p3.md:9:  - **Faithfulness notes (caught in review):** `replies[]` is **not** mechanically text‑extractable — it contains `#if/#else/#endif` config branches (WHOIS_SIGNON_TIME/USERS_RFC1459/ENABLE_SUMMON/TXT_NOSTATSK), two bare‑`NULL` entries, and an escaped `\r\n` (entry 384) that Rust source‑level CRLF normalization would silently corrupt → it is **dumped from the compiled `cref_replies` oracle** with byte‑level escaping. `alphabet_id[256]` in s_id.c is partially initialized (249 explicit values) so indices 249..=255 default to **0** (reproduced verbatim). `init_sid` is `#if 0` (not ported). `poolsize *= 1.1` reproduced as `(poolsize as f64 * 1.1) as u_int`.
p1.md:9:  - **Faithfulness notes (caught in review):** reproduced `match()`'s always‑active `MAX_ITERATIONS 512` cap; `dbuf_get` mirrors C's `&&` short‑circuit (avoids `dbuf_map`'s `tail` side effect); `dbuf` `poolsize` hard‑codes the compile‑time `(BUFFERPOOL>1500000)?…:1500000` value (correct for this config, pinned by an L1 test); `irc_memcmp` = unsigned byte compare (only the sign is observable); `istat` externed from C, not redefined.
p7.md:362:  - **Config-resolved body.** `USE_IAUTH` ON → the `sendto_iauth("%d D", cptr->fd)` notify block (gated `!IsListener && !IsConnecting`) compiles. DEBUGMODE off → the `Debug()` lines vanish. No other `#ifdef`'d branches. Macros reproduced inline: `IsHandshake`/`IsConnecting` (`status == STAT_HANDSHAKE`/`STAT_CONNECTING`), `IsIllegal(aconf)` (`status & CONF_ILLEGAL`), `ConfConFreq(aconf)` (`aconf->class->conFreq`, int→time_t), `CFLAG` (`CONF_CONNECT_SERVER|CONF_ZCONNECT_SERVER` = 40); `HANGONRETRYDELAY`=30/`HANGONGOODLINK`=900 (config.h.dist:656-657, object-like config macros absent from bindgen → Rust consts). Reuses the P7g `is_server`/`is_client`/`is_listener` helpers. The reconnect-reschedule arm short-circuits on `IsServer` (so `find_conf_exact` is only called for a server) exactly as C.
p7.md:379:  - **Config-resolved body.** No `#ifdef`s in this function; DEBUGMODE off → no `Debug` line. `IsListenerInactive(x)` = `(x)->flags & FLAGS_LISTENINACTIVE` (0x8000000, bindgen const); `ClearListenerInactive(x)` = `(x)->flags &= ~FLAGS_LISTENINACTIVE`; `flags` is a `c_long` field so the mask is `as c_long`. `LISTENQUEUE` (config.h:622 = 128) is a config `#define` absent from bindgen → reproduced as a `const c_int`. `listen()`'s return is ignored exactly as C → the observable post-state (inactive bit cleared, node kept) is identical regardless of the fd. `sendto_flag(SCH_NOTICE, ...)` is the existing variadic C trampoline (`ircd_sys::bindings::sendto_flag` + `ServerChannels_SCH_NOTICE`); no new extern. It is safe in L1 because it short-circuits when `svchans[chan].svc_ptr == NULL` (the default un-`setup_svchans`'d state) → no-op in both worlds.
p7.md:399:  - **Faithfulness.** Idempotent short‑circuit (`udpfd != -1` → return it, ignore `aconf`); the assign‑then‑test (`(udpfd = socket(...)) == -1`) reproduced as set‑bindgen‑extern‑then‑check; each later failure does `close(fd); udpfd = -1; return -1`. Bind address: a numeric `aconf->passwd` (`isdigit(*passwd)`) → `inetpton(AF_INET6, …)`, falling back to a 16‑byte `bcopy` of `minus_one` on parse failure; else `in6addr_any`. `htons` = `(port as u16).to_be()`.
