# P7 — I/O core + event loop + glue (per-cluster progress)

One-line summary per cluster. Full entries: [`docs/progress-log/p7.md`](docs/progress-log/p7.md).
Phase row + plan: [`PLAN.md`](PLAN.md) P7; plans under `docs/superpowers/plans/`.

- **P7a DONE: `common/bsd.c` (socket write leaf)** — ported `deliver_it` (the bottom of the send path: `send()` + WOULDBLOCK→0/`FLAGS_BLOCKED` + `sendB` accumulation + `-errno`) and the re-arming `dummy` signal stub to `ircd-common/src/bsd.rs`; both portable → **`bsd.o` dropped outright** (no `_link.o`). L1 differential (5 cases, full FLAGS_BLOCKED set/clear/untouched matrix) zero-diff vs `cref_`; L2 = existing golden suite (deliver_it is the universal write path) stays byte-identical; no S2S/no new L2 (utility TU).
- **P7b DONE: `common/packet.c` (inbound packet reassembler)** — ported `dopacket` (the only exported symbol; ZIP_LINKS/DEBUGMODE off → just the plain `while (length>0 && ch2)` line-reassembly loop: CR-or-LF framing, `receiveB`/`receiveM` counter accumulation on me/cptr/acpt with the `acpt==&me` guard, `cptr->count` partial-line carry, BUFSIZE-1 overflow cap, and the parse→FLUSH_BUFFER/IsDead→exit_client/IsServer+UNKCMD return handling) to `ircd-common/src/packet.rs`; all callees already Rust → **`packet.o` dropped outright** (no `_link.o`). L1 differential (8 cases: single LF/CR, skipped extra CR-LF, two-lines-one-buffer, partial→continuation round-trip, acpt==&me vs distinct-acpt, 600-byte overflow truncation) zero-diff vs `cref_`; serialized on a `GLOBALS_LOCK` (shared `me`/`cref_me`). L2 = existing golden suite (universal read path) stays byte-identical (`golden_registration` confirmed); no S2S/no new L2 (utility TU, no IsServer-remote-field formatting).
- **P7c DONE: `ircd.c` tune-file pair (`ircd_writetune`/`ircd_readtune`)** — ported the tune-file persistence pair (the 7 sizing globals `ww_size`/`lk_size`/`_HASHSIZE`/`_CHANNELHASHSIZE`/`_SIDSIZE`/`poolsize`/`_UIDSIZE` serialized one-decimal-per-line via `sprintf`, parsed back via `sscanf`, the `USE_HOSTHASH`/`USE_IPHASH` mirrors `_HOSTNAMEHASHSIZE`/`_IPHASHSIZE` = `_HASHSIZE`, the `BOOT_BADTUNE` silent-return-vs-`exit(1)` branch, and the `lk_size = max(lk_size, ww_size)` clamp) to `ircd-common/src/ircd.rs`. First partial port of the central `ircd.c` → `ircd_link.o` second-compile (`-DPORT_IRCD_TUNE_P7c`, carrying ircd.o's IRCD*_PATH/IAUTH machine-path defines so the surviving C is byte-identical); `c_ircd_main`/`me`/signals/`restart`/`server_reboot`/the tune callers stay C. L1 differential (`ircd_tune_diff.rs`, 9 cases: writetune byte-identical files incl. lk<ww + zero/INT_MAX/u32-max edges, readtune global round-trip incl. clamp + hash mirrors + missing-file + BOOT_BADTUNE silent return, write→read round-trip) zero-diff vs `cref_`, serialized on a `GLOBALS_LOCK`. No new L2 (utility TU, not a `msgtab` handler; `ircd_readtune` exercised at boot by the existing golden suite — `golden_registration` stays byte-identical); no S2S (no remote-field formatting). The `exit(1)` arm is untested-by-design (would kill the test process).
- **P7d DONE: `s_bsd.c` socket/file utility leaves** — first (partial) port of the central I/O TU `s_bsd.c`; ported the three pure libc-wrapper leaves that touch none of the event-loop data globals: `get_sockerr` (`getsockopt(SO_ERROR)`-or-saved-`errno`), `set_non_blocking` (`fcntl F_GETFL`→`F_SETFL|O_NONBLOCK`; failure path calls the still-C `report_error`), and `write_pidfile` (truncate+create `IRCDPID_PATH`, `sprintf("%5d\n", getpid())`) to `ircd-common/src/s_bsd.rs`. Partial port via `s_bsd_link.o` (`-DPORT_S_BSD_LEAF_P7d`, carrying s_bsd.o's `IRCDPID_PATH`/`IAUTH_PATH`/`IAUTH` machine-path defines); the event loop + `local[]`/`highest_fd`/`timeofday`/`FdAry` + listeners + `add_connection`/`read_message`/`report_error`/`get_my_name`/`add_local_domain`/`start_iauth` stay C. `IRCDPID_PATH` (a command-line define, absent from bindgen) exposed to Rust via the P6m make-`--eval`+`rustc-env` pattern → `ircd_sys::PID_PATH`. L1 differential (`s_bsd_leaves_diff.rs`, 4 cases: get_sockerr fd<0 errno-passthrough + valid-fd/no-error, set_non_blocking O_NONBLOCK-set-with-untouched-fd-inverse, write_pidfile identical-behavior) zero-diff vs `cref_`, serialized on `GLOBALS_LOCK`. No new L2 (utility TU; `write_pidfile` hit at boot, `set_non_blocking`/`get_sockerr` on every connect — covered by the existing golden boot/connect path, `golden_registration` byte-identical); no S2S (no remote-field formatting). Untested-by-design: get_sockerr's `err!=0` branch + set_non_blocking's fcntl-failure→report_error branch (need a pending-error socket / bad fd); write_pidfile's byte rendering is pinned only where `IRCDPID_PATH` is writable (its dir is absent in the sandbox → both worlds no-op identically).
- **P7e DONE: `s_bsd.c` name-resolution leaf (`add_local_domain`)** — ported the next-easiest s_bsd.c leaf after the P7d socket/file trio: `add_local_domain` (strip one trailing `.` + `size++`; if the name is unqualified, lazily `ircd_res_init()` when `!(options & RES_INIT)`, then append `"." + ircd_res.defdname` iff `defdname[0]` and `strlen(defdname)+2 <= size`) to `ircd-common/src/s_bsd.rs`. Touches none of the event-loop globals — its only dependency is the resolver state (`ircd_res`/`ircd_res_init`), already Rust since P6. Partial port via the existing `s_bsd_link.o` seam with a new guard `-DPORT_S_BSD_LEAF_P7e` (added alongside `-DPORT_S_BSD_LEAF_P7d`); `get_my_name` (its only in-TU caller, needs `gethostname`/`gethostbyname`/`mysk`) stays C. RED confirmed the undefined symbol referenced by the now-Rust `s_conf.rs` + still-C `s_bsd.c` (`get_my_name`/`connect_server`); after GREEN `nm` shows `add_local_domain` as `T` from Rust. L1 differential (`add_local_domain_diff.rs`, 6 cases: trailing-dot-strip/no-append, unqualified-append, the size-guard boundary len+1-vs-len+2 inverse, empty-defdname-no-append, the `size++`-enables-append faithfulness check, and the init-trigger branch via `$LOCALDOMAIN` for determinism — both worlds run their P6-verified-equivalent `ircd_res_init`) zero-diff vs `cref_add_local_domain`, isolated worlds (Rust reads the real `ircd_res`, oracle reads `cref_ircd_res`), serialized on `GLOBALS_LOCK`. No new L2 (callee TU, not a `msgtab` handler; runs at boot via `s_conf.c` read_conf + on `connect_server` — `golden_registration` byte-identical); no S2S (no remote-field formatting).
- **P7f DONE: `s_bsd.c` delayed-close leaf (`delay_close`)** — ported the `DELAY_CLOSE`-gated (=15) `delay_close` (s_bsd.c:3359): a private static time-sorted linked list of fds awaiting a delayed `close()`, swept per call (expired entries, or — under fd pressure when `is_delayclosewait > (MAXCLIENTS-is_localc)>>1` — the oldest quarter; `fd==-2` from `m_close` forces close-all), then `fd>=0` is queued at `timeofday+15` (with `set_non_blocking`+`shutdown(SHUT_RD)`); returns the head entry's scheduled time or 0. Faithful: the unsigned `int-u_long` threshold (wraps), the `time<now || tmpdel-- >0` short-circuit (tmpdel only decrements when not expired), the 46-byte (43 chars+`\r\n`+NUL) "Too rapid connections" error sent to the *new* fd. Same `s_bsd_link.o` seam, new guard `-DPORT_S_BSD_DELAY_CLOSE_P7f`; reads the still-C `istat` (ircd.c) + `timeofday` (s_bsd.c) globals, calls the Rust `set_non_blocking` (P7d) + `MyMalloc` (P2). L1 differential (`delay_close_diff.rs`, 6 cases: queue-one + inverse time-eviction, unexpired-stays early-break, `fd==-2` close-all drain, overflow drop-oldest-quarter, chronological-head ordering) zero-diff vs `cref_delay_close`, isolated worlds (real `istat`/`timeofday` vs `cref_*`), serialized on `GLOBALS_LOCK` (incl. a `reset()` to drain the persistent static lists between tests). No new L2 (callee, not a `msgtab` handler — hit by the io_loop `delay_close(-1)`/`m_close`/connection-close paths; `golden_registration` byte-identical); no S2S (no remote-field formatting).
- **P7g DONE: `s_bsd.c` fd-teardown leaf (`close_client_fd`)** — ported the descriptor-teardown leaf `close_client_fd` (s_bsd.c:1270): closes `authfd` then `fd` (flushing its sendQ first via the Rust `flush_connections`, removing it from `fdas`/`fdall` via the Rust `del_fd` + clearing `local[fd]`), then drains `sendQ`/`recvQ` (`DBufClear`→`dbuf_delete`) and zeroes `passwd`. Config-resolved: `SO_LINGER` defined (the linger blocks compile, fired only when `exitc==EXITC_PING`), `ZIP_LINKS` off (`zip_free` omitted). All real callees already Rust (`flush_connections` P3, `del_fd` P2, `dbuf_delete` P1); only `report_error` stays C (already an `extern "C"` decl since P7d; fires solely on a `setsockopt(SO_LINGER)` failure). Same `s_bsd_link.o` seam, new guard `-DPORT_S_BSD_CLOSE_FD_P7g`; reads the still-C `local[]`/`fdas`/`fdall` globals. L1 differential (`close_client_fd_diff.rs`, 6 cases: client both-fds, server + listener `IsServer||IsListener` fdas+fdall arm, fd<0 only-authfd-closed, both-fds<0 no-op, and the inverse-of-insert recvQ-drain + passwd-zero) zero-diff vs `cref_close_client_fd`, isolated worlds (real `local`/`fdas`/`fdall` + Rust `flush_connections`/`del_fd` vs `cref_*`), serialized on `GLOBALS_LOCK`; inverse invariants checked (fd actually closed via EBADF, `local[fd]==NULL`, array slot freed). `exitc=0` everywhere → the `SO_LINGER`/`report_error` branches untested-by-design; the sendQ flush-then-clear (live socket I/O) is L2. No new L2 (callee, not a `msgtab` handler — hit on every disconnect via `close_connection`/`exit_client`; `golden_registration` incl. quit/reuse byte-identical); no S2S (no remote-field formatting).
