  - **L1.** `close_connection_diff.rs`, 6 cases, isolated worlds (Rust reads/mutates the real `ircstp`/`nextconnect`/`ListenerLL`/`local`/`fdas`/`fdall`/`me`/`istat` + calls Rust `close_client_fd`/`del_queries`/`det_confs_butmask`; oracle uses `cref_*`), serialized on `GLOBALS_LOCK`. `me.fd`/`cref_me.fd` pinned to -1 (inner `flush_connections` else-branch); `adfd`/`cref_adfd` pinned to -1 (`sendto_iauth` no-op, no live iauth pipe); `firsttime`/`since` pinned to constants for deterministic `timeofday - firsttime` deltas. Cases: (1) server → `is_sv`/`is_sbs`/`is_sbr`/`is_sti`; (2) client → `is_cl`/`is_cbs`/`is_cbr`/`is_cti` (inverse: server/ni untouched); (3) unknown → only `is_ni`; (4) handshake + connecting, `nextconnect==0` → `nextconnect = now + 30`; (5) P-line acceptor refcount 5→4 (inverse: closed client fd torn down); (6) illegal listener (`CONF_ILLEGAL`, `clients<=0`) unlinked from a 2-node `ListenerLL` — inverse invariants: head.next NULL, `ListenerLL` head intact, target fd -1, `from` NULL, `confs` detached. Zero-diff vs `cref_close_connection`. **Fixture note:** case 6's `det_confs_butmask`→`detach_conf` decrements the unsigned `istat.is_conflink` once per detached link; seeded `is_conflink=1` in both worlds (the real `attach_conf` would have incremented it) — without it the decrement underflows (C wraps silently, Rust debug-overflow panics, surfacing the unrealistic fixture).
  - **Untested-by-design.** The recursive `close_connection(cptr->acpt)` when the acceptor itself becomes illegal (needs a fully-illegal acceptor conf — case 5 covers the non-recursive refcount arm). The `find_conf_exact` reconnect-reschedule arm (returns NULL with no conf loaded → both worlds skip it identically). The `sendto_iauth` wire emission (L2, variadic trampoline, like the rest of the sendto_* family).
  - **L2 / S2S.** No new L2: hit on every disconnect; `golden_registration` (incl. `register_quit_reuse_releases_nick`) stays byte-identical. No S2S: formats no remote-user fields (the `IsServer` branch touches only local stats counters + reconnect scheduling, not wire output).

- **2026-06-06 — P7i (`s_bsd.c` listener-list teardown leaf `close_listeners`) merged.** The next `s_bsd.c` leaf after P7d (socket/file trio), P7e (`add_local_domain`), P7f (`delay_close`), P7g (`close_client_fd`), P7h (`close_connection`). Ported `close_listeners` (s_bsd.c:427) to `ircd-common/src/s_bsd.rs` — the listener-GC layer directly above the P7g/P7h teardown leaves.
  - **Cluster choice.** The cleanest remaining s_bsd leaf: it is a pure walk over the `ListenerLL` global dispatching to two already-Rust callees (`close_client_fd` P7g, `close_connection` P7h) — no socket syscalls of its own, effect fully observable as `ListenerLL` + per-node `aClient` post-state. The other remaining s_bsd symbols are the event-loop core (`read_message`/`add_connection`), listener *construction* (`inetport`/`add_listener`/`open_listener` — real `socket`/`bind`/`listen`), sender-only (`report_error`), real-DNS (`get_my_name`), or `static` (no `cref_` oracle: `set_sock_opts`/`check_init`).
  - **Guard / seam.** Same `s_bsd_link.o` partial-compile; added `-DPORT_S_BSD_CLOSE_LISTENERS_P7i` to the recipe in `ircd-sys/build.rs` (alongside the P7d/P7e/P7f/P7g/P7h guards) and wrapped the C body (s_bsd.c:427-462) in `#ifndef PORT_S_BSD_CLOSE_LISTENERS_P7i`. RED confirmed `close_listeners` undefined — referenced only by the now-Rust `s_conf.rs` rehash (`s_conf.c:1315`); after GREEN `nm target/debug/ircd` shows it `T` from Rust. The cref oracle keeps the full unguarded `s_bsd.o`.
  - **Config-resolved body.** UNIXPORT off (`cbuild/config.h:339 #undef UNIXPORT`; `nm cbuild/s_bsd.o` has no `unixport`) → the entire `#ifdef UNIXPORT` `IsUnixSocket`/`sprintf(unixpath)`/`unlink` block is not compiled. Resolved body: `for (acptr = ListenerLL; acptr; acptr = bcptr) { aconf = acptr->confs->value.aconf; bcptr = acptr->next; if (IsIllegal(aconf)) { if (aconf->clients > 0) close_client_fd(acptr); else close_connection(acptr); } }`. The `bcptr = acptr->next` is read *before* the teardown because `close_connection` may unlink `acptr` (the P7h `ListenerLL`-unlink arm). `IsIllegal` reuses the existing `conf_is_illegal` helper (`aconf->status & CONF_ILLEGAL`). No new externs — both callees are Rust in the same module.
  - **Classification.** Callee/utility TU (no `msgtab` entry) — the rehash listener garbage-collector, called from `s_conf.c` `rehash`.
