername(fd)`→`"theirport , ourport\r\n"`→`write(authfd)`, with the `authsenderr` failure path (`ircstp->is_abad++`, close `authfd`, `highest_fd` walk past NULL `local[]`, `authfd=-1`, clear `FLAGS_AUTH|FLAGS_WRAUTH`); success clears only `FLAGS_WRAUTH`. `read_authports`: `read` buffered across partial reads via `cptr->count`, `sscanf` the `"%hd , %hd : USERID : %*[^:]: %512s"` grammar, set `auth` (`OTHER`→`-`-prefixed `MyMalloc`, else `mystrdup`) + `set_clean_username` (P7v sibling) + `FLAGS_GOTID`; no `\n`/`\r` yet → early return; bad/empty → `is_abad++`. Config-resolved (USE_SYSLOG/DEBUGMODE off → no syslog/`get_client_name`/`Debug`; AFINET=AF_INET6 → `sockaddr_in6`/`sin6_port`; BUFSIZE=512). `index`→`strchr`, `rindex`→`strrchr`, `MyFree`→`free`, `ntohs`→`u16::from_be`; `sscanf` driven through libc with the exact C format. Seam: `-DPORT_S_AUTH_AUTHPORTS_P7w` on `s_auth_link.o`; both already global in `s_auth_ext.h` → no de-static, the prototype comes from the header. **L1** (`authports_diff.rs`, 10 cases) zero-diff vs `cref_`: `send_authports` over a *real* IPv6-loopback connected socket (so `getsockname`/`getpeername` populate `sin6_port` — an AF_UNIX socketpair leaves the port bytes untouched, a false diff) + the error/`highest_fd`-walk paths; `read_authports` over socketpair read-ends covering valid/OTHER/bad/ERROR/partial-early-return/EOF + the pre-auth free + `istat` decrement. Serialized on `GLOBALS_LOCK`. No L2/no S2S (utility TU, no `msgtab` entry, no live ident peer in the golden harness, no remote-user fields); existing golden suite (`golden_registration`) stays byte-identical.
- **P7x DONE: `s_auth.c` ident initiator `start_auth`** — ported the RFC1413 query initiator (`-DPORT_S_AUTH_START_AUTH_P7x` on the `s_auth_link.o` recipe): opens the non-blocking `authfd` socket, derives local/peer addrs from `getpeername`/`getsockname(cptr->fd)`, optionally overrides the bind source from the P-line TLS `source_ip`, then either hands off to iauth (`adfd>=0`: build `"<fd> C <themip> <themport> <usip> <usport>"` via `inetntop`+`ipv6string`+libc `sprintf`, `sendto_iauth`; success → `close authfd`/`authfd=-1`/`FLAGS_XAUTH`/return) or `bind`/`connect`s to `[peer]:113` (arm `FLAGS_WRAUTH|FLAGS_AUTH`, bump `highest_fd`). Config-resolved: NO_IDENT off (full body), USE_IAUTH on (early-return + handoff), USE_SYSLOG/DEBUGMODE off (no syslog/Debug), AFINET=AF_INET6. Calls the Rust `set_non_blocking`/`report_error`/`inetntop`/`inetpton`; *calls* the variadic `sendto_iauth`/`sendto_flag` (stay C). L1 differential (3 cases: `XOPT_REQUIRED && adfd<0` early return; iauth-handoff query bytes byte-identical over a shared real IPv6-loopback `cptr->fd`; getpeername-failure `authfd`-reset) zero-diff vs `cref_`, serialized on `GLOBALS_LOCK`. Utility/callee TU (no `msgtab`) — L1 is the gate; golden suite stays byte-identical (`golden_registration` confirmed); no S2S (no `IsServer`/remote-field path).