- **P7h DONE: `s_bsd.c` connection-teardown leaf (`close_connection`)** — ported the bookkeeping layer directly above the P7g `close_client_fd`: `close_connection` (s_bsd.c:1341) bumps the per-class `ircstp` stats (`is_sv`/`is_cl`/`is_ni` + byte/time accumulators), drops outstanding DNS queries (`del_queries`), reschedules server reconnect (`find_conf_exact`→`nextconnect` with the `HANGONGOODLINK`/`HANGONRETRYDELAY` clamp), schedules a hang-on retry for an aborted handshake/connect, notifies iauth (`sendto_iauth "%d D"`) + decrements the P-line acceptor's `clients` refcount (recursing into `close_connection(acpt)` when the acceptor itself goes illegal), tears the descriptors down via the Rust `close_client_fd`, unlinks an illegal listener from `ListenerLL`, then `det_confs_butmask(cptr,0)` + `cptr->from = NULL`. Config-resolved: `USE_IAUTH` ON → the `sendto_iauth` block compiles; DEBUGMODE off. All callees already resolvable (`del_queries`/`find_conf_exact`/`det_confs_butmask` Rust since P6; `sendto_iauth` the variadic C trampoline; `close_client_fd` Rust P7g). Same `s_bsd_link.o` seam, new guard `-DPORT_S_BSD_CLOSE_CONN_P7h`; reads the still-C `ircstp`/`nextconnect`/`ListenerLL`/`timeofday`/`me` globals. L1 differential (`close_connection_diff.rs`, 6 cases: server/client/unknown stats accounting, handshake+connecting `nextconnect = now+30`, P-line acceptor refcount 5→4, illegal-listener `ListenerLL` unlink with the inverse — node gone, head intact, `from` NULL, confs detached) zero-diff vs `cref_close_connection`, isolated worlds (real `ircstp`/`nextconnect`/`ListenerLL`/`local`/`fdas`/`fdall`/`me`/`istat` vs `cref_*`), serialized on `GLOBALS_LOCK`; `me.fd`/`adfd` pinned to -1 (inner `flush_connections` else-branch + `sendto_iauth` no-op). No new L2 (callee, not a `msgtab` handler — hit on every disconnect via `exit_client`; `golden_registration` incl. quit/reuse byte-identical); no S2S (formats no remote-user fields). Untested-by-design: the recursive `close_connection(acpt)` (needs a fully-illegal acceptor conf) + the `find_conf_exact` reconnect-reschedule arm (NULL with no conf loaded) + the `sendto_iauth` wire emission (L2, variadic trampoline).
- **P7i DONE: `s_bsd.c` listener-list teardown leaf (`close_listeners`)** — ported the layer directly above P7g/P7h: `close_listeners` (s_bsd.c:427) walks the `ListenerLL` doubly-linked list and tears down every listener whose conf has gone illegal (`IsIllegal(aconf)`) — `clients>0` → the Rust `close_client_fd` (fd torn, node stays in the list), `clients≤0` → the Rust `close_connection` (fd torn + node unlinked + confs detached + `from` cleared); legal listeners untouched; the `bcptr = acptr->next` save handles the in-loop unlink. UNIXPORT off (config.h:339) → the `IsUnixSocket`/`unlink` block vanishes; both callees already Rust (P7g/P7h) → no new externs (reuses the existing `conf_is_illegal` helper). Same `s_bsd_link.o` seam, new guard `-DPORT_S_BSD_CLOSE_LISTENERS_P7i`; the only caller is the now-Rust `s_conf.rs` rehash (`s_conf.c:1315`). L1 differential (`close_listeners_diff.rs`, 5 cases: illegal-clients=0 unlinked, illegal-clients>0 stays-linked inverse, legal untouched (fd still open via fcntl), mixed 3-node middle-removed with the two legals relinked, all-illegal drains the list) zero-diff vs `cref_close_listeners`, isolated worlds, serialized on `GLOBALS_LOCK`. No new L2 (callee, not a `msgtab` handler — hit by rehash; `golden_registration` byte-identical); no S2S (no remote-field formatting).
- **P7j DONE: `s_bsd.c` listener-reactivation leaf (`activate_delayed_listeners`)** — ported the counterpart to P7i's `close_listeners`: `activate_delayed_listeners` (s_bsd.c:526) walks the `ListenerLL` list and, for every listener flagged `FLAGS_LISTENINACTIVE`, calls `listen(fd, LISTENQUEUE=128)`, clears the inactive bit, and counts it; if any were reactivated it emits one `sendto_flag(SCH_NOTICE, "%d listeners activated", cnt)` notice. No `#ifdef`s (DEBUGMODE off → no `Debug`); `listen()`'s return is ignored exactly as C. Same `s_bsd_link.o` seam, new guard `-DPORT_S_BSD_ACTIVATE_DELAYED_P7j`; no new still-C externs (`sendto_flag` is the existing variadic trampoline via `ircd_sys::bindings`, safe in L1 — short-circuits on NULL `svc_ptr`; `LISTENQUEUE` reproduced as a const since it's absent from bindgen). RED confirmed the undefined symbol referenced by the now-Rust `s_serv.rs` (`m_set`/burst) + `s_misc.rs` (`check_split`); after GREEN `nm` shows it `T` from Rust. L1 differential (`activate_delayed_listeners_diff.rs`, 5 cases: single-inactive→activated (inactive bit clear + socket actually listening via `SO_ACCEPTCONN`), single-active untouched (inverse), mixed `[active,inactive,active]` only-middle, empty no-op, all-inactive) zero-diff vs `cref_activate_delayed_listeners`, isolated worlds over real TCP-socket fds, serialized on `GLOBALS_LOCK`; inverse invariant — listeners never removed, already-active nodes untouched. No new L2 (callee, not a `msgtab` handler — hit by server-burst/rehash; `golden_registration` byte-identical); no S2S (formats only an integer count, no remote-user fields).
- **P7k DONE: `s_bsd.c` `add_connection_refuse` (connection-refuse leaf)** — ported the refuse-path companion to `add_connection` (stays C): `DELAY_CLOSE` on → the `delay=0` reset is not compiled, so `delay` is honored verbatim; `close(fd)` unless delayed, `ircstp->is_ref++`, `acptr->fd = -2`, then `free_client` (Rust, P2). Partial-ported via `s_bsd_link.o` (`-DPORT_S_BSD_ADD_CONN_REFUSE_P7k`). L1 differential (3 cases: delay==0 closes the fd, delay==1 leaves it open — the inverse pair, two refuses accumulate `is_ref`) zero-diff vs `cref_`; `acptr` is freed inside the call (UAF post-state) so the test compares side effects (`is_ref` delta + fd fate), and `acptr->fd=-2` is untested-by-design (no surviving reader). No L2/no S2S (callee, not a `msgtab` handler; formats no remote-user fields).
- **P7l DONE: `s_bsd.c` `setup_ping` (UDP CPING-socket setup leaf)** — ported the one-shot setup half of the server-to-server CPING feature: bind the single shared `udpfd` UDP socket. Idempotent (`udpfd != -1` → return it, ignore `aconf`); config-resolved (`AFINET`=`AF_INET6` → `from` is a `sockaddr_in6`, the `SIN_*` macros map to `sin6_*`; `SETSOCKOPT` length is `sizeof(int)`=4 not `sizeof(*p)`; `FNDELAY`=`O_NONBLOCK`; DEBUGMODE/USE_SYSLOG off → no `Debug`/`syslog`). Faithful assign-then-test: `udpfd` set from `socket()` before the `==-1` check, each later failure does `close(fd); udpfd=-1`. Bind addr from a numeric `aconf->passwd` via the Rust `inetpton` (P1, falls back to `minus_one`=all-`0xff`) else `in6addr_any`. Partial port via `s_bsd_link.o` (`-DPORT_S_BSD_SETUP_PING_P7l`); `udpfd` stays a C global (the still-C `read_message`/`polludp`/`check_ping` read it) → Rust reads/writes the bindgen extern; the CPING-output siblings `send_ping`/`check_ping`/`polludp` stay C (share `udpfd` only, which stays C). RED confirmed the undefined symbol referenced by the now-Rust `s_conf.rs` rehash (`s_conf.c:2041`); after GREEN `nm` shows `setup_ping` `T` from Rust. L1 differential (`setup_ping_diff.rs`, 3 cases: fresh setup opens a non-blocking `SOCK_DGRAM` recorded in `udpfd`, idempotent second call returns the same fd unchanged — the inverse-of-state path, numeric-passwd `"::1"` drives the `inetpton` bind-addr branch) zero-diff vs `cref_setup_ping`, isolated worlds (real `udpfd` vs `cref_udpfd`), serialized on `GLOBALS_LOCK` with a `reset()` closing the prior socket between cases; compares the fd's *properties* (valid/non-blocking/`SOCK_DGRAM`) not its integer value (worlds open distinct sockets). No new L2 (callee, not a `msgtab` handler — hit by `s_conf.rs` rehash when a `connect{}` block has a port; `golden_registration` byte-identical); no S2S (formats no remote-user fields). Untested-by-design: the `setsockopt`/`bind`/`fcntl` failure arms (need an induced syscall failure; both worlds take the success path identically).
