Phase row + plan: [`PLAN.md`](PLAN.md) P7; plans under `docs/superpowers/plans/`.

- **P7a DONE: `common/bsd.c` (socket write leaf)** — ported `deliver_it` (the bottom of the send path: `send()` + WOULDBLOCK→0/`FLAGS_BLOCKED` + `sendB` accumulation + `-errno`) and the re-arming `dummy` signal stub to `ircd-common/src/bsd.rs`; both portable → **`bsd.o` dropped outright** (no `_link.o`). L1 differential (5 cases, full FLAGS_BLOCKED set/clear/untouched matrix) zero-diff vs `cref_`; L2 = existing golden suite (deliver_it is the universal write path) stays byte-identical; no S2S/no new L2 (utility TU).
- **P7b DONE: `common/packet.c` (inbound packet reassembler)** — ported `dopacket` (the only exported symbol; ZIP_LINKS/DEBUGMODE off → just the plain `while (length>0 && ch2)` line-reassembly loop: CR-or-LF framing, `receiveB`/`receiveM` counter accumulation on me/cptr/acpt with the `acpt==&me` guard, `cptr->count` partial-line carry, BUFSIZE-1 overflow cap, and the parse→FLUSH_BUFFER/IsDead→exit_client/IsServer+UNKCMD return handling) to `ircd-common/src/packet.rs`; all callees already Rust → **`packet.o` dropped outright** (no `_link.o`). L1 differential (8 cases: single LF/CR, skipped extra CR-LF, two-lines-one-buffer, partial→continuation round-trip, acpt==&me vs distinct-acpt, 600-byte overflow truncation) zero-diff vs `cref_`; serialized on a `GLOBALS_LOCK` (shared `me`/`cref_me`). L2 = existing golden suite (universal read path) stays byte-identical (`golden_registration` confirmed); no S2S/no new L2 (utility TU, no IsServer-remote-field formatting).
- **P7c DONE: `ircd.c` tune-file pair (`ircd_writetune`/`ircd_readtune`)** — ported the tune-file persistence pair (the 7 sizing globals `ww_size`/`lk_size`/`_HASHSIZE`/`_CHANNELHASHSIZE`/`_SIDSIZE`/`poolsize`/`_UIDSIZE` serialized one-decimal-per-line via `sprintf`, parsed back via `sscanf`, the `USE_HOSTHASH`/`USE_IPHASH` mirrors `_HOSTNAMEHASHSIZE`/`_IPHASHSIZE` = `_HASHSIZE`, the `BOOT_BADTUNE` silent-return-vs-`exit(1)` branch, and the `lk_size = max(lk_size, ww_size)` clamp) to `ircd-common/src/ircd.rs`. First partial port of the central `ircd.c` → `ircd_link.o` second-compile (`-DPORT_IRCD_TUNE_P7c`, carrying ircd.o's IRCD*_PATH/IAUTH machine-path defines so the surviving C is byte-identical); `c_ircd_main`/`me`/signals/`restart`/`server_reboot`/the tune callers stay C. L1 differential (`ircd_tune_diff.rs`, 9 cases: writetune byte-identical files incl. lk<ww + zero/INT_MAX/u32-max edges, readtune global round-trip incl. clamp + hash mirrors + missing-file + BOOT_BADTUNE silent return, write→read round-trip) zero-diff vs `cref_`, serialized on a `GLOBALS_LOCK`. No new L2 (utility TU, not a `msgtab` handler; `ircd_readtune` exercised at boot by the existing golden suite — `golden_registration` stays byte-identical); no S2S (no remote-field formatting). The `exit(1)` arm is untested-by-design (would kill the test process).
- **P7d DONE: `s_bsd.c` socket/file utility leaves** — first (partial) port of the central I/O TU `s_bsd.c`; ported the three pure libc-wrapper leaves that touch none of the event-loop data globals: `get_sockerr` (`getsockopt(SO_ERROR)`-or-saved-`errno`), `set_non_blocking` (`fcntl F_GETFL`→`F_SETFL|O_NONBLOCK`; failure path calls the still-C `report_error`), and `write_pidfile` (truncate+create `IRCDPID_PATH`, `sprintf("%5d\n", getpid())`) to `ircd-common/src/s_bsd.rs`. Partial port via `s_bsd_link.o` (`-DPORT_S_BSD_LEAF_P7d`, carrying s_bsd.o's `IRCDPID_PATH`/`IAUTH_PATH`/`IAUTH` machine-path defines); the event loop + `local[]`/`highest_fd`/`timeofday`/`FdAry` + listeners + `add_connection`/`read_message`/`report_error`/`get_my_name`/`add_local_domain`/`start_iauth` stay C. `IRCDPID_PATH` (a command-line define, absent from bindgen) exposed to Rust via the P6m make-`--eval`+`rustc-env` pattern → `ircd_sys::PID_PATH`. L1 differential (`s_bsd_leaves_diff.rs`, 4 cases: get_sockerr fd<0 errno-passthrough + valid-fd/no-error, set_non_blocking O_NONBLOCK-set-with-untouched-fd-inverse, write_pidfile identical-behavior) zero-diff vs `cref_`, serialized on `GLOBALS_LOCK`. No new L2 (utility TU; `write_pidfile` hit at boot, `set_non_blocking`/`get_sockerr` on every connect — covered by the existing golden boot/connect path, `golden_registration` byte-identical); no S2S (no remote-field formatting). Untested-by-design: get_sockerr's `err!=0` branch + set_non_blocking's fcntl-failure→report_error branch (need a pending-error socket / bad fd); write_pidfile's byte rendering is pinned only where `IRCDPID_PATH` is writable (its dir is absent in the sandbox → both worlds no-op identically).
- **P7e DONE: `s_bsd.c` name-resolution leaf (`add_local_domain`)** — ported the next-easiest s_bsd.c leaf after the P7d socket/file trio: `add_local_domain` (strip one trailing `.` + `size++`; if the name is unqualified, lazily `ircd_res_init()` when `!(options & RES_INIT)`, then append `"." + ircd_res.defdname` iff `defdname[0]` and `strlen(defdname)+2 <= size`) to `ircd-common/src/s_bsd.rs`. Touches none of the event-loop globals — its only dependency is the resolver state (`ircd_res`/`ircd_res_init`), already Rust since P6. Partial port via the existing `s_bsd_link.o` seam with a new guard `-DPORT_S_BSD_LEAF_P7e` (added alongside `-DPORT_S_BSD_LEAF_P7d`); `get_my_name` (its only in-TU caller, needs `gethostname`/`gethostbyname`/`mysk`) stays C. RED confirmed the undefined symbol referenced by the now-Rust `s_conf.rs` + still-C `s_bsd.c` (`get_my_name`/`connect_server`); after GREEN `nm` shows `add_local_domain` as `T` from Rust. L1 differential (`add_local_domain_diff.rs`, 6 cases: trailing-dot-strip/no-append, unqualified-append, the size-guard boundary len+1-vs-len+2 inverse, empty-defdname-no-append, the `size++`-enables-append faithfulness check, and the init-trigger branch via `$LOCALDOMAIN` for determinism — both worlds run their P6-verified-equivalent `ircd_res_init`) zero-diff vs `cref_add_local_domain`, isolated worlds (Rust reads the real `ircd_res`, oracle reads `cref_ircd_res`), serialized on `GLOBALS_LOCK`. No new L2 (callee TU, not a `msgtab` handler; runs at boot via `s_conf.c` read_conf + on `connect_server` — `golden_registration` byte-identical); no S2S (no remote-field formatting).
- **P7f DONE: `s_bsd.c` delayed-close leaf (`delay_close`)** — ported the `DELAY_CLOSE`-gated (=15) `delay_close` (s_bsd.c:3359): a private static time-sorted linked list of fds awaiting a delayed `close()`, swept per call (expired entries, or — under fd pressure when `is_delayclosewait > (MAXCLIENTS-is_localc)>>1` — the oldest quarter; `fd==-2` from `m_close` forces close-all), then `fd>=0` is queued at `timeofday+15` (with `set_non_blocking`+`shutdown(SHUT_RD)`); returns the head entry's scheduled time or 0. Faithful: the unsigned `int-u_long` threshold (wraps), the `time<now || tmpdel-- >0` short-circuit (tmpdel only decrements when not expired), the 46-byte (43 chars+`\r\n`+NUL) "Too rapid connections" error sent to the *new* fd. Same `s_bsd_link.o` seam, new guard `-DPORT_S_BSD_DELAY_CLOSE_P7f`; reads the still-C `istat` (ircd.c) + `timeofday` (s_bsd.c) globals, calls the Rust `set_non_blocking` (P7d) + `MyMalloc` (P2). L1 differential (`delay_close_diff.rs`, 6 cases: queue-one + inverse time-eviction, unexpired-stays early-break, `fd==-2` close-all drain, overflow drop-oldest-quarter, chronological-head ordering) zero-diff vs `cref_delay_close`, isolated worlds (real `istat`/`timeofday` vs `cref_*`), serialized on `GLOBALS_LOCK` (incl. a `reset()` to drain the persistent static lists between tests). No new L2 (callee, not a `msgtab` handler — hit by the io_loop `delay_close(-1)`/`m_close`/connection-close paths; `golden_registration` byte-identical); no S2S (no remote-field formatting).
- **P7g DONE: `s_bsd.c` fd-teardown leaf (`close_client_fd`)** — ported the descriptor-teardown leaf `close_client_fd` (s_bsd.c:1270): closes `authfd` then `fd` (flushing its sendQ first via the Rust `flush_connections`, removing it from `fdas`/`fdall` via the Rust `del_fd` + clearing `local[fd]`), then drains `sendQ`/`recvQ` (`DBufClear`→`dbuf_delete`) and zeroes `passwd`. Config-resolved: `SO_LINGER` defined (the linger blocks compile, fired only when `exitc==EXITC_PING`), `ZIP_LINKS` off (`zip_free` omitted). All real callees already Rust (`flush_connections` P3, `del_fd` P2, `dbuf_delete` P1); only `report_error` stays C (already an `extern "C"` decl since P7d; fires solely on a `setsockopt(SO_LINGER)` failure). Same `s_bsd_link.o` seam, new guard `-DPORT_S_BSD_CLOSE_FD_P7g`; reads the still-C `local[]`/`fdas`/`fdall` globals. L1 differential (`close_client_fd_diff.rs`, 6 cases: client both-fds, server + listener `IsServer||IsListener` fdas+fdall arm, fd<0 only-authfd-closed, both-fds<0 no-op, and the inverse-of-insert recvQ-drain + passwd-zero) zero-diff vs `cref_close_client_fd`, isolated worlds (real `local`/`fdas`/`fdall` + Rust `flush_connections`/`del_fd` vs `cref_*`), serialized on `GLOBALS_LOCK`; inverse invariants checked (fd actually closed via EBADF, `local[fd]==NULL`, array slot freed). `exitc=0` everywhere → the `SO_LINGER`/`report_error` branches untested-by-design; the sendQ flush-then-clear (live socket I/O) is L2. No new L2 (callee, not a `msgtab` handler — hit on every disconnect via `close_connection`/`exit_client`; `golden_registration` incl. quit/reuse byte-identical); no S2S (no remote-field formatting).