p7.md:409:  - **Faithfulness.** The C guard `if (!aconf->ipnum.s6_addr || AND16(...)==255 || !cp->port)` — the first disjunct is the address of an array field, so it is **always false** in C; reproduced as the two real gates only (`AND16==255` ≡ all 16 bytes `0xff` via `iter().fold(0xff, &)`, the unresolved `minus_one` sentinel; and `cp->port==0`). All `aCPing` counters (`ping`/`seq`/`lseq`/`recvd`) are `u_long` → unsigned arithmetic (`cp->seq * conFreq > 1200`, `cp->ping -= cp->ping/cp->recvd`). `pi.pi_seq = cp->lseq++` is post‑increment (the packet carries the pre‑increment value). The window block does `seq++` then conditional `seq--` (net 0 when it fires), with `recvd--` only when `recvd == seq` (post‑`++`). `sin.SIN_PORT = htons(cp->port)` = `(*cp).port.to_be()`.
p7.md:418:  - **Config-resolved body.** `UNIXPORT` OFF (config.h:339) → `open_listener`'s `*aconf->host == '/'` unix-socket branch is not compiled; only the inet branch survives. No other `#ifdef`s. Macros reproduced inline: `IsListener(x)` (existing `is_listener` helper), `IsConfDelayed(aconf)` = `aconf->flags & PFLAG_DELAYED` (bindgen const, `flags` is `c_long`), `SetListenerInactive(x)` = `flags |= FLAGS_LISTENINACTIVE` (bindgen const), `IsIllegal(aconf)` (existing `conf_is_illegal` helper). `firstrejoindone`/`ListenerLL`/`fdas`/`fdall`/`inetport`/`add_fd` are bindgen externs (`inetport`/`firstrejoindone` stay C; `add_fd` resolves to the Rust list port).
p7.md:428:  - **Config-resolved body.** No `#ifdef`s in `add_listener` itself (the adjacent `#ifdef UNIXPORT unixport` block is a separate function, untouched). Macros reproduced inline: `FLAGS_LISTEN` (bindgen const, `flags` is `c_long`), `ME` = `me.name` (read the bindgen `me` global's `name`), `SetMe(cptr)` = `cptr->status = STAT_ME` (`Status_STAT_ME`). `make_client(NULL)` allocates a `CLIENT_LOCAL` client (fd = -1, so `open_listener` does not early-return); `make_link()` is the one-element confs link.
p7.md:439:  - **Faithfulness.** Order matters: the NULL-ipmask refuse and the `ad[i]>>8` invalid-ipmask refuse both `return -1` **before** the `sockhost`/`auth`/`socket` writes (so on those paths `fd` stays -1, `auth` NULL). The `if (cptr->fd == -1)` socket-open is conditional (an already-open fd is reused). The `cptr == &me` KLUDGE (`sprintf(buf, replies[RPL_MYPORTIS], ME, "*", ntohs(port)); write(0, buf, …)`) is reproduced verbatim via the bindgen `replies` incomplete-array + `RPL_MYPORTIS` const, but is unreachable for a listener stub (`cptr != &me`). `DupString(cptr->auth, ipname)` = `MyMalloc(strlen+1)` (Rust P2) + `strcpy`. The ipmask canonicalization (`sscanf "%d.%d.%d.%d"` → `sprintf` back) and the `sprintf "%-.42s.%u"` sockhost are done via `libc::sscanf`/`libc::sprintf` for byte-exactness. The bind addr: `in6addr_any` when `!ip || (!isxdigit(*ip) && *ip != ':')`, else `inetpton` (Rust P1) with the 16-byte `minus_one` fallback on parse failure.
p7.md:478:  - **Faithfulness** — calls the **libc `pow`** via a local `extern "C" { fn pow(f64,f64)->f64; }`, NOT `f64::powf`: the std intrinsic is permitted to differ from the system `pow` in the last ULP, which would diverge the `(u_int)(f*100.0)` integer truncation and break L1. The final store reproduces the C `double → u_int → int` cast chain as `(f * 100.0) as u32 as c_int` (`f` is clamped `≤ 100000.0`, so `f*100 ≤ 1e7` fits `u32`). `send_ping` is called *before* the `cp` read, faithfully — order matters because it mutates the window the pref math reads.
