
- **2026-06-06 — P7bb (`s_bsd.c` `add_connection` + `check_clones`) merged.**
  - **Cluster choice** — the inbound-connection acceptor `add_connection` (s_bsd.c:1638), the next leaf bottom-up after the P7d–P7aa socket/teardown/listener/access-check leaves: it is called from the still-C `read_listener` for each fd `accept()`ed off a listener. Its only caller-private callee `check_clones` (s_bsd.c:1572, `CLONE_CHECK`) is ported alongside it.
  - **Guard** — `-DPORT_S_BSD_ADD_CONN_P7bb` wraps two regions under one macro: `check_clones` (inside the surrounding `#ifdef CLONE_CHECK`) and `add_connection`. The P7k `add_connection_refuse` sitting between them keeps its own guard. `add_unixconnection` (`#ifdef UNIXPORT`) is not compiled.
  - **`check_clones` as a private twin** — `static` in C → no `cref_` symbol → cannot be L1-diffed directly; ported as a module-private Rust `fn` with a `static mut BACKLOG` matching the C function-local `struct abacklog` list (age out `pt+CLONE_PERIOD<timeofday`, prepend `{ip,now}`, count same-ip nodes). `MyMalloc` (P2) / libc `free` (the `MyFree` macro). Observed only through `add_connection`'s clone-reject path. The P7p `set_sock_opts` / P7z `check_init` precedent.
  - **Config-resolved body** — `NO_DNS_LOOKUP` set (build.rs `EXTRA_CFLAGS`): the `else` arm just sets `acptr->hostp = NULL`, and the `USE_IAUTH && !NO_DNS_LOOKUP` alias-forwarding block (`%d A`/`%d N` to iauth) is compiled out. `CLONE_CHECK` on (CLONE_MAX=10, CLONE_PERIOD=2) → the clone branch compiles; `DELAY_CLOSE`=15 → clone reject uses `nextdelayclose = delay_close(fd)` then `add_connection_refuse(fd,acptr,1)`. `UNIXPORT` undef, `AFINET=AF_INET6` (`sin6_*`, 16-byte `in6_addr`), `linux` → the getpeername-fail arm guards `report_error` behind `errno != ENOTCONN`.
  - **Callees** — `make_client`/`add_client_to_list`/`add_fd` (P2), `inetntop` (P1), `report_error` (P7q), `add_connection_refuse` (P7k), `delay_close` (P7f), `set_non_blocking` (P7d), `set_sock_opts` (P7p private twin), `start_auth` (P7x) all Rust; `get_sockhost`/`get_client_host`/`sendto_flog` stay C (non-variadic bindgen externs); `sendto_flag` is *called* (variadic, → P8). `local`/`highest_fd`/`fdall`/`nextdelayclose`/`ipv6string`/`timeofday` are bindgen statics.
  - **Classification** — utility/callee TU (not a `msgtab` handler): reached from `read_listener`. Universally exercised by L2.
  - **L1** — `ircd-testkit/tests/add_connection_diff.rs`, 3 tests, zero-diff vs `cref_`. `start_auth` neutralized in both worlds by `iauth_options=XOPT_REQUIRED`+`adfd=-1` (its top early-return) so its socket side effects drop out of the diff. `normal_accept_then_clone_flood` (case 1 + 4 merged so the process-`static` backlog starts pristine): first accept over a SHARED connected ::1 fd → compare full surviving post-state (return non-null, `ip`=::1, `port`, `sockhost`, `fd`, `acpt`, `hostp`=NULL, `local[fd]`, `highest_fd`, `aconf->clients`=1); then per world calls #2..#10 succeed and the 11th (count=11>CLONE_MAX) is clone-refused (exercising the backlog twin). `getpeername_failure_refuses` + `illegal_conf_refuses`: the two refuse inverses (NULL + `ircstp->is_ref`+1 + `clients` untouched + fd closed; own fd per world since the path closes it). Serialized on `GLOBALS_LOCK` (`local`/`highest_fd`/`fdall`/`ipv6string`/`timeofday`/`ircstp`/`iauth_options`/`adfd`/the backlog are process globals; the p7-l1-shared-global-race hazard).
  - **L2** — no new test. `add_connection` is the universal inbound acceptor — every `ircd-golden` client connection already flows through it; `golden_registration` (success path) byte-identical, `golden_s2s_link` green (incoming server links also go through it before `m_server`/`check_server_init`).
  - **S2S** — none. `add_connection` formats no remote-user fields and has no `IsServer(cptr)` branch (the client has no name/type yet).

- **2026-06-06 — P7cc (`s_bsd.c` `connect_server` + static `connect_inet`) merged.** The outbound server-connection setup (s_bsd.c:2511) — the counterpart of the inbound `add_connection` (P7bb). Ported to `ircd-common/src/s_bsd.rs`; guard `-DPORT_S_BSD_CONNECT_SERVER_P7cc` on the `s_bsd_link.o` recipe. `connect_server` now resolves from Rust; the still-C `do_dns_async`/`try_connections` and the Rust `m_connect` call it via the `s_bsd_ext.h` prototype.
  - **Cluster choice** — the next leaf bottom-up after the P7d–P7bb socket/teardown/listener/access-check leaves. `connect_server`'s only caller-private callee is the file-`static` `connect_inet` (s_bsd.c:2674), ported alongside as a private Rust twin (no `cref_` oracle for a `static`).
  - **`set_sock_opts` lifecycle** — ported as a private Rust twin back in P7p, while the C `static` was kept for its remaining compiled caller. Survey: 268 (`inetport`, P7p — guarded out), 1731 (`add_connection`, P7bb — guarded out), 1802 (`add_unixconnection`, UNIXPORT off — not compiled), 2595 (`connect_server` — the last one). With `connect_server` ported, the C `static set_sock_opts` + its forward proto (s_bsd.c:69) have zero compiled callers → both guarded out under `PORT_S_BSD_CONNECT_SERVER_P7cc` (the P7aa `check_init` precedent); the Rust port uses the existing P7p twin.
  - **Config-resolved body** — `UNIXPORT` undef → `connect_unix` not compiled, the `*aconf->host == '/'` branch drops → always `connect_inet`; `AFINET = AF_INET6` → `sockaddr_in6`/`sin6_*`/16-byte `in6_addr`; `DEBUGMODE` off → all `Debug(...)` no-ops (the leading `inet_ntop` into `ipv6string` is inside `Debug(...)` → not evaluated). `mysk` (P7s de-static'd) is the outbound-bind source; `minus_one` the all-`0xff` sentinel.
  - **FINDING (faithful)** — `connect_server`'s DNS-resolution block (s_bsd.c:2538-2558, guarded by `if (!aconf->ipnum.S_ADDR && *aconf->host != '/')`) is **dead code** under AF_INET6. `S_ADDR` = `s6_addr`, an embedded array; `!aconf->ipnum.s6_addr` is the address of that array → always non-NULL → always false. The block never runs (the same `!ipnum.s6_addr` array-address quirk noted in `send_ping`/P7m); `hp` is used directly. Omitted in the port with a comment.
  - **Faithfulness** — the `free_server:` goto becomes a `connect_server_free(cptr)` helper returning -1; `SetConnecting` = `status = STAT_CONNECTING (-4)`; `connect_inet`'s `static struct SOCKADDR server` is a module `static mut MaybeUninit<sockaddr_in6>` (bzero'd every call, the C `static` semantics); the dup-IP scan compares network-order `server.sin6_port` to the host-order `acptr->port` (a faithful C quirk); `index`→`strchr`(unused — DNS block dead), `htons`→`u16::to_be`. `dummy` (P7a) is the `SIGALRM` handler.