- **P7h DONE: `s_bsd.c` connection-teardown leaf (`close_connection`)** — ported the bookkeeping layer directly above the P7g `close_client_fd`: `close_connection` (s_bsd.c:1341) bumps the per-class `ircstp` stats (`is_sv`/`is_cl`/`is_ni` + byte/time accumulators), drops outstanding DNS queries (`del_queries`), reschedules server reconnect (`find_conf_exact`→`nextconnect` with the `HANGONGOODLINK`/`HANGONRETRYDELAY` clamp), schedules a hang-on retry for an aborted handshake/connect, notifies iauth (`sendto_iauth "%d D"`) + decrements the P-line acceptor's `clients` refcount (recursing into `close_connection(acpt)` when the acceptor itself goes illegal), tears the descriptors down via the Rust `close_client_fd`, unlinks an illegal listener from `ListenerLL`, then `det_confs_butmask(cptr,0)` + `cptr->from = NULL`. Config-resolved: `USE_IAUTH` ON → the `sendto_iauth` block compiles; DEBUGMODE off. All callees already resolvable (`del_queries`/`find_conf_exact`/`det_confs_butmask` Rust since P6; `sendto_iauth` the variadic C trampoline; `close_client_fd` Rust P7g). Same `s_bsd_link.o` seam, new guard `-DPORT_S_BSD_CLOSE_CONN_P7h`; reads the still-C `ircstp`/`nextconnect`/`ListenerLL`/`timeofday`/`me` globals. L1 differential (`close_connection_diff.rs`, 6 cases: server/client/unknown stats accounting, handshake+connecting `nextconnect = now+30`, P-line acceptor refcount 5→4, illegal-listener `ListenerLL` unlink with the inverse — node gone, head intact, `from` NULL, confs detached) zero-diff vs `cref_close_connection`, isolated worlds (real `ircstp`/`nextconnect`/`ListenerLL`/`local`/`fdas`/`fdall`/`me`/`istat` vs `cref_*`), serialized on `GLOBALS_LOCK`; `me.fd`/`adfd` pinned to -1 (inner `flush_connections` else-branch + `sendto_iauth` no-op). No new L2 (callee, not a `msgtab` handler — hit on every disconnect via `exit_client`; `golden_registration` incl. quit/reuse byte-identical); no S2S (formats no remote-user fields). Untested-by-design: the recursive `close_connection(acpt)` (needs a fully-illegal acceptor conf) + the `find_conf_exact` reconnect-reschedule arm (NULL with no conf loaded) + the `sendto_iauth` wire emission (L2, variadic trampoline).
- **P7i DONE: `s_bsd.c` listener-list teardown leaf (`close_listeners`)** — ported the layer directly above P7g/P7h: `close_listeners` (s_bsd.c:427) walks the `ListenerLL` doubly-linked list and tears down every listener whose conf has gone illegal (`IsIllegal(aconf)`) — `clients>0` → the Rust `close_client_fd` (fd torn, node stays in the list), `clients≤0` → the Rust `close_connection` (fd torn + node unlinked + confs detached + `from` cleared); legal listeners untouched; the `bcptr = acptr->next` save handles the in-loop unlink. UNIXPORT off (config.h:339) → the `IsUnixSocket`/`unlink` block vanishes; both callees already Rust (P7g/P7h) → no new externs (reuses the existing `conf_is_illegal` helper). Same `s_bsd_link.o` seam, new guard `-DPORT_S_BSD_CLOSE_LISTENERS_P7i`; the only caller is the now-Rust `s_conf.rs` rehash (`s_conf.c:1315`). L1 differential (`close_listeners_diff.rs`, 5 cases: illegal-clients=0 unlinked, illegal-clients>0 stays-linked inverse, legal untouched (fd still open via fcntl), mixed 3-node middle-removed with the two legals relinked, all-illegal drains the list) zero-diff vs `cref_close_listeners`, isolated worlds, serialized on `GLOBALS_LOCK`. No new L2 (callee, not a `msgtab` handler — hit by rehash; `golden_registration` byte-identical); no S2S (no remote-field formatting).
- **P7j DONE: `s_bsd.c` listener-reactivation leaf (`activate_delayed_listeners`)** — ported the counterpart to P7i's `close_listeners`: `activate_delayed_listeners` (s_bsd.c:526) walks the `ListenerLL` list and, for every listener flagged `FLAGS_LISTENINACTIVE`, calls `listen(fd, LISTENQUEUE=128)`, clears the inactive bit, and counts it; if any were reactivated it emits one `sendto_flag(SCH_NOTICE, "%d listeners activated", cnt)` notice. No `#ifdef`s (DEBUGMODE off → no `Debug`); `listen()`'s return is ignored exactly as C. Same `s_bsd_link.o` seam, new guard `-DPORT_S_BSD_ACTIVATE_DELAYED_P7j`; no new still-C externs (`sendto_flag` is the existing variadic trampoline via `ircd_sys::bindings`, safe in L1 — short-circuits on NULL `svc_ptr`; `LISTENQUEUE` reproduced as a const since it's absent from bindgen). RED confirmed the undefined symbol referenced by the now-Rust `s_serv.rs` (`m_set`/burst) + `s_misc.rs` (`check_split`); after GREEN `nm` shows it `T` from Rust. L1 differential (`activate_delayed_listeners_diff.rs`, 5 cases: single-inactive→activated (inactive bit clear + socket actually listening via `SO_ACCEPTCONN`), single-active untouched (inverse), mixed `[active,inactive,active]` only-middle, empty no-op, all-inactive) zero-diff vs `cref_activate_delayed_listeners`, isolated worlds over real TCP-socket fds, serialized on `GLOBALS_LOCK`; inverse invariant — listeners never removed, already-active nodes untouched. No new L2 (callee, not a `msgtab` handler — hit by server-burst/rehash; `golden_registration` byte-identical); no S2S (formats only an integer count, no remote-user fields).
- **P7k DONE: `s_bsd.c` `add_connection_refuse` (connection-refuse leaf)** — ported the refuse-path companion to `add_connection` (stays C): `DELAY_CLOSE` on → the `delay=0` reset is not compiled, so `delay` is honored verbatim; `close(fd)` unless delayed, `ircstp->is_ref++`, `acptr->fd = -2`, then `free_client` (Rust, P2). Partial-ported via `s_bsd_link.o` (`-DPORT_S_BSD_ADD_CONN_REFUSE_P7k`). L1 differential (3 cases: delay==0 closes the fd, delay==1 leaves it open — the inverse pair, two refuses accumulate `is_ref`) zero-diff vs `cref_`; `acptr` is freed inside the call (UAF post-state) so the test compares side effects (`is_ref` delta + fd fate), and `acptr->fd=-2` is untested-by-design (no surviving reader). No L2/no S2S (callee, not a `msgtab` handler; formats no remote-user fields).
- **P7l DONE: `s_bsd.c` `setup_ping` (UDP CPING-socket setup leaf)** — ported the one-shot setup half of the server-to-server CPING feature: bind the single shared `udpfd` UDP socket. Idempotent (`udpfd != -1` → return it, ignore `aconf`); config-resolved (`AFINET`=`AF_INET6` → `from` is a `sockaddr_in6`, the `SIN_*` macros map to `sin6_*`; `SETSOCKOPT` length is `sizeof(int)`=4 not `sizeof(*p)`; `FNDELAY`=`O_NONBLOCK`; DEBUGMODE/USE_SYSLOG off → no `Debug`/`syslog`). Faithful assign-then-test: `udpfd` set from `socket()` before the `==-1` check, each later failure does `close(fd); udpfd=-1`. Bind addr from a numeric `aconf->passwd` via the Rust `inetpton` (P1, falls back to `minus_one`=all-`0xff`) else `in6addr_any`. Partial port via `s_bsd_link.o` (`-DPORT_S_BSD_SETUP_PING_P7l`); `udpfd` stays a C global (the still-C `read_message`/`polludp`/`check_ping` read it) → Rust reads/writes the bindgen extern; the CPING-output siblings `send_ping`/`check_ping`/`polludp` stay C (share `udpfd` only, which stays C). RED confirmed the undefined symbol referenced by the now-Rust `s_conf.rs` rehash (`s_conf.c:2041`); after GREEN `nm` shows `setup_ping` `T` from Rust. L1 differential (`setup_ping_diff.rs`, 3 cases: fresh setup opens a non-blocking `SOCK_DGRAM` recorded in `udpfd`, idempotent second call returns the same fd unchanged — the inverse-of-state path, numeric-passwd `"::1"` drives the `inetpton` bind-addr branch) zero-diff vs `cref_setup_ping`, isolated worlds (real `udpfd` vs `cref_udpfd`), serialized on `GLOBALS_LOCK` with a `reset()` closing the prior socket between cases; compares the fd's *properties* (valid/non-blocking/`SOCK_DGRAM`) not its integer value (worlds open distinct sockets). No new L2 (callee, not a `msgtab` handler — hit by `s_conf.rs` rehash when a `connect{}` block has a port; `golden_registration` byte-identical); no S2S (formats no remote-user fields). Untested-by-design: the `setsockopt`/`bind`/`fcntl` failure arms (need an induced syscall failure; both worlds take the success path identically).
- **P7m DONE: `s_bsd.c` `send_ping` (UDP CPING-output leaf)** — ported the output half of the server-to-server CPING (UDP ping) feature, the sibling to P7l's `setup_ping`: advance the per-`connect{}` sliding-window RTT statistics on the conf's `aCPing` (`lseq++`, `seq++`-then-conditional-`--`, the `seq*conFreq>1200` window adjusting `ping`/`recvd`) and `sendto` a `Ping` datagram (`pi_cp`/`pi_id=htonl(PING_CPING)`/`pi_seq`/`pi_tv`) over the shared `udpfd`. Config-resolved (`AFINET`=`AF_INET6` → `sin` is `sockaddr_in6`; `IN6ADDRSZ`=16; DEBUGMODE/USE_SYSLOG off → no `Debug`/`syslog`; `PING_CPING`=0x02). Faithful: the C guard's first disjunct `!aconf->ipnum.s6_addr` is an array address → always false, so only `AND16(ipnum)==255` (all-0xff unresolved sentinel) and `cp->port==0` gate; all `aCPing` counters are `u_long` → unsigned window arithmetic; `cp->lseq++` post-increments (the packet carries the old value). Partial port via the existing `s_bsd_link.o` seam, new guard `-DPORT_S_BSD_SEND_PING_P7m`; `udpfd` stays a C global (shared with the still-C `setup_ping`/`polludp`), Rust reads the bindgen extern → no new still-C externs (true leaf). L1 differential (`send_ping_diff.rs`, 7 cases: basic send with packet check, the three early returns — unresolved ipnum/zero port/zero conFreq, window recvd>0/recvd==0/recvd==seq) zero-diff vs `cref_send_ping`, isolated worlds (real `udpfd` vs `cref_udpfd`) each binding a `::1` UDP receiver to `recvfrom` the datagram; compares the deterministic `aCPing` post-state + the world-independent packet fields (`pi_id`/`pi_seq`), excluding `pi_cp` (live pointer) + `pi_tv` (gettimeofday); serialized on `GLOBALS_LOCK`. No new L2 (callee, not a `msgtab` handler — reached from the server-connect CPING path; `golden_registration` byte-identical); no S2S (formats no remote-user wire fields). Untested-by-design: `pi_tv`/`pi_cp` nondeterministic; the `sendto` failure path is `(void)`-ignored by C → unobservable.
- **P7n DONE: `s_bsd.c` `open_listener`/`reopen_listeners` (listener (re)construction wrappers)** — ported the layer directly above the still-C socket constructor `inetport`: `open_listener` (s_bsd.c:467) (re)opens one listener (early-return on `!IsListener || fd>0`; UNIXPORT off → only the inet branch; a delayed-listen P-line before the first rejoin sets `dolisten=0` + `FLAGS_LISTENINACTIVE`; dispatches to the still-C `inetport` + the Rust `add_fd` (P2)/`set_non_blocking` (P7d), registering a created fd in `fdas`/`fdall`), and `reopen_listeners` (s_bsd.c:512) walks `ListenerLL` reopening every legal closed-fd listener. Partial port via the existing `s_bsd_link.o` seam (`-DPORT_S_BSD_OPEN_LISTENER_P7n`); `inetport` (real socket/bind/listen, with its static `set_sock_opts`) stays C. L1 differential (`open_listener_diff.rs`, 6 cases: normal→listening, delayed-before-rejoin→inactive/not-listening, delayed-after-rejoin→listens (inverse), `!IsListener` no-op, `fd>0` no-op, `reopen_listeners` skips illegal + already-open) zero-diff vs `cref_` (observable fd properties — valid/`SO_ACCEPTCONN`/`O_NONBLOCK` — + flags/`fdas`/`fdall`/`local[fd]`, since each world opens its own socket), serialized on `GLOBALS_LOCK`. No new L2 (callee, hit at boot/rehash; `golden_registration` byte-identical); no S2S (no remote-user wire fields).