  - **L1.** `close_listeners_diff.rs`, 5 cases, isolated worlds (Rust reads/mutates the real `ListenerLL`/`local`/`fdas`/`fdall`/`me`/`ircstp`/`istat` + calls the Rust `close_client_fd`/`close_connection`; oracle uses `cref_*`), serialized on `GLOBALS_LOCK`. `me.fd`/`adfd` pinned to -1 (inner `flush_connections` else-branch + `sendto_iauth` no-op); listeners built with status `STAT_ME` + flags `FLAGS_LISTEN` + `from = self` + a one-element confs `Link` + a live pipe fd registered in `local`/`fdas`/`fdall`; `istat.is_conflink` seeded per `close_connection`-bound node (its `det_confs_butmask` decrements the unsigned counter once per detached link — underflow else). Each case builds an identical `ListenerLL` on both worlds, runs `close_listeners`, and compares the structural walk (surviving node count + per-node `(fd_torn, from_null, confs_null)` — pointers differ across worlds so the comparison is on observable facts) plus inverse invariants. Cases: (1) illegal clients=0 → `close_connection` → unlinked (`ListenerLL` drained, fd -1, `from` NULL, confs detached); (2) illegal clients>0 → `close_client_fd` → fd torn BUT node stays linked + `from == self` + confs NOT detached (inverse of 1); (3) legal → fully untouched (fd still a valid descriptor via `fcntl(F_GETFD)`, still linked); (4) mixed `[legal] -> [illegal,c=0] -> [legal]` → middle removed, the two legals relinked head↔next with intact fds; (5) all-illegal-c=0 → list fully drained. Zero-diff vs `cref_close_listeners`.
  - **L2 / S2S.** No new L2: `close_listeners` is the rehash listener-GC, exercised at boot/rehash by the existing golden suite (`golden_registration` byte-identical). No S2S: it formats no remote-user wire fields (its only side effects are the descriptor teardowns + `ListenerLL` mutation).

- **2026-06-06 — P7j (`s_bsd.c` listener-reactivation leaf `activate_delayed_listeners`) merged.** The next `s_bsd.c` leaf after P7d–P7i; the reactivation counterpart to P7i's `close_listeners` teardown. Ported `activate_delayed_listeners` (s_bsd.c:526) to `ircd-common/src/s_bsd.rs`.
  - **Cluster choice.** The cleanest remaining s_bsd leaf: a pure walk over `ListenerLL` flipping one flag bit (`FLAGS_LISTENINACTIVE`) + a `listen()` syscall + a counter, the natural pair to P7i. Its whole effect is per-node `flags`/listen-state post-state → L1-testable by list inspection. The other remaining s_bsd symbols are the event-loop core (`read_message`/`add_connection`), listener *construction* (`inetport`/`add_listener`/`open_listener`/`reopen_listeners` — real `socket`/`bind`/`listen`), sender-only (`report_error`), process setup (`daemonize`/`init_sys`/`start_iauth`), real-DNS (`get_my_name`), or `static` (no `cref_` oracle: `set_sock_opts`/`check_init`/`check_clones`).
  - **Guard / seam.** Same `s_bsd_link.o` partial-compile; added `-DPORT_S_BSD_ACTIVATE_DELAYED_P7j` to the recipe in `ircd-sys/build.rs` (alongside the P7d–P7i guards) and wrapped the C body (s_bsd.c:526-545) in `#ifndef PORT_S_BSD_ACTIVATE_DELAYED_P7j`. RED confirmed `activate_delayed_listeners` undefined — referenced by the now-Rust `s_serv.rs:739` (`m_set` burst path) and `s_misc.rs:1153` (`check_split`); after GREEN `nm target/debug/ircd` shows it `T` from Rust. The cref oracle keeps the full unguarded `s_bsd.o` → `cref_activate_delayed_listeners`.
  - **Config-resolved body.** No `#ifdef`s in this function; DEBUGMODE off → no `Debug` line. `IsListenerInactive(x)` = `(x)->flags & FLAGS_LISTENINACTIVE` (0x8000000, bindgen const); `ClearListenerInactive(x)` = `(x)->flags &= ~FLAGS_LISTENINACTIVE`; `flags` is a `c_long` field so the mask is `as c_long`. `LISTENQUEUE` (config.h:622 = 128) is a config `#define` absent from bindgen → reproduced as a `const c_int`. `listen()`'s return is ignored exactly as C → the observable post-state (inactive bit cleared, node kept) is identical regardless of the fd. `sendto_flag(SCH_NOTICE, ...)` is the existing variadic C trampoline (`ircd_sys::bindings::sendto_flag` + `ServerChannels_SCH_NOTICE`); no new extern. It is safe in L1 because it short-circuits when `svchans[chan].svc_ptr == NULL` (the default un-`setup_svchans`'d state) → no-op in both worlds.
  - **Classification.** Callee/utility TU (no `msgtab` entry) — reached from the server-burst / TS-adjust path (`s_serv.c`) and `s_misc.c` `check_split`. Formats **no remote-user fields** (only an integer count) → no S2S even though a server path reaches it.
  - **L1.** `activate_delayed_listeners_diff.rs`, 5 cases, isolated worlds (Rust reads/mutates the real `ListenerLL`/`me`; oracle uses `cref_*`), serialized on `GLOBALS_LOCK`. `me.fd`/`adfd` pinned to -1 (defensive). Each `new_listener(inactive)` builds an `aClient` (status `STAT_ME`, flags `FLAGS_LISTEN` [+`FLAGS_LISTENINACTIVE`]) over a **real TCP socket** so `listen()` genuinely succeeds (asserted via `getsockopt SO_ACCEPTCONN`). Each case builds an identical `ListenerLL` on both worlds, runs the function, and compares the per-node `(still_inactive, accepting)` vector + node count (listeners are never removed). Cases: (1) single inactive → activated (bit clear + `SO_ACCEPTCONN==1`); (2) single active → untouched (inverse — flag stays clear, not re-listened, stays in list); (3) mixed `[active,inactive,active]` → only middle activated, all 3 kept, order preserved; (4) empty → no-op (cnt=0, `sendto_flag` not fired, no crash); (5) all-inactive (3 nodes) → all activated. Zero-diff vs `cref_activate_delayed_listeners`.