- **P7y DONE: `s_auth.c` iauth-pipe line parser `read_iauth`** — ported the last non-variadic logic in s_auth.c (s_auth.c:174; the slave-auth pipe drain: persistent `obuf`/`olen` partial-line carry + per-opcode dispatch `>`/`G`/`O`/`V`/`a`/`A`/`s`/`S`/`U`/`u`/`o`/`D`/`K`/`k`/garbage) to `ircd-common/src/s_auth.rs`; guarded the C body out via `-DPORT_S_AUTH_READ_IAUTH_P7y` on the `s_auth_link.o` recipe (`#else extern` proto for the still-C callers); the file-scope globals `iauth_version`/`iauth_conf`/`iauth_stats`/`iauth_options`/`iauth_spawn` stay C-owned in s_auth_link.o, referenced via extern; the variadic `sendto_iauth`/`sendto_flag` are CALLED (stay C). L1 differential (10 cases: O-options incl. flagless-reset, V replace+free, A/a conf add+clear, s/S stats reset+append, U/u ident, U with istat-decrement via per-world `MyMalloc`/`cref_MyMalloc`, gone/mismatch/garbage negatives, obuf/olen partial-line carry round-trip) zero-diff vs `cref_`; serialized on `GLOBALS_LOCK`. **Finding:** the per-client prefix uses the ported `inetntop` which expands `::1`→`0:0:0:0:0:0:0:1` (a faithful support.c quirk), so the iauth line must carry the expanded IPv6 form. No L2/S2S (utility TU, no `msgtab` entry, no `IsServer`/remote-field formatting; reached only via a live iauth slave the golden harness doesn't run). **Only `sendto_iauth`/`vsendto_iauth` (variadic → P8) remain C in s_auth.c.**
- **P7z DONE: `s_bsd.c` `check_client` (ordinary-client access check)** — ported `check_client` (the access check run from the Rust `register_user`): resolve the `getpeername` peer addr → `cptr->ip`/`port` (via a private Rust twin of the file-`static` `check_init`), verify the DNS host↔ip mapping both ways (IP# Mismatch → clear `hostp`), then `attach_Iline`. `NO_OPER_REMOTE`/`UNIXPORT` undef → no trailing `FLAGS_LOCAL` block / no unix branch (so no `mysk` use). `check_init` stays compiled in `s_bsd_link.o` for the still-C `check_server_init` (GCC inlines it into that sole remaining caller) — the P7p `set_sock_opts` private-twin precedent. Guard `-DPORT_S_BSD_CHECK_CLIENT_P7z`. L1 4-case zero-diff (`check_client_diff.rs`: no-hostp/empty-conf→-2, hostp-addr-match→kept, hostp-mismatch→cleared, getpeername-fail→-1) over a shared real IPv6-loopback fd + empty `conf`/`cref_conf`; L2 = existing `golden_registration` (the success path: real I:line → 0 → client registers) byte-identical; no S2S (no `IsServer` branch — servers go through `check_server_init`/`check_server`).
- **P7aa DONE: `s_bsd.c` `check_server_init` + `check_server` (server-side access check)** — ported the sibling of P7z `check_client` (`-DPORT_S_BSD_CHECK_SERVER_P7aa`): `check_server_init` attaches the C/N lines for the server name, confirms a C+N pair for a dialed link (`IsConnecting`/`IsHandshake`), fires an async DNS lookup of the conf host (`count_cnlines` + a stack `Link{value.aconf, flags=ASYNC_CONF}` + `gethost_byname`, `nextdnscheck=1`), then defers to `check_server`; `check_server` runs `check_init` (the P7z private Rust twin), validates the resolved host↔ip mapping (`IP# Mismatch` → drop `hp`, faithful four-`c_ulong` over-read), searches C/N lines by hostname/sockhost/ip#, `det_confs_butmask`, then on a C+N match `attach_conf`s both + the `AND16(ipnum)==255` dynamic-ip adoption + `get_sockhost(c_conf->host)`. Both dropped from `s_bsd_link.o`; the file-`static` `check_init` (+ its prototype) loses its last C caller so it is guarded out under the same `P7aa` symbol. Config-resolved: `UNIXPORT`/`DEBUGMODE` off. Callees (`attach_confs`/`find_conf`/`find_conf_host`/`find_conf_ip`/`attach_conf`/`det_confs_butmask`/`count_cnlines`/`gethost_byname`/`get_sockhost`/`add_local_domain`) are Rust; `sendto_flag` is *called* (variadic → P8). L1 6-case zero-diff (`check_server_diff.rs`: init unknown/handshake deny; check_server bad-socket→-2; connected ::1 no-hostp/hostp-match/hostp-mismatch→-1 with agreeing ip/port/sockhost); the C+N **success** path (return 0/attach) is covered by the existing L2-S2S golden suite (`golden_s2s_link`/`_eob`/`_who` link a real peer the Rust ircd accepts through `check_server_init` — all green). No new L2 file.