- **P7o DONE: `s_bsd.c` `add_listener` (listener-constructor wrapper)** — ported the layer directly above the now-Rust `open_listener` (P7n): `add_listener` (s_bsd.c:330) builds the `me`-like listener-stub `aClient` via the Rust `make_client`/`make_link` (P2) — `FLAGS_LISTEN`, `SetMe` (STAT_ME), self `acpt`/`from`, `name = ME` (= `me.name`), `firsttime = time(NULL)`, a one-element `confs` link carrying the passed `aconf` — opens the socket via the Rust `open_listener`, then prepends the client to `ListenerLL` (back-linking the old head's `prev` when non-empty); returns 0. No `#ifdef`s. Partial port via the existing `s_bsd_link.o` seam, new guard `-DPORT_S_BSD_ADD_LISTENER_P7o`; all callees already Rust → no new still-C externs (`add_listener` referenced by the now-Rust `s_conf.rs` initconf). L1 differential (`add_listener_diff.rs`, 3 cases: into empty `ListenerLL` → sole node listening+registered with prev/next NULL, prepend before an existing node → new head + old head's `prev` back-linked (inverse), two consecutive calls → chain order + back-links) zero-diff vs `cref_add_listener`, isolated worlds (each opens its own socket / `make_client` allocates its own pointer → compares observable facts not raw fd/pointer values; `me.name` pinned to `irc.test` so `inetport`'s `ME`-based sockhost matches; `firsttime=time(NULL)` asserted non-zero, not compared), serialized on `GLOBALS_LOCK`. No new L2 (callee, hit at boot/rehash via `s_conf.c` initconf; `golden_registration` byte-identical); no S2S (formats no remote-user wire fields).
- **P7p DONE: `s_bsd.c` `inetport` (listener socket constructor)** — ported the layer directly below the now-Rust `open_listener` (P7n): the real socket constructor `inetport` (s_bsd.c:210). Creates an `AF_INET6` (`AFINET`) stream socket, optionally `bind()`s it (`if (port)` → `in6addr_any` when ip is unset/non-numeric, else the Rust `inetpton` with the all-`0xff` `minus_one` fallback), applies its `static` callee `set_sock_opts`, fills `cptr` (`auth` = the ipmask canonicalized to `"a.b.c.d"` via `DupString`/`MyMalloc`; `sockhost` = `"<ip-or-ME>.<port>"` via `sprintf "%-.42s.%u"`; `ip` = the `getsockname` result; `port`), registers `local[fd] = cptr`, bumps `highest_fd`, and (when `dolisten`) `listen(fd, 128)`; returns 0, or -1 on a refused (`!ipmask`/bad ipmask) or failed (`socket`/`bind`/`getsockname`) open. `set_sock_opts` is `static` (no `cref_` oracle) → ported as a **private Rust twin** (config-resolved: SO_REUSEADDR=1, SO_RCVBUF/SO_SNDBUF/SO_SNDLOWAT=8192, `sizeof(int)` optlen; SO_DEBUG `&& 0` + SO_USELOOPBACK-undefined-on-Linux skipped); the C `static set_sock_opts` **stays compiled** for its other callers `check_server_init`/`connect_server`. Partial port via the existing `s_bsd_link.o` seam, new guard `-DPORT_S_BSD_INETPORT_P7p`; `report_error` + the variadic `sendto_flag` stay C, `local`/`highest_fd`/`me`/`minus_one`/`replies` read via bindgen externs. The `cptr == &me` inetd-on-fd-0 KLUDGE (writes `replies[RPL_MYPORTIS]` to fd 0) reproduced faithfully but never fires for a listener stub. L1 differential (`inetport_diff.rs`, 6 cases: normal port=0 listening (full compare — sockhost `irc.test.0`/auth `0.0.0.0`/port/socket-options/`local[fd]`/`highest_fd` bump), dolisten=0 not-listening (the listen inverse), NULL-ipmask + invalid-ipmask `256.0.0.0` refuse (return -1 before any socket, the error inverse), wildcard `in6addr_any` bind → `::` ip, `::1` `inetpton` bind → `::1` ip — the two bind cases serialized per world over one probed free port) zero-diff vs `cref_inetport`, isolated worlds (each opens its own socket → compares observable fd properties + world-independent struct fields, never the raw fd), serialized on `GLOBALS_LOCK`. No L2/no S2S (callee, hit at boot/rehash via `open_listener`; `golden_registration` byte-identical; formats no remote-user wire fields).
- **P7q DONE: `s_bsd.c` `report_error` (error-reporting output leaf)** — ported the genuine clean leaf left in the central I/O TU: `report_error` (s_bsd.c:151) calls **no** other `s_bsd.c` function, so it ports in isolation, and the linker now resolves its 27 internal call sites (every still‑C `report_error("…", cptr)` + the already‑Rust leaves that called it via `extern "C"`) to the Rust definition. Derives `host` via `get_client_name` (or `""` when `cptr==NULL`), refines `errtmp` from the socket's pending `SO_ERROR` (the getsockopt readout, mirroring P7d's `get_sockerr`), fires the `SCH_ERROR` local‑opers notice (`sendto_flag`), sends a NOTICE back through a half‑open (`Connecting`/`Handshake`) server link's **remote** `byuid` introducer (`find_uid`→`sendto_one`, the `:%s NOTICE %s :` + `text` `strcpy`/`strncat` construction), then echoes the formatted error to `stderr` while `serverbooting`. Config‑resolved: `SO_ERROR` defined (getsockopt compiles), `DEBUGMODE`/`USE_SYSLOG` off (no `Debug`/`syslog`). The variadic `sendto_flag`/`sendto_one`/`fprintf` are *called*, not defined — legal in stable Rust (the trampolines stay C until P8). Partial port via the existing `s_bsd_link.o` seam, new guard `-DPORT_S_BSD_REPORT_ERROR_P7q`; reads the still‑C `serverbooting`/glibc `stderr`, calls the Rust `get_client_name` (P5)/`find_uid` (P4). L1 differential (`report_error_diff.rs`, 4 cases: `serverbooting=1`+`cptr=NULL` formatted stderr echo, the `serverbooting=0` inverse gate → no output, `cptr` non‑NULL `host=get_client_name`, varied format/errno) captures fd 2 via a pipe redirect and asserts byte‑identical Rust‑vs‑`cref` stderr; serialized on `GLOBALS_LOCK` (sets `serverbooting`/`cref_serverbooting` + `errno` per case). No new L2 (output callee, not a `msgtab` handler — the `SCH_ERROR` error path is exercised by the existing golden suite; `golden_registration` byte‑identical); no S2S in L1. Untested‑by‑design: the `SO_ERROR` readout (needs a pending‑error socket; `fd<0` skips it identically), the `sendto_flag` wire emission (L2, variadic), the `bysptr` remote NOTICE (S2S — needs a connecting peer with a remote `byuid`).
- **P7r DONE: `s_bsd.c` `init_sys` (fd-table boot leaf)** — ported the cleanest remaining leaf in the central I/O TU: `init_sys` (s_bsd.c:693), called once from `ircd.c` `main` at boot. Config-resolved to a libc-only body: `RLIMIT_FD_MAX` is **not defined on Linux** → the whole `getrlimit`/`setrlimit` + `exit(-1)` rlimit block is excluded; `USE_POLL=1` → the sequent `setdtablesize` block is excluded; Linux → the `setlinebuf(stderr)` branch. So the only callees are libc (`setlinebuf`/`bzero`/`close`) and the only state is the already-exported `fdas`/`fdall`/`local` globals (no shared private static with still-C code — unlike `get_my_name`/`mysk`). Body: line-buffer stderr, `bzero` the two `fdarray`s + `highest=-1`, NULL `local[0..MAXCONNECTIONS=50]` while `close()`ing fds `3..50` (0/1/2 kept — stderr stays open until `daemonize`). Partial port via the existing `s_bsd_link.o` seam, new guard `-DPORT_S_BSD_INIT_SYS_P7r`; `fdas`/`fdall` via bindgen externs, `local[]` via the existing `local_base()` helper. RED confirmed the undefined symbol referenced by still-C `ircd.c:1010`; after GREEN `nm` shows `init_sys` `T` from Rust. L1 differential (`init_sys_diff.rs`, 3 cases: fresh-init zeroes arrays + NULLs local + inverse-of-dirty invariant, closes fds 3..N, keeps 0/1/2 open) zero-diff vs `cref_init_sys` — **fork-isolated** per world (the close loop is destructive to the test process's fds → each world runs in a forked child, results returned via `mmap(MAP_SHARED|MAP_ANONYMOUS)` which survives the close loop), serialized on `GLOBALS_LOCK`. No new L2 (boot callee, not a `msgtab` handler — the existing golden suite boots through it, `golden_registration` byte-identical); no S2S (formats no remote-user fields). Untested-by-design: `setlinebuf(stderr)` (unobservable); the rlimit/`exit` arms don't compile under the locked config.
- **P7s DONE: `s_bsd.c` `get_my_name` (server-own-hostname resolver) + de-static `mysk`** — ported the most leaf-like remaining `s_bsd.c` function after P7d–P7r: `get_my_name` (s_bsd.c:2940), which at boot resolves the server's canonical hostname into `me.name` (`gethostname` → `add_local_domain` → `gethostbyname(cname)||gethostbyname(name)` + the `h_aliases` walk, picking the `mycmp(ME)` match) and initialises the outgoing-bind source address `mysk` (`bzero` + `sin6_family=AF_INET6`/`sin6_port=0`, then the M-line `find_me()->passwd` via `inetpton` with the `minus_one` all-`0xff` fallback when it's a digit-led non-v6). Its only in-TU callee `add_local_domain` is already Rust (P7e); all other callees are libc or already-Rust (`find_me` P6, `inetpton`/`mycmp` P1, `minus_one`/`me` bindgen). The single blocker — the file-private `static struct SOCKADDR_IN mysk` (s_bsd.c:55) shared with the still-C `check_client` (localhost detect) / `connect_inet` (outgoing bind) — was broken by **de-static'ing `mysk`** (a behaviour-preserving storage-class change: single TU, no other `mysk`), which also makes the cref archive export `cref_mysk` (the `objcopy` prefix-rename only follows global symbols — the L1 static-symbol limit), giving the L1 test a full cross-world `mysk` compare. Config-resolved: `HAVE_GETIPNODEBYNAME` undef → plain `gethostbyname`; `DEBUGMODE` off; the `mysk.SIN_ADDR` write at s_bsd.c:3012 is dead `#if 0`. Partial port via the existing `s_bsd_link.o` seam, new guard `-DPORT_S_BSD_GET_MY_NAME_P7s`; `gethostbyname` declared via a local extern (absent from the libc crate). L1 differential (`get_my_name_diff.rs`, 6 cases: M-conf NULL-passwd addr-zero, non-digit-passwd addr-zero inverse, valid `2001:db8::1` → parsed addr, digit-but-invalid `9zz` → minus_one, resolvable `localhost` cname → gethostbyname+alias-loop, empty cname → BadPtr early return) zero-diff vs `cref_get_my_name` — both worlds call the same libc `gethostname`/`gethostbyname` (identical results in one run) + a shared `conf`/`cref_conf` M-conf, and the shared-but-isolated `me`/`cref_me` ME is pinned to `irc.test`; asserts the `name` output buffer + the full 28-byte `mysk`/`cref_mysk` agree, serialized on `GLOBALS_LOCK`. No L2/no S2S (boot callee, not a `msgtab` handler; the existing golden boot exercises it — `golden_registration` byte-identical; formats no remote-user wire fields). Untested-by-design: the resolved hostname is host-dependent (the test asserts the two worlds *agree*, not a fixed string); the `gethostname == -1` early return needs an induced failure (both worlds take the success path identically).