  - **Untested-by-design.** The `sendto_flag` wire emission (cnt>0) is the variadic-trampoline path; with NULL `svc_ptr` it is a no-op (L2 territory, like the rest of the `sendto_*` family). `listen()`'s failure path is unreachable-by-observation (return ignored).
  - **L2 / S2S.** No new L2: hit by server-burst/rehash; `golden_registration` (incl. `register_quit_reuse_releases_nick`) stays byte-identical. No S2S: formats no remote-user wire fields.

- **2026-06-06 — P7k (`s_bsd.c` `add_connection_refuse`, connection-refuse leaf) merged.** The next leaf in the central I/O TU after the P7d–P7j socket/file/teardown/listener leaves; the refuse-path companion to `add_connection` (which stays C).
  - **Cluster choice** — `add_connection_refuse` (`s_bsd.c:1594`), a true leaf: its only callees are `close` (libc), `free_client` (Rust, P2), and a bump of the bindgen `ircstp` global. Called from `add_connection`'s four refuse paths (clone-check fail, IP-line refuse, `DELAY_CLOSE` accept throttle, DNSBL/iauth refuse), all later in the same C TU.
  - **Guard** — partial-ported via `s_bsd_link.o` with `-DPORT_S_BSD_ADD_CONN_REFUSE_P7k` added to the build.rs make-eval recipe; the C body wrapped in `#ifndef PORT_S_BSD_ADD_CONN_REFUSE_P7k … #endif`. The cref oracle keeps the full unguarded `s_bsd.o` so `cref_add_connection_refuse` survives.
  - **Config-resolved body** — `DELAY_CLOSE` is defined (`config.h:440`, =15) → the `#if !defined(DELAY_CLOSE)` arm (`delay = 0`) is **not compiled**; `delay` is honored verbatim. Body: `if (delay==0) close(fd); ircstp->is_ref++; acptr->fd = -2; free_client(acptr);`.
  - **ABI** — no `*_ext.h` prototype (file-local-by-use, defined before its callers in the same TU) but a global `T` symbol; the `#[no_mangle] pub unsafe extern "C" fn add_connection_refuse` resolves the C `add_connection` call sites at link. No bindgen decl needed. `free_client` called as `crate::list::free_client` (same crate).
  - **Classification** — utility/callee TU, not a `msgtab` handler. → L1 is the gate.
  - **L1** (`add_connection_refuse_diff.rs`, 3 cases) — two isolated worlds (Rust port `c_add_connection_refuse` vs `cref_add_connection_refuse`), each with its own backing `stats` (its `ircstp` points at it) and its own `make_client`/`free_client`. `acptr` built via that world's `make_client(NULL)` so `free_client` is the clean inverse (a `calloc`'d client would trip `free_client`'s `auth != username` error arm). `acptr` is freed inside the call → post-state is a UAF, so the test compares side effects: `is_ref` delta (+1) and the fd's fate. Case 1 `delay==0`: fd actually closed (second `close` → EBADF). Case 2 `delay==1`: fd left open (our `close` returns 0) — the happy-path/inverse pair. Case 3: two refuses accumulate `is_ref` to 2. Zero-diff vs `cref_`; serialized on `GLOBALS_LOCK` (the P7 L1 shared-global hazard — `ircstp`/`cref_ircstp` process-global).
  - **Untested-by-design** — `acptr->fd = -2` (set immediately before `free_client`; no surviving reader under the locked config). `free_client` internals are P2-tested (`list_diff.rs`).
  - **No L2 / no S2S** — reached only from `add_connection`'s refuse paths; no client command reaches it deterministically under the locked config, and it formats no remote-user wire fields. Sibling s_bsd L1 tests (P7d–P7j) re-run green after the shared `s_bsd_link.o` recipe change. `cargo build` 0 warnings; `add_connection_refuse` resolves `T` in `target/debug/ircd`.

- **2026‑06‑06 — P7l (`s_bsd.c` `setup_ping`, UDP CPING‑socket setup leaf) merged.** Ported the next s_bsd.c leaf after the P7d–P7k socket/file/teardown/listener/refuse leaves: the one‑shot setup half of the server‑to‑server CPING (UDP ping) feature.
  - **Cluster choice.** `setup_ping` (s_bsd.c:3018) is a self‑contained leaf — it binds the single shared `udpfd` UDP socket and returns its fd. Its only non‑libc deps are `inetpton` (Rust P1), `minus_one` (bindgen all‑`0xff` global), and `udpfd` (a C global it sets). The CPING‑output siblings `send_ping` (non‑static) and `check_ping`/`polludp` (static) stay C; they share `udpfd` only, which stays a C global, so no atomic cluster move is needed.
  - **Guard / seam.** Partial port via the existing `s_bsd_link.o` second‑compile, new guard `-DPORT_S_BSD_SETUP_PING_P7l` added alongside the P7d–P7k guards in `ircd-sys/build.rs`; the C body wrapped in `#ifndef PORT_S_BSD_SETUP_PING_P7l`.