  - **Callees** — `find_server` (P4), `make_client`/`make_server`/`free_client`/`free_server`/`add_fd`/`add_client_to_list` (P2), `attach_confs_host`/`find_conf_host`/`det_confs_butmask` (P6), `get_sockhost`/`get_client_name` (P5), `set_non_blocking` (P7d), `set_sock_opts` (P7p twin), `inetpton` (P1) all Rust; the variadic `sendto_flag`/`sendto_one` are *called* (→ P8). `mysk`/`minus_one`/`portnum`/`highest_fd`/`local`/`fdall`/`nextping`/`timeofday`/`istat`/`me` are bindgen statics.
  - **Classification / L1** — utility/callee TU (not a `msgtab` handler; reached from `m_connect`/`try_connections`/`do_dns_async`). `cref_connect_server` exported → cross-world differential (`ircd-testkit/tests/connect_server_diff.rs`, 3 cases zero-diff). The success path does a live `socket`/`bind`/`connect` to a configured peer → not deterministic at L1. Cases: (1) `server_already_present` — `find_server` hit → `SCH_NOTICE` + return -1 before any `make_client`/socket work (`by`=NULL); (2) `server_already_present_remote_by` — remote `IsPerson` `by` (fd<0 → `!MyClient`) so the extra `sendto_one(by,...)` arm fires; (3 inverse/cleanup) `connect_inet_failure_refused` — empty hash → `make_client`/`make_server` → `connect_inet` `socket`+`bind`(unconfigured zeroed `mysk` → AF_UNSPEC) fails → `return NULL` → `free_server` cleanup → -1; asserts `highest_fd` unchanged + the hash left clean. Per-world `inithashtables()` (else `hashtab` is NULL → segv); serialized on `GLOBALS_LOCK` (the [[p7-l1-shared-global-race]] hazard). Findings: `hash_find_server`'s suffix-mask search overwrites `'.'`→`'*'` in-place → the conf/lookup strings must be writable heap (not `c"…"` literals); a remote `by` needs `acpt` set (self) or `send_message` null-derefs `(*to).acpt`.
  - **L2 / S2S** — no new file. The existing `ircd-golden`/`boot_s2s` harness dials **into** the ircd (`TcpStream::connect` = inbound `add_connection`), so it does not exercise `connect_server`'s outbound dial; deferred to the event-loop/CONNECT L2 (the `read_message` cluster). Regression check: `golden_registration` + `golden_s2s_link` byte-identical (the port doesn't touch inbound paths). No remote-user field formatting → no S2S-specific path.

- **2026-06-06 — P7dd (`s_bsd.c` `start_iauth`) merged.** The iauth subprocess (re)spawn leaf (s_bsd.c:565) — the deepest remaining leaf in `s_bsd.c`'s boot subtree (`daemonize` calls it; `read_message` is the loop top). Ported to `ircd-common/src/s_bsd.rs`; guard `-DPORT_S_BSD_START_IAUTH_P7dd` on the `s_bsd_link.o` recipe.
  - **Cluster choice** — after P7d–P7cc ported every socket/teardown/listener/access-check/connection leaf, the three C functions left in `s_bsd.c` are `start_iauth`, `daemonize`, and `read_message` (+ its `static` siblings `polludp`/`check_ping`). `daemonize` calls `start_iauth` and `read_message` is the loop top, so `start_iauth` is the next leaf bottom-up. It is the only function that creates the `adfd` pipe the P7u–P7y `s_auth.c` readers drain.
  - **Classification** — utility/callee TU (no `msgtab` entry). Callers: `daemonize` (boot), `io_loop` (the `restart_iauth`/`nextiarestart` timer, ircd.c:1286), `rehash` (`start_iauth(2)` = kill-first, s_conf.c:1303), `s_auth.c` `read_iauth` restart requests. All reach it via `s_bsd_ext.h`. L1 is the differential gate (`extern` → `cref_start_iauth` oracle).
  - **Config-resolved body** — `USE_IAUTH` on → the whole `#if defined(USE_IAUTH)` body compiles; `IAUTH_BUFFER = 65535`; `MAXCONNECTIONS = 50` (the child fd-close bound). `IAUTH_PATH` (= `$(server_bin_dir)/$(IAUTH)`) and `IAUTH` are recursively-expanded Makefile vars passed only on `s_bsd.o`'s compile line (absent from bindgen) → build.rs expands both via `make` and hands them to the crate as `ircd_sys::IAUTH_PATH` / `ircd_sys::IAUTH` (the `PID_PATH`/`MOTD_PATH` precedent), so the Rust `execl` spawns the identical binary as reference-C.
  - **Faithfulness** — the three function `static`s (`last`/`first`/`iauth_pid`) → module-private `static mut START_IAUTH_*`; both worlds start `first = 1` so the burst-send block is skipped on the first call. `vfork()` → `libc::fork()`: behaviorally identical here (the child only runs a close loop + `dup2` + `execl`, so COW `fork` produces the same result) and Rust's libc deprecates `vfork` as memory-unsafe (the close-loop/dup2-between-vfork-and-exec is exactly the flagged pattern). The socketpair-failure arm does NOT early-return (faithful). The burst-send pointer arithmetic (`s += sprintf(s, "%d O\n", i)`, the `s > e` flush, the `*(s-1) = '\0'` newline-strip) is translated byte-for-byte over a `[c_char; BUFSIZ]` (`libc::BUFSIZ` = 8192 on gnu, matching the C `<stdio.h>` macro). `execl` CStrings are built *before* `fork`.
  - **Callees** — `read_iauth` (P7y), `set_non_blocking` (P7d) Rust; `sendto_flag`/`sendto_iauth` are *called* (variadic → P8); `socketpair`/`setsockopt`/`fork`/`dup2`/`execl`/`close`/`kill`/`_exit`/`time` are libc. `adfd`/`iauth_spawn`/`bootopt`/`highest_fd`/`local` are bindgen globals.
  - **L1** — `ircd-testkit/tests/start_iauth_diff.rs`, 3 cases zero-diff vs `cref_`, serialized on `GLOBALS_LOCK` (the [[p7-l1-shared-global-race]] hazard; each world keeps its own `adfd`/`iauth_spawn`/`bootopt`). `boot_noiauth_returns`: `BOOT_NOIAUTH` → immediate return, `adfd` stays -1, `iauth_spawn` unchanged. `already_running_returns`: not-NOIAUTH but `adfd>=0`, `rcvdsig=0` → returns untouched (the inverse). `spawn_sets_adfd`: the real meat — the socketpair + setsockopt + `set_non_blocking` + fork prefix; asserts the observable post-state agrees across worlds and the spawn happened (`adfd` opened nonblocking via `fcntl F_GETFL & O_NONBLOCK`, `iauth_spawn == 1`); the child `execl`s the absent `IAUTH_PATH` and `_exit`s, reaped via a bounded `waitpid(WNOHANG)` loop so the test can never hang. The non-first-call burst is skipped (both `first = 1`) → its differential coverage is deferred to L2/soak (needs a populated `local[]` + a second post-`first` call).
  - **L2 / S2S** — no new file. The golden harness boots `-t -s` (`BOOT_NOIAUTH`) → only `start_iauth`'s early return runs (`golden_registration` byte-identical); the full spawn is a process-lifecycle side effect whose end-to-end gate is the P7-exit L2/soak run with iauth enabled, as for `daemonize`/`server_reboot`. No `IsServer(cptr)` branch / no remote-user field formatting → no S2S path.

- **2026-06-06 — P7ee (`s_bsd.c` `daemonize`) merged.** Ported the boot detach glue `daemonize` (s_bsd.c:794), the layer directly above the P7dd `start_iauth`.
  - **Cluster choice.** Called once from `ircd.c:1152` (still C → resolves to the Rust def once dropped). Now a clean leaf: its only non-libc callees — `init_resolver` (P6, Rust) and `start_iauth` (P7dd, Rust) — are already ported. With it gone, the only still-C logic in `s_bsd.c` is the event loop (`read_message` + its statics `polludp`/`check_ping`).