p6.md:246:    (parse.c `getfield` `|`-splitter). It reproduces the historical **dead-`quotes[]`
p6.md:308:  - **L1** (`ircd-testkit/tests/s_conf_find_conf_diff.rs`): hand-built parallel conf lists / `Link` chains, both `conf` and `cref_conf` pointed at the same head; `c_find_conf*` == `cref_find_conf*` pointer-for-pointer across each fn's positive + inverse — name/host/status/port/passwd-BadPtr-asymmetry misses, the CONF_OPERATOR over-limit skip (later in-limit op preferred), the server-mask `mycmp`-exact vs non-server `match`-glob split, the `>HOSTLEN`/BadPtr NUL early-outs, the empty-passwd-vs-sid-mask gate, and the `find_conf_ip` host-string-restored assertion. **The differential caught a real bug in the first draft:** I had translated C's `!match(tmp->passwd, sid)` sid gate as `match_(...) != 0` (inverted) — C's `!match` is true when the passwd-mask *matches* the sid (entry eligible), so it is `== 0`. Fixed; zero diff.
p6.md:324:  - **Config-resolved body.** `CONF_BOUNCE`=262144, `RPL_BOUNCE`=10 (bindgen consts). Three `fd`-keyed dispatch modes preserved byte-for-byte: `fd>=0` early rejection (cptr==NULL, class+host unknown → for an empty-host B-line, `sprintf(rpl, replies[RPL_BOUNCE], ME, "unknown", name, port)` + `strcat("\r\n")` + a **raw `sendto(fd,…)`** syscall); `fd==-1` ("too many", class known → a bare-number B-line host `!strchr('.')&&(isdigit||'-')` is matched against `class` via `atoi`); `fd==-2` (host known, class not a number → the class-number branch is skipped, host glob/`match_ipmask` only). On a match the reply goes via the variadic `sendto_one(cptr, …, BadTo(cptr->name), name, port)`. The `if/else if` ladder faithfully reproduces C's outer-if (class-number) / outer-else (`strchr('/')`→match_ipmask else `match`) nesting. Reused `reply`/`me_name`/`bad_to`/`match_`/`match_ipmask`; added `strcat`/`sendto` to the module's libc extern block (`sprintf`/`strlen`/`strchr`/`isdigit`/`atoi` were already there).
p6.md:336:  - **L1** (`ircd-testkit/tests/s_conf_attach_diff.rs`): unlike the read-only P6e–P6j lookups, these MUTATE shared state, so the two impls can't share it. Each scenario runs identically on two fully-isolated worlds via an `Api` of fn-pointers — LIVE (Rust port) over `conf`/`istat`/`classes`, CREF over `cref_conf`/`cref_istat`/`cref_classes`, each built with its own allocators — returning a `Vec<i64>` of observations (return codes, refcounts, chain shape, is_conflink delta, freed-ness) asserted equal. 8 tests, zero diff: attach happy-path + is_attached idempotency + detach round-trip (re-attach clean, counts back to baseline); IsIllegal -1 + Y-line-max -3 gates + the under-cap inverse; ENABLE_CIDR_LIMITS amount=2 admits 2 same-CIDR clients, rejects the 3rd with -4, freed slot reusable after detach; free-class on maxLinks==-1; illegal-conf removal from the global conf list (pointer gone, survivor head); det_confs_butmask keeping only the masked conf; attach_confs glob-vs-mycmp + attach_confs_host host match, each with its miss. `mk_class` wipes the struct (make_class is a bare MyMalloc — uninitialized maxH* would trip the IPHASH loop and differ between worlds; caught as the first SIGSEGV).
p6.md:372:  - **Layout hazard / HEADER bitfields** — the function writes the 12-byte DNS header through a `HEADER *` bitfield struct (`nameser_def.h:249`: `id:16`/`opcode:4`/`rd:1`/`rcode:4`/`qdcount:16`/`ancount:16`/`arcount:16`). Rather than hand-reproduce gcc's little-endian bitfield packing, the port uses the **bindgen `HEADER`** type (`ircd_sys::bindings`, asserted size 12) and its `set_*` accessors, which are byte-identical to the C layout by construction. `htons` reproduced as `u16::to_be`; `h_errno = NETDB_INTERNAL` via an `extern "C" { fn __h_errno_location() }`. `bzero`→`ptr::write_bytes`, `bcopy`→`ptr::copy`.