- **P7t DONE: `ircd.c` `calculate_preference` (AC preference leaf)** — ported `calculate_preference` (ircd.c:387, the auto-connect preference recompute called periodically from `io_loop`): walks the global `conf` list, fires the already-Rust `send_ping` (P7m) on every AC-able `connect{}` C-line (`CONF_CONNECT_SERVER|CONF_ZCONNECT_SERVER` + `port>0`), then derives `pref` from that conf's `aCPing` window stats (or the `-1` sentinel when `seq==0`/`recvd==0`). Partial-port via the existing `ircd_link.o` second-compile, new guard `-DPORT_IRCD_CALC_PREF_P7t` (the C body `#ifndef`-guarded with an `#else extern` prototype so the still-C `io_loop` caller keeps a declaration). Faithfulness: calls the **libc `pow` symbol** (not `f64::powf` — last-ULP drift would corrupt the `(u_int)(f*100.0)` truncation); final cast reproduces C `double→u_int→int pref`. L1 differential (5 cases: skips, recvd==0 sentinel, full-window compute, mixed list) zero-diff vs `cref_` (isolated `conf`/`cref_conf` worlds, serialized on `GLOBALS_LOCK`). L2 = existing golden boot stays byte-identical (locked config has no `connect{}` C-lines → loop body is a no-op); no S2S (utility, no remote-user wire fields). Note: the `cp==NULL` sentinel clause is dead defensive code — `send_ping` dereferences `cp->port` first.
- **P7u DONE: `s_auth.c` iauth `/STATS` reporters** (`report_iauth_conf`/`report_iauth_stats`) — opened the last P7 TU by porting its two cleanest leaves: list-walking reporters that emit `RPL_STATSIAUTH`/`RPL_STATSDEBUG` per `iauth_conf`/`iauth_stats` `LineItem` node via the variadic `sendto_one` (`report_iauth_conf` gated on `adfd >= 0`). De-static'd the two file-static list heads (the P7s `mysk` precedent) so the still-C `read_iauth` writer keeps them while the Rust readers reference them via extern; partial-ported via new `s_auth_link.o` (`-DPORT_S_AUTH_REPORT_P7u`). L1 sendQ-capture differential zero-diff (6 cases incl. adfd<0 + empty-list inverses); golden byte-identical (no iauth in golden → reporters are no-ops); no S2S (no remote-user fields).
- **P7v DONE: `s_auth.c` `set_clean_username` (last pure-logic leaf)** — ported `set_clean_username` (s_auth.c:44; derives `cptr->username` ≤USERLEN+NUL from the raw ident reply `cptr->auth`: dirty-prefix `-` on `[`/`@`/over-length/leading-`:`/embedded-whitespace, copy ≤USERLEN chars dropping `@`/`[`/whitespace, then free+redirect `auth` at the interior `username` buffer when equal else bump `istat.is_auth`/`is_authmem`) to `ircd-common/src/s_auth.rs`. De-static'd (behaviour-preserving — single TU) so `nm -g` emits `cref_set_clean_username` and the still-C callers (`read_iauth`/`start_auth`) resolve to the Rust def once the body is `#ifndef PORT_S_AUTH_CLEAN_USERNAME_P7v`-guarded out of `s_auth_link.o`. L1 differential (9 cases: free path clean-fits/exact-USERLEN/empty, istat path `@`/`[`/over-length/leading-`:`/interior-whitespace, inverses trailing-whitespace-not-dirty-but-unequal + NULL-auth early-return) zero-diff vs `cref_` on the full `username[11]` buffer + `is_auth`/`is_authmem` deltas + the `auth==&username` self-pointer predicate; serialized on `GLOBALS_LOCK` (shared `istat`). L1 is the gate (utility/callee TU, reached only from the still-C iauth/ident I/O the golden harness doesn't run); `golden_registration` stays byte-identical (no-regression); no S2S (no remote-user fields).

- **P7w DONE: `s_auth.c` ident-protocol I/O pair `send_authports`/`read_authports`** — ported the RFC1413 ident query/reply pair to `ircd-common/src/s_auth.rs` (the leaf relative to the still-C `start_auth` + the `s_bsd.c` event loop at `s_bsd.c:2363`/`2368`). `send_authports`: `getsockname`/`getpeername(fd)`→`"theirport , ourport\r\n"`→`write(authfd)`, with the `authsenderr` failure path (`ircstp->is_abad++`, close `authfd`, `highest_fd` walk past NULL `local[]`, `authfd=-1`, clear `FLAGS_AUTH|FLAGS_WRAUTH`); success clears only `FLAGS_WRAUTH`. `read_authports`: `read` buffered across partial reads via `cptr->count`, `sscanf` the `"%hd , %hd : USERID : %*[^:]: %512s"` grammar, set `auth` (`OTHER`→`-`-prefixed `MyMalloc`, else `mystrdup`) + `set_clean_username` (P7v sibling) + `FLAGS_GOTID`; no `\n`/`\r` yet → early return; bad/empty → `is_abad++`. Config-resolved (USE_SYSLOG/DEBUGMODE off → no syslog/`get_client_name`/`Debug`; AFINET=AF_INET6 → `sockaddr_in6`/`sin6_port`; BUFSIZE=512). `index`→`strchr`, `rindex`→`strrchr`, `MyFree`→`free`, `ntohs`→`u16::from_be`; `sscanf` driven through libc with the exact C format. Seam: `-DPORT_S_AUTH_AUTHPORTS_P7w` on `s_auth_link.o`; both already global in `s_auth_ext.h` → no de-static, the prototype comes from the header. **L1** (`authports_diff.rs`, 10 cases) zero-diff vs `cref_`: `send_authports` over a *real* IPv6-loopback connected socket (so `getsockname`/`getpeername` populate `sin6_port` — an AF_UNIX socketpair leaves the port bytes untouched, a false diff) + the error/`highest_fd`-walk paths; `read_authports` over socketpair read-ends covering valid/OTHER/bad/ERROR/partial-early-return/EOF + the pre-auth free + `istat` decrement. Serialized on `GLOBALS_LOCK`. No L2/no S2S (utility TU, no `msgtab` entry, no live ident peer in the golden harness, no remote-user fields); existing golden suite (`golden_registration`) stays byte-identical.
- **P7x DONE: `s_auth.c` ident initiator `start_auth`** — ported the RFC1413 query initiator (`-DPORT_S_AUTH_START_AUTH_P7x` on the `s_auth_link.o` recipe): opens the non-blocking `authfd` socket, derives local/peer addrs from `getpeername`/`getsockname(cptr->fd)`, optionally overrides the bind source from the P-line TLS `source_ip`, then either hands off to iauth (`adfd>=0`: build `"<fd> C <themip> <themport> <usip> <usport>"` via `inetntop`+`ipv6string`+libc `sprintf`, `sendto_iauth`; success → `close authfd`/`authfd=-1`/`FLAGS_XAUTH`/return) or `bind`/`connect`s to `[peer]:113` (arm `FLAGS_WRAUTH|FLAGS_AUTH`, bump `highest_fd`). Config-resolved: NO_IDENT off (full body), USE_IAUTH on (early-return + handoff), USE_SYSLOG/DEBUGMODE off (no syslog/Debug), AFINET=AF_INET6. Calls the Rust `set_non_blocking`/`report_error`/`inetntop`/`inetpton`; *calls* the variadic `sendto_iauth`/`sendto_flag` (stay C). L1 differential (3 cases: `XOPT_REQUIRED && adfd<0` early return; iauth-handoff query bytes byte-identical over a shared real IPv6-loopback `cptr->fd`; getpeername-failure `authfd`-reset) zero-diff vs `cref_`, serialized on `GLOBALS_LOCK`. Utility/callee TU (no `msgtab`) — L1 is the gate; golden suite stays byte-identical (`golden_registration` confirmed); no S2S (no `IsServer`/remote-field path).
- **P7y DONE: `s_auth.c` iauth-pipe line parser `read_iauth`** — ported the last non-variadic logic in s_auth.c (s_auth.c:174; the slave-auth pipe drain: persistent `obuf`/`olen` partial-line carry + per-opcode dispatch `>`/`G`/`O`/`V`/`a`/`A`/`s`/`S`/`U`/`u`/`o`/`D`/`K`/`k`/garbage) to `ircd-common/src/s_auth.rs`; guarded the C body out via `-DPORT_S_AUTH_READ_IAUTH_P7y` on the `s_auth_link.o` recipe (`#else extern` proto for the still-C callers); the file-scope globals `iauth_version`/`iauth_conf`/`iauth_stats`/`iauth_options`/`iauth_spawn` stay C-owned in s_auth_link.o, referenced via extern; the variadic `sendto_iauth`/`sendto_flag` are CALLED (stay C). L1 differential (10 cases: O-options incl. flagless-reset, V replace+free, A/a conf add+clear, s/S stats reset+append, U/u ident, U with istat-decrement via per-world `MyMalloc`/`cref_MyMalloc`, gone/mismatch/garbage negatives, obuf/olen partial-line carry round-trip) zero-diff vs `cref_`; serialized on `GLOBALS_LOCK`. **Finding:** the per-client prefix uses the ported `inetntop` which expands `::1`→`0:0:0:0:0:0:0:1` (a faithful support.c quirk), so the iauth line must carry the expanded IPv6 form. No L2/S2S (utility TU, no `msgtab` entry, no `IsServer`/remote-field formatting; reached only via a live iauth slave the golden harness doesn't run). **Only `sendto_iauth`/`vsendto_iauth` (variadic → P8) remain C in s_auth.c.**
- **P7z DONE: `s_bsd.c` `check_client` (ordinary-client access check)** — ported `check_client` (the access check run from the Rust `register_user`): resolve the `getpeername` peer addr → `cptr->ip`/`port` (via a private Rust twin of the file-`static` `check_init`), verify the DNS host↔ip mapping both ways (IP# Mismatch → clear `hostp`), then `attach_Iline`. `NO_OPER_REMOTE`/`UNIXPORT` undef → no trailing `FLAGS_LOCAL` block / no unix branch (so no `mysk` use). `check_init` stays compiled in `s_bsd_link.o` for the still-C `check_server_init` (GCC inlines it into that sole remaining caller) — the P7p `set_sock_opts` private-twin precedent. Guard `-DPORT_S_BSD_CHECK_CLIENT_P7z`. L1 4-case zero-diff (`check_client_diff.rs`: no-hostp/empty-conf→-2, hostp-addr-match→kept, hostp-mismatch→cleared, getpeername-fail→-1) over a shared real IPv6-loopback fd + empty `conf`/`cref_conf`; L2 = existing `golden_registration` (the success path: real I:line → 0 → client registers) byte-identical; no S2S (no `IsServer` branch — servers go through `check_server_init`/`check_server`).
- **P7aa DONE: `s_bsd.c` `check_server_init` + `check_server` (server-side access check)** — ported the sibling of P7z `check_client` (`-DPORT_S_BSD_CHECK_SERVER_P7aa`): `check_server_init` attaches the C/N lines for the server name, confirms a C+N pair for a dialed link (`IsConnecting`/`IsHandshake`), fires an async DNS lookup of the conf host (`count_cnlines` + a stack `Link{value.aconf, flags=ASYNC_CONF}` + `gethost_byname`, `nextdnscheck=1`), then defers to `check_server`; `check_server` runs `check_init` (the P7z private Rust twin), validates the resolved host↔ip mapping (`IP# Mismatch` → drop `hp`, faithful four-`c_ulong` over-read), searches C/N lines by hostname/sockhost/ip#, `det_confs_butmask`, then on a C+N match `attach_conf`s both + the `AND16(ipnum)==255` dynamic-ip adoption + `get_sockhost(c_conf->host)`. Both dropped from `s_bsd_link.o`; the file-`static` `check_init` (+ its prototype) loses its last C caller so it is guarded out under the same `P7aa` symbol. Config-resolved: `UNIXPORT`/`DEBUGMODE` off. Callees (`attach_confs`/`find_conf`/`find_conf_host`/`find_conf_ip`/`attach_conf`/`det_confs_butmask`/`count_cnlines`/`gethost_byname`/`get_sockhost`/`add_local_domain`) are Rust; `sendto_flag` is *called* (variadic → P8). L1 6-case zero-diff (`check_server_diff.rs`: init unknown/handshake deny; check_server bad-socket→-2; connected ::1 no-hostp/hostp-match/hostp-mismatch→-1 with agreeing ip/port/sockhost); the C+N **success** path (return 0/attach) is covered by the existing L2-S2S golden suite (`golden_s2s_link`/`_eob`/`_who` link a real peer the Rust ircd accepts through `check_server_init` — all green). No new L2 file.