  - **Guard / seam.** Partial port via the existing `s_bsd_link.o` recipe, new guard `-DPORT_S_BSD_DAEMONIZE_P7ee`; the C body `#ifndef`-guarded (no `#else` proto — `daemonize` is declared in `s_bsd_ext.h`).
  - **Config-resolved body.** `TIOCNOTTY` defined on Linux → the `int fd` + ioctl block compiles. The `setpgrp` arm resolves to the `#else` `setpgrp(0, getpid())` branch (verified by preprocessing — none of `HPUX`/`SVR4`/`DYNIXPTX`/`_POSIX_SOURCE`/`SGI`/`__CYGWIN32__`/`__APPLE__` are defined); the linked glibc symbol is `setpgrp(void)` (ignores the args) — declared 2-arg in a local extern to mirror the source verbatim. `stdout`/`stderr`/`stdin` are glibc `extern FILE *` symbols (not the macros) → local externs (`stderr` reuses the module-top decl). `init_resolver` called as `crate::res::init_resolver`; `start_iauth` is the local Rust def in this module (called bare, not imported, to avoid shadowing the bindgen decl).
  - **Faithfulness.** `bootopt & BOOT_TTY` → short-circuit to `init_dgram` (no fork/no fd close); else `fclose(stdout)`/`close(1)`, (unless `BOOT_DEBUG`) `fclose(stderr)`/`close(2)`, and when `((bootopt & BOOT_CONSOLE) || isatty(0)) && !(bootopt & BOOT_INETD)` → `fork()` (the parent `exit(0)`s to detach), `open("/dev/tty")`+`ioctl(TIOCNOTTY)`+`close`, `setpgrp(0, getpid())`, `fclose(stdin)`/`close(0)`; then always `resfd = init_resolver(0x1f)` + `start_iauth(0)`.
  - **Classification / L1.** Utility/boot callee (no `msgtab` entry). **Mostly untestable by design:** the detach path forks (parent `exit(0)`s) and closes fds 0/1/2 — calling it on that path destroys the test harness, and even fork-isolation (P7r's trick) can't measure a function whose whole job is to detach. The only differentially-safe path is the `BOOT_TTY` short-circuit (`goto init_dgram`: no fork, no fd close) — which is also the only path any harness ever takes (golden boots `-t` = `BOOT_TTY`). `daemonize_diff.rs` (1 case): `bootopt = cref_bootopt = BOOT_TTY|BOOT_NOIAUTH`, `adfd=-1`, `resfd=-99` sentinel → call each world's `daemonize` → assert `resfd != -99` and `>= 0` (init_resolver opened the resolver socket), `(resfd>=0)==(cref_resfd>=0)` (both worlds succeeded identically), and the inverse: `adfd == -1` in both (`start_iauth(0)` reached but short-circuited on `BOOT_NOIAUTH`, touching nothing). Serialized on `GLOBALS_LOCK`; the opened resolver sockets are closed afterward. Untested-by-design: the entire detach path (`fclose`/`close` of 0/1/2, `fork`+parent `exit`, `TIOCNOTTY` ioctl, `setpgrp`).
  - **L2 / S2S.** No new L2 (boot callee, not a `msgtab` handler — the existing golden suite boots through the `BOOT_TTY` path of `daemonize`; `golden_registration` byte-identical, confirmed). No S2S (formats no remote-user wire fields).

- **2026-06-06 — P7ff (`s_bsd.c` `read_message` + 8 statics — the event loop) merged.** Ported the select/poll event loop `read_message` (s_bsd.c:2088) and its eight file-`static` helpers to `ircd-common/src/s_bsd.rs`; guard `-DPORT_S_BSD_READ_MESSAGE_P7ff` on the `s_bsd_link.o` recipe. This is the body of `io_loop` and the **last *logic* in `s_bsd.c`** — after it, `s_bsd_link.o` defines **zero functions**, only the data globals.
  - **Cluster choice** — `read_message` is the only non-`static` symbol left in `s_bsd_link.o`; its callees `completed_connection` (s_bsd.c:1247), `read_listener` (1835), `read_packet` (2004), `client_packet` (1938), `ircd_no_fakelag` (1930), `do_dns_async` (3324), `polludp` (3212), `check_ping` (3165) are all `static` (no `cref_` oracle) → one connected component, ported together as module-private Rust twins (the `check_init`/`set_sock_opts`/`connect_inet`/`check_clones` precedent).
  - **Config-resolved body** — `USE_POLL` **off** → the `select()`/`fd_set`/`FD_*`/`highfd` path compiles; the entire `#if defined(USE_POLL)` pfd machinery is dead and omitted. `USE_IAUTH` on (the `DoingXAuth`/`WaitingXAuth`/`adfd`/`read_iauth`/`sendto_iauth` arms + do_dns_async's iauth alias-forward block). `LISTENER_DELAY` = 1 (the listener once-per-second throttle), `LISTENER_MAXACCEPT` = 10, `MAXCLIENTS` = 45, `CLIENT_FLOOD` = 1000, `HELLO_MSG`/`IRC_VERSION` resolved as module consts. `ZIP_LINKS`/`UNIXPORT`/`DEBUGMODE` off, `DELAY_CLOSE`/`CACCEPT_DELAYED_CLOSE` on, `JAPANESE` off, `AFINET=AF_INET6`.
  - **Faithfulness** — `highfd`/`delay2`/`ret` declared before the `for(res=0;;)` select-retry loop (persist across retries, never reset — the faithful C quirk). The `read_message` per-fd dispatch `goto deadsocket` becomes a `dead: bool` + structured `continue`s (both goto sites set `dead`, the deadsocket block runs once). `while(max--)` in `read_listener` → a `{ let cur = max; max -= 1; cur != 0 }` head. `client_packet`'s inner long-no-newline `while(dolen<=0)` drain + `FLAGS_NONL` break preserved. `check_ping`'s `cp->ping = (cp->rtt /= cp->lrecvd)` order kept; `pow` is the libc symbol (NOT `f64::powf` — last-ULP drift, the P7t precedent). `polludp`'s `ntohl`/`htonl` over the `u_long pi_id` truncate to 32 bits then byteswap (`u32::from_be`/`to_be as u_long`); the `#if 0` recvfrom-error report and the function `static`s `last`/`cnt`/`mlen`/`lasterr` → module `static mut`. `do_dns_async`'s `static Link ln` → a module `static mut DO_DNS_LN` (const-initialised union) so the address handed to `get_res` is stable; `hp->h_addr` macro = `h_addr_list[0]`. The private `static char readbuf[READBUF_SIZE]` (16384) → a module `static mut READBUF`.
  - **Callees** — in-module Rust: `add_connection` (P7bb), `connect_server` (P7cc), `delay_close` (P7f), `report_error` (P7q), `get_sockerr` (P7d). bindgen externs (resolve to Rust at link): `dopacket` (P7b), `exit_client`/`get_client_name` (P5), `send_queued`/`flush_connections` (P3/send), `start_auth`/`read_iauth`/`send_authports`/`read_authports` (P7w-y), `find_conf`/`is_allowed` (P6), `match_`/`inetntop` (P1), `dbuf_get`/`getmsg`/`put` (P1), `get_res`/`del_queries`/`find_bounce`/`my_name_for_link`, `restart`. Variadic (*called*, → P8): `sendto_flag`/`sendto_one`/`sendto_iauth`. The data globals `local[]`/`highest_fd`/`timeofday`/`fdas`/`fdall`/`readcalls`/`udpfd`/`resfd`/`adfd`/`ircstp`/`istat`/`iconf`/`conf`/`nextping`/`nextdelayclose`/`ipv6string`/`me` are bindgen statics (still C-owned in `s_bsd_link.o`).