p6.md:409:  - **Faithfulness.** Raw-pointer translation of the C for-loops with post-increment index walks (`for (i=0,s=h_name; s; s=h_aliases[i++])` → `s = *aliases.offset(i); i+=1` at the loop tail), incl. the `find_cache_name` full-list fallback's **fixed-`s`=alias[0] quirk** (`s` set only in the init, never in the increment → it only ever compares alias[0]). `update_list`'s T_PTR alias-merge reallocs `h_aliases` by one + `mystrdup`s the new name; the T_A/T_AAAA addr-merge reproduces the double-`MyRealloc` exactly — realloc the contiguous IP block (`*h_addr_list[0]`) to `addrcount*16`, realloc the pointer array to `addrcount+1`, repoint each pointer into the (possibly moved) block, NULL-terminate, `bcopy` the new IP into the last slot (`*--ab`) — then the `addrcount>1` → clear `FLG_PTR_FWD|VALID` vs the single-addr `FLG_PTR_PEND_REV`/`FLG_PTR_PEND_FWD` logic. `find_cache_number`'s second loop preserves the C for-loop `continue`→increment semantics (every guard incl. the `cp = rem_list(cp)` degenerate-reap falls through to the trailing `cp = cp->list_next`). `bcmp`→16-byte slice compare; `MyRealloc`/`mystrdup`/`mycmp` are the Rust ports resolved at link.
p6.md:419:  - **Faithfulness notes.** `make_cache` **steals** the ResRQ's alias pointers (`rptr->he.h_aliases[n]` → cache, source nulled) and `h_name` (nulled after copy) — preserved exactly, so the L1 asserts the source ResRQ fields go NULL. The `*t++ = s; s += sizeof(IN_ADDR)` two-array block-fill is reproduced with raw-pointer `t.add(1)`/`s.add(IN_ADDR_SIZE)` walks; `bzero` → `write_bytes(_,0,_)`. The `ttl < 600` clamp bumps `reinfo.re_shortttl` and forces 600; `expireat = timeofday + ttl`. `add_to_cache`'s `++incache > MAXCACHED` LRU evict walks `cachetop` to the tail (`while !(*cp).list_next.is_null()`) and `rem_cache`s it. `MyMalloc` declared returning `*mut c_char` to match dbuf.rs's decl (avoids the redeclared-signature warning), cast at each use.
p6.md:457:  - **Faithfulness notes** — the `nm += i - 1` step is **unsigned modular** arithmetic: with 0 aliases `i == 0`, so it adds `(int)-1` widened to `u_long` (= `u_long::MAX`, i.e. `nm -= 1`), and the following `nm += sizeof(char*)` nets `+7`. Reproduced with `wrapping_add` throughout the `nm` accumulation so it may transit `u_long::MAX` without a debug-mode overflow panic. The `%d` format applied to the `u_long` args (`ts`/`sm`/`im`/`nm`) is preserved verbatim (reads the low 32 bits) — the values pass as `u_long` so the live trampoline and `cref_sendto_one` push identical bytes.
p6.md:476:  - **L1** — `ircd-testkit/tests/res_query_name_diff.rs`: two fully-isolated `World`s (LIVE = Rust port over res_link.o/res_init globals; CREF = `cref_*` oracle), each with its own loopback `::1` UDP recv+send sockets + `ircd_res`/`reinfo`/`resfd`/`first` base pointers (the `res_send_msg_diff.rs` shape). **Determinism via a strong interposed `#[no_mangle] gettimeofday`** returning a fixed `tv` — both worlds (the Rust `libc::gettimeofday` call and the cref-archive call) resolve to it at link, so packets are byte-identical **including the id field** and the `find_id` collision loop is reproducible (`ircd_res.id` pinned to 0 → mkquery writes `htons(1)`, first computed id = `1 + (tv_usec & 0xffff)`). Diff on `{ret, datagram bytes, rptr.{id,sends,sent}, re_sent delta, h_errno}` over: A-record query (1 send, id == header id, sends 0→1), PTR query (qtype trailer == T_PTR), a forced one-collision id advance (seed the queue with a node whose id == the first computed id) vs the no-collision inverse (k stays 0 → id == first computed) with the exact second-iteration id checked against the C formula, mkquery-failure (300-char single label → dn_comp fails → `r<=0`, NO_RECOVERY, no send, `sends`/`sent`/`re_sent` untouched), and send-failure (`resfd=-1` → `send_res_msg` -1 → TRY_AGAIN, but `sends` **still** bumped before the send, `sent`/`re_sent` untouched). Zero diff over 5 tests.