  - **Config‑resolved body.** `AFINET` = `AF_INET6` (`common/os.h:680`) → `from` is a `libc::sockaddr_in6`, the `SIN_FAMILY`/`SIN_PORT`/`SIN_ADDR` macros map to `sin6_family`/`sin6_port`/`sin6_addr`. The `SETSOCKOPT` macro (`sys_def.h:29`) passes `sizeof(int)`=4 as the option length, **not** `sizeof(*p)`. `FNDELAY` = `O_NDELAY` = `O_NONBLOCK`. `DEBUGMODE`/`USE_SYSLOG` off → the `Debug`/`syslog` lines vanish. `IN6ADDRSZ` = 16.
  - **Faithfulness.** Idempotent short‑circuit (`udpfd != -1` → return it, ignore `aconf`); the assign‑then‑test (`(udpfd = socket(...)) == -1`) reproduced as set‑bindgen‑extern‑then‑check; each later failure does `close(fd); udpfd = -1; return -1`. Bind address: a numeric `aconf->passwd` (`isdigit(*passwd)`) → `inetpton(AF_INET6, …)`, falling back to a 16‑byte `bcopy` of `minus_one` on parse failure; else `in6addr_any`. `htons` = `(port as u16).to_be()`.
  - **Classification.** Callee TU, not a `msgtab` handler — reached only from the now‑Rust `s_conf.rs` rehash (`s_conf.c:2041`, a `connect{}` block with a port). RED confirmed the undefined `setup_ping` referenced by `s_conf.rs`; after GREEN `nm target/debug/ircd` shows `setup_ping` as `T` (from Rust).
  - **L1.** `ircd-testkit/tests/setup_ping_diff.rs`, 3 cases: (1) fresh setup opens a valid non‑blocking `SOCK_DGRAM` recorded in `udpfd`; (2) idempotent second call (the inverse‑of‑state path) returns the same fd unchanged and opens no new socket, even with a different `aconf`; (3) numeric `passwd` `"::1"` drives the `inetpton` bind‑address branch (loopback bind succeeds) vs the `in6addr_any` default. Zero‑diff vs `cref_setup_ping`; isolated worlds (real `udpfd` vs `cref_udpfd`), serialized on `GLOBALS_LOCK` with a `reset()` that closes the prior socket + restores `udpfd = -1` between cases. Because each world opens its own socket, the test compares the fd's *properties* (open, non‑blocking, `SOCK_DGRAM`) + the global‑state contract (`udpfd` set / idempotent), never the integer fd value.
  - **L2 / S2S.** No new L2 (callee, hit by rehash; `golden_registration` byte‑identical, 0 warnings). No S2S (formats no remote‑user fields).
  - **Untested‑by‑design.** The `setsockopt`/`bind`/`fcntl` failure arms (`close(fd); udpfd = -1`) need an induced syscall failure (privileged/occupied bind) — not deterministic in the sandbox; both worlds take the success path identically. The actual UDP `sendto` is `send_ping`'s concern (a later leaf).

- **2026‑06‑06 — P7m (`s_bsd.c` `send_ping`, UDP CPING‑output leaf) merged.** Ported the next s_bsd.c leaf after the P7d–P7l socket/file/teardown/listener/refuse/CPING‑setup leaves: the output half of the server‑to‑server CPING (UDP ping) feature, the sibling to P7l's `setup_ping`.
  - **Cluster choice.** `send_ping` (s_bsd.c:3077) is a self‑contained leaf — its only non‑libc dependency is the `udpfd` C global it `sendto`s over (and which stays C, shared with `setup_ping`/`polludp`). No ircd callees → no atomic cluster move. The CPING‑*input* siblings `check_ping`/`polludp` (both `static`, no `cref_` oracle) stay C; they share `udpfd` only.
  - **Guard / seam.** Partial port via the existing `s_bsd_link.o` second‑compile, new guard `-DPORT_S_BSD_SEND_PING_P7m` added alongside the P7d–P7l guards in `ircd-sys/build.rs`; the C body (s_bsd.c:3077‑3117) wrapped in `#ifndef PORT_S_BSD_SEND_PING_P7m`. RED confirmed `send_ping` undefined — referenced by the still‑C `ircd.c:405` (`try_connections` CPING path); after GREEN `nm target/debug/ircd` shows it `T` from Rust. The cref oracle keeps the full unguarded `s_bsd.o` → `cref_send_ping`.
  - **Config‑resolved body.** `AFINET`=`AF_INET6` (`common/os.h:680`) → `sin` is a `libc::sockaddr_in6`, `SIN_PORT`/`SIN_FAMILY`/`SIN_ADDR` map to `sin6_*`. `IN6ADDRSZ`=16 → `bcopy(aconf->ipnum.s6_addr, sin.sin6_addr.s6_addr, 16)`. DEBUGMODE/USE_SYSLOG off → the `Debug` line vanishes. `PING_CPING`=0x02 (`struct_def.h:411`, bindgen const) → `pi.pi_id = htonl(2)` (a `u_long`, network order).
  - **Faithfulness.** The C guard `if (!aconf->ipnum.s6_addr || AND16(...)==255 || !cp->port)` — the first disjunct is the address of an array field, so it is **always false** in C; reproduced as the two real gates only (`AND16==255` ≡ all 16 bytes `0xff` via `iter().fold(0xff, &)`, the unresolved `minus_one` sentinel; and `cp->port==0`). All `aCPing` counters (`ping`/`seq`/`lseq`/`recvd`) are `u_long` → unsigned arithmetic (`cp->seq * conFreq > 1200`, `cp->ping -= cp->ping/cp->recvd`). `pi.pi_seq = cp->lseq++` is post‑increment (the packet carries the pre‑increment value). The window block does `seq++` then conditional `seq--` (net 0 when it fires), with `recvd--` only when `recvd == seq` (post‑`++`). `sin.SIN_PORT = htons(cp->port)` = `(*cp).port.to_be()`.