  - **Classification** — utility/boot callee (no `msgtab` entry; reached from `io_loop`). `read_message` has a `cref_` oracle but is the event loop — every meaningful path `select()`s real fds, `accept()`s/`recvfrom()`s/`send()`s real sockets, and *destructively* `exit_client`s, none of which is differentially deterministic in isolation (the `daemonize`/P7ee situation). **L2 is the real gate.**
  - **L1** — `ircd-testkit/tests/read_message_diff.rs`, 2 cases zero-diff vs `cref_`, serialized on `GLOBALS_LOCK` (the [[p7-l1-shared-global-race]] hazard; `udpfd`/`resfd`/`adfd` are process globals). The one differentially-safe path: an empty `FdAry` (`highest = -1`) + `udpfd = resfd = adfd = -1` + `delay = 0` → an empty fd_set, `select(0, …, 200ms)` returns 0, no dispatch, return 0; both worlds agree (`ro = 0` and `ro = 1`). Proves the loop skeleton + the `select` call + the no-fds-ready dispatch are byte-identical.
  - **L2 / S2S** — no new file. The *entire* `ircd-golden` `golden_*` + `golden_s2s_*` suite (111 test files) runs through `read_message` (it is `io_loop`'s body) — registration, every channel/user/oper command, and the full S2S server-burst/netsplit matrix exercise the accept/read/write/exit + server-link `read_packet`/`completed_connection` paths end-to-end. Ran the full 111-file suite with `--no-fail-fast`: **192 passed, 2 failed**, both **pre-existing reference-C STATS garbage flakes** ([[p5-s2s-stats-flake]]), not P7ff regressions (the reference-C binary is frozen — a Rust edit can't change its output; the Rust side prints the correct value in both): (1) `golden_s2s_s_serv_stats` `s2s_stats_match_reference` — uninitialised peer-burst sendq (`…965524992kB sq` vs Rust `0kB sq`); (2) `golden_s_misc` `stats_t_matches_reference` — STATS t's "dropped %luSq/%luYg/%luFl" prints `ircstp->is_cklQ/is_ckly/is_cklno` (`u_int`, 4 bytes) with `%lu` (8 bytes) in the still-C variadic `sendto_one`, so reference-C `va_arg`s 4 bytes of call-frame garbage (`281470681743360Sq/…`) vs Rust `0Sq/0Yg/0Fl` — a `%lu`/`u_int` width-mismatch in s_misc.c:1079, surfaced (not caused) by P7ff.
  - **Untested-by-design (noted)** — the destructive accept/read/write/exit dispatch, `polludp`/`check_ping` (need a live UDP CPING peer), and `do_dns_async` (needs a live resolver fd) are deterministic only at L2/soak.

- **2026-06-06 — P7gg (`ircd.c` `try_connections`, auto-connect timer) merged.** Ported the static `io_loop` AC timer (ircd.c:226) to `ircd-common/src/ircd.rs`, the sibling of `calculate_preference` (P7t).
  - **Cluster choice** — `try_connections` is the next `io_loop` timer helper after `calculate_preference`. Each AC tick it walks the global `conf` list, folds the lowest future `hold` into `next`, and chooses the single best AC-able `connect{}` C-line to dial: candidate = status carries `CONF_CONNECT_SERVER|CONF_ZCONNECT_SERVER`, `port > 0`, class `maxLinks != 0`; skipped if future-held / at `maxLinks` / already linked (`find_name`/`find_mask`) / denied (`find_denied`); best by (lower `pref >= 0`, else higher class number). The winner is spliced to the list **tail** (round-robin), its `hold` penalised by another `con_freq`, then deferred (AC disabled) or dialed via `connect_server` (P7cc). Returns the next-call time (`0` = nothing pending); `BOOT_STANDALONE` → `0`.
  - **Guard / de-static** — `try_connections` is `static` → no `cref_` oracle symbol. De-static'd in ircd.c under `#ifndef PORT_IRCD_TRY_CONNECTIONS_P7gg` (the `mysk`/`check_init`/`connect_inet` precedent) so the cref archive's prefix-rename exports `cref_try_connections`; the `#else` branch is an `extern time_t try_connections(time_t)` prototype so the still-C `io_loop` caller (ircd.c:1186) keeps a declaration. `-DPORT_IRCD_TRY_CONNECTIONS_P7gg` added to the `ircd_link.o` make rule (alongside the P7c/P7t defines). The full `ircd.o` (cref oracle, no PORT define) keeps the non-static body.
  - **Config-resolved body** — `DISABLE_DOUBLE_CONNECTS` undef → the whole `for (i=highest_fd…)` duplicate-IP scan + `SCH_SERVER` "AC postponed" notice block is dead (dropped); `DEBUGMODE` off → every `Debug((…))` no-op.
  - **Faithfulness** — the tail-splice replicates the C `for (pconf=&conf; (aconf=*pconf); pconf=&(aconf->next))` walk **exactly**: the `if (aconf==con_conf) *pconf=aconf->next;` removal does NOT short-circuit the pointer advance, and the detached node's own `next` is left intact so the walk still reaches the real tail through it. Macros inlined: `Class(x)=x->class`, `MaxLinks(x)=x->maxLinks`, `Links(x)=x->links`, `ConfClass(x)=x->class->class`, `get_con_freq` (Rust P2). `DELAYCHASETIMELIMIT`=1800. The variadic `sendto_flag` is *called* via the module's local `extern "C"` block (→ P8); `connect_server` (P7cc)/`find_name`/`find_mask` (P4)/`find_denied` (P6) resolve through the link seam.
  - **Classification** — `io_loop` callee (no `msgtab` entry), reached only from the periodic AC recompute; formats no remote-user wire fields.
  - **L1** — `try_connections_diff.rs`, 8-case zero-diff vs `cref_try_connections` over two isolated conf worlds (Rust `conf`/`iconf`/`bootopt` vs the `cref_` copies), serialized on `GLOBALS_LOCK` (the documented P7 shared-global hazard). Covers every path that does NOT reach `connect_server`: `BOOT_STANDALONE` early return, empty conf, all skip-`continue`s (non-C-line, `port<=0`, `maxLinks==0`, future-held, class-full-before-hold-write, already-linked, denied), and — by pinning `iconf.aconnect=0` — the best-conf selection, the tail-splice (winner moved to list end), the `hold += get_con_freq` penalty, and the "administratively disabled" deferred-notice branch. Compares per-conf `hold`/`pref` + the resulting list order (by build index) + the return value. Two initial expectation bugs in the test (wrong `BOOT_STANDALONE` literal; assuming the class-full skip writes `hold`) were caught because the Rust↔oracle diff stayed green while the absolute-value asserts failed — fixed the expectations, port unchanged.
  - **L2** — the `connect_server`-reached dial is L2-only: the `ircd-golden`/S2S harness dials *into* the ircd and never auto-connects out (the P7cc precedent), so the outbound AC dial is deferred to the event-loop/CONNECT L2. `golden_registration` confirmed byte-identical (boot/event-loop path unaffected). No S2S (no remote-field formatting).

- **2026-06-06 — P7hh (`ircd.c` `check_pings` — the io_loop ping/timeout sweep) merged.** Ported the static `io_loop` timer helper `check_pings` (ircd.c:525) to `ircd-common/src/ircd.rs`, the sibling of `try_connections` (P7gg) and `calculate_preference` (P7t). The next `io_loop` callee after the AC timer; one of the two remaining loop helpers (`delayed_kills` is next).
  - **Cluster choice / Scope.** Called once per loop tick from `io_loop` (ircd.c:1277) when `timeofday >= nextping`. Walks `local[highest_fd..0]`; per non-listener local connection: pings idle registered links (`FLAGS_PINGSENT` state machine), times out unregistered/unresponsive ones (`exit_client`; servers/connecting/handshake get a "No response … closing link" notice, with a remote-oper NOTICE via `bysptr`; DNS/auth/xauth waiters either get an iauth extension (`%d d`/`%d T`) or are reset/exited), and folds the soonest next-check calendar time into `oldest` (the return), with the `+PINGFREQUENCY`/`+30` clamps.