- **P7m DONE: `s_bsd.c` `send_ping` (UDP CPING-output leaf)** — ported the output half of the server-to-server CPING (UDP ping) feature, the sibling to P7l's `setup_ping`: advance the per-`connect{}` sliding-window RTT statistics on the conf's `aCPing` (`lseq++`, `seq++`-then-conditional-`--`, the `seq*conFreq>1200` window adjusting `ping`/`recvd`) and `sendto` a `Ping` datagram (`pi_cp`/`pi_id=htonl(PING_CPING)`/`pi_seq`/`pi_tv`) over the shared `udpfd`. Config-resolved (`AFINET`=`AF_INET6` → `sin` is `sockaddr_in6`; `IN6ADDRSZ`=16; DEBUGMODE/USE_SYSLOG off → no `Debug`/`syslog`; `PING_CPING`=0x02). Faithful: the C guard's first disjunct `!aconf->ipnum.s6_addr` is an array address → always false, so only `AND16(ipnum)==255` (all-0xff unresolved sentinel) and `cp->port==0` gate; all `aCPing` counters are `u_long` → unsigned window arithmetic; `cp->lseq++` post-increments (the packet carries the old value). Partial port via the existing `s_bsd_link.o` seam, new guard `-DPORT_S_BSD_SEND_PING_P7m`; `udpfd` stays a C global (shared with the still-C `setup_ping`/`polludp`), Rust reads the bindgen extern → no new still-C externs (true leaf). L1 differential (`send_ping_diff.rs`, 7 cases: basic send with packet check, the three early returns — unresolved ipnum/zero port/zero conFreq, window recvd>0/recvd==0/recvd==seq) zero-diff vs `cref_send_ping`, isolated worlds (real `udpfd` vs `cref_udpfd`) each binding a `::1` UDP receiver to `recvfrom` the datagram; compares the deterministic `aCPing` post-state + the world-independent packet fields (`pi_id`/`pi_seq`), excluding `pi_cp` (live pointer) + `pi_tv` (gettimeofday); serialized on `GLOBALS_LOCK`. No new L2 (callee, not a `msgtab` handler — reached from the server-connect CPING path; `golden_registration` byte-identical); no S2S (formats no remote-user wire fields). Untested-by-design: `pi_tv`/`pi_cp` nondeterministic; the `sendto` failure path is `(void)`-ignored by C → unobservable.
- **P7n DONE: `s_bsd.c` `open_listener`/`reopen_listeners` (listener (re)construction wrappers)** — ported the layer directly above the still-C socket constructor `inetport`: `open_listener` (s_bsd.c:467) (re)opens one listener (early-return on `!IsListener || fd>0`; UNIXPORT off → only the inet branch; a delayed-listen P-line before the first rejoin sets `dolisten=0` + `FLAGS_LISTENINACTIVE`; dispatches to the still-C `inetport` + the Rust `add_fd` (P2)/`set_non_blocking` (P7d), registering a created fd in `fdas`/`fdall`), and `reopen_listeners` (s_bsd.c:512) walks `ListenerLL` reopening every legal closed-fd listener. Partial port via the existing `s_bsd_link.o` seam (`-DPORT_S_BSD_OPEN_LISTENER_P7n`); `inetport` (real socket/bind/listen, with its static `set_sock_opts`) stays C. L1 differential (`open_listener_diff.rs`, 6 cases: normal→listening, delayed-before-rejoin→inactive/not-listening, delayed-after-rejoin→listens (inverse), `!IsListener` no-op, `fd>0` no-op, `reopen_listeners` skips illegal + already-open) zero-diff vs `cref_` (observable fd properties — valid/`SO_ACCEPTCONN`/`O_NONBLOCK` — + flags/`fdas`/`fdall`/`local[fd]`, since each world opens its own socket), serialized on `GLOBALS_LOCK`. No new L2 (callee, hit at boot/rehash; `golden_registration` byte-identical); no S2S (no remote-user wire fields).
- **P7o DONE: `s_bsd.c` `add_listener` (listener-constructor wrapper)** — ported the layer directly above the now-Rust `open_listener` (P7n): `add_listener` (s_bsd.c:330) builds the `me`-like listener-stub `aClient` via the Rust `make_client`/`make_link` (P2) — `FLAGS_LISTEN`, `SetMe` (STAT_ME), self `acpt`/`from`, `name = ME` (= `me.name`), `firsttime = time(NULL)`, a one-element `confs` link carrying the passed `aconf` — opens the socket via the Rust `open_listener`, then prepends the client to `ListenerLL` (back-linking the old head's `prev` when non-empty); returns 0. No `#ifdef`s. Partial port via the existing `s_bsd_link.o` seam, new guard `-DPORT_S_BSD_ADD_LISTENER_P7o`; all callees already Rust → no new still-C externs (`add_listener` referenced by the now-Rust `s_conf.rs` initconf). L1 differential (`add_listener_diff.rs`, 3 cases: into empty `ListenerLL` → sole node listening+registered with prev/next NULL, prepend before an existing node → new head + old head's `prev` back-linked (inverse), two consecutive calls → chain order + back-links) zero-diff vs `cref_add_listener`, isolated worlds (each opens its own socket / `make_client` allocates its own pointer → compares observable facts not raw fd/pointer values; `me.name` pinned to `irc.test` so `inetport`'s `ME`-based sockhost matches; `firsttime=time(NULL)` asserted non-zero, not compared), serialized on `GLOBALS_LOCK`. No new L2 (callee, hit at boot/rehash via `s_conf.c` initconf; `golden_registration` byte-identical); no S2S (formats no remote-user wire fields).
- **P7p DONE: `s_bsd.c` `inetport` (listener socket constructor)** — ported the layer directly below the now-Rust `open_listener` (P7n): the real socket constructor `inetport` (s_bsd.c:210). Creates an `AF_INET6` (`AFINET`) stream socket, optionally `bind()`s it (`if (port)` → `in6addr_any` when ip is unset/non-numeric, else the Rust `inetpton` with the all-`0xff` `minus_one` fallback), applies its `static` callee `set_sock_opts`, fills `cptr` (`auth` = the ipmask canonicalized to `"a.b.c.d"` via `DupString`/`MyMalloc`; `sockhost` = `"<ip-or-ME>.<port>"` via `sprintf "%-.42s.%u"`; `ip` = the `getsockname` result; `port`), registers `local[fd] = cptr`, bumps `highest_fd`, and (when `dolisten`) `listen(fd, 128)`; returns 0, or -1 on a refused (`!ipmask`/bad ipmask) or failed (`socket`/`bind`/`getsockname`) open. `set_sock_opts` is `static` (no `cref_` oracle) → ported as a **private Rust twin** (config-resolved: SO_REUSEADDR=1, SO_RCVBUF/SO_SNDBUF/SO_SNDLOWAT=8192, `sizeof(int)` optlen; SO_DEBUG `&& 0` + SO_USELOOPBACK-undefined-on-Linux skipped); the C `static set_sock_opts` **stays compiled** for its other callers `check_server_init`/`connect_server`. Partial port via the existing `s_bsd_link.o` seam, new guard `-DPORT_S_BSD_INETPORT_P7p`; `report_error` + the variadic `sendto_flag` stay C, `local`/`highest_fd`/`me`/`minus_one`/`replies` read via bindgen externs. The `cptr == &me` inetd-on-fd-0 KLUDGE (writes `replies[RPL_MYPORTIS]` to fd 0) reproduced faithfully but never fires for a listener stub. L1 differential (`inetport_diff.rs`, 6 cases: normal port=0 listening (full compare — sockhost `irc.test.0`/auth `0.0.0.0`/port/socket-options/`local[fd]`/`highest_fd` bump), dolisten=0 not-listening (the listen inverse), NULL-ipmask + invalid-ipmask `256.0.0.0` refuse (return -1 before any socket, the error inverse), wildcard `in6addr_any` bind → `::` ip, `::1` `inetpton` bind → `::1` ip — the two bind cases serialized per world over one probed free port) zero-diff vs `cref_inetport`, isolated worlds (each opens its own socket → compares observable fd properties + world-independent struct fields, never the raw fd), serialized on `GLOBALS_LOCK`. No L2/no S2S (callee, hit at boot/rehash via `open_listener`; `golden_registration` byte-identical; formats no remote-user wire fields).
- **P7q DONE: `s_bsd.c` `report_error` (error-reporting output leaf)** — ported the genuine clean leaf left in the central I/O TU: `report_error` (s_bsd.c:151) calls **no** other `s_bsd.c` function, so it ports in isolation, and the linker now resolves its 27 internal call sites (every still‑C `report_error("…", cptr)` + the already‑Rust leaves that called it via `extern "C"`) to the Rust definition. Derives `host` via `get_client_name` (or `""` when `cptr==NULL`), refines `errtmp` from the socket's pending `SO_ERROR` (the getsockopt readout, mirroring P7d's `get_sockerr`), fires the `SCH_ERROR` local‑opers notice (`sendto_flag`), sends a NOTICE back through a half‑open (`Connecting`/`Handshake`) server link's **remote** `byuid` introducer (`find_uid`→`sendto_one`, the `:%s NOTICE %s :` + `text` `strcpy`/`strncat` construction), then echoes the formatted error to `stderr` while `serverbooting`. Config‑resolved: `SO_ERROR` defined (getsockopt compiles), `DEBUGMODE`/`USE_SYSLOG` off (no `Debug`/`syslog`). The variadic `sendto_flag`/`sendto_one`/`fprintf` are *called*, not defined — legal in stable Rust (the trampolines stay C until P8). Partial port via the existing `s_bsd_link.o` seam, new guard `-DPORT_S_BSD_REPORT_ERROR_P7q`; reads the still‑C `serverbooting`/glibc `stderr`, calls the Rust `get_client_name` (P5)/`find_uid` (P4). L1 differential (`report_error_diff.rs`, 4 cases: `serverbooting=1`+`cptr=NULL` formatted stderr echo, the `serverbooting=0` inverse gate → no output, `cptr` non‑NULL `host=get_client_name`, varied format/errno) captures fd 2 via a pipe redirect and asserts byte‑identical Rust‑vs‑`cref` stderr; serialized on `GLOBALS_LOCK` (sets `serverbooting`/`cref_serverbooting` + `errno` per case). No new L2 (output callee, not a `msgtab` handler — the `SCH_ERROR` error path is exercised by the existing golden suite; `golden_registration` byte‑identical); no S2S in L1. Untested‑by‑design: the `SO_ERROR` readout (needs a pending‑error socket; `fd<0` skips it identically), the `sendto_flag` wire emission (L2, variadic), the `bysptr` remote NOTICE (S2S — needs a connecting peer with a remote `byuid`).