- **P7bb DONE: `s_bsd.c` `add_connection` (inbound-connection acceptor) + private `check_clones` twin** — port the per-`accept()` local-client constructor (`make_client` → resolve peer addr into `ip`/`port`/`sockhost` → clone-rate check → register fd in `local[]`/`fdall`/client list → `start_auth`) plus its file-`static` clone-rate callee `check_clones` (`CLONE_CHECK`; persistent backlog list, ported as a private Rust twin — no `cref_` oracle) via `-DPORT_S_BSD_ADD_CONN_P7bb`. Config-resolved: `NO_DNS_LOOKUP` (hostp=NULL, no async lookup, `USE_IAUTH` alias-forwarding block compiled out), `DELAY_CLOSE`/`CLONE_CHECK` on, `UNIXPORT` off, `AF_INET6`. L1 differential (normal accept post-state + clone flood over the backlog + the getpeername-fail/IsIllegal refuse inverses; `start_auth` neutralized via `iauth_options=XOPT_REQUIRED`+`adfd=-1`) zero-diff vs `cref_`; L2 = `golden_registration` (every client connection flows through it) byte-identical, `golden_s2s_link` green (incoming server links too); no new S2S (formats no remote-user fields, no `IsServer` branch).
- **P7cc DONE: `s_bsd.c` `connect_server` + static `connect_inet`** — the outbound server-connection setup (counterpart of P7bb `add_connection`): refuse if already linked, else build a client/server stub, `connect_inet` (`socket`/`bind` to `mysk` + dup-IP scan), `connect()`, re-attach+verify C/N lines, register the fd. `connect_inet` ported as a private Rust twin; `set_sock_opts` (last compiled C caller now gone) guarded out under the same `-DPORT_S_BSD_CONNECT_SERVER_P7cc`. Finding: the DNS block is dead under AF_INET6 (`!aconf->ipnum.S_ADDR` = array address, always false). L1 3-case zero-diff (already-present ±remote `by`, connect_inet-failure cleanup); no new L2 (golden/S2S dials *into* the ircd → outbound dial deferred to the event-loop/CONNECT L2).
- **P7dd DONE: `s_bsd.c` `start_iauth` (iauth subprocess respawn)** — the deepest boot-subtree leaf (`daemonize` calls it). (Re)spawns the external iauth helper over an `AF_UNIX` `socketpair`, recording the parent end in `adfd`: `BOOT_NOIAUTH` + `adfd>=0` + 90s-throttle guards, then `socketpair` → Rust `set_non_blocking` both ends → `setsockopt(SO_SNDBUF/RCVBUF, IAUTH_BUFFER=65535)` → `fork` (← `vfork`; identical here, libc deprecates vfork) → child close-loop/`dup2`/`execl(IAUTH_PATH, IAUTH)` → parent close; the non-first-call live-client burst as `"<fd> O"` lines. Statics `last`/`first`/`iauth_pid` → module-private; `IAUTH_PATH`/`IAUTH` expanded by build.rs into `ircd_sys::IAUTH_PATH`/`IAUTH` (the `PID_PATH` precedent). Guard `-DPORT_S_BSD_START_IAUTH_P7dd` on `s_bsd_link.o`. L1 3-case zero-diff (NOIAUTH + already-running early returns + the spawn post-state — `adfd` nonblocking, `iauth_spawn++` — with bounded child reaping); burst + full spawn end-to-end → L2/soak (golden boots `-t -s` = `BOOT_NOIAUTH`); no S2S.
- **P7ee DONE: `s_bsd.c` `daemonize` (boot detach + resolver/iauth init)** — ported the layer directly above the P7dd `start_iauth` (called once from `ircd.c` `main` at boot), now a clean leaf since its only non-libc callees `init_resolver` (P6) and `start_iauth` (P7dd) are Rust. Config-resolved: `TIOCNOTTY` defined on Linux (the ioctl block compiles); the `setpgrp` arm is the `#else` `setpgrp(0, getpid())` branch (glibc `setpgrp(void)` ignores the args; declared 2-arg to mirror the source). Faithful: `bootopt & BOOT_TTY` → short-circuit straight to `init_dgram` (no fork/no fd close); else `fclose(stdout)`/`close(1)`, (unless `BOOT_DEBUG`) `fclose(stderr)`/`close(2)`, and on a console/tty-not-inetd `fork()` (parent `exit(0)`s to detach) → `TIOCNOTTY` ioctl → `setpgrp` → `fclose(stdin)`/`close(0)`; then always `resfd = init_resolver(0x1f)` + `start_iauth(0)`. Partial port via the `s_bsd_link.o` seam (`-DPORT_S_BSD_DAEMONIZE_P7ee`). L1 differential (`daemonize_diff.rs`, 1 case: the `BOOT_TTY|BOOT_NOIAUTH` short-circuit — `init_resolver` opens a valid `resfd` socket, `start_iauth(0)` reached-but-no-op under `BOOT_NOIAUTH` leaving `adfd=-1` — the inverse check; both worlds identical) zero-diff vs `cref_daemonize`, serialized on `GLOBALS_LOCK`. **Mostly untestable by design:** the detach path forks (parent `exit(0)`s) + closes 0/1/2 — calling it destroys the harness, and even fork-isolation can't measure a function whose job is to detach; the only differentially-safe path (and the only one any harness takes — golden boots `-t` = `BOOT_TTY`) is the `BOOT_TTY` short-circuit. No new L2 (boot callee; `golden_registration` byte-identical via this path); no S2S (no remote-user fields). **Only `read_message` (+ its statics `polludp`/`check_ping`) remains C in `s_bsd.c`.**
- **P7ff DONE: `s_bsd.c` event-loop cluster `read_message` + 8 statics** (`completed_connection`/`read_listener`/`read_packet`/`client_packet`/`ircd_no_fakelag`/`do_dns_async`/`polludp`/`check_ping`) — the body of `io_loop` and the last *logic* in `s_bsd.c`: build the read/write fd_set over `fdp`+`udpfd`/`resfd`/`adfd` → `select()` → dispatch resolver/UDP/iauth reads + auth-fd I/O + listener `accept()`s + writable sendQ flushes + readable packets + dead-socket `exit_client`. `USE_POLL` off → the `select()` path; the 8 statics → module-private Rust twins (no `cref_` oracle); guard `-DPORT_S_BSD_READ_MESSAGE_P7ff`. **With `read_message` ported, `s_bsd_link.o` has zero functions left — only the data globals.** L1 = the differentially-safe empty-loop path (`read_message_diff.rs`, 2 cases zero-diff); L2 = the *entire* `golden_*`+`golden_s2s_*` suite byte-identical (every byte flows through it; only the known `golden_s2s_s_serv_stats` reference-C uninitialised-sendq flake fails — [[p5-s2s-stats-flake]]); destructive accept/read/write/exit + `polludp`/`do_dns_async` are L2-only by design.
- **P7gg DONE: `ircd.c` `try_connections` (auto-connect timer)** — ported the static io_loop AC timer (walks `conf`, picks the best AC-able `connect{}` C-line by lowest-hold/best-`pref`/highest-class, splices the winner to the list tail, penalises its `hold`, then defers or dials via `connect_server`); de-static'd (mysk precedent) so the cref archive exports `cref_try_connections`, guarded `-DPORT_IRCD_TRY_CONNECTIONS_P7gg` in `ircd_link.o` with an `#else extern` proto for the still-C io_loop caller. `DISABLE_DOUBLE_CONNECTS` undef → dup-IP scan dead. L1 8-case zero-diff (all non-`connect_server` paths incl. the tail-splice + deferred-notice via `iconf.aconnect=0`); the dial path is L2-only (golden dials *into* the ircd — P7cc precedent); no S2S.
- **P7hh DONE: `ircd.c` `check_pings` (io_loop ping/timeout sweep)** — ported the static io_loop timer helper (ircd.c:525): walks `local[highest_fd..0]`, pings idle registered links (`FLAGS_PINGSENT` state machine), times out unresponsive ones (`exit_client`; servers get a "No response … closing link" notice; DNS/auth waiters reset or handed to iauth via `sendto_iauth`), and folds the soonest next-check time into the return value. De-static'd under `-DPORT_IRCD_CHECK_PINGS_P7hh` (the try_connections P7gg precedent) on the `ircd_link.o` recipe; `#else extern` proto for the still-C io_loop caller. Config-resolved: TIMEDKLINES off → `kflag` permanently 0 (find_kill/kill-notice + static `lkill` gone, timeout arm always "Ping timeout"); USE_IAUTH on; DEBUGMODE off. C `goto ping_timeout` modelled by guarding the if/else on the negated recently-active condition; `bysptr` kept outside the loop (never reset). L1 (`check_pings_diff.rs`, 7 cases) zero-diff vs `cref_check_pings` over isolated worlds (real `local`/`highest_fd`/`me` vs `cref_*`), serialized on `GLOBALS_LOCK`: empty, listener-skip, recently-active-no-ping, the PINGSENT ping-send branch (its inverse), young-unregistered, already-pinged-idle-below-2*ping, mixed multi-fd sweep — asserts per-client (flags,lasttime)+return. The `exit_client` timeout paths are L2-gated (destructive+variadic, the read_message/P7ff precedent). L2 = the ircd-golden suite runs check_pings every io_loop tick; `golden_registration`+`golden_channel_join` byte-identical, only the documented `stats_t` reference-C garbage flake remains. No S2S (no command-driven remote-field formatting).
- **P7ii DONE: `ircd.c` `delayed_kills` (io_loop K-line sweep)** — ported the second io_loop timer helper (sibling of P7hh `check_pings`, ircd.c:447): runs only while `rehashed > 0`, walks `local[dk_lastfd..j]` and `find_kill`s every local person, `exit_client`ing K-line matches. De-static'd under `-DPORT_IRCD_DELAYED_KILLS_P7ii` on `ircd_link.o` (the check_pings precedent; `#else extern` proto for the still-C io_loop caller). Config-resolved: MAXDELAYEDKILLS=200 > MAXCONNECTIONS=50 → `j` always clamps to 0 → the sweep always completes in one call (persistent statics reset every call; the `return rehashed` incomplete-batch path unreachable); TIMEDKLINES off → find_kill `timedklines`=0. L1 (`delayed_kills_diff.rs`, 6 cases) zero-diff vs `cref_delayed_kills` over isolated worlds (real `local`/`highest_fd`/`rehashed` vs `cref_*` + empty kconf → no kill), serialized on `GLOBALS_LOCK`: empty across rehashed∈{0,1,2}→return{0,0,1}, person-no-kline completes & survives (the inverse of the kill arm), non-person/NULL skipped, mixed sweep — asserts return + per-client (status,flags,still-in-local). The `kflag==-1` kill arm (`exit_client`, destructive) is untested-by-design AND has no L2 path (golden never rehashes → delayed_kills' body isn't reached); `golden_registration` byte-identical (no-regression). No S2S (no remote-user wire fields).
- **P7jj DONE: `ircd.c` `setup_me` boot initializer** — ported the `me`-singleton initializer (ircd.c:723, de-static'd + extern-declared, `-DPORT_IRCD_SETUP_ME_P7jj` on `ircd_link.o`) to `ircd-common/src/ircd.rs`: passwd-derived `username`/`auth`, `get_my_name` sockhost, the `STAT_ME`/`FLAGS_OPER`/`FLAGS_EOB`/`SV_UID` bits, server-name interning (`find_server_num`/`find_server_string`), `make_user`, `istat.is_users`/`is_eobservers`, client+SID hash registration, `verstr=PATCHLEVEL`, `setup_server_channels`. All callees already Rust; no variadic senders. **L2-gated, no L1** (mutates 4 shared global tables + the `me` singleton + `istat` → not L1-isolatable; the P7dd/ee/ff precedent) — golden registration/lusers/s2s_server/s2s_info/s2s_map + 3 s_misc byte-identical (stats_t = documented pre-existing reference-C garbage flake). No S2S (no command wire output).