  - **Guard / de-static.** `check_pings` is `static` → no `cref_` oracle symbol. De-static'd in ircd.c under `#ifndef PORT_IRCD_CHECK_PINGS_P7hh` (the `try_connections`/`mysk` precedent) so the cref archive's prefix-rename exports `cref_check_pings`; the `#else` branch is an `extern time_t check_pings(time_t)` proto so the still-C `io_loop` caller keeps a declaration. `-DPORT_IRCD_CHECK_PINGS_P7hh` added to the `ircd_link.o` make recipe (alongside the P7c/P7t/P7gg defines). The full `ircd.o` (cref oracle, no PORT define) keeps the non-static body.
  - **Config-resolved body.** `TIMEDKLINES` off (config.h:207 commented) → the `static time_t lkill`, the `kflag = find_kill(...)` block, the `if (kflag && IsPerson)` kill-notice arm, and the trailing `if (currenttime - lkill > 60)` all vanish; `kflag` is permanently 0 → the goto guard reduces to `if (IsRegistered && ping >= now-lasttime)`, the timeout `if` to `((idle >= 2*ping && PINGSENT) || (!registered && firsttime-too-old))`, and the kill/else collapses to always `exit_client(... "Ping timeout")`. `USE_IAUTH` on → the iauth extwait/notimeout `sendto_iauth` block compiles. `DEBUGMODE` off → every `Debug((...))` no-op. `ACCEPTTIMEOUT`=90, `PINGFREQUENCY`=120 (plain `#define`s, inlined as module consts).
  - **Faithfulness.** The C forward `goto ping_timeout` (recently-active fast path) is modelled by guarding the whole timeout/ping if/else on the **negated** recently-active condition and falling through to the timeout computation — no control-flow change. `bysptr` is declared **once outside** the loop and never reset inside (faithful: a server-timeout's `bysptr` persists across later iterations). `ME` = `me.name`. Macros inlined as private `unsafe fn` helpers (copied from s_bsd.rs): `is_listener`/`is_registered`/`is_server`/`is_connecting`/`is_handshake`/`doing_dns`/`doing_auth`/`doing_xauth`/`clear_auth`/`clear_dns`/`clear_xauth`/`clear_wxauth`/`set_done_xauth`/`my_connect`/`me_ptr`/`local_base`. The variadic `sendto_one`/`sendto_iauth`/`sendto_flag` are *called* via the module's local `extern "C"` block (→ P8); `exit_client`/`find_uid`/`get_client_name`/`del_queries` resolve through the link seam (Rust P5/P6).
  - **Classification.** `io_loop` callee (no `msgtab` entry), reached only from the periodic ping recompute. The only remote read is `bysptr` (a remote oper) for a NOTICE on server timeout — a server-link path exercised by the L2/S2S loop, not a client command. → **L2-gated**, with an L1 over the deterministic non-destructive paths.
  - **L1** — `check_pings_diff.rs`, 7-case zero-diff vs `cref_check_pings` over two isolated worlds (Rust `local`/`highest_fd`/`me` vs the `cref_` copies), each building its own parallel client set, serialized on `GLOBALS_LOCK` (the documented P7 shared-global hazard). Covers every path that does NOT reach `exit_client` or the server-timeout `find_uid`/`sendto_one`: empty `local[]` (oldest stays 0 → `now+PINGFREQUENCY`), listener-skip (`FLAGS_LISTEN`), recently-active registered (`ping >= now-lasttime` → goto, no ping, flags untouched), the `FLAGS_PINGSENT` ping-send branch (idle 121 > ping 120, below 2*ping → sets `FLAGS_PINGSENT` + rewrites `lasttime = now-ping` + sends PING — the inverse of recently-active), young unregistered (firsttime < ACCEPTTIMEOUT, left alone), already-pinged idle below 2*ping (folds oldest only), and a mixed multi-fd sweep (listener + recent + idle-pinged + young-unreg) exercising the oldest-fold + final clamps. Asserts each client's post-`(flags,lasttime)` + the return value identical. Finding: a fresh `calloc`'d client needs `acpt` set (real `make_client` sets it to the listener) or `send_message`'s `acpt != &me` sendM bump null-derefs; `fd = -1` + a sub-1024-byte PING never trips `send_queued` so there is no real socket write.
  - **L2** — no new file. The entire `ircd-golden` suite runs `check_pings` every `io_loop` tick (it is the registration-timeout + ping path). `golden_registration` (boot/loop/timeout) and `golden_channel_join` byte-identical; the only failure is the documented pre-existing `golden_s_misc` `stats_t` reference-C garbage flake ([[p5-s2s-stats-flake]] / P7ff) — a `%lu`/`u_int` width mismatch in the still-C variadic `sendto_one` (`281470681743360Sq` from `va_arg`'d call-frame garbage in the frozen reference-C binary vs the correct `0Sq/0Yg/0Fl` from Rust), surfaced not caused. No S2S (no command-driven remote-field formatting).

- **2026-06-06 — P7ii (`ircd.c` `delayed_kills` — the io_loop K-line sweep) merged.** Ported the static `io_loop` timer helper `delayed_kills` (ircd.c:447) to `ircd-common/src/ircd.rs`, the sibling of `check_pings` (P7hh). The other of the two remaining loop helpers; `io_loop` calls it (ircd.c:1294, `rehashed = delayed_kills(timeofday)`) **only while `rehashed > 0`** — i.e. after a rehash queues a K-line re-evaluation.
  - **Cluster choice / Scope.** Walks `local[dk_lastfd..j]` (a batch of at most `MAXDELAYEDKILLS`); for every local fully-registered person it runs `find_kill`, and on a match (`kflag == -1`) notices the oper channel (`sendto_flag "Kill line active for %s"`), stamps `cptr->exitc = EXITC_KLINE`, and `exit_client`s the connection with the kill reason. Returns 1 if work remains queued (incomplete batch, or `rehashed == 2` — a rehash arrived mid-sweep), else 0. Persistent function-local statics (`dk_rehashed`/`dk_lastfd`/`dk_checked`/`dk_killed`) carry the batch cursor across calls; `dk_rehashed == 0` re-arms the sweep from `highest_fd`.
  - **Guard / de-static.** `delayed_kills` is `static` → no `cref_` oracle symbol. De-static'd in ircd.c under `#ifndef PORT_IRCD_DELAYED_KILLS_P7ii` (the `check_pings`/`try_connections`/`mysk` precedent) so the cref archive's prefix-rename exports `cref_delayed_kills`; the `#else` branch is an `extern int delayed_kills(time_t)` proto so the still-C `io_loop` caller keeps a declaration. `-DPORT_IRCD_DELAYED_KILLS_P7ii` added to the `ircd_link.o` make recipe (alongside the P7c/P7t/P7gg/P7hh defines). The full `ircd.o` (cref oracle, no PORT define) keeps the non-static body.
  - **Config-resolved body.** `MAXDELAYEDKILLS` = 200 (config.h:423) and `MAXCONNECTIONS` = 50 (config.h:150): the `#ifdef MAXDELAYEDKILLS` batch block IS compiled, but `j = dk_lastfd - 199` with `dk_lastfd ≤ 49` is **always < 0 → clamped to 0**, so the whole `local[]` is swept in a single call and `dk_lastfd` always reaches -1 → the persistent statics reset every call (no multi-call drain) and the trailing `return rehashed` (incomplete-batch path) is **unreachable** under the locked config — ported faithfully regardless. `TIMEDKLINES` off → `find_kill`'s `timedklines` arg is 0 (the `check_pings` finding); `DEBUGMODE` off → the `Debug((DEBUG_DEBUG, "DelayedKills killed…"))` no-op.