  - **Classification.** Callee/utility TU (no `msgtab` entry) — reached from the server‑connect / `try_connections` CPING path, not a client command. Formats **no remote‑user fields** (only a binary UDP datagram to the configured peer) → no S2S.
  - **L1.** `send_ping_diff.rs`, 7 cases, isolated worlds (Rust reads the real `udpfd`; oracle reads `cref_udpfd`), serialized on `GLOBALS_LOCK`. Each case `open_udp()`s a fresh UDP socket as that world's `udpfd`, binds a non‑blocking `::1:<ephemeral>` receiver, points the conf's destination port at it, drives `send_ping`, and `recvfrom`s the datagram. Compares Rust‑vs‑oracle the deterministic `aCPing` post‑state (`seq`/`lseq`/`recvd`/`ping`) byte‑identical + the world‑independent packet fields (`pi_id == htonl(2)`, `pi_seq == pre‑increment lseq`); `pi_cp` (a live pointer) and `pi_tv` (`gettimeofday`) are nondeterministic/world‑specific → excluded. Cases: (1) basic send, no window → `lseq` 0→1, `seq` 0→1, packet with `pi_seq=0`; (2) unresolved ipnum (all `0xff`, `AND16==255`) → early return, counters untouched, no packet (inverse of 1); (3) `cp->port==0` → early return; (4) `conFreq==0` → early return; (5) window `recvd>0` (`seq=12`→13, `13*100>1200` → `ping 1000 - 1000/5 = 800`, `recvd`≠`seq` stays, `seq--`→12); (6) window `recvd==0` (`ping`→0); (7) window `recvd==seq` post‑`++` (`recvd--` also fires: `ping 1300-100=1200`, `recvd 13→12`). Zero‑diff vs `cref_send_ping`.
  - **Untested‑by‑design.** `pi_tv` (`gettimeofday`) + `pi_cp` (a live pointer) are nondeterministic/world‑specific → excluded from the packet comparison. The `sendto` failure path is `(void)`‑ignored by C → unobservable.
  - **L2 / S2S.** No new L2: callee, hit by the server‑connect CPING path; `golden_registration` (incl. `register_quit_reuse_releases_nick`) stays byte‑identical. No S2S: formats no remote‑user wire fields.

- **2026‑06‑06 — P7n (`s_bsd.c` listener-(re)construction wrappers `open_listener`/`reopen_listeners`) merged.** The next `s_bsd.c` leaf after the P7d–P7m socket/file/teardown/listener/CPING leaves — the layer directly above the still-C socket constructor `inetport`. Ported `open_listener` (s_bsd.c:467) + `reopen_listeners` (s_bsd.c:512) to `ircd-common/src/s_bsd.rs`.
  - **Cluster choice.** The cleanest remaining s_bsd leaf with no static-callee blocker: `reopen_listeners` is a pure `ListenerLL` walk → `open_listener`; `open_listener` dispatches to the still-C `inetport` (real socket/bind/listen, keeps its static callee `set_sock_opts` with internal linkage in the surviving C) plus the already-Rust `add_fd` (P2) and `set_non_blocking` (P7d). The strangler seam holds with `inetport` staying C, called via the bindgen extern — porting the layer *above* a still-C leaf is allowed (symbols resolve either direction). The other remaining s_bsd symbols are the event-loop core (`read_message`/`add_connection`), listener *construction* (`inetport`/`add_listener` — real syscalls + the static `set_sock_opts`), sender-only (`report_error`), process setup (`init_sys`/`daemonize`/`start_iauth`), connection auth (`check_client`/`check_server`/`check_server_init`), real-DNS (`get_my_name`), or `static` (no `cref_` oracle).
  - **Guard / seam.** Same `s_bsd_link.o` partial-compile; added `-DPORT_S_BSD_OPEN_LISTENER_P7n` to the recipe in `ircd-sys/build.rs` (alongside the P7d–P7m guards) and wrapped the two C bodies (s_bsd.c:467-525) in a single `#ifndef PORT_S_BSD_OPEN_LISTENER_P7n`. RED confirmed both symbols undefined — `open_listener` referenced by the still-C `add_listener` (s_bsd.c:347), `reopen_listeners` by the now-Rust `s_conf.rs` rehash (line 2927); after GREEN `nm target/debug/ircd` shows both `T` from Rust. The cref oracle keeps the full unguarded `s_bsd.o` → `cref_open_listener`/`cref_reopen_listeners`.
  - **Config-resolved body.** `UNIXPORT` OFF (config.h:339) → `open_listener`'s `*aconf->host == '/'` unix-socket branch is not compiled; only the inet branch survives. No other `#ifdef`s. Macros reproduced inline: `IsListener(x)` (existing `is_listener` helper), `IsConfDelayed(aconf)` = `aconf->flags & PFLAG_DELAYED` (bindgen const, `flags` is `c_long`), `SetListenerInactive(x)` = `flags |= FLAGS_LISTENINACTIVE` (bindgen const), `IsIllegal(aconf)` (existing `conf_is_illegal` helper). `firstrejoindone`/`ListenerLL`/`fdas`/`fdall`/`inetport`/`add_fd` are bindgen externs (`inetport`/`firstrejoindone` stay C; `add_fd` resolves to the Rust list port).