- **P7kk DONE: `ircd.c` signal-handler + reboot cluster** (`s_die`/`s_slave`/`s_rehash`/`s_restart`/`restart`/`server_reboot`, ircd.c:73–215) — ported the SIGTERM/SIGUSR1/SIGHUP/SIGINT handlers + the `restart`→`server_reboot` shutdown path to `ircd-common/src/ircd.rs` via `-DPORT_IRCD_SIGNALS_P7kk` (single guard over the contiguous block; `#else` re-declares the two non-header handlers for the still-C `setup_signals`); de-static'd the `dorehash`/`dorestart`/`restart_iauth` flags (shared with the still-C `io_loop`; one C definition, Rust writes via a local `extern "C"` block) and `s_rehash`/`s_slave` (cref oracle). `IRCD_PATH` plumbed as `ircd_sys::SERVER_PATH` for `server_reboot`'s `execv`. L1 differential (`ircd_signals_diff.rs`, 3 tests: `s_rehash` 0→1→2→2 ratchet, `s_slave` restart_iauth set, `s_restart` dorestart-when-not-tty) zero-diff vs `cref_`, serialized on `GLOBALS_LOCK`, signal dispositions saved/restored. L2 = boot gate (setup_signals installs the Rust handlers) + `golden_s_serv_shutdown`/`_maint` (die/restart/rehash reject + rehash_success io_loop path) byte-identical; the terminating arms (`exit`/`execv`) are faithful-by-inspection. No S2S (no command-driven remote-user wire fields).
=====DOCS P7=====
  - **Config-resolved body.** `TIOCNOTTY` defined on Linux → the `int fd` + ioctl block compiles. The `setpgrp` arm resolves to the `#else` `setpgrp(0, getpid())` branch (verified by preprocessing — none of `HPUX`/`SVR4`/`DYNIXPTX`/`_POSIX_SOURCE`/`SGI`/`__CYGWIN32__`/`__APPLE__` are defined); the linked glibc symbol is `setpgrp(void)` (ignores the args) — declared 2-arg in a local extern to mirror the source verbatim. `stdout`/`stderr`/`stdin` are glibc `extern FILE *` symbols (not the macros) → local externs (`stderr` reuses the module-top decl). `init_resolver` called as `crate::res::init_resolver`; `start_iauth` is the local Rust def in this module (called bare, not imported, to avoid shadowing the bindgen decl).
  - **Faithfulness.** `bootopt & BOOT_TTY` → short-circuit to `init_dgram` (no fork/no fd close); else `fclose(stdout)`/`close(1)`, (unless `BOOT_DEBUG`) `fclose(stderr)`/`close(2)`, and when `((bootopt & BOOT_CONSOLE) || isatty(0)) && !(bootopt & BOOT_INETD)` → `fork()` (the parent `exit(0)`s to detach), `open("/dev/tty")`+`ioctl(TIOCNOTTY)`+`close`, `setpgrp(0, getpid())`, `fclose(stdin)`/`close(0)`; then always `resfd = init_resolver(0x1f)` + `start_iauth(0)`.
  - **Classification / L1.** Utility/boot callee (no `msgtab` entry). **Mostly untestable by design:** the detach path forks (parent `exit(0)`s) and closes fds 0/1/2 — calling it on that path destroys the test harness, and even fork-isolation (P7r's trick) can't measure a function whose whole job is to detach. The only differentially-safe path is the `BOOT_TTY` short-circuit (`goto init_dgram`: no fork, no fd close) — which is also the only path any harness ever takes (golden boots `-t` = `BOOT_TTY`). `daemonize_diff.rs` (1 case): `bootopt = cref_bootopt = BOOT_TTY|BOOT_NOIAUTH`, `adfd=-1`, `resfd=-99` sentinel → call each world's `daemonize` → assert `resfd != -99` and `>= 0` (init_resolver opened the resolver socket), `(resfd>=0)==(cref_resfd>=0)` (both worlds succeeded identically), and the inverse: `adfd == -1` in both (`start_iauth(0)` reached but short-circuited on `BOOT_NOIAUTH`, touching nothing). Serialized on `GLOBALS_LOCK`; the opened resolver sockets are closed afterward. Untested-by-design: the entire detach path (`fclose`/`close` of 0/1/2, `fork`+parent `exit`, `TIOCNOTTY` ioctl, `setpgrp`).
  - **L2 / S2S.** No new L2 (boot callee, not a `msgtab` handler — the existing golden suite boots through the `BOOT_TTY` path of `daemonize`; `golden_registration` byte-identical, confirmed). No S2S (formats no remote-user wire fields).

- **2026-06-06 — P7ff (`s_bsd.c` `read_message` + 8 statics — the event loop) merged.** Ported the select/poll event loop `read_message` (s_bsd.c:2088) and its eight file-`static` helpers to `ircd-common/src/s_bsd.rs`; guard `-DPORT_S_BSD_READ_MESSAGE_P7ff` on the `s_bsd_link.o` recipe. This is the body of `io_loop` and the **last *logic* in `s_bsd.c`** — after it, `s_bsd_link.o` defines **zero functions**, only the data globals.
  - **Cluster choice** — `read_message` is the only non-`static` symbol left in `s_bsd_link.o`; its callees `completed_connection` (s_bsd.c:1247), `read_listener` (1835), `read_packet` (2004), `client_packet` (1938), `ircd_no_fakelag` (1930), `do_dns_async` (3324), `polludp` (3212), `check_ping` (3165) are all `static` (no `cref_` oracle) → one connected component, ported together as module-private Rust twins (the `check_init`/`set_sock_opts`/`connect_inet`/`check_clones` precedent).
  - **Config-resolved body** — `USE_POLL` **off** → the `select()`/`fd_set`/`FD_*`/`highfd` path compiles; the entire `#if defined(USE_POLL)` pfd machinery is dead and omitted. `USE_IAUTH` on (the `DoingXAuth`/`WaitingXAuth`/`adfd`/`read_iauth`/`sendto_iauth` arms + do_dns_async's iauth alias-forward block). `LISTENER_DELAY` = 1 (the listener once-per-second throttle), `LISTENER_MAXACCEPT` = 10, `MAXCLIENTS` = 45, `CLIENT_FLOOD` = 1000, `HELLO_MSG`/`IRC_VERSION` resolved as module consts. `ZIP_LINKS`/`UNIXPORT`/`DEBUGMODE` off, `DELAY_CLOSE`/`CACCEPT_DELAYED_CLOSE` on, `JAPANESE` off, `AFINET=AF_INET6`.
  - **Faithfulness** — `highfd`/`delay2`/`ret` declared before the `for(res=0;;)` select-retry loop (persist across retries, never reset — the faithful C quirk). The `read_message` per-fd dispatch `goto deadsocket` becomes a `dead: bool` + structured `continue`s (both goto sites set `dead`, the deadsocket block runs once). `while(max--)` in `read_listener` → a `{ let cur = max; max -= 1; cur != 0 }` head. `client_packet`'s inner long-no-newline `while(dolen<=0)` drain + `FLAGS_NONL` break preserved. `check_ping`'s `cp->ping = (cp->rtt /= cp->lrecvd)` order kept; `pow` is the libc symbol (NOT `f64::powf` — last-ULP drift, the P7t precedent). `polludp`'s `ntohl`/`htonl` over the `u_long pi_id` truncate to 32 bits then byteswap (`u32::from_be`/`to_be as u_long`); the `#if 0` recvfrom-error report and the function `static`s `last`/`cnt`/`mlen`/`lasterr` → module `static mut`. `do_dns_async`'s `static Link ln` → a module `static mut DO_DNS_LN` (const-initialised union) so the address handed to `get_res` is stable; `hp->h_addr` macro = `h_addr_list[0]`. The private `static char readbuf[READBUF_SIZE]` (16384) → a module `static mut READBUF`.
  - **Callees** — in-module Rust: `add_connection` (P7bb), `connect_server` (P7cc), `delay_close` (P7f), `report_error` (P7q), `get_sockerr` (P7d). bindgen externs (resolve to Rust at link): `dopacket` (P7b), `exit_client`/`get_client_name` (P5), `send_queued`/`flush_connections` (P3/send), `start_auth`/`read_iauth`/`send_authports`/`read_authports` (P7w-y), `find_conf`/`is_allowed` (P6), `match_`/`inetntop` (P1), `dbuf_get`/`getmsg`/`put` (P1), `get_res`/`del_queries`/`find_bounce`/`my_name_for_link`, `restart`. Variadic (*called*, → P8): `sendto_flag`/`sendto_one`/`sendto_iauth`. The data globals `local[]`/`highest_fd`/`timeofday`/`fdas`/`fdall`/`readcalls`/`udpfd`/`resfd`/`adfd`/`ircstp`/`istat`/`iconf`/`conf`/`nextping`/`nextdelayclose`/`ipv6string`/`me` are bindgen statics (still C-owned in `s_bsd_link.o`).
  - **Classification** — utility/boot callee (no `msgtab` entry; reached from `io_loop`). `read_message` has a `cref_` oracle but is the event loop — every meaningful path `select()`s real fds, `accept()`s/`recvfrom()`s/`send()`s real sockets, and *destructively* `exit_client`s, none of which is differentially deterministic in isolation (the `daemonize`/P7ee situation). **L2 is the real gate.**
  - **L1** — `ircd-testkit/tests/read_message_diff.rs`, 2 cases zero-diff vs `cref_`, serialized on `GLOBALS_LOCK` (the [[p7-l1-shared-global-race]] hazard; `udpfd`/`resfd`/`adfd` are process globals). The one differentially-safe path: an empty `FdAry` (`highest = -1`) + `udpfd = resfd = adfd = -1` + `delay = 0` → an empty fd_set, `select(0, …, 200ms)` returns 0, no dispatch, return 0; both worlds agree (`ro = 0` and `ro = 1`). Proves the loop skeleton + the `select` call + the no-fds-ready dispatch are byte-identical.
  - **L2 / S2S** — no new file. The *entire* `ircd-golden` `golden_*` + `golden_s2s_*` suite (111 test files) runs through `read_message` (it is `io_loop`'s body) — registration, every channel/user/oper command, and the full S2S server-burst/netsplit matrix exercise the accept/read/write/exit + server-link `read_packet`/`completed_connection` paths end-to-end. Ran the full 111-file suite with `--no-fail-fast`: **192 passed, 2 failed**, both **pre-existing reference-C STATS garbage flakes** ([[p5-s2s-stats-flake]]), not P7ff regressions (the reference-C binary is frozen — a Rust edit can't change its output; the Rust side prints the correct value in both): (1) `golden_s2s_s_serv_stats` `s2s_stats_match_reference` — uninitialised peer-burst sendq (`…965524992kB sq` vs Rust `0kB sq`); (2) `golden_s_misc` `stats_t_matches_reference` — STATS t's "dropped %luSq/%luYg/%luFl" prints `ircstp->is_cklQ/is_ckly/is_cklno` (`u_int`, 4 bytes) with `%lu` (8 bytes) in the still-C variadic `sendto_one`, so reference-C `va_arg`s 4 bytes of call-frame garbage (`281470681743360Sq/…`) vs Rust `0Sq/0Yg/0Fl` — a `%lu`/`u_int` width-mismatch in s_misc.c:1079, surfaced (not caused) by P7ff.
  - **Untested-by-design (noted)** — the destructive accept/read/write/exit dispatch, `polludp`/`check_ping` (need a live UDP CPING peer), and `do_dns_async` (needs a live resolver fd) are deterministic only at L2/soak.

- **2026-06-06 — P7gg (`ircd.c` `try_connections`, auto-connect timer) merged.** Ported the static `io_loop` AC timer (ircd.c:226) to `ircd-common/src/ircd.rs`, the sibling of `calculate_preference` (P7t).