- **P7bb DONE: `s_bsd.c` `add_connection` (inbound-connection acceptor) + private `check_clones` twin** — port the per-`accept()` local-client constructor (`make_client` → resolve peer addr into `ip`/`port`/`sockhost` → clone-rate check → register fd in `local[]`/`fdall`/client list → `start_auth`) plus its file-`static` clone-rate callee `check_clones` (`CLONE_CHECK`; persistent backlog list, ported as a private Rust twin — no `cref_` oracle) via `-DPORT_S_BSD_ADD_CONN_P7bb`. Config-resolved: `NO_DNS_LOOKUP` (hostp=NULL, no async lookup, `USE_IAUTH` alias-forwarding block compiled out), `DELAY_CLOSE`/`CLONE_CHECK` on, `UNIXPORT` off, `AF_INET6`. L1 differential (normal accept post-state + clone flood over the backlog + the getpeername-fail/IsIllegal refuse inverses; `start_auth` neutralized via `iauth_options=XOPT_REQUIRED`+`adfd=-1`) zero-diff vs `cref_`; L2 = `golden_registration` (every client connection flows through it) byte-identical, `golden_s2s_link` green (incoming server links too); no new S2S (formats no remote-user fields, no `IsServer` branch).
- **P7cc DONE: `s_bsd.c` `connect_server` + static `connect_inet`** — the outbound server-connection setup (counterpart of P7bb `add_connection`): refuse if already linked, else build a client/server stub, `connect_inet` (`socket`/`bind` to `mysk` + dup-IP scan), `connect()`, re-attach+verify C/N lines, register the fd. `connect_inet` ported as a private Rust twin; `set_sock_opts` (last compiled C caller now gone) guarded out under the same `-DPORT_S_BSD_CONNECT_SERVER_P7cc`. Finding: the DNS block is dead under AF_INET6 (`!aconf->ipnum.S_ADDR` = array address, always false). L1 3-case zero-diff (already-present ±remote `by`, connect_inet-failure cleanup); no new L2 (golden/S2S dials *into* the ircd → outbound dial deferred to the event-loop/CONNECT L2).
===recent commits===
811e92e0 docs(blog): add 011-the-dial-out-you-can-only-test-by-not-dialing
4745283f test(res): fix c_char-signedness in res_comp/res_walk L1 diffs
0e5ab0e9 docs(claude): update memory
20bef764 docs(p7cc): record connect_server + connect_inet port in PLAN + progress logs
8c173694 test(p7cc): L1 differential for connect_server (outbound dial)
44c3f8f7 feat(p7cc): port s_bsd.c connect_server + static connect_inet (outbound dial)
5eea353c docs(blog): add 010-you-dont-write-a-test-for-the-front-door
b223c37e docs(p7bb): record add_connection + check_clones port in PLAN + progress logs
282a6936 test(p7bb): L1 differential for add_connection + check_clones
7c66a6c0 feat(p7bb): port s_bsd.c add_connection + check_clones (inbound acceptor)
cc9d452f docs(p7aa): record check_server_init/check_server port in PLAN + progress logs + memory
6f51e42c test(p7aa): L1 differential for check_server_init + check_server
8c451890 feat(p7aa): port s_bsd.c check_server_init + check_server (server access check)
683c64d1 docs(blog): add 009-hand-both-of-them-the-same-socket
dcd0982e fix(list): use c_char scratch buffers for sprintf in free_user/free_server
c6900427 fix(s_bsd): declare add_connection_refuse for still-C callers under P7k
ca720c71 chore: commit claude sessions
721f18bb docs: commit claude memories
4deb016c docs(blog): add 008-eat-the-file-one-function-at-a-time
c1a48970 docs(p7z): record check_client port in PLAN + progress logs + plan