p6.md:483:  - **Faithfulness notes.** The domain-append branch is gated on `rptr != NULL` (the resend path) in the C — faithful: a *fresh* `do_query_name` (rptr==NULL) never appends `defdname`, and stores the **original** (un-truncated/un-appended) `name`, not `hname`. `do_query_number`'s two `sprintf` branches are reproduced by building the exact byte string in Rust (`{}` decimal for the IPv4 form, single-nibble lowercase `{:x}` for the ip6.arpa form, byte-reversed low-then-high nibble) and `copy_nonoverlapping` into the C `ipbuf`; `bcopy` → `copy_nonoverlapping`; `&rptr->he.h_addr` = `&he.h_addr_list[0]`.
p6.md:532:  - **Port** — removed the seven `static mut …` lines from the `extern "C"` block in `ircd-common/src/res.rs`; added seven `#[no_mangle] pub static mut` definitions: pointers `= null_mut()`, `incache = 0`, and `hashtable`/`cainfo`/`reinfo` `= unsafe { MaybeUninit::zeroed().assume_init() }` (the `s_misc.rs::ircst` idiom). C BSS zero-init → these reproduce it byte-for-byte. `CacheInfo`/`ResInfo` promoted to `pub` (now in `pub static` signatures). `ircd_res`/`resfd`/`minus_one` stay extern (owned by res_init.rs / s_bsd.c / support.c).
p6.md:544:  - **Faithfulness notes (reproduced byte-for-byte).** (1) The `getfield` escape/`#`-comment loop quirk where the `switch` translation of `\n`/`\r`/`\t`/`\0` is immediately overwritten by the subsequent left-shift (net effect: backslash removed, next char kept literally; a trailing backslash truncates). (2) `aconf->port` is the ONE field C does NOT reset per line (the struct is reused; only host/passwd/name/class/clients/status/flags are cleared each iteration), so under `-d9` a line with <5 fields prints the *previous* line's port — modelled as a carried `port_reg` register, zeroed after an append (the C `aconf=NULL`→re-malloc). (3) `get_class` always returns the same static `&cls`, so `validate`'s `bconf->class == aconf->class` pointer compare is "both non-NULL" — modelled by `class_set: bool`. (4) `mycmp` uses libc `toupper` (ASCII fold), not a table. (5) `ctop` is prepend-order, so the unmatched-conf warnings print in reverse file order. (6) `maxsendq` is a file static carried across lines (debug-only read).
p6.md:545:  - **C UB excluded (documented).** The reference `dgets` returns a buffer that is NOT NUL-terminated, so the `-d`/`-s` line echo reads uninitialised/stale stack in two cases: a line ≥511 bytes echoed under `-d`/`-d9` (stack-frame-dependent; `-s` and non-debug happen to match), and a config file with no trailing final newline (last-line echo). Both are genuine UB and non-reproducible; all fixtures end with a newline, and `long.conf` is only run without an echoing flag. The Rust port implements the well-defined NUL-terminated behaviour, which matches C on every non-UB path.
p5.md:11:  - **msgtab dispatch findings (caught at L2):** a *registered* client's `SERVICE` maps to `m_nop` (msgtab index 1 = registered‑client column is `m_nop`), so it produces no reply — `m_service` is only reached from index 0 (unregistered) / 4 (server→SERVICE). Bare `SQUERY` is rejected by `parse()` with `461` (min‑params) before the handler. So L2 coverage of the ported code is: `m_servlist` (`235`), `m_squery`+`best_service` (`408`, empty list), and `m_service` reject (unregistered client → `ERROR`).
p5.md:24:  - **Globals owned here:** `ircst`/`ircstp` (`*ircstp = &ircst`) as `#[no_mangle] static mut` — `ircst` zero‑inits via `MaybeUninit::zeroed().assume_init()` (const), `ircstp` via `addr_of_mut!(ircst)`; `motd`=NULL, `motd_mtime`=0. `months`/`weekdays` stay module‑private `&str` tables. All Is*/Got*/strncpyzt macros reproduced inline; `match`/`mycmp` imported from bindings; hash/list/whowas callees (`del_from_*_hash_table`/`remove_client_from_list`/`unregister_server`/`add_history`/`off_history`) resolve to the Rust ports; channel/conf/bsd callees (`remove_user_from_channel`/`del_invite`/`find_conf_name`/`close_connection`/`activate_delayed_listeners`/`is_chan_op`/`remove_server_from_tree`/`report_iauth_stats`/`dgets`) stay C.