  - **Faithfulness.** The C `for (i = dk_lastfd; i >= j; i--)` with its `continue` (which still runs `i--`) and in-loop `j--` (on a NULL/non-person slot, only while `j > 0`) is modelled by a `while i >= j` loop that decrements `i` before every `continue`/iteration end, so the post-loop `dk_lastfd = i` lands on `j-1` identically. `IsPerson` = `user && (STAT_CLIENT || STAT_OPER)` and `BadPtr` inlined as private `unsafe fn` helpers. The summary `sendto_flag(SCH_NOTICE, "DelayedKills checked %d killed %d in %d sec", dk_checked, dk_killed, currenttime - dk_rehashed)` passes a `time_t` (long) to a `%d` — a faithful C quirk, passed verbatim (the variadic trampoline reads 32 bits; a no-op until the notice channel exists). The variadic `sendto_flag` is *called* (→ P8); `find_kill` (Rust P6i)/`get_client_name`/`exit_client` resolve through the link seam.
  - **Classification.** `io_loop` callee (no `msgtab` entry), reached only after a rehash queues K-line re-evaluation (`rehashed > 0`). → **L1-gated**: the kill arm is destructive (`exit_client`) AND requires both a matching K-line conf and `rehashed > 0`, neither of which the golden suite produces — so unlike `check_pings`, `delayed_kills`' body has no L2 path at all (golden never rehashes).
  - **L1** — `delayed_kills_diff.rs`, 6-case zero-diff vs `cref_delayed_kills` over two isolated worlds (Rust `local`/`highest_fd`/`rehashed` + empty `kconf`/`tkconf` → `find_kill` returns 0, no kill, vs the `cref_` copies), serialized on `GLOBALS_LOCK` (the documented P7 shared-global hazard). Covers the **non-kill** sweep (the inverse of the destructive kill arm): empty `local[]` across `rehashed` ∈ {0,1,2} (→ return {0,0,1} — exercises the requeue logic), an `IsPerson` client over empty conf (checked, no kill → completes, **client left alive**: status/flags unchanged + still in `local[]`), non-person (no `user`) + userless STAT_CLIENT slots (both `!IsPerson` → skipped before `find_kill`), and a mixed multi-fd sweep. Asserts identical return + per-client `(status, flags, still-in-local)`. A `with_user` client gets a zeroed `anUser` (username "") so `find_kill` walks the empty conf and returns 0.
  - **Untested-by-design / L2** — the `kflag == -1` kill arm (`exit_client` is destructive — the `check_pings`/`read_message` L2-gating precedent — and needs both a K-line conf match and a queued rehash). No new L2 file: `golden_registration` confirmed byte-identical (no-regression; the boot/event-loop path is unaffected and `delayed_kills` is never entered without a rehash). No S2S (formats no command-driven remote-user wire fields).

- **2026-06-06 — P7jj (`ircd.c` `setup_me`) merged.** Ported the boot-time `me`-singleton initializer to `ircd-common/src/ircd.rs`, the last substantive non-spine leaf in `ircd.c`.
  - **Cluster choice** — `setup_me` (ircd.c:723) is the boot helper `main()` calls once (ircd.c:1113) after `bzero(&me)` + `make_server(&me)` + config read have populated `me.serv->namebuf` (server name; `make_server` self-points `me.name → serv->namebuf`), `me.serv->sid`, `me.info`. The remaining `ircd.c` leaves are `setup_signals` (blocked on the still-static signal handlers `s_rehash`/`s_slave`), `bad_command` (exit, untestable), `open_debugfile` (empty under DEBUGMODE-off) — `setup_me` is the only one with real, L2-observable logic.
  - **Seam / Guard** — `#ifndef PORT_IRCD_SETUP_ME_P7jj` around the body, `static` removed, `extern void setup_me(aClient *mp);` after `#endif` so the guarded `ircd_link.o`'s `main()` resolves the call to the Rust `#[no_mangle] setup_me` (the cref oracle keeps the full unguarded `ircd.o`). `-DPORT_IRCD_SETUP_ME_P7jj` appended to the `ircd_link.o` make recipe. Confirmed `nm target/debug/ircd` shows `T setup_me` (from Rust).
  - **Faithfulness** — `getpwuid(getuid())->pw_name` (or `"unknown"`) feeds both `username` copies; `me.info == DefInfo` compares the **global** `me.info` pointer (via `addr_of_mut!(me)`) against the `DefInfo` constant (list.c); `ME` = `me.name`; `SetMe`=`status=STAT_ME`, `SetEOB`=`flags|=FLAGS_EOB`; `strncpyzt` (local macro twin) + `strcpy(user->host, mp->name)` use the exact bindgen array lengths; `PATCHLEVEL` resolved to the locked `patchlevel.h` literal `"0211030000"`. No variadic senders called.
  - **Callees** — `get_my_name` (P7s), `find_server_num`/`find_server_string` (P5 s_serv), `make_user` (P2 list), `add_to_client_hash_table`/`add_to_sid_hash_table` (P2 hash), `setup_server_channels` (P5 channel), `mystrdup` (P1) — all Rust, imported from `ircd_sys::bindings`.
  - **Classification / L2-gated (no L1)** — not a `msgtab` handler. `setup_me` mutates four shared process-global tables (client hash, SID hash, `server_name[]` interning, channel hash) plus the `me` singleton and `istat`; an L1 differential on the real Rust-side globals can't be isolated/cleaned without leaking channel-hash entries into other `ircd-common` L1 tests. Its entire output is observable on every `ircd-golden` boot (server name in numerics, SID, 004/005, LUSERS `is_users`, oper+EOB status, server channels, `verstr`/`info` in the S2S burst), so the golden suite is the gate (P7dd/ee/ff L2-gating precedent).
  - **L2** — golden `registration` (x2), `s_serv_lusers`, `s2s_server` (introduce), `s2s_s_serv_info`, `s2s_s_serv_map`, and 3/4 `s_misc` all byte-identical. The `s_misc::stats_t` failure is the documented pre-existing reference-C uninitialized-garbage flake (`...743360Sq/...452800Yg/...` on the **reference** side; Rust correctly emits `0Sq/0Yg/0Fl`) — see the p5-s2s-stats-flake note, not a regression.
  - **S2S** — none needed: `setup_me` formats no command-driven remote-user wire fields.
- **2026-06-06 — P7kk (`ircd.c` signal-handler + reboot cluster) merged.** Ported the contiguous signal block `ircd.c:73–215` — the SIGTERM/SIGUSR1/SIGHUP/SIGINT handlers (`s_die`/`s_slave`/`s_rehash`/`s_restart`) plus the `restart`→`server_reboot` shutdown path — to `ircd-common/src/ircd.rs`.
  - **Cluster choice** — a connected component: the four signal handlers set the io_loop flags (`dorehash`/`dorestart`/`restart_iauth`), `restart` (called by Rust `list.rs`/`s_bsd.rs`/`s_serv.rs` + still-C `io_loop`) calls `server_reboot`. Deliberately *excludes* `setup_signals` (the installer — needs `dummy` + edits the shared forward-proto line 34; its own sub-phase), `io_loop`, `open_debugfile`, `bad_command`, `c_ircd_main`.
  - **Seam / Guard** — one `#ifndef PORT_IRCD_SIGNALS_P7kk` over 73–215; the `#else` branch re-declares `s_rehash`/`s_slave` (not in `ircd_ext.h`) so the still-C `setup_signals` (line 1370) keeps its prototypes — `s_die`/`s_restart`/`restart`/`server_reboot` are header-declared. `-DPORT_IRCD_SIGNALS_P7kk` appended to the `ircd_link.o` recipe; the cref oracle keeps the full unguarded `ircd.o`. Confirmed `nm target/debug/ircd` shows `T` for all six from Rust.