- **P7r DONE: `s_bsd.c` `init_sys` (fd-table boot leaf)** — ported the cleanest remaining leaf in the central I/O TU: `init_sys` (s_bsd.c:693), called once from `ircd.c` `main` at boot. Config-resolved to a libc-only body: `RLIMIT_FD_MAX` is **not defined on Linux** → the whole `getrlimit`/`setrlimit` + `exit(-1)` rlimit block is excluded; `USE_POLL=1` → the sequent `setdtablesize` block is excluded; Linux → the `setlinebuf(stderr)` branch. So the only callees are libc (`setlinebuf`/`bzero`/`close`) and the only state is the already-exported `fdas`/`fdall`/`local` globals (no shared private static with still-C code — unlike `get_my_name`/`mysk`). Body: line-buffer stderr, `bzero` the two `fdarray`s + `highest=-1`, NULL `local[0..MAXCONNECTIONS=50]` while `close()`ing fds `3..50` (0/1/2 kept — stderr stays open until `daemonize`). Partial port via the existing `s_bsd_link.o` seam, new guard `-DPORT_S_BSD_INIT_SYS_P7r`; `fdas`/`fdall` via bindgen externs, `local[]` via the existing `local_base()` helper. RED confirmed the undefined symbol referenced by still-C `ircd.c:1010`; after GREEN `nm` shows `init_sys` `T` from Rust. L1 differential (`init_sys_diff.rs`, 3 cases: fresh-init zeroes arrays + NULLs local + inverse-of-dirty invariant, closes fds 3..N, keeps 0/1/2 open) zero-diff vs `cref_init_sys` — **fork-isolated** per world (the close loop is destructive to the test process's fds → each world runs in a forked child, results returned via `mmap(MAP_SHARED|MAP_ANONYMOUS)` which survives the close loop), serialized on `GLOBALS_LOCK`. No new L2 (boot callee, not a `msgtab` handler — the existing golden suite boots through it, `golden_registration` byte-identical); no S2S (formats no remote-user fields). Untested-by-design: `setlinebuf(stderr)` (unobservable); the rlimit/`exit` arms don't compile under the locked config.
- **P7s DONE: `s_bsd.c` `get_my_name` (server-own-hostname resolver) + de-static `mysk`** — ported the most leaf-like remaining `s_bsd.c` function after P7d–P7r: `get_my_name` (s_bsd.c:2940), which at boot resolves the server's canonical hostname into `me.name` (`gethostname` → `add_local_domain` → `gethostbyname(cname)||gethostbyname(name)` + the `h_aliases` walk, picking the `mycmp(ME)` match) and initialises the outgoing-bind source address `mysk` (`bzero` + `sin6_family=AF_INET6`/`sin6_port=0`, then the M-line `find_me()->passwd` via `inetpton` with the `minus_one` all-`0xff` fallback when it's a digit-led non-v6). Its only in-TU callee `add_local_domain` is already Rust (P7e); all other callees are libc or already-Rust (`find_me` P6, `inetpton`/`mycmp` P1, `minus_one`/`me` bindgen). The single blocker — the file-private `static struct SOCKADDR_IN mysk` (s_bsd.c:55) shared with the still-C `check_client` (localhost detect) / `connect_inet` (outgoing bind) — was broken by **de-static'ing `mysk`** (a behaviour-preserving storage-class change: single TU, no other `mysk`), which also makes the cref archive export `cref_mysk` (the `objcopy` prefix-rename only follows global symbols — the L1 static-symbol limit), giving the L1 test a full cross-world `mysk` compare. Config-resolved: `HAVE_GETIPNODEBYNAME` undef → plain `gethostbyname`; `DEBUGMODE` off; the `mysk.SIN_ADDR` write at s_bsd.c:3012 is dead `#if 0`. Partial port via the existing `s_bsd_link.o` seam, new guard `-DPORT_S_BSD_GET_MY_NAME_P7s`; `gethostbyname` declared via a local extern (absent from the libc crate). L1 differential (`get_my_name_diff.rs`, 6 cases: M-conf NULL-passwd addr-zero, non-digit-passwd addr-zero inverse, valid `2001:db8::1` → parsed addr, digit-but-invalid `9zz` → minus_one, resolvable `localhost` cname → gethostbyname+alias-loop, empty cname → BadPtr early return) zero-diff vs `cref_get_my_name` — both worlds call the same libc `gethostname`/`gethostbyname` (identical results in one run) + a shared `conf`/`cref_conf` M-conf, and the shared-but-isolated `me`/`cref_me` ME is pinned to `irc.test`; asserts the `name` output buffer + the full 28-byte `mysk`/`cref_mysk` agree, serialized on `GLOBALS_LOCK`. No L2/no S2S (boot callee, not a `msgtab` handler; the existing golden boot exercises it — `golden_registration` byte-identical; formats no remote-user wire fields). Untested-by-design: the resolved hostname is host-dependent (the test asserts the two worlds *agree*, not a fixed string); the `gethostname == -1` early return needs an induced failure (both worlds take the success path identically).
- **P7t DONE: `ircd.c` `calculate_preference` (AC preference leaf)** — ported `calculate_preference` (ircd.c:387, the auto-connect preference recompute called periodically from `io_loop`): walks the global `conf` list, fires the already-Rust `send_ping` (P7m) on every AC-able `connect{}` C-line (`CONF_CONNECT_SERVER|CONF_ZCONNECT_SERVER` + `port>0`), then derives `pref` from that conf's `aCPing` window stats (or the `-1` sentinel when `seq==0`/`recvd==0`). Partial-port via the existing `ircd_link.o` second-compile, new guard `-DPORT_IRCD_CALC_PREF_P7t` (the C body `#ifndef`-guarded with an `#else extern` prototype so the still-C `io_loop` caller keeps a declaration). Faithfulness: calls the **libc `pow` symbol** (not `f64::powf` — last-ULP drift would corrupt the `(u_int)(f*100.0)` truncation); final cast reproduces C `double→u_int→int pref`. L1 differential (5 cases: skips, recvd==0 sentinel, full-window compute, mixed list) zero-diff vs `cref_` (isolated `conf`/`cref_conf` worlds, serialized on `GLOBALS_LOCK`). L2 = existing golden boot stays byte-identical (locked config has no `connect{}` C-lines → loop body is a no-op); no S2S (utility, no remote-user wire fields). Note: the `cp==NULL` sentinel clause is dead defensive code — `send_ping` dereferences `cp->port` first.
- **P7u DONE: `s_auth.c` iauth `/STATS` reporters** (`report_iauth_conf`/`report_iauth_stats`) — opened the last P7 TU by porting its two cleanest leaves: list-walking reporters that emit `RPL_STATSIAUTH`/`RPL_STATSDEBUG` per `iauth_conf`/`iauth_stats` `LineItem` node via the variadic `sendto_one` (`report_iauth_conf` gated on `adfd >= 0`). De-static'd the two file-static list heads (the P7s `mysk` precedent) so the still-C `read_iauth` writer keeps them while the Rust readers reference them via extern; partial-ported via new `s_auth_link.o` (`-DPORT_S_AUTH_REPORT_P7u`). L1 sendQ-capture differential zero-diff (6 cases incl. adfd<0 + empty-list inverses); golden byte-identical (no iauth in golden → reporters are no-ops); no S2S (no remote-user fields).
- **P7v DONE: `s_auth.c` `set_clean_username` (last pure-logic leaf)** — ported `set_clean_username` (s_auth.c:44; derives `cptr->username` ≤USERLEN+NUL from the raw ident reply `cptr->auth`: dirty-prefix `-` on `[`/`@`/over-length/leading-`:`/embedded-whitespace, copy ≤USERLEN chars dropping `@`/`[`/whitespace, then free+redirect `auth` at the interior `username` buffer when equal else bump `istat.is_auth`/`is_authmem`) to `ircd-common/src/s_auth.rs`. De-static'd (behaviour-preserving — single TU) so `nm -g` emits `cref_set_clean_username` and the still-C callers (`read_iauth`/`start_auth`) resolve to the Rust def once the body is `#ifndef PORT_S_AUTH_CLEAN_USERNAME_P7v`-guarded out of `s_auth_link.o`. L1 differential (9 cases: free path clean-fits/exact-USERLEN/empty, istat path `@`/`[`/over-length/leading-`:`/interior-whitespace, inverses trailing-whitespace-not-dirty-but-unequal + NULL-auth early-return) zero-diff vs `cref_` on the full `username[11]` buffer + `is_auth`/`is_authmem` deltas + the `auth==&username` self-pointer predicate; serialized on `GLOBALS_LOCK` (shared `istat`). L1 is the gate (utility/callee TU, reached only from the still-C iauth/ident I/O the golden harness doesn't run); `golden_registration` stays byte-identical (no-regression); no S2S (no remote-user fields).

- **P7w DONE: `s_auth.c` ident-protocol I/O pair `send_authports`/`read_authports`** — ported the RFC1413 ident query/reply pair to `ircd-common/src/s_auth.rs` (the leaf relative to the still-C `start_auth` + the `s_bsd.c` event loop at `s_bsd.c:2363`/`2368`). `send_authports`: `getsockname`/`getpeername(fd)`→`"theirport , ourport\r\n"`→`write(authfd)`, with the `authsenderr` failure path (`ircstp->is_abad++`, close `authfd`, `highest_fd` walk past NULL `local[]`, `authfd=-1`, clear `FLAGS_AUTH|FLAGS_WRAUTH`); success clears only `FLAGS_WRAUTH`. `read_authports`: `read` buffered across partial reads via `cptr->count`, `sscanf` the `"%hd , %hd : USERID : %*[^:]: %512s"` grammar, set `auth` (`OTHER`→`-`-prefixed `MyMalloc`, else `mystrdup`) + `set_clean_username` (P7v sibling) + `FLAGS_GOTID`; no `\n`/`\r` yet → early return; bad/empty → `is_abad++`. Config-resolved (USE_SYSLOG/DEBUGMODE off → no syslog/`get_client_name`/`Debug`; AFINET=AF_INET6 → `sockaddr_in6`/`sin6_port`; BUFSIZE=512). `index`→`strchr`, `rindex`→`strrchr`, `MyFree`→`free`, `ntohs`→`u16::from_be`; `sscanf` driven through libc with the exact C format. Seam: `-DPORT_S_AUTH_AUTHPORTS_P7w` on `s_auth_link.o`; both already global in `s_auth_ext.h` → no de-static, the prototype comes from the header. **L1** (`authports_diff.rs`, 10 cases) zero-diff vs `cref_`: `send_authports` over a *real* IPv6-loopback connected socket (so `getsockname`/`getpeername` populate `sin6_port` — an AF_UNIX socketpair leaves the port bytes untouched, a false diff) + the error/`highest_fd`-walk paths; `read_authports` over socketpair read-ends covering valid/OTHER/bad/ERROR/partial-early-return/EOF + the pre-auth free + `istat` decrement. Serialized on `GLOBALS_LOCK`. No L2/no S2S (utility TU, no `msgtab` entry, no live ident peer in the golden harness, no remote-user fields); existing golden suite (`golden_registration`) stays byte-identical.