  - **Faithfulness.** `open_listener` early-returns on `!IsListener(cptr) || cptr->fd > 0` — note `> 0` (not `>= 0`), so fd 0 does not early-return. The delayed branch sets `dolisten = 0` AND marks the listener inactive, so `inetport` skips `listen()` (socket created, not accepting). `inetport` returning non-zero resets `cptr->fd = -1` ("to allow further inetport calls"); only when `cptr->fd >= 0` afterward is the fd registered in `fdas`/`fdall` + flipped non-blocking.
  - **Classification.** Callee/utility TU (no `msgtab` entry) — `reopen_listeners` reached from `rehash` (`s_conf.rs`), `open_listener` from `add_listener`/`reopen_listeners`. → L1 is the gate; no S2S (formats no remote-user wire fields).
  - **L1.** `open_listener_diff.rs`, 6 cases, isolated worlds (Rust port reads/mutates the real `ListenerLL`/`local`/`fdas`/`fdall`/`me`/`firstrejoindone` + calls the real C `inetport` and the Rust `add_fd`/`set_non_blocking`; oracle uses `cref_*` + `cref_inetport`), serialized on `GLOBALS_LOCK`. Each world opens its **own** socket via `inetport` (fd integers differ) → the comparison is on the fd's observable properties (`fd_valid` via `fcntl F_GETFD`, `listening` via `SO_ACCEPTCONN`, `nonblocking` via `O_NONBLOCK`), the `FLAGS_LISTENINACTIVE` bit, `fdas`/`fdall` membership, `local[fd]==cptr`, and `port`. Listener built with `ip=NULL`, `port=0` (no bind → no addr-family hazard; `inetport` still does `socket`/`getsockname`/`listen`), `ipmask="0.0.0.0"`; `me.name` pointed at `me.namebuf` and pinned to `"irc.test"` in both worlds so `inetport`'s `ME`-based `sockhost` is identical. Cases: (1) normal listener → listening, non-blocking, registered, not inactive; (2) delayed + `firstrejoindone==0` → `dolisten=0`: created but NOT listening, `FLAGS_LISTENINACTIVE` set, still registered + non-blocking; (3) delayed + `firstrejoindone==1` (inverse of 2) → behaves normal (listening, flag clear); (4) `!IsListener` → no-op (fd stays -1, nothing registered); (5) `fd>0` early-return → fd untouched, not registered; (6) `reopen_listeners` over `[illegal fd<0, legal fd<0, legal fd>0]` → only the legal-fd<0 node is opened, the illegal + already-open nodes skipped (the open node's per-world pipe fd compared against its own recorded start value, not cross-world). Zero-diff vs `cref_*`.
  - **Untested-by-design.** `inetport`'s failure arms (socket/bind failure → `report_error` + `cptr->fd=-1`) need an induced syscall failure; both worlds take the success path identically. The `cptr == &me` `write(0,…)` KLUDGE inside `inetport` is not reached (our cptr != `me`).
  - **L2 / S2S.** No new L2: hit at boot/rehash by the existing golden suite (`golden_registration` byte-identical, 0 warnings). No S2S: formats no remote-user wire fields.

- **2026‑06‑06 — P7o (`s_bsd.c` `add_listener`, listener-constructor wrapper) merged.** The next `s_bsd.c` leaf after the P7d–P7n socket/file/teardown/listener/CPING leaves — the listener *constructor* directly above the now-Rust `open_listener` (P7n). Ported `add_listener` (s_bsd.c:330) to `ircd-common/src/s_bsd.rs`.
  - **Cluster choice.** The natural next leaf: `add_listener` is a thin constructor whose every callee is already Rust — `make_client`/`make_link` (P2) and `open_listener` (P7n, which itself calls the still-C `inetport` + the Rust `add_fd`/`set_non_blocking`). Its whole effect is the new listener-stub `aClient`'s fields + the socket open (delegated to `open_listener`) + the `ListenerLL` prepend → fully observable as list + per-node post-state. The remaining s_bsd symbols are the event-loop core (`read_message`/`add_connection`), the real socket constructor (`inetport` + its static `set_sock_opts`), sender-only (`report_error`), process setup (`init_sys`/`daemonize`/`start_iauth`), connection auth (`check_client`/`check_server`/`check_server_init` + the static `check_init`), real-DNS (`get_my_name`), or `static` (no `cref_` oracle).
  - **Guard / seam.** Same `s_bsd_link.o` partial-compile; added `-DPORT_S_BSD_ADD_LISTENER_P7o` to the recipe in `ircd-sys/build.rs` (alongside the P7d–P7n guards) and wrapped the C body (s_bsd.c:330-358) in `#ifndef PORT_S_BSD_ADD_LISTENER_P7o`. RED confirmed `add_listener` undefined — referenced only by the now-Rust `s_conf.rs` initconf (`s_conf.c:2287`); after GREEN `nm target/debug/ircd` shows it `T` from Rust. The cref oracle keeps the full unguarded `s_bsd.o` → `cref_add_listener`.
  - **Config-resolved body.** No `#ifdef`s in `add_listener` itself (the adjacent `#ifdef UNIXPORT unixport` block is a separate function, untouched). Macros reproduced inline: `FLAGS_LISTEN` (bindgen const, `flags` is `c_long`), `ME` = `me.name` (read the bindgen `me` global's `name`), `SetMe(cptr)` = `cptr->status = STAT_ME` (`Status_STAT_ME`). `make_client(NULL)` allocates a `CLIENT_LOCAL` client (fd = -1, so `open_listener` does not early-return); `make_link()` is the one-element confs link.