  - **De-static** — `dorehash`/`dorestart`/`restart_iauth` (`volatile static int` → `volatile int`): read by the still-C `io_loop`, written by the Rust handlers, so one definition must serve both — they stay C-defined in `ircd_link.o`, Rust references them through a local `extern "C"` block; de-static also yields `cref_dorehash`/… for L1. `s_rehash`/`s_slave` (+ the line-37 forward proto) de-static'd so the prefix-rename exports `cref_s_rehash`/`cref_s_slave` (the L1-cref-static-symbol limit).
  - **Config-resolved body** — `POSIX_SIGNALS`=1 (the `sigaction` re-arm in each handler compiles), `RETSIGTYPE`=void, `USE_IAUTH` ON (`s_slave` + the SIGCHLD arm), `USE_SYSLOG` UNDEF (every syslog/closelog/openlog arm dropped), `UNIXPORT` UNDEF (`s_die`'s unix-socket unlink loop dropped), `DEBUGMODE` OFF (`Debug()` no-ops), not `__FreeBSD__`. `MAXCONNECTIONS`=50; `SCH_NOTICE`=`ServerChannels_SCH_NOTICE`.
  - **Faithfulness** — the `sbrk(0)-sbrk0` byte delta is `(brk as usize).wrapping_sub(sbrk0 as usize) as u32` fed to the variadic `%u`; `s_die` broadcasts `:%s SDIE` via `sendto_serv_v` with `(*me.serv).sid`; `restart`/`server_reboot` notice via `sendto_flag(SCH_NOTICE,…)`; `s_restart`'s `BOOT_TTY`→`fprintf(stderr)`+`exit` arm uses the module's `stderr_ptr()` helper; the fd-close sweep is `for i in 3..MAXCONNECTIONS`. `IRCD_PATH` (Makefile var, absent from bindgen) plumbed via build.rs `cargo:rustc-env=IRCD_SERVER_PATH` → `ircd_sys::SERVER_PATH` for `server_reboot`'s `execv(IRCD_PATH, myargv)` (the MOTD/PID/IAUTH path precedent). The `fn as usize` sigaction-handler casts go through an explicit `unsafe extern "C" fn(c_int)` pointer (no warning).
  - **Callees** — `flush_connections`/`logfiles_close`/`mybasename` (Rust/P1), `ircd_writetune` (P7c, Rust), variadic `sendto_serv_v`/`sendto_flag` (C trampolines → P8); libc `sigaction`/`sigemptyset`/`sigaddset`/`sbrk`/`close`/`isatty`/`execv`/`exit`/`fprintf`. Globals `me`/`tunefile`/`sbrk0`/`myargv`/`bootopt` from bindings; the de-static'd flags from the local extern block.
  - **L1** — `ircd_signals_diff.rs` (3 tests): `s_rehash` ratchet 0→1, 1→2, 2→2; `s_slave` sets `restart_iauth`; `s_restart` sets `dorestart` with `BOOT_TTY` cleared — each zero-diff vs the `cref_` oracle on the respective flag. Serialized on `GLOBALS_LOCK` (the P7 L1 shared-global hazard); SIGHUP/SIGINT/SIGUSR1 dispositions snapshotted+restored (the handlers re-arm themselves). The terminating arms (`s_die`/`restart`/`server_reboot` `exit`/`execv`; `s_restart`'s `BOOT_TTY` exit) are not run — faithful by inspection.
  - **L2** — boot gate: the still-C `setup_signals` now installs the Rust handlers on every `ircd-golden` boot; `golden_registration` (x2), `golden_s_serv_shutdown` (die/restart/rehash *reject* + `rehash_success` — the io_loop reading the de-static'd `dorehash`), `golden_s_serv_maint` (die/restart reject) all byte-identical. `golden_s_misc::stats_t` fails on the documented pre-existing reference-C uninitialized-garbage flake (`…743360Sq` on the **reference** side; Rust correctly emits `0Sq/0Yg/0Fl`) — see the p5-s2s-stats-flake note, not a regression.
  - **S2S** — none needed: the signal cluster formats no command-driven remote-user wire fields.

- **2026-06-07 — P7ll (`ircd.c` `setup_signals` — the boot signal installer) merged.** Ported the static `setup_signals(void)` (ircd.c:1388) to `ircd-common/src/ircd.rs`. It is the boot-time signal-disposition installer `main()` calls once (ircd.c:1033, after config read). P7kk deliberately left it to "its own sub-phase" because it references `dummy` and the four signal handlers — all of which are only now Rust, making it a clean leaf.
  - **Cluster choice / Scope.** A self-contained installer: builds a `struct sigaction` and `sigaction()`s it onto SIGWINCH/SIGPIPE (SIG_IGN), SIGALRM (`dummy`), SIGHUP (`s_rehash`), SIGINT (`s_restart`), SIGTERM (`s_die`), SIGUSR1 (`s_slave`), SIGCHLD (SIG_IGN+`SA_NOCLDWAIT`). All callees are Rust: `dummy` (bsd.rs, P7a), `s_rehash`/`s_restart`/`s_die`/`s_slave` (ircd.rs, P7kk). The remaining `ircd.c` leaves are now only `bad_command` (usage→exit, untestable), `open_debugfile` (empty under DEBUGMODE-off), and the `c_ircd_main`/`io_loop` spine.
  - **Guard / de-static.** `setup_signals` was `static` (declared in the line-34 group `static void open_debugfile(void), setup_signals(void), io_loop(void);`) → no `cref_` oracle symbol. Split it out: `open_debugfile`/`io_loop` stay in the static group; `setup_signals` becomes a plain `void setup_signals(void);` forward proto + its body wrapped in `#ifndef PORT_IRCD_SETUP_SIGNALS_P7ll` (the P7kk/P7jj precedent). The cref archive compiles without the PORT define → keeps the de-static'd body → the prefix-rename exports `cref_setup_signals`; `ircd_link.o` compiles with `-DPORT_IRCD_SETUP_SIGNALS_P7ll` (appended to the recipe in `ircd-sys/build.rs`) → body removed, `main()`'s call resolves to the Rust `#[no_mangle] setup_signals`. `nm target/debug/ircd` confirms `T setup_signals` from Rust.
  - **Config-resolved body.** `POSIX_SIGNALS`=1 (setup.h:347) → the `sigaction` branch (not the `signal()` `#else`). `SIGWINCH` defined on Linux → its `sigaddset`+`sigaction` compile. `USE_IAUTH` ON → the SIGUSR1→`s_slave` arm + the SIGCHLD arm (with `act.sa_flags = SA_NOCLDWAIT`, defined on glibc/musl) compile. not `__FreeBSD__` → no SIGTRAP arm. `RESTARTING_SYSTEMCALLS` undef → no trailing `siginterrupt`.
  - **Faithfulness.** The `sa_mask` is **cumulative** — `sigemptyset` is called exactly twice (once at the top before the SIG_IGN/dummy trio, once before SIGHUP), so SIGWINCH/SIGPIPE/SIGALRM share mask `{PIPE,ALRM,WINCH}` and SIGHUP…SIGCHLD accrete `{HUP}→{HUP,INT}→{HUP,INT,TERM}→…,USR1}→…,CHLD}`. Modelled exactly. The C `struct sigaction act;` leaves `sa_restorer` uninitialised, but glibc supplies its own restorer inside the `sigaction(2)` wrapper, so the *installed* (queried-back) disposition is identical in both worlds regardless; Rust `std::mem::zeroed()` for `act` is harmless. The `fn as usize` handler casts go through an explicit `unsafe extern "C" fn(c_int)` pointer.
  - **Classification.** Boot callee (no `msgtab` entry), reached once from `main()`. → **L1 differential + L2 boot gate.** Unlike the wholly-terminating handlers (P7kk), the installer is differentially testable: it mutates process *signal dispositions*, not shared memory, and those snapshot/restore cleanly.