- **P7x DONE: `s_auth.c` ident initiator `start_auth`** — ported the RFC1413 query initiator (`-DPORT_S_AUTH_START_AUTH_P7x` on the `s_auth_link.o` recipe): opens the non-blocking `authfd` socket, derives local/peer addrs from `getpeername`/`getsockname(cptr->fd)`, optionally overrides the bind source from the P-line TLS `source_ip`, then either hands off to iauth (`adfd>=0`: build `"<fd> C <themip> <themport> <usip> <usport>"` via `inetntop`+`ipv6string`+libc `sprintf`, `sendto_iauth`; success → `close authfd`/`authfd=-1`/`FLAGS_XAUTH`/return) or `bind`/`connect`s to `[peer]:113` (arm `FLAGS_WRAUTH|FLAGS_AUTH`, bump `highest_fd`). Config-resolved: NO_IDENT off (full body), USE_IAUTH on (early-return + handoff), USE_SYSLOG/DEBUGMODE off (no syslog/Debug), AFINET=AF_INET6. Calls the Rust `set_non_blocking`/`report_error`/`inetntop`/`inetpton`; *calls* the variadic `sendto_iauth`/`sendto_flag` (stay C). L1 differential (3 cases: `XOPT_REQUIRED && adfd<0` early return; iauth-handoff query bytes byte-identical over a shared real IPv6-loopback `cptr->fd`; getpeername-failure `authfd`-reset) zero-diff vs `cref_`, serialized on `GLOBALS_LOCK`. Utility/callee TU (no `msgtab`) — L1 is the gate; golden suite stays byte-identical (`golden_registration` confirmed); no S2S (no `IsServer`/remote-field path).
===== DOCS LOG TAIL =====

- **2026‑06‑06 — P7q (`s_bsd.c` `report_error`, error-reporting output leaf) merged.** The genuine clean leaf left in the central I/O TU.
  - **Cluster choice.** `report_error` (s_bsd.c:151) calls **no** other `s_bsd.c` function → it ports in isolation. The 27 internal call sites (the still‑C `add_connection`/`check_*`/`connect_server`/`read_message` + the already‑Rust P7d–P7p leaves that called it via an `extern "C"` decl) now resolve to the Rust definition. The remaining unported s_bsd.c functions (`add_connection`, `read_message`, `connect_server`, `get_my_name`, `init_sys`/`daemonize`/`start_iauth`, the `check_*` conf cluster) are all either event-loop cores, fork/destructive glue, or clustered via the file-private `static mysk` (`get_my_name`↔`connect_server`↔`check_client`) — none is a clean standalone leaf, so `report_error` was the right next pick.
  - **Guard / seam.** Partial port via the existing `s_bsd_link.o` second-compile, new guard `-DPORT_S_BSD_REPORT_ERROR_P7q` (added alongside P7d–P7p in `ircd-sys/build.rs`). The Rust port replaces the old `extern "C" { fn report_error }` decl in `s_bsd.rs`.
  - **Config‑resolved body.** `SO_ERROR` defined → the getsockopt readout compiles (mirrors P7d's `get_sockerr`); `DEBUGMODE` off → no `Debug`; `USE_SYSLOG` off → no `syslog`. `text` is a printf **format** taking two `%s` (`host`, `strerror`). Faithful: `errtmp = errno` first; `host = get_client_name(cptr, FALSE)` or `""`; the `!IsMe && fd>=0` SO_ERROR refinement; `sendto_flag(SCH_ERROR, text, host, strerror)`; the `Connecting||Handshake` + `serv->byuid[0]` + remote‑`bysptr` NOTICE (`:%s NOTICE %s :` via `strcpy`+`strncat`, then `sendto_one(bysptr, fmbuf, ME, bysptr->name, host, strerror)`); the `serverbooting` `fprintf(stderr, text, host, strerror)` + `fprintf(stderr, "\n")` echo. The variadic `sendto_flag`/`sendto_one`/`fprintf` are **called** (legal in stable Rust), not defined — the trampolines stay C until P8. `stderr` is glibc's `extern FILE *stderr` symbol (not the macro). Added inline `is_me`/`my_connect` helpers + a `SCH_ERROR` const.
  - **Classification.** Utility / output leaf — **no `msgtab` entry**. Effects: the `SCH_ERROR` opers notice (variadic wire, L2), the remote `bysptr` NOTICE (S2S), and the `serverbooting` stderr echo (L1‑capturable). So L1 gates the deterministic format core; the wire paths are L2/S2S/untested‑by‑design.
  - **L1.** `report_error_diff.rs`, 4 cases, isolated worlds (Rust reads the real `serverbooting` + calls Rust `get_client_name`; oracle uses `cref_serverbooting` + `cref_get_client_name`), serialized on `GLOBALS_LOCK`. A `capture_stderr` helper dup/pipe‑redirects fd 2 around each call, `fflush(NULL)` before+after, reads the pipe, restores fd 2. The same heap `aClient` (`calloc`‑zeroed, `fd=-1` → `!MyConnect` → `host=name`, no SO_ERROR, `status=STAT_CLIENT` → no bysptr) is passed to both worlds (read‑only). Each case sets both worlds' `serverbooting` + `errno`. Cases: (1) `serverbooting=1`+`cptr=NULL` → `host=""`, `errno=ECONNREFUSED` → formatted `"…:Connection refused\n"`; (2) **inverse / the gate** — `serverbooting=0` → **no** stderr output (both empty); (3) `serverbooting=1`+`cptr` non‑NULL → `host=get_client_name=name`, `errno=EHOSTUNREACH`; (4) host embedded mid‑string + varied errno (`ETIMEDOUT`/`EPIPE`). Zero‑diff vs `cref_report_error`.
  - **Verification.** `cargo build` (workspace, 0 warnings); `nm target/debug/ircd | grep ' T report_error'` → defined from Rust; L1 zero‑diff; L2 `golden_registration` (boot path exercises `report_error` on errors) byte‑identical.
  - **No new L2 / no S2S.** Output callee, not a `msgtab` handler — the `SCH_ERROR` error notice is covered by the existing golden suite. Untested‑by‑design: the `SO_ERROR` getsockopt readout (needs a pending‑error socket; `fd<0` skips it identically), the `sendto_flag` SCH_ERROR wire emission (L2, variadic), the `bysptr` remote NOTICE (S2S — needs a `Connecting`/`Handshake` server whose `byuid` resolves to a remote introducer).

- **2026-06-06 — P7r (`s_bsd.c` `init_sys`, fd-table boot leaf) merged.** Ported the cleanest remaining leaf in the central I/O TU `s_bsd.c`.
  - **Cluster choice** — after the P7d–P7q leaves, the genuinely-clean leaves are nearly exhausted; `init_sys` is the last one that calls **no** other `s_bsd.c` function and shares **no** private static with still-C code (it touches only the already-exported `fdas`/`fdall`/`local` globals). Contrast: `get_my_name` shares the private `mysk` static with still-C `check_init`/`connect_server` (a shared-static connected component, deferred); `daemonize`/`start_iauth` are blocked on the still-C iauth spawn.
  - **Config-resolved body** — two `#ifdef`s collapse the source: `RLIMIT_FD_MAX` is **not defined on Linux** (verified via `gcc -E`) → the entire `getrlimit`/`setrlimit` of `RLIMIT_FD_MAX`+`RLIMIT_CORE` block (with its `exit(-1)` arms) does not compile; `USE_POLL=1` (setup.h:390) → the `#if !defined(USE_POLL)` sequent `setdtablesize` block is excluded; Linux (not PCS/DYNIXPTX/SVR3/HPUX/SVR4) → the `setlinebuf(stderr)` branch. Resolved body: `setlinebuf(stderr)`; `bzero(&fdas)`/`bzero(&fdall)` + `fdas.highest=fdall.highest=-1`; `local[0]=local[1]=local[2]=NULL`; `for (fd=3; fd<MAXCONNECTIONS=50; fd++){ local[fd]=NULL; close(fd); }`. Callees: libc only.
  - **Mechanism** — partial port via the existing `s_bsd_link.o` second-compile seam, new guard `-DPORT_S_BSD_INIT_SYS_P7r` in `ircd-sys/build.rs`; `init_sys` wrapped in `#ifndef PORT_S_BSD_INIT_SYS_P7r` in `ircd/s_bsd.c`. Rust port in `ircd-common/src/s_bsd.rs`: `setlinebuf` via a local extern (reusing the module's `stderr` extern), `fdas`/`fdall` via `addr_of_mut!(ircd_sys::bindings::fdas/fdall)` + `write_bytes(_,0,1)`, `local[]` via the existing `local_base()` helper, `MAXCONNECTIONS` from bindgen.
  - **Classification** — boot callee, not a `msgtab` handler.
  - **L1** — `init_sys_diff.rs`, 3 cases, zero-diff vs `cref_init_sys`. The close loop closes fds `3..49` in the calling process → **destructive to cargo's test fds**, so each world runs in a **forked child** and returns its post-state through an `mmap(MAP_SHARED|MAP_ANONYMOUS)` region (memory, not an fd → survives the close loop); the parent `waitpid`s and asserts Rust-child == cref-child == expected. Each child pre-dirties its globals (`highest=7`, `fd[]` non-zero, `local[0]/[5]/[N-1]` sentinels) so the test proves the body **wrote** (inverse-of-dirty), opens a sentinel fd dup'd onto fd 10, and reports: `fdas`/`fdall.highest` (=-1), non-NULL `local[]` count (=0), `fd[]` fully zeroed, sentinel-fd-closed, fds 1/2 still open. Isolated worlds (real `fdas`/`fdall`/`local` vs `cref_*`), serialized on `GLOBALS_LOCK`.