  - **Cluster choice** — `try_connections` is the next `io_loop` timer helper after `calculate_preference`. Each AC tick it walks the global `conf` list, folds the lowest future `hold` into `next`, and chooses the single best AC-able `connect{}` C-line to dial: candidate = status carries `CONF_CONNECT_SERVER|CONF_ZCONNECT_SERVER`, `port > 0`, class `maxLinks != 0`; skipped if future-held / at `maxLinks` / already linked (`find_name`/`find_mask`) / denied (`find_denied`); best by (lower `pref >= 0`, else higher class number). The winner is spliced to the list **tail** (round-robin), its `hold` penalised by another `con_freq`, then deferred (AC disabled) or dialed via `connect_server` (P7cc). Returns the next-call time (`0` = nothing pending); `BOOT_STANDALONE` → `0`.
  - **Guard / de-static** — `try_connections` is `static` → no `cref_` oracle symbol. De-static'd in ircd.c under `#ifndef PORT_IRCD_TRY_CONNECTIONS_P7gg` (the `mysk`/`check_init`/`connect_inet` precedent) so the cref archive's prefix-rename exports `cref_try_connections`; the `#else` branch is an `extern time_t try_connections(time_t)` prototype so the still-C `io_loop` caller (ircd.c:1186) keeps a declaration. `-DPORT_IRCD_TRY_CONNECTIONS_P7gg` added to the `ircd_link.o` make rule (alongside the P7c/P7t defines). The full `ircd.o` (cref oracle, no PORT define) keeps the non-static body.
  - **Config-resolved body** — `DISABLE_DOUBLE_CONNECTS` undef → the whole `for (i=highest_fd…)` duplicate-IP scan + `SCH_SERVER` "AC postponed" notice block is dead (dropped); `DEBUGMODE` off → every `Debug((…))` no-op.
  - **Faithfulness** — the tail-splice replicates the C `for (pconf=&conf; (aconf=*pconf); pconf=&(aconf->next))` walk **exactly**: the `if (aconf==con_conf) *pconf=aconf->next;` removal does NOT short-circuit the pointer advance, and the detached node's own `next` is left intact so the walk still reaches the real tail through it. Macros inlined: `Class(x)=x->class`, `MaxLinks(x)=x->maxLinks`, `Links(x)=x->links`, `ConfClass(x)=x->class->class`, `get_con_freq` (Rust P2). `DELAYCHASETIMELIMIT`=1800. The variadic `sendto_flag` is *called* via the module's local `extern "C"` block (→ P8); `connect_server` (P7cc)/`find_name`/`find_mask` (P4)/`find_denied` (P6) resolve through the link seam.
  - **Classification** — `io_loop` callee (no `msgtab` entry), reached only from the periodic AC recompute; formats no remote-user wire fields.
  - **L1** — `try_connections_diff.rs`, 8-case zero-diff vs `cref_try_connections` over two isolated conf worlds (Rust `conf`/`iconf`/`bootopt` vs the `cref_` copies), serialized on `GLOBALS_LOCK` (the documented P7 shared-global hazard). Covers every path that does NOT reach `connect_server`: `BOOT_STANDALONE` early return, empty conf, all skip-`continue`s (non-C-line, `port<=0`, `maxLinks==0`, future-held, class-full-before-hold-write, already-linked, denied), and — by pinning `iconf.aconnect=0` — the best-conf selection, the tail-splice (winner moved to list end), the `hold += get_con_freq` penalty, and the "administratively disabled" deferred-notice branch. Compares per-conf `hold`/`pref` + the resulting list order (by build index) + the return value. Two initial expectation bugs in the test (wrong `BOOT_STANDALONE` literal; assuming the class-full skip writes `hold`) were caught because the Rust↔oracle diff stayed green while the absolute-value asserts failed — fixed the expectations, port unchanged.
  - **L2** — the `connect_server`-reached dial is L2-only: the `ircd-golden`/S2S harness dials *into* the ircd and never auto-connects out (the P7cc precedent), so the outbound AC dial is deferred to the event-loop/CONNECT L2. `golden_registration` confirmed byte-identical (boot/event-loop path unaffected). No S2S (no remote-field formatting).

- **2026-06-06 — P7hh (`ircd.c` `check_pings` — the io_loop ping/timeout sweep) merged.** Ported the static `io_loop` timer helper `check_pings` (ircd.c:525) to `ircd-common/src/ircd.rs`, the sibling of `try_connections` (P7gg) and `calculate_preference` (P7t). The next `io_loop` callee after the AC timer; one of the two remaining loop helpers (`delayed_kills` is next).
  - **Cluster choice / Scope.** Called once per loop tick from `io_loop` (ircd.c:1277) when `timeofday >= nextping`. Walks `local[highest_fd..0]`; per non-listener local connection: pings idle registered links (`FLAGS_PINGSENT` state machine), times out unregistered/unresponsive ones (`exit_client`; servers/connecting/handshake get a "No response … closing link" notice, with a remote-oper NOTICE via `bysptr`; DNS/auth/xauth waiters either get an iauth extension (`%d d`/`%d T`) or are reset/exited), and folds the soonest next-check calendar time into `oldest` (the return), with the `+PINGFREQUENCY`/`+30` clamps.
  - **Guard / de-static.** `check_pings` is `static` → no `cref_` oracle symbol. De-static'd in ircd.c under `#ifndef PORT_IRCD_CHECK_PINGS_P7hh` (the `try_connections`/`mysk` precedent) so the cref archive's prefix-rename exports `cref_check_pings`; the `#else` branch is an `extern time_t check_pings(time_t)` proto so the still-C `io_loop` caller keeps a declaration. `-DPORT_IRCD_CHECK_PINGS_P7hh` added to the `ircd_link.o` make recipe (alongside the P7c/P7t/P7gg defines). The full `ircd.o` (cref oracle, no PORT define) keeps the non-static body.
  - **Config-resolved body.** `TIMEDKLINES` off (config.h:207 commented) → the `static time_t lkill`, the `kflag = find_kill(...)` block, the `if (kflag && IsPerson)` kill-notice arm, and the trailing `if (currenttime - lkill > 60)` all vanish; `kflag` is permanently 0 → the goto guard reduces to `if (IsRegistered && ping >= now-lasttime)`, the timeout `if` to `((idle >= 2*ping && PINGSENT) || (!registered && firsttime-too-old))`, and the kill/else collapses to always `exit_client(... "Ping timeout")`. `USE_IAUTH` on → the iauth extwait/notimeout `sendto_iauth` block compiles. `DEBUGMODE` off → every `Debug((...))` no-op. `ACCEPTTIMEOUT`=90, `PINGFREQUENCY`=120 (plain `#define`s, inlined as module consts).
  - **Faithfulness.** The C forward `goto ping_timeout` (recently-active fast path) is modelled by guarding the whole timeout/ping if/else on the **negated** recently-active condition and falling through to the timeout computation — no control-flow change. `bysptr` is declared **once outside** the loop and never reset inside (faithful: a server-timeout's `bysptr` persists across later iterations). `ME` = `me.name`. Macros inlined as private `unsafe fn` helpers (copied from s_bsd.rs): `is_listener`/`is_registered`/`is_server`/`is_connecting`/`is_handshake`/`doing_dns`/`doing_auth`/`doing_xauth`/`clear_auth`/`clear_dns`/`clear_xauth`/`clear_wxauth`/`set_done_xauth`/`my_connect`/`me_ptr`/`local_base`. The variadic `sendto_one`/`sendto_iauth`/`sendto_flag` are *called* via the module's local `extern "C"` block (→ P8); `exit_client`/`find_uid`/`get_client_name`/`del_queries` resolve through the link seam (Rust P5/P6).
  - **Classification.** `io_loop` callee (no `msgtab` entry), reached only from the periodic ping recompute. The only remote read is `bysptr` (a remote oper) for a NOTICE on server timeout — a server-link path exercised by the L2/S2S loop, not a client command. → **L2-gated**, with an L1 over the deterministic non-destructive paths.
  - **L1** — `check_pings_diff.rs`, 7-case zero-diff vs `cref_check_pings` over two isolated worlds (Rust `local`/`highest_fd`/`me` vs the `cref_` copies), each building its own parallel client set, serialized on `GLOBALS_LOCK` (the documented P7 shared-global hazard). Covers every path that does NOT reach `exit_client` or the server-timeout `find_uid`/`sendto_one`: empty `local[]` (oldest stays 0 → `now+PINGFREQUENCY`), listener-skip (`FLAGS_LISTEN`), recently-active registered (`ping >= now-lasttime` → goto, no ping, flags untouched), the `FLAGS_PINGSENT` ping-send branch (idle 121 > ping 120, below 2*ping → sets `FLAGS_PINGSENT` + rewrites `lasttime = now-ping` + sends PING — the inverse of recently-active), young unregistered (firsttime < ACCEPTTIMEOUT, left alone), already-pinged idle below 2*ping (folds oldest only), and a mixed multi-fd sweep (listener + recent + idle-pinged + young-unreg) exercising the oldest-fold + final clamps. Asserts each client's post-`(flags,lasttime)` + the return value identical. Finding: a fresh `calloc`'d client needs `acpt` set (real `make_client` sets it to the listener) or `send_message`'s `acpt != &me` sendM bump null-derefs; `fd = -1` + a sub-1024-byte PING never trips `send_queued` so there is no real socket write.
  - **L2** — no new file. The entire `ircd-golden` suite runs `check_pings` every `io_loop` tick (it is the registration-timeout + ping path). `golden_registration` (boot/loop/timeout) and `golden_channel_join` byte-identical; the only failure is the documented pre-existing `golden_s_misc` `stats_t` reference-C garbage flake ([[p5-s2s-stats-flake]] / P7ff) — a `%lu`/`u_int` width mismatch in the still-C variadic `sendto_one` (`281470681743360Sq` from `va_arg`'d call-frame garbage in the frozen reference-C binary vs the correct `0Sq/0Yg/0Fl` from Rust), surfaced not caused. No S2S (no command-driven remote-field formatting).

- **2026-06-06 — P7ii (`ircd.c` `delayed_kills` — the io_loop K-line sweep) merged.** Ported the static `io_loop` timer helper `delayed_kills` (ircd.c:447) to `ircd-common/src/ircd.rs`, the sibling of `check_pings` (P7hh). The other of the two remaining loop helpers; `io_loop` calls it (ircd.c:1294, `rehashed = delayed_kills(timeofday)`) **only while `rehashed > 0`** — i.e. after a rehash queues a K-line re-evaluation.
  - **Cluster choice / Scope.** Walks `local[dk_lastfd..j]` (a batch of at most `MAXDELAYEDKILLS`); for every local fully-registered person it runs `find_kill`, and on a match (`kflag == -1`) notices the oper channel (`sendto_flag "Kill line active for %s"`), stamps `cptr->exitc = EXITC_KLINE`, and `exit_client`s the connection with the kill reason. Returns 1 if work remains queued (incomplete batch, or `rehashed == 2` — a rehash arrived mid-sweep), else 0. Persistent function-local statics (`dk_rehashed`/`dk_lastfd`/`dk_checked`/`dk_killed`) carry the batch cursor across calls; `dk_rehashed == 0` re-arms the sweep from `highest_fd`.
  - **Guard / de-static.** `delayed_kills` is `static` → no `cref_` oracle symbol. De-static'd in ircd.c under `#ifndef PORT_IRCD_DELAYED_KILLS_P7ii` (the `check_pings`/`try_connections`/`mysk` precedent) so the cref archive's prefix-rename exports `cref_delayed_kills`; the `#else` branch is an `extern int delayed_kills(time_t)` proto so the still-C `io_loop` caller keeps a declaration. `-DPORT_IRCD_DELAYED_KILLS_P7ii` added to the `ircd_link.o` make recipe (alongside the P7c/P7t/P7gg/P7hh defines). The full `ircd.o` (cref oracle, no PORT define) keeps the non-static body.
  - **Config-resolved body.** `MAXDELAYEDKILLS` = 200 (config.h:423) and `MAXCONNECTIONS` = 50 (config.h:150): the `#ifdef MAXDELAYEDKILLS` batch block IS compiled, but `j = dk_lastfd - 199` with `dk_lastfd ≤ 49` is **always < 0 → clamped to 0**, so the whole `local[]` is swept in a single call and `dk_lastfd` always reaches -1 → the persistent statics reset every call (no multi-call drain) and the trailing `return rehashed` (incomplete-batch path) is **unreachable** under the locked config — ported faithfully regardless. `TIMEDKLINES` off → `find_kill`'s `timedklines` arg is 0 (the `check_pings` finding); `DEBUGMODE` off → the `Debug((DEBUG_DEBUG, "DelayedKills killed…"))` no-op.