  - **Faithfulness.** The order matters: `make_client` already sets `name = namebuf` + `firsttime = timeofday`; `add_listener` overwrites `name = ME` and `firsttime = time(NULL)` (wall clock, not the event-loop `timeofday`). `open_listener` is called *before* the list splice. The prepend is the verbatim C: `if (ListenerLL) ListenerLL->prev = cptr; cptr->next = ListenerLL; cptr->prev = NULL; ListenerLL = cptr;`.
  - **Classification.** Callee/utility TU (no `msgtab` entry) — the listener constructor, called from `s_conf.c` initconf (boot) and rehash. → L1 is the gate; no S2S (formats no remote-user wire fields).
  - **L1.** `add_listener_diff.rs`, 3 cases, isolated worlds (Rust port reads/mutates the real `ListenerLL`/`local`/`fdas`/`fdall`/`me` + calls the real C `inetport` via the Rust `open_listener`; oracle uses `cref_*` + `cref_inetport`), serialized on `GLOBALS_LOCK`. Each world opens its **own** socket (fd integers differ) and `make_client` allocates its **own** client pointer → the comparison is on observable facts: the listener's `flags`/`status`, `acpt`/`from` self-pointers (as bools), `name` string, `confs->value.aconf` identity (matches the conf handed in) + `confs->next == NULL`, the `ListenerLL` prepend linkage (`prev == NULL`, `next == old head`), and the fd's properties (`fd_valid` via `fcntl F_GETFD`, `listening` via `SO_ACCEPTCONN`, `nonblocking` via `O_NONBLOCK`) + `fdas`/`fdall`/`local[fd]==cptr` membership + `port`. `me.name` pinned to `"irc.test"` in both worlds so `inetport`'s `ME`-based `sockhost` is identical. `firsttime = time(NULL)` is nondeterministic across the two calls → asserted non-zero, excluded from the cross-world compare. Cases: (1) into empty `ListenerLL` → sole node, `FLAGS_LISTEN`/`STAT_ME`/self pointers/`ME` name/`confs->aconf`, listening + non-blocking + registered, prev/next NULL; (2) prepend before an existing node → new head with `prev == NULL`, `next == old head`, and the inverse invariant — the old head's `prev` now points back at the new node; (3) two consecutive calls → head is the 2nd, `head->next == 1st`, `1st->next == NULL`, with both back-links. Zero-diff vs `cref_add_listener`.
  - **Untested-by-design.** `firsttime = time(NULL)` (wall clock) is nondeterministic → asserted non-zero, not compared. `inetport`'s failure arms (socket/bind failure → `report_error` + `fd = -1`) need an induced syscall failure; both worlds take the success path identically (covered transitively by P7n's open_listener test notes).
  - **L2 / S2S.** No new L2: `add_listener` runs at boot (and rehash) via `s_conf.c` initconf; the existing golden suite exercises it — `golden_registration` (incl. `register_quit_reuse_releases_nick`) stays byte-identical (0 warnings). No S2S: it formats no remote-user wire fields.

- **2026‑06‑06 — P7p (`s_bsd.c` `inetport`, listener socket constructor) merged.** The next `s_bsd.c` leaf after the P7d–P7o socket/file/teardown/listener/CPING leaves — the real socket constructor directly below the now-Rust `open_listener` (P7n). Ported `inetport` (s_bsd.c:210) + a private twin of its `static` callee `set_sock_opts` to `ircd-common/src/s_bsd.rs`.
  - **Cluster choice.** `inetport` is the layer `open_listener` (P7n) and `add_listener` (P7o) call; porting it completes the listener-construction stack bottom-up. Its only `static` callee `set_sock_opts` (s_bsd.c:1468) has no `cref_` oracle, so it is ported as a **private (non-`#[no_mangle]`) Rust fn** alongside `inetport`; the C `static set_sock_opts` is **not** removed — it stays compiled for its other in-TU callers `check_server_init`/`connect_server` (a static + a private-Rust twin coexist with no symbol clash; the duplicate vanishes when those two callers are ported). `inetport`'s effects are fully L1-observable (the created fd's properties + the `cptr` field writes), the same harness shape as P7n/P7o. The remaining s_bsd symbols are the event-loop core (`read_message`/`add_connection`), connection auth (`check_client`/`check_server`/`check_server_init` + the static `check_init`), sender-only (`report_error`), process setup (`init_sys`/`daemonize`/`start_iauth`), real-DNS (`get_my_name`), or `static` (no `cref_` oracle).
  - **Guard / seam.** Same `s_bsd_link.o` partial-compile; added `-DPORT_S_BSD_INETPORT_P7p` to the recipe in `ircd-sys/build.rs` (alongside the P7d–P7o guards) and wrapped the C `inetport` body (s_bsd.c:210-323) in `#ifndef PORT_S_BSD_INETPORT_P7p` (the adjacent `static set_sock_opts` left untouched). RED confirmed `inetport` undefined — referenced by the now-Rust `open_listener` (`s_bsd.rs:605`) and the still-C `ircd.c:1107`; after GREEN `nm target/debug/ircd` shows `inetport` `T` from Rust, and the C `set_sock_opts` survives as a `t` local (with the mangled `ircd_common::s_bsd::set_sock_opts` private twin). The cref oracle keeps the full unguarded `s_bsd.o` → `cref_inetport`.