  - **L2 / S2S** — no new L2 (boot callee; the existing golden suite boots through it, `golden_registration` byte-identical confirmed); no S2S (formats no remote-user fields). Untested-by-design: `setlinebuf(stderr)` (unobservable line-buffering); the rlimit/`exit` arms don't compile under the locked config.

- **2026-06-06 — P7s (`s_bsd.c` `get_my_name`, server-own-hostname resolver, + de-static `mysk`) merged.** The most leaf-like remaining `s_bsd.c` function after the P7d–P7r leaves. Ported `get_my_name` (s_bsd.c:2940) to `ircd-common/src/s_bsd.rs`.
  - **Cluster choice.** After P7d–P7r the genuinely-clean s_bsd.c leaves are exhausted; the remaining exported functions are the event-loop core (`add_connection`/`read_message` + statics), the connection-auth cluster (`check_init`/`check_client`/`check_server`/`check_server_init`), `connect_server`, and the fork/iauth glue (`daemonize`/`start_iauth`). `get_my_name` is the most leaf-like: its **only** in-TU callee is `add_local_domain` (already Rust, P7e); everything else is libc (`gethostname`/`gethostbyname`/`isdigit`/`strlen`) or already-Rust (`find_me` P6, `inetpton`/`mycmp` P1, `minus_one`/`me` bindgen). NB: the `utmp_open`/`utmp_read`/`utmp_close` trio + `summon` are **not** remaining leaves — they're `#if defined(ENABLE_SUMMON) || defined(USERS_SHOWS_UTMP)` (both off) so they don't compile at all (user-confirmed).
  - **The `mysk` blocker / de-static.** `get_my_name` **writes** the file-private `static struct SOCKADDR_IN mysk` (s_bsd.c:55); the still-C `check_client` (s_bsd.c:965, localhost detection) and `connect_inet` (s_bsd.c:2687/2692, outgoing bind) **read** it. To split the writer (→ Rust) from the C readers, `mysk` needs a linkable symbol → changed `static struct SOCKADDR_IN mysk;` → `struct SOCKADDR_IN mysk;` (file-scope global) **unconditionally** (behaviour-preserving: single TU, no other `mysk`; storage-class only). This also makes the cref archive export `cref_mysk` (the `objcopy --prefix-symbols` rename only follows *global* symbols — the L1 static-symbol limit), so the L1 test gets a full cross-world `mysk` comparison. `mysk` stays **C-owned** (defined in `s_bsd_link.o`); Rust references it via a local `extern "C" { static mut mysk: libc::sockaddr_in6; }`.
  - **Guard / seam.** Partial port via the existing `s_bsd_link.o` second-compile, new guard `-DPORT_S_BSD_GET_MY_NAME_P7s` added alongside P7d–P7r in `ircd-sys/build.rs`; the C body (s_bsd.c:2940-3023) wrapped in `#ifndef PORT_S_BSD_GET_MY_NAME_P7s`. RED confirmed `get_my_name` undefined — referenced by the still-C `ircd.c:702` (boot); after GREEN `nm target/debug/ircd` shows `get_my_name` `T` from Rust and `mysk` a `B` global. The cref oracle keeps the full unguarded `s_bsd.o` → `cref_get_my_name` + `cref_mysk`.
  - **Config-resolved body.** `HAVE_GETIPNODEBYNAME` **undef** (setup.h:53) → the plain `gethostbyname(cname) || gethostbyname(name)` branch (no `getipnodebyname`/`freehostent`). `DEBUGMODE` off → no `Debug` at 3015. The `mysk.SIN_ADDR` write at s_bsd.c:3012 is inside a `#if 0 … #endif` (dead) → **not** ported. `SOCKADDR_IN` = `sockaddr_in6` (`AFINET`=`AF_INET6`); `tmp[HOSTLEN+1]` (=64) is a module-private `static mut`; `ME` = `me.name`; `BadPtr(cname)` = `cname.is_null() || *cname == 0`; `strncpyzt` = `strncpy` + force-NUL.
  - **Faithfulness.** `mysk` is `bzero`'d first → full-struct byte compare is valid (padding/flowinfo/scope_id stay zero). The passwd branch fires only when `aconf->passwd && isdigit(*passwd)` (so `"2001:db8::1"` qualifies but `"::1"` does not — leading char must be a digit); `inetpton` failure → `bcopy(minus_one, …, 16)`. The alias loop is `for (hname=h_name, i=0; hname; hname=h_aliases[i++])` → Rust reads `h_aliases[i]` then `i += 1` (post-increment). `gethostbyname` is declared via a local extern (absent from the libc crate).
  - **Classification.** Boot callee / utility TU (no `msgtab` entry) — called from `ircd.c` boot + `connect_server`. → L1 is the gate; no S2S (formats no remote-user wire fields).
  - **L1.** `get_my_name_diff.rs`, 6 cases, isolated worlds (Rust writes the real `mysk`; oracle writes `cref_mysk`), shared `conf`/`cref_conf` M-conf list + shared read-only `cptr`, `me`/`cref_me` ME pinned to `irc.test`, separate `name` output buffers, serialized on `GLOBALS_LOCK`. Determinism: `gethostname`/`gethostbyname` are non-deterministic across runs but **identical across the two worlds in one run** → the differential holds whatever DNS returns; the test asserts the two worlds *agree* (`name` bytes + the full 28-byte `mysk`==`cref_mysk`), not a fixed string. Cases: (1) M-conf NULL passwd → addr stays zero (family/port set); (2) non-digit passwd `"abc"` → isdigit false → addr zero (inverse); (3) valid `"2001:db8::1"` → inetpton fills `20 01 0d b8 … 01`; (4) digit-but-invalid `"9zz"` → inetpton fails → `mysk` addr all-`0xff` (minus_one); (5) `cname="localhost"` → drives the `gethostbyname` + alias-loop branch; (6) `cname=""` → `BadPtr` early return after `add_local_domain`. Zero-diff vs `cref_get_my_name`.
  - **Verification.** `cargo build` (workspace, 0 warnings); L1 zero-diff; sibling s_bsd L1 (`s_bsd_leaves_diff`/`add_local_domain_diff`/`init_sys_diff`/`report_error_diff`/`close_connection_diff`) re-run green; `golden_registration` byte-identical (boot exercises `get_my_name`).
  - **Untested-by-design.** The resolved hostname is host-dependent (asserted as *agreement*, not a literal); the `gethostname == -1` early return needs an induced failure (both worlds take the success path identically).

- **2026-06-06 — P7t (`ircd.c` `calculate_preference`, AC preference leaf) merged.** Ported `calculate_preference` (ircd.c:387) to `ircd-common/src/ircd.rs`.
  - **Cluster choice** — the cleanest remaining exported leaf in `ircd.c`: the `s_bsd.c` clean leaves are exhausted (the rest belong to the deferred event-loop / auth / connect clusters), and `calculate_preference`'s only TU-callee, `send_ping`, was already ported in P7m. It is the periodic auto-connect (AC) preference recompute invoked from `io_loop` (ircd.c:1164) when `timeofday >= nextpreference`.
  - **Body** — walks the global `conf` list; skips non-C-lines (status lacking `CONF_CONNECT_SERVER|CONF_ZCONNECT_SERVER`) and AC-ineligible C-lines (`port <= 0`); for the rest fires `send_ping(aconf)` (advances the conf's `aCPing` sliding window) then sets `pref = -1` when there is no usable window (`cp==NULL || cp->seq==0 || cp->recvd==0`), else computes `pref = (u_int)(f*100)` from `recvd/seq`, `pow(f,20)`, `ping/recvd` with a `0.001` floor and a `100000.0` ceiling. Returns `currenttime + 60`.
  - **Config-resolved body** — no `#ifdef`s; compiles verbatim. `CONF_CONNECT_SERVER=0x08`, `CONF_ZCONNECT_SERVER=0x20`.
  - **Seam** — partial port via the existing `ircd_link.o` second-compile (which already drops the P7c tune pair); new guard `-DPORT_IRCD_CALC_PREF_P7t` added to its `make --eval` line. The C function is wrapped `#ifndef PORT_IRCD_CALC_PREF_P7t … #else extern time_t calculate_preference(time_t); #endif` — the function is in no `*_ext.h`, and `io_loop` (its sole caller, same TU, defined later) relied on the in-file definition for its implicit prototype, so the `#else` supplies the `extern` declaration. `nm target/debug/ircd` confirms `T calculate_preference` (came from Rust).
  - **Faithfulness** — calls the **libc `pow`** via a local `extern "C" { fn pow(f64,f64)->f64; }`, NOT `f64::powf`: the std intrinsic is permitted to differ from the system `pow` in the last ULP, which would diverge the `(u_int)(f*100.0)` integer truncation and break L1. The final store reproduces the C `double → u_int → int` cast chain as `(f * 100.0) as u32 as c_int` (`f` is clamped `≤ 100000.0`, so `f*100 ≤ 1e7` fits `u32`). `send_ping` is called *before* the `cp` read, faithfully — order matters because it mutates the window the pref math reads.
  - **Classification** — utility / callee TU (no `msgtab` entry; reached only from `io_loop`).
  - **L1** — `ircd-testkit/tests/calculate_preference_diff.rs`, zero-diff vs `cref_`. Two isolated worlds (Rust reads `conf`/`udpfd`; oracle reads `cref_conf`/`cref_udpfd`), each builds a parallel `conf` linked list, runs, then compares every node's `pref` + `aCPing` post-state + the `currenttime+60` return. 5 cases: non-C-line skip (pref untouched), `port<=0` skip (send_ping not even called), `recvd==0` sentinel (send_ping bumps seq/lseq, recvd stays 0 → `-1`), full-window compute (byte-identical pref), and a 5-node mixed list. `udpfd` left at `-1` (send_ping's `sendto` fails, ignored; the pref math reads only the counters mutated beforehand). Serialized on `GLOBALS_LOCK` (the P7 L1 shared-global hazard).
  - **L2** — no new test: the locked golden config defines no `connect{}` C-lines, so the loop body is a no-op on a golden boot → `golden_registration` stays byte-identical (re-confirmed). Same utility-leaf L2 posture as P7c/P7m.
  - **S2S** — none: formats no remote-user wire fields (only a numeric `pref` field and a binary UDP datagram via send_ping).
  - **Untested-by-design** — the `cp==NULL` clause of the `-1` sentinel is dead defensive code: `calculate_preference` calls `send_ping(aconf)` first, and `send_ping` unconditionally dereferences `cp->port`, so an AC-able C-line with `ping==NULL` segfaults both implementations identically. It never occurs in practice (config allocates an `aCPing` for every `connect{}` line), so the L1 test never builds such a node and the realistic sentinel is exercised via `recvd==0`.