  - **L1** — `setup_signals_diff.rs`, 1-case zero-diff vs `cref_setup_signals`, serialized on `GLOBALS_LOCK` (process-global dispositions; the P7 shared-global hazard). Snapshot all 8 dispositions → `setup_signals()` (Rust) → query the 8 → `cref_setup_signals()` → query the 8 → restore the originals. Asserts, per signal: `sa_flags` identical between worlds, `sa_mask` byte-identical (memcmp the `sigset_t`), and the **world-correct** handler is wired — SIG_IGN for SIGPIPE/SIGWINCH/SIGCHLD (identical across worlds), else the world's own symbol (Rust `dummy`/`s_rehash`/`s_restart`/`s_die`/`s_slave` vs `cref_dummy`/…); handler pointers differ *by design* (Rust vs cref symbol), the verified claim being "right handler on right signal with the right mask/flags". Plus a SIGCHLD `SA_NOCLDWAIT` / SIGWINCH+SIGPIPE flags-0 spot-check.
  - **L2** — no new file. The still-C `main()` calls `setup_signals` on every `ircd-golden` boot, installing the Rust handlers; `golden_registration` (x2), `golden_s_serv_shutdown` (die/restart reject), `golden_s_serv_maint` (close/rehash reject + `rehash_success` — the io_loop reading the handler-set `dorehash`) all byte-identical = no regression.
  - **S2S** — none: `setup_signals` formats no command-driven remote-user wire fields.

- **2026‑06‑07 — P7mm (`ircd.c` `io_loop`) merged.** The event-loop body — the per-tick driver that the still-C `main` runs as `while (1) io_loop();` — is now Rust.
  - **Cluster choice** — `io_loop` is the last substantive piece of I/O-core *logic* in `ircd.c`; only `c_ircd_main` (the boot/init sequence) and the trivial helpers `bad_command`/`open_debugfile` remain C, left for the final P7 drop step that removes `c_ircd_main` and `ircd.o`/`ircd_link.o` entirely.
  - **Seam** — `io_loop` was `static void io_loop(void)`. Body guarded with `#ifndef PORT_IRCD_IO_LOOP_P7mm`; under the guard the file-top forward decl is split into a `static` proto for `open_debugfile` + `extern void io_loop(void);` so the still-C `main` (in `ircd_link.o`) resolves `io_loop()` to the Rust `#[no_mangle]` symbol. `-DPORT_IRCD_IO_LOOP_P7mm` appended to the `ircd_link.o` recipe in `ircd-sys/build.rs`. No cref-archive change (io_loop is `static` → no oracle needed).
  - **Config‑resolved body** — locked config: `DELAY_CLOSE` OFF (the `nextdelayclose`/`delay_close` timer arm and its `delay = MIN(nextdelayclose, delay)` line dropped), `TKLINE` ON (`if (nexttkexpire && timeofday >= nexttkexpire) nexttkexpire = tkline_expire(0);` kept), `DEBUGMODE` OFF (the two `Debug(...)` no-ops and the trailing `checklists()` dropped). `TIMESEC` = 60, `MIN(a,b)` → `a.min(b)`.
  - **Classification** — static utility, no `msgtab` entry, called only from `main`. **No L1**: `io_loop` is `static` so the cref archive exports no `cref_io_loop` (`l1-cref-static-symbol-limit`).
  - **Faithfulness** — `static time_t delay` → a function-local `let mut delay` (it is unconditionally assigned before every read each call, so behaviorally identical). The `while (maxs--)` drain loop preserves the post-decrement semantics. Already-Rust siblings (`calculate_preference` P7t, `try_connections` P7gg, `check_pings` P7hh, `delayed_kills` P7ii, `restart` P7kk, `ircd_writetune` P7c) called directly; `tkline_expire`/`collect_channel_garbage`/`timeout_query_list`/`expire_cache`/`read_message`/`flush_fdary`/`start_iauth`/`flush_connections`/`rehash` and the `next*`/`fdas`/`fdall` globals via bindgen; `nextpreference`/`nextiarestart` (not in any `*_ext.h`) via a local `extern "C"` block — they remain C globals in `ircd_link.o`. `&me`/`&fdas`/`&fdall` via `std::ptr::addr_of_mut!`; `time(NULL)` → `libc::time(null)`; `restart("Caught SIGINT")` via a `c"…"` literal cast.
  - **Verify** — `cargo build -p ircd-rs` 0 warnings; `nm target/debug/ircd | grep io_loop` shows global `T io_loop` (Rust, was static `t`). **L2** byte-identical across `golden_registration`, `golden_channel_join`, `golden_debug` (STATS m/u → count_memory/send_usage), `golden_s2s_link` (link burst + remote WHOIS + remote-quit round-trip) — every booted Rust ircd drives this loop.
  - **Plan** — `docs/superpowers/plans/2026-06-07-p7mm-io_loop.md`.

- **2026-06-07 — P7nn (`ircd.c` CLI boot helpers `bad_command` + `open_debugfile`) merged.** The last *non-spine* logic in `ircd.c` — two file-`static` helpers called only from `c_ircd_main`. Plan: [`docs/superpowers/plans/2026-06-07-p7nn-ircd-cli-helpers.md`](../superpowers/plans/2026-06-07-p7nn-ircd-cli-helpers.md).
  - **Cluster choice** — `bad_command` (ircd.c:809) and `open_debugfile` (ircd.c:1372): two independent leaves with no shared state, both reached only from the boot spine (`bad_command` on argv-parse failure, `open_debugfile` unconditionally at boot). Ported together as the penultimate P7 step so the final step is `c_ircd_main` alone.
  - **Config-resolved body** — `CMDLINE_CONFIG` undef → `bad_command`'s `[-f config]` `%s` slot = `""`; `DEBUGMODE` undef → its `[-x loglevel]` `%s` slot = `""` **and** `open_debugfile`'s entire body (`#ifdef DEBUGMODE`) compiles out → a pure no-op `return`. The Rust `bad_command` issues the two `libc::printf`s (the format literal with both `%s` args = `c""`) then `libc::exit(-1)`; `open_debugfile` is an empty fn.
  - **Seam** — de-static'd both definitions **and** their prototypes (split `open_debugfile` out of the P7mm `io_loop` static-proto group, added a top-of-file `void bad_command(void);` so the still-C `c_ircd_main` keeps a declaration once the body is guarded out). Both bodies `#ifndef PORT_IRCD_CLI_HELPERS_P7nn`-guarded; new define added to the `ircd_link.o` recipe in `ircd-sys/build.rs`. The unguarded cref compile keeps the de-static'd bodies → `cref_bad_command`/`cref_open_debugfile`. RED confirmed (undefined `bad_command`/`open_debugfile` at link before the Rust defs); GREEN `nm target/debug/ircd` shows both `T` from Rust.
  - **Classification / L1** — utility/callee helpers (no `msgtab` entry). `ircd_cli_helpers_diff.rs`, 2 cases, zero-diff vs `cref_`, serialized on `GLOBALS_LOCK`: (1) `bad_command` is `fork()`-isolated per world — child dups stdout into a pipe, calls the fn (prints + `exit(-1)`), parent drains the pipe + `waitpid`; asserts captured stdout byte-identical **and** wait status identical (`exit(-1)` → `WEXITSTATUS==255`). (2) `open_debugfile` no-op contract via the inverse invariant: snapshot fd 2's `fstat` dev/ino, call both worlds, assert fd 2 unchanged (DEBUGMODE off → it must NOT redirect stderr).
  - **L2 / S2S** — `golden_registration` byte-identical (`open_debugfile` no-op on every boot; `bad_command` unreachable from a valid boot). No S2S — neither helper formats remote-user wire fields.