  - **Config-resolved body.** `AFINET` = `AF_INET6` (`os.h:680`) → `server` is a `libc::sockaddr_in6`, `SIN_FAMILY`/`SIN_PORT` map to `sin6_*`; `SOCKADDR_IN` = `sockaddr_in6`. `__CYGWIN32__` off → no in-body `set_non_blocking`. `LISTENQUEUE` = 128 (config const, not in bindgen). `ME` = `me.name`. `cptr->ip` is the bindgen `in6_addr` (a `__in6_u.__u6_addr8` union, not libc's `.s6_addr`). `cptr->port` is a `u_short`. `set_sock_opts` config-resolution: SO_REUSEADDR (opt=1) + SO_RCVBUF/SO_SNDBUF/SO_SNDLOWAT (opt=8192) all compile; SO_DEBUG is `#if … && 0` (never); SO_USELOOPBACK is **not defined on Linux** (skipped). The `SETSOCKOPT` macro (`sys_def.h:29`) passes `sizeof(int)`=4 as the option length for every call (`sizeof(o3)` where `o3` is the value arg), not `sizeof(*p)`. SO_SNDLOWAT is set quietly (no `report_error` on failure); the others `report_error` on failure (kept C).
  - **Faithfulness.** Order matters: the NULL-ipmask refuse and the `ad[i]>>8` invalid-ipmask refuse both `return -1` **before** the `sockhost`/`auth`/`socket` writes (so on those paths `fd` stays -1, `auth` NULL). The `if (cptr->fd == -1)` socket-open is conditional (an already-open fd is reused). The `cptr == &me` KLUDGE (`sprintf(buf, replies[RPL_MYPORTIS], ME, "*", ntohs(port)); write(0, buf, …)`) is reproduced verbatim via the bindgen `replies` incomplete-array + `RPL_MYPORTIS` const, but is unreachable for a listener stub (`cptr != &me`). `DupString(cptr->auth, ipname)` = `MyMalloc(strlen+1)` (Rust P2) + `strcpy`. The ipmask canonicalization (`sscanf "%d.%d.%d.%d"` → `sprintf` back) and the `sprintf "%-.42s.%u"` sockhost are done via `libc::sscanf`/`libc::sprintf` for byte-exactness. The bind addr: `in6addr_any` when `!ip || (!isxdigit(*ip) && *ip != ':')`, else `inetpton` (Rust P1) with the 16-byte `minus_one` fallback on parse failure.
  - **Classification.** Callee/utility TU (no `msgtab` entry) — `inetport` is reached from `open_listener` (boot/rehash) and the inetd `me`-listener path. → L1 is the gate; no S2S (formats no remote-user wire fields).
  - **L1.** `inetport_diff.rs`, 6 cases, isolated worlds (the Rust port reads/mutates the real `local`/`highest_fd`/`me` and calls the real `inetpton`/`MyMalloc`; the oracle uses the `cref_*` copies + `cref_inetport`), serialized on `GLOBALS_LOCK`. `me.name` pinned to `"irc.test"` in both worlds so the `ME`-based sockhost matches. Because each world opens its own socket (fd integers differ), the `Obs` compares the fd's observable properties (`fd_valid` via `fcntl F_GETFD`, `listening` via `SO_ACCEPTCONN`, the three socket options via `getsockopt SO_REUSEADDR/SO_RCVBUF/SO_SNDBUF`) + the world-independent struct fields (`sockhost`, `auth`, `port`, `ip` 16 bytes, `local[fd]==cptr`, the -1/0 return), never the raw fd; `highest_fd` is asserted per-world to equal the new fd. Cases: (1) normal port=0 listener (dolisten=1) → full compare: ret 0, listening, sockhost `irc.test.0`, auth `0.0.0.0`, port 0, registered, `highest_fd` bumped; (2) dolisten=0 (the `listen()` inverse) → socket created + opts set but NOT listening, still registered; (3) NULL ipmask → return -1 before any socket (the refuse inverse), fd untouched, auth NULL; (4) invalid ipmask `256.0.0.0` (`256>>8 != 0`) → return -1 before sockhost/auth/socket; (5) wildcard bind (ip=NULL, port=P) → `in6addr_any`, getsockname → `::`, `cptr->ip` all-zero, sockhost `irc.test.<P>`; (6) `::1` bind (`*ip == ':'` → the `inetpton` branch) → bind `::1`, getsockname → `::1`, `cptr->ip` = `::1`, sockhost `::1.<P>`. The two bind cases (5,6) are serialized per world (run + observe + close Rust, then cref) over one `probe_free_port()`'d port, since both worlds would otherwise collide on it. Zero-diff vs `cref_inetport`; sibling P7d–P7o L1 tests + `golden_registration` re-run green.
  - **Untested-by-design.** The `socket`/`bind`/`getsockname` failure arms (→ `report_error` + close + return -1) need an induced syscall failure; both worlds take the success path identically. The `cptr == &me` KLUDGE (`write(0, …)`) and the `fd >= MAXCLIENTS` overflow refuse are unreachable for a listener stub. `set_sock_opts`'s `report_error` arms fire only on a `setsockopt` failure (none here).
  - **L2 / S2S.** No new L2: `inetport` runs at boot (and rehash) via `open_listener`; the existing golden suite exercises it — `golden_registration` (incl. `register_quit_reuse_releases_nick`) stays byte-identical (0 warnings). No S2S: it formats no remote-user wire fields.