- **2026-06-06 — P7u (`s_auth.c` iauth `/STATS` reporters `report_iauth_conf`/`report_iauth_stats`) merged.** Opened the last P7 TU, `s_auth.c` (the socket/ident/iauth-pipe I/O deferred from P5), by porting its two cleanest leaves to `ircd-common/src/s_auth.rs`.
  - **Cluster choice.** After P7a–P7t the clean leaves of `s_bsd.c` and `ircd.c` are exhausted (the rest are the deferred event-loop/auth/connect-server/signal clusters), so the natural next move is `s_auth.c`. Its iauth-pipe **write** path (`vsendto_iauth`/`sendto_iauth`) is irreducibly C — `vsendto_iauth` takes `va_list` and `sendto_iauth` is variadic (the keystone send-family finding) → P8, not now. The **read** path `read_iauth` is the big iauth protocol parser (stays C). The two cleanest leaves are the `/STATS` reporters: each walks a `LineItem` (`aExtCf`/`aExtData` = `struct LineItem { char *line; struct LineItem *next; }`) linked list and emits one numeric per node via `sendto_one`. Their only in-TU dependency is the two list heads `read_iauth` populates.
  - **Config-resolved body.** Both live in the `#if defined(USE_IAUTH)` block (USE_IAUTH **ON** → compiled). `RPL_STATSIAUTH=239`, `RPL_STATSDEBUG=249` (bindgen consts); `ME=me.name`. No `#ifdef`-gated branches inside either body. `report_iauth_conf` early-returns when `adfd < 0` (iauth slave fd); `report_iauth_stats` has no guard.
  - **The seam / de-static.** The writer `read_iauth` stays C, so to split the Rust readers from it the two file-`static` list heads `iauth_conf`/`iauth_stats` (s_auth.c:97-98) are **de-static'd** (drop `static`, file-scope global) — behaviour-preserving (single TU, no other symbol of those names; storage-class only), the P7s `mysk` precedent. This gives the C-owned globals linkable symbols (defined in `s_auth_link.o`, written by `read_iauth`; Rust references them via a local `extern "C" { static mut … : *mut LineItem }`) **and** makes the cref archive export `cref_iauth_conf`/`cref_iauth_stats` (the `objcopy --prefix-symbols` rename only follows global symbols — the L1 static-symbol limit), giving the L1 differential parallel C-owned heads to populate.
  - **Guard / build.rs.** Partial port via a new `s_auth_link.o` second-compile, guard `-DPORT_S_AUTH_REPORT_P7u`; the C bodies wrapped `#ifndef PORT_S_AUTH_REPORT_P7u … #endif`. Added `"s_auth.o" => "s_auth_link.o"` to `link_objs()` and a plain `sh -c` compile (s_auth.c references no machine-path macros — `start_iauth` lives in `s_bsd.c`, not here — so no `make --eval` path-var expansion needed, unlike `s_bsd_link.o`/`ircd_link.o`). `s_auth.o` stays in `CREF_OBJS` (unguarded oracle); **not** in `PORTED` (still-C symbols remain). RED confirmed `report_iauth_conf`/`report_iauth_stats` undefined — referenced by the already-Rust `m_stats` (s_serv.rs) and `tstats` (s_misc.rs); after GREEN `nm target/debug/ircd` shows both `T` (from Rust) and `iauth_conf`/`iauth_stats` `B` (C-owned globals).
  - **Faithfulness.** `report_iauth_conf` checks `adfd < 0` **before** the walk; both post-increment through `ectmp = ectmp->next` in declaration order (head first). `sendto_one` called via a local `extern "C"` variadic decl (the s_numeric pattern); fmt literal `c":%s %d %s :%s".as_ptr() as *mut c_char`.
  - **Classification.** Utility / callee TU (no `msgtab` entry) — reached only from STATS: `report_iauth_conf` ← `s_serv.c` m_stats (`/STATS a`/`i`), `report_iauth_stats` ← `s_misc.c` `tstats` (`/STATS t`). → L1 is the gate.
  - **L1.** `ircd-testkit/tests/iauth_reporters_diff.rs`, 6 cases, zero-diff. The reporters' only observable surface is the bytes `sendto_one` buffers into the recipient's `sendQ`, so the test builds a shared read-only `LineItem` list (pointed at by both `iauth_conf` and `cref_iauth_conf` — the reporters never mutate it), gives each world its OWN heap recipient `aClient` (Rust `send_message`→Rust `dbuf_put` vs `cref_send_message`→`cref_dbuf_put` — separate dbuf pools), drives both reporters, then drains each `sendQ` with its MATCHING `dbuf_get` (cross-reading would corrupt the foreign freelist) and asserts byte-identical. Recipient: `fd=-1`, `status=STAT_CLIENT`, `from`/`serv`/`confs` NULL (`get_sendq` returns default QUEUELEN, no deref), `acpt = &me`/`&cref_me` so `send_message`'s `if (to->acpt != &me) (*to->acpt).sendM++` branch is skipped (a real local client always has a valid `acpt`; the zeroed NULL would deref — found the hard way). Cases: (1) 3-node conf list, `adfd=5` → 3× RPL_STATSIAUTH; (2) **inverse/guard** non-empty list, `adfd=-1` → no output; (3) **inverse** empty conf list → no output; (4) 3-node stats list → 3× RPL_STATSDEBUG; (5) **inverse** empty stats list → no output; (6) single node + longer `to` arg → `%s :%s` passthrough. Serialized on `GLOBALS_LOCK` (`me`/`adfd`/`iauth_conf`/`iauth_stats` are process globals).
  - **L2.** No new test: golden boots `-t -s` (no iauth) → `adfd<0` + empty lists → both reporters are no-ops, so any STATS path stays byte-identical = no-regression only. `golden_registration` re-confirmed byte-identical.
  - **S2S.** None — the reporters format no remote-user wire fields (only the local server name + a config/stat line).
  - **Verification.** `cargo build --workspace` (0 warnings); L1 zero-diff (6/6); `golden_registration` byte-identical.

- **2026-06-06 — P7v (`s_auth.c` `set_clean_username`) merged.** The last pure-logic leaf of `s_auth.c`; everything else left in the TU is socket/ident/iauth-pipe I/O kept in C.
  - **Cluster choice.** `set_clean_username` (s_auth.c:44) is the only `s_auth.c` function with no socket/fd dependency — callees are libc-only (`strchr`/`strlen`/`isspace`/`strcmp`, `MyFree`→`free`) plus the `istat` global (defined in still-C ircd.c, reachable via bindgen) and the interior self-pointer `cptr->auth = cptr->username`. The remaining `s_auth.c` symbols are all I/O: `read_iauth` (iauth-pipe parser, writes the P7u list heads), the variadic `sendto_iauth`/`vsendto_iauth`, `start_auth` + the ident-protocol `send_authports`/`read_authports` — per the PLAN these stay C for now.
  - **Behaviour.** Derives `cptr->username` (≤USERLEN=10 + NUL) from the raw ident reply: NULL `auth` → early return; mark "dirty" (prefix a `-`) if `auth` contains `[`/`@`, `strlen>USERLEN`, has a leading `:` (then skip it), or has whitespace followed by more chars; copy up to USERLEN chars dropping `@`/`[`/whitespace; if the cleaned name `strcmp`-equals the original, `MyFree(auth)` + redirect `auth` at the interior `username` buffer (the `make_client` self-pointer hazard → `addr_of_mut!`), else the original heap `auth` survives and `istat.is_authmem += strlen+1`, `istat.is_auth += 1`.
  - **Guard / seam.** `set_clean_username` was `static` → `nm -g` (ircd-testkit's cref renamer) emitted no oracle. De-static'd in s_auth.c (storage-class only, behaviour-preserving — single TU, no other symbol of this name; the P7s `mysk` / P7u list-head precedent) and the body `#ifndef PORT_S_AUTH_CLEAN_USERNAME_P7v`-guarded out of `s_auth_link.o` (`-D` added to the recipe in `ircd-sys/build.rs` alongside `-DPORT_S_AUTH_REPORT_P7u`), with an `#else` extern prototype so the still-C callers keep a declaration. RED confirmed `undefined reference to set_clean_username` from both the test and the C callers (`read_iauth`:410, `read_authports`:810); after GREEN `nm target/debug/ircd` shows `T set_clean_username` (from Rust). The cref oracle keeps the full unguarded `s_auth.o` → `cref_set_clean_username`.
  - **Classification.** Utility/callee (no `msgtab` entry). Reached only from the still-C `read_iauth`/`start_auth`, which need a live iauth/ident peer the golden harness doesn't run (boots `-t -s`, `adfd<0`). L1 is the gate.
  - **L1.** `ircd-testkit/tests/set_clean_username_diff.rs`: two independent calloc'd heap `aClient`s per case (one driven by `c_set_clean_username` [→Rust], one by `cref_set_clean_username`), each with its own `auth` allocated by libc `strdup` (the fn may `free()` it → must be malloc-compatible, not a Rust `CString`); calloc'd → zeroed `username[11]` so trailing bytes match. Asserts byte/field-identical across worlds: the full `username[11]` buffer, the `is_auth`/`is_authmem` deltas (`istat` vs `cref_istat`, read before/after), and the `auth == &username` self-pointer predicate (plus, when false, the surviving `auth` string content). 9 cases: free path (`"bob"`, exact-USERLEN `"abcdefghij"`, empty `""`), istat path (`"bob@host"`, `"bo[b"`, `"verylongusername"`, `":bob"`, `"bo b"`), inverses (`"bob "` trailing-whitespace not-dirty-but-unequal, NULL-auth early return). Zero-diff; serialized on `GLOBALS_LOCK` (`istat`/`cref_istat` are process globals).
  - **L2 / S2S.** No new L2: the only callers are unreachable under the golden harness's `-t -s` boot (no iauth slave, no ident peer); `golden_registration` stays byte-identical (no-regression). No S2S — the function formats no remote-user fields / has no `IsServer` branch.

- **2026-06-06 — P7w (`s_auth.c` ident-protocol I/O pair `send_authports`/`read_authports`) merged.** The RFC1413 ident query/reply pair — the leaf relative to the still-C `start_auth` + the `s_bsd.c` event loop (`s_bsd.c:2363`/`2368`, the `FLAGS_WRAUTH`/auth-readable arms). Ported to `ircd-common/src/s_auth.rs` alongside the P7u reporters + P7v `set_clean_username`.