  - **Faithfulness.** The C `for (i = dk_lastfd; i >= j; i--)` with its `continue` (which still runs `i--`) and in-loop `j--` (on a NULL/non-person slot, only while `j > 0`) is modelled by a `while i >= j` loop that decrements `i` before every `continue`/iteration end, so the post-loop `dk_lastfd = i` lands on `j-1` identically. `IsPerson` = `user && (STAT_CLIENT || STAT_OPER)` and `BadPtr` inlined as private `unsafe fn` helpers. The summary `sendto_flag(SCH_NOTICE, "DelayedKills checked %d killed %d in %d sec", dk_checked, dk_killed, currenttime - dk_rehashed)` passes a `time_t` (long) to a `%d` — a faithful C quirk, passed verbatim (the variadic trampoline reads 32 bits; a no-op until the notice channel exists). The variadic `sendto_flag` is *called* (→ P8); `find_kill` (Rust P6i)/`get_client_name`/`exit_client` resolve through the link seam.
  - **Classification.** `io_loop` callee (no `msgtab` entry), reached only after a rehash queues K-line re-evaluation (`rehashed > 0`). → **L1-gated**: the kill arm is destructive (`exit_client`) AND requires both a matching K-line conf and `rehashed > 0`, neither of which the golden suite produces — so unlike `check_pings`, `delayed_kills`' body has no L2 path at all (golden never rehashes).
  - **L1** — `delayed_kills_diff.rs`, 6-case zero-diff vs `cref_delayed_kills` over two isolated worlds (Rust `local`/`highest_fd`/`rehashed` + empty `kconf`/`tkconf` → `find_kill` returns 0, no kill, vs the `cref_` copies), serialized on `GLOBALS_LOCK` (the documented P7 shared-global hazard). Covers the **non-kill** sweep (the inverse of the destructive kill arm): empty `local[]` across `rehashed` ∈ {0,1,2} (→ return {0,0,1} — exercises the requeue logic), an `IsPerson` client over empty conf (checked, no kill → completes, **client left alive**: status/flags unchanged + still in `local[]`), non-person (no `user`) + userless STAT_CLIENT slots (both `!IsPerson` → skipped before `find_kill`), and a mixed multi-fd sweep. Asserts identical return + per-client `(status, flags, still-in-local)`. A `with_user` client gets a zeroed `anUser` (username "") so `find_kill` walks the empty conf and returns 0.
  - **Untested-by-design / L2** — the `kflag == -1` kill arm (`exit_client` is destructive — the `check_pings`/`read_message` L2-gating precedent — and needs both a K-line conf match and a queued rehash). No new L2 file: `golden_registration` confirmed byte-identical (no-regression; the boot/event-loop path is unaffected and `delayed_kills` is never entered without a rehash). No S2S (formats no command-driven remote-user wire fields).

- **2026-06-06 — P7jj (`ircd.c` `setup_me`) merged.** Ported the boot-time `me`-singleton initializer to `ircd-common/src/ircd.rs`, the last substantive non-spine leaf in `ircd.c`.
  - **Cluster choice** — `setup_me` (ircd.c:723) is the boot helper `main()` calls once (ircd.c:1113) after `bzero(&me)` + `make_server(&me)` + config read have populated `me.serv->namebuf` (server name; `make_server` self-points `me.name → serv->namebuf`), `me.serv->sid`, `me.info`. The remaining `ircd.c` leaves are `setup_signals` (blocked on the still-static signal handlers `s_rehash`/`s_slave`), `bad_command` (exit, untestable), `open_debugfile` (empty under DEBUGMODE-off) — `setup_me` is the only one with real, L2-observable logic.
  - **Seam / Guard** — `#ifndef PORT_IRCD_SETUP_ME_P7jj` around the body, `static` removed, `extern void setup_me(aClient *mp);` after `#endif` so the guarded `ircd_link.o`'s `main()` resolves the call to the Rust `#[no_mangle] setup_me` (the cref oracle keeps the full unguarded `ircd.o`). `-DPORT_IRCD_SETUP_ME_P7jj` appended to the `ircd_link.o` make recipe. Confirmed `nm target/debug/ircd` shows `T setup_me` (from Rust).
  - **Faithfulness** — `getpwuid(getuid())->pw_name` (or `"unknown"`) feeds both `username` copies; `me.info == DefInfo` compares the **global** `me.info` pointer (via `addr_of_mut!(me)`) against the `DefInfo` constant (list.c); `ME` = `me.name`; `SetMe`=`status=STAT_ME`, `SetEOB`=`flags|=FLAGS_EOB`; `strncpyzt` (local macro twin) + `strcpy(user->host, mp->name)` use the exact bindgen array lengths; `PATCHLEVEL` resolved to the locked `patchlevel.h` literal `"0211030000"`. No variadic senders called.
  - **Callees** — `get_my_name` (P7s), `find_server_num`/`find_server_string` (P5 s_serv), `make_user` (P2 list), `add_to_client_hash_table`/`add_to_sid_hash_table` (P2 hash), `setup_server_channels` (P5 channel), `mystrdup` (P1) — all Rust, imported from `ircd_sys::bindings`.
  - **Classification / L2-gated (no L1)** — not a `msgtab` handler. `setup_me` mutates four shared process-global tables (client hash, SID hash, `server_name[]` interning, channel hash) plus the `me` singleton and `istat`; an L1 differential on the real Rust-side globals can't be isolated/cleaned without leaking channel-hash entries into other `ircd-common` L1 tests. Its entire output is observable on every `ircd-golden` boot (server name in numerics, SID, 004/005, LUSERS `is_users`, oper+EOB status, server channels, `verstr`/`info` in the S2S burst), so the golden suite is the gate (P7dd/ee/ff L2-gating precedent).
  - **L2** — golden `registration` (x2), `s_serv_lusers`, `s2s_server` (introduce), `s2s_s_serv_info`, `s2s_s_serv_map`, and 3/4 `s_misc` all byte-identical. The `s_misc::stats_t` failure is the documented pre-existing reference-C uninitialized-garbage flake (`...743360Sq/...452800Yg/...` on the **reference** side; Rust correctly emits `0Sq/0Yg/0Fl`) — see the p5-s2s-stats-flake note, not a regression.
  - **S2S** — none needed: `setup_me` formats no command-driven remote-user wire fields.
- **2026-06-06 — P7kk (`ircd.c` signal-handler + reboot cluster) merged.** Ported the contiguous signal block `ircd.c:73–215` — the SIGTERM/SIGUSR1/SIGHUP/SIGINT handlers (`s_die`/`s_slave`/`s_rehash`/`s_restart`) plus the `restart`→`server_reboot` shutdown path — to `ircd-common/src/ircd.rs`.
  - **Cluster choice** — a connected component: the four signal handlers set the io_loop flags (`dorehash`/`dorestart`/`restart_iauth`), `restart` (called by Rust `list.rs`/`s_bsd.rs`/`s_serv.rs` + still-C `io_loop`) calls `server_reboot`. Deliberately *excludes* `setup_signals` (the installer — needs `dummy` + edits the shared forward-proto line 34; its own sub-phase), `io_loop`, `open_debugfile`, `bad_command`, `c_ircd_main`.
  - **Seam / Guard** — one `#ifndef PORT_IRCD_SIGNALS_P7kk` over 73–215; the `#else` branch re-declares `s_rehash`/`s_slave` (not in `ircd_ext.h`) so the still-C `setup_signals` (line 1370) keeps its prototypes — `s_die`/`s_restart`/`restart`/`server_reboot` are header-declared. `-DPORT_IRCD_SIGNALS_P7kk` appended to the `ircd_link.o` recipe; the cref oracle keeps the full unguarded `ircd.o`. Confirmed `nm target/debug/ircd` shows `T` for all six from Rust.
  - **De-static** — `dorehash`/`dorestart`/`restart_iauth` (`volatile static int` → `volatile int`): read by the still-C `io_loop`, written by the Rust handlers, so one definition must serve both — they stay C-defined in `ircd_link.o`, Rust references them through a local `extern "C"` block; de-static also yields `cref_dorehash`/… for L1. `s_rehash`/`s_slave` (+ the line-37 forward proto) de-static'd so the prefix-rename exports `cref_s_rehash`/`cref_s_slave` (the L1-cref-static-symbol limit).
  - **Config-resolved body** — `POSIX_SIGNALS`=1 (the `sigaction` re-arm in each handler compiles), `RETSIGTYPE`=void, `USE_IAUTH` ON (`s_slave` + the SIGCHLD arm), `USE_SYSLOG` UNDEF (every syslog/closelog/openlog arm dropped), `UNIXPORT` UNDEF (`s_die`'s unix-socket unlink loop dropped), `DEBUGMODE` OFF (`Debug()` no-ops), not `__FreeBSD__`. `MAXCONNECTIONS`=50; `SCH_NOTICE`=`ServerChannels_SCH_NOTICE`.
  - **Faithfulness** — the `sbrk(0)-sbrk0` byte delta is `(brk as usize).wrapping_sub(sbrk0 as usize) as u32` fed to the variadic `%u`; `s_die` broadcasts `:%s SDIE` via `sendto_serv_v` with `(*me.serv).sid`; `restart`/`server_reboot` notice via `sendto_flag(SCH_NOTICE,…)`; `s_restart`'s `BOOT_TTY`→`fprintf(stderr)`+`exit` arm uses the module's `stderr_ptr()` helper; the fd-close sweep is `for i in 3..MAXCONNECTIONS`. `IRCD_PATH` (Makefile var, absent from bindgen) plumbed via build.rs `cargo:rustc-env=IRCD_SERVER_PATH` → `ircd_sys::SERVER_PATH` for `server_reboot`'s `execv(IRCD_PATH, myargv)` (the MOTD/PID/IAUTH path precedent). The `fn as usize` sigaction-handler casts go through an explicit `unsafe extern "C" fn(c_int)` pointer (no warning).
  - **Callees** — `flush_connections`/`logfiles_close`/`mybasename` (Rust/P1), `ircd_writetune` (P7c, Rust), variadic `sendto_serv_v`/`sendto_flag` (C trampolines → P8); libc `sigaction`/`sigemptyset`/`sigaddset`/`sbrk`/`close`/`isatty`/`execv`/`exit`/`fprintf`. Globals `me`/`tunefile`/`sbrk0`/`myargv`/`bootopt` from bindings; the de-static'd flags from the local extern block.
  - **L1** — `ircd_signals_diff.rs` (3 tests): `s_rehash` ratchet 0→1, 1→2, 2→2; `s_slave` sets `restart_iauth`; `s_restart` sets `dorestart` with `BOOT_TTY` cleared — each zero-diff vs the `cref_` oracle on the respective flag. Serialized on `GLOBALS_LOCK` (the P7 L1 shared-global hazard); SIGHUP/SIGINT/SIGUSR1 dispositions snapshotted+restored (the handlers re-arm themselves). The terminating arms (`s_die`/`restart`/`server_reboot` `exit`/`execv`; `s_restart`'s `BOOT_TTY` exit) are not run — faithful by inspection.
  - **L2** — boot gate: the still-C `setup_signals` now installs the Rust handlers on every `ircd-golden` boot; `golden_registration` (x2), `golden_s_serv_shutdown` (die/restart/rehash *reject* + `rehash_success` — the io_loop reading the de-static'd `dorehash`), `golden_s_serv_maint` (die/restart reject) all byte-identical. `golden_s_misc::stats_t` fails on the documented pre-existing reference-C uninitialized-garbage flake (`…743360Sq` on the **reference** side; Rust correctly emits `0Sq/0Yg/0Fl`) — see the p5-s2s-stats-flake note, not a regression.
  - **S2S** — none needed: the signal cluster formats no command-driven remote-user wire fields.