  - **Cluster choice** — leaf-first: these are leaves relative to `start_auth` (which opens the ident connection) and the still-C select/poll loop. They share no file-`static` with the rest of `s_auth.c` (the `iauth_*` statics belong to `read_iauth`) → independent cluster. The remaining s_auth C = `read_iauth` (iauth-pipe parser), `start_auth` (connection setup), the variadic `sendto_iauth`/`vsendto_iauth`.
  - **Config-resolved body** — `USE_SYSLOG` undef → the get{sock,peer}name-error `syslog(...)` block (the only `get_client_name` call) drops to a bare `goto authsenderr`; `DEBUGMODE` undef → every `Debug((...))` a no-op (its `inet_ntop`/`ipv6string` arg never evaluated); `AFINET=AF_INET6` → `SOCKADDR_IN`=`sockaddr_in6`, `SIN_PORT`=`sin6_port`, `SOCKADDR`=`sockaddr`, `SOCK_LEN_TYPE`=`socklen_t`; `BUFSIZE=512` (`cptr->buffer` is `[char;512]`, `count` an `int`); flags `FLAGS_AUTH=0x200`/`FLAGS_WRAUTH=0x400`/`FLAGS_GOTID=0x1000`, `ClearAuth`=`flags&=~FLAGS_AUTH`.
  - **`send_authports`** — `getsockname`/`getpeername(fd)` (short-circuit `||` preserved), `sprintf`→Rust `format!("{} , {}\r\n", ntohs(them.sin6_port), ntohs(us.sin6_port))`, single `write(authfd)`. A short write or a get{sock,peer}name failure is `authsenderr`: `ircstp->is_abad++`, `close(authfd)`, walk `highest_fd` down while `local[highest_fd]` is NULL, `authfd=-1`, clear `FLAGS_AUTH|FLAGS_WRAUTH`. Success → clear only `FLAGS_WRAUTH`.
  - **`read_authports`** — `read(authfd, buffer+count, sizeof(buffer)-1-count)` (buffered across partial reads via `count`), then `libc::sscanf(buffer, "%hd , %hd : USERID : %*[^:]: %512s", &remp, &locp, ruser)` (driven through libc with the exact C format → bit-identical parse). On a match: extract `system` (the `: <type> :` field via `strrchr` + leading-`isspace` skip + `strncpyzt`) and `ruser` (copy non-space/non-`:` chars). No match but `len!=0` and a `\n`/`\r` present → clear `ruser`; no `\n`/`\r` yet → **early return** (keep reading). Then `close(authfd)` + `highest_fd` walk + `count=0` + `authfd=-1` + `ClearAuth`; `!locp||!remp||!*ruser` → `is_abad++`, else `is_asuc++`; free the old `auth` (+`istat` decrement) when it's not the interior `username` pointer, set `auth` (`OTHER`→`MyMalloc`+`'-'`+`strcpy`, else `mystrdup`), `set_clean_username`, `FLAGS_GOTID`.
  - **Seam** — `-DPORT_S_AUTH_AUTHPORTS_P7w` added to the `s_auth_link.o` second-compile; both bodies `#ifndef`-guarded out of `s_auth.c`. Both are already global in `s_auth_ext.h` (unlike the static `set_clean_username`), so the C callers' prototype comes from the header → **no de-static, no `#else` prototype** needed (the P7u `report_iauth_*` precedent). RED confirmed: `cargo build -p ircd-rs` → exactly `send_authports`/`read_authports` undefined (from `s_bsd.c:2363`/`2368`); GREEN: `nm target/debug/ircd` shows both as `T` (from Rust). `index`→`strchr`, `rindex`→`strrchr`, `MyFree`→`free`, `ntohs`→`u16::from_be`; globals `ircstp`/`highest_fd`/`local[]`/`istat` + `mystrdup`/`MyMalloc` are the ircd-common defs.
  - **Classification** — utility/callee TU (no `msgtab` entry); reached only from the still-C ident I/O path. **L1 is the gate.**
  - **L1** — `ircd-testkit/tests/authports_diff.rs`, 10 cases, zero-diff vs `cref_*`. Two independent heap `aClient`s + per-world `ircstp`(+backing `stats`)/`istat`/`highest_fd`/`local[]` (the `cref_*` twins), serialized on `GLOBALS_LOCK` (the P7 L1 shared-global convention). fd I/O over socketpairs. **`send_authports`**: both worlds' `fd` point at one *real* connected IPv6-loopback socket (`connected_inet6`) so `getsockname`/`getpeername` populate `sin6_port` identically — an AF_UNIX socketpair leaves the port bytes untouched, so C reads uninitialised stack while Rust reads its zeroed buffer (the one false diff this caught, fixed in the harness, not the port). Each world writes to its own `authfd` whose bytes are read back and compared. Cases: success (identical written bytes + `FLAGS_WRAUTH` cleared, `FLAGS_AUTH` untouched), getsockname-error (`fd=-1` → `is_abad++`, `authfd=-1`, flags cleared), and the `authfd==highest_fd` walk to a non-NULL `local[]` floor. **`read_authports`**: each world's `authfd` is a socketpair read-end fed an identical canned reply. Cases: valid `USERID`(→`is_asuc++`, username `bob`, free path), `OTHER`(→`-bob`), bad reply with `\n`(→`is_abad++`, no `GOTID`), `ERROR` reply, **partial read with no `\n`/`\r`**(→ early return: `authfd` still open, `count` advanced, no counter change — the inverse/round-trip case), EOF (`read`==0 → `is_abad++`), and a pre-existing heap `auth` (→ freed + `istat` decremented). Asserts byte/field identical `username[11]`, `auth` (string or the `auth==&username` predicate), `flags`, `count`, `authfd`, and the `is_asuc`/`is_abad` + `is_auth`/`is_authmem` deltas.
  - **L2 / S2S** — none. No `msgtab` entry; the ident path needs a live ident server the `ircd-golden` harness doesn't run (`-t -s`, `adfd<0`). Formats no remote-user wire fields, no `IsServer` branch → no S2S. Existing golden suite stays byte-identical (`golden_registration` re-run green as the no-regression check).

- **2026-06-06 — P7x (`s_auth.c` ident initiator `start_auth`) merged.** Ported `start_auth` (s_auth.c:544) to `ircd-common/src/s_auth.rs` — the function that initiates the RFC1413 (ident) query carried out by the P7w pair `send_authports`/`read_authports`.
  - **Cluster choice** — leaf-first: the last ident-protocol leaf in s_auth.c. Remaining C in s_auth.c after this = `read_iauth` (iauth-pipe parser) + the variadic `sendto_iauth`/`vsendto_iauth` (va_list → P8 trampolines).
  - **Guard** — `-DPORT_S_AUTH_START_AUTH_P7x` added to the existing `s_auth_link.o` recipe (alongside `_P7u`/`_P7v`/`_P7w`). The C body is `#ifndef`-guarded with an `#else` extern prototype so the still-C callers (`s_bsd.c:1272`/`1732` — `check_client`/`add_connection`) keep a declaration.
  - **Config-resolved body** — `NO_IDENT` undef → full body (not the empty stub); `USE_IAUTH` on → the `(iauth_options & XOPT_REQUIRED) && adfd<0` early-return + the `adfd>=0` iauth-handoff `abuf` block; `USE_SYSLOG` undef → the `socket()`-failure `syslog` collapses to a bare `ircstp->is_abad++`; `DEBUGMODE` undef → every `Debug((...))` no-op; `AFINET=AF_INET6` → `SOCKADDR_IN`=`sockaddr_in6`, `SIN_FAMILY`/`SIN_PORT`=`sin6_family`/`sin6_port`, `SOCK_LEN_TYPE`=`socklen_t`.
  - **Faithfulness** — `ntohs`→`u16::from_be`, `htons`→`u16::to_be`; the iauth query is built with libc `sprintf` through the exact `"%d C %s %u "`/`"%s %u"` formats + the global `ipv6string` scratch the C reused (sequenced them→us, byte-for-byte); `IsConfTLS(x)`=`x->flags & PFLAG_TLS`, `BadPtr(x)`=`!x||*x=='\0'`. The Rust ports `set_non_blocking` (P7d)/`report_error` (P7q)/`inetntop`/`inetpton` (P1) resolve through the link seam; the variadic `sendto_iauth`/`sendto_flag` are *called* via a local `extern "C"` block. `errno` via `*libc::__errno_location()` compared to `EINPROGRESS`.
  - **Classification** — utility/callee TU (no `msgtab` entry); reached only from the still-C connection path (`add_connection`→`check_client`→`start_auth`), which needs a live ident peer the `ircd-golden` harness doesn't run.
  - **L1** — `ircd-testkit/tests/start_auth_diff.rs`, 3 cases, zero-diff vs `cref_start_auth`, serialized on `GLOBALS_LOCK` (P7 shared-global convention), per-world `adfd`/`iauth_options`/`ircstp`/`highest_fd`: (1) `XOPT_REQUIRED && adfd<0` early return (authfd/flags untouched); (2) iauth handoff — `adfd`=socketpair write-end (write succeeds → `sendto_iauth` returns 0), `cptr->fd`=a shared *real* connected IPv6-loopback socket so both worlds' getpeername/getsockname read identical addrs/ports → the query bytes written to `adfd` are byte-identical, `authfd` closed, `FLAGS_XAUTH` set; (3) getpeername failure on an unconnected socket → `report_error` + `authfd=-1` (compares cptr state only; the client needs a real `name`+`STAT_CLIENT` since fd>=0 → `get_client_name` takes the MyConnect/showip branch). Not covered (noted in the test header): the `MAXCONNECTIONS-2` fd-exhaustion guard (can't force a high fd) and the bind/connect-to-113 network tail.
  - **L2 / S2S** — no new test. Utility TU with no client/golden path under the locked config (no ident peer); L1 is the gate. Existing golden suite stays byte-identical (`golden_registration` green). No S2S — no `IsServer` branch, formats no remote-user fields.
  - **Observation (out of scope, pre-existing P5)** — case 3 surfaced a `get_client_name(showip=TRUE)` divergence on a NULL `auth` pointer: the Rust port emits `tester[@]` where glibc `sprintf("%.*s", N, NULL)` emits `tester[(null)@]`. Only observable via `report_error`'s stderr (not asserted here); a latent faithfulness gap in the P5 `get_client_name` port, not P7x.