p5.md:29:  - **`format!` per user request:** WHOX (354) is built field‑by‑field into a `Vec<u8>` — numeric fields (`%d` hopcount, `%ld` idle) via `format!`, arbitrary C‑string fields (username/host/info/…) copied raw via `push_cstr` (a UTF‑8 String would corrupt non‑ASCII bytes), then truncated to `BUFSIZE‑1` (faithful to C's incremental `snprintf`/`snprintf_append` truncation). `send_whois`'s channel‑list accumulation keeps the byte‑exact pointer/`len` logic on a private `static mut BUF` (the C file‑static `buf` stays with the C remnant). The placeholder `UnknownUser` anUser (unreachable on the IsPerson path) reproduced as a `static mut` via a `const carr()`.
p5.md:34:  - **Faithfulness notes:** `m_userhost` walks up to 5 targets across `parv[]` via the `idx` index (`parv[++idx]`), space‑separates entries (the `if(*buf2)` "not the first entry" guard → tracked by `buf2` staying non‑empty), reproduces the `strncat(buf, buf2, sizeof(buf)-len)` cap **and** C's `len += strlen(buf2)` (the full length even when truncated), and the re‑head/flush at `len > BUFSIZE-(NICKLEN+5+HOSTLEN+USERLEN)=419` (effectively dead for ≤5 short targets, ported anyway). `m_ison` strtoken‑splits the **single** trailing param, appends `name` + a trailing space per hit, and breaks at `len+i > BUFSIZE-4` ("leave room for ` \r\n\0`").
p5.md:46:  - **Faithfulness note — the non‑MyConnect away‑buffer leak reproduced verbatim.** For a remote (`!MyConnect`) `sptr` marking away, C `MyMalloc`s the buffer into the local `away` but only assigns `sptr->user->away = away` (and `strcpy`s) inside the `if (MyConnect(sptr))` block — so the remote‑away allocation is leaked. The Rust port mirrors this exactly (allocate + set `FLAGS_AWAY` + the `+a` server propagation unconditionally; store + strcpy + 306 ack only under `my_connect`). Not "fixed" (P8 territory).
p5.md:53:  - **Faithfulness notes:** the 'a' switch case **falls through** to default for server/internal callers (`cptr==NULL || IsServer(cptr)`) — reproduced by the `_ =>` arm doing the 'a'‑specific away‑clear then continuing into the flag‑flip; a local client's `+a` is a no‑op (`continue`, the C switch `break`). The misleading‑indent `return 1;` after the USERSDONTMATCH `else` is **inside** the mismatch‑`if` block (unconditional once the guard trips) — reproduced. Inner loop advances the char pointer **first** so `continue` = C's switch `break`. ClearOper/ClearLocOp also set `status=STAT_CLIENT`; SetClient = `IsAnOper?STAT_OPER:STAT_CLIENT` — reproduced. The private `UMODE_BUF` static replaces the s_user.c file‑static `buf` (transient within send_umode_out; the C remnant keeps its own `buf`). `istat.is_user`/`is_oper`/`is_awaymem` are `u_long`; `servp->usercnt` is `[c_int;3]`.
p5.md:62:  - **Faithfulness notes:** `encr = parv[2]` may be NULL (OPER min‑params is 2) but is only dereferenced past a `find_Oline` hit, so the wrong‑name 491 path is safe; `StrEq` reproduced via libc `strcmp` (same UB as C if a matching O‑line is hit with no password — not exercised). The transient host split `s = index(host,'@'); *s='\0'; …; *s='@'` is reproduced verbatim even though `s` (after‑'@') is unused under NO_OPER_REMOTE‑off (net no‑op; mutates the C‑owned host in place and restores it). `istat.is_oper` is `u_long`; `servp->usercnt` is `[c_int;3]` → `usercnt[2] += 1`. `%d`/`%c` args (the `:%s %d %s :Too many …` lines + the SCH_NOTICE operator‑letter) cast to `c_int` (the P5c width rule).
p5.md:67:  - **Cleanest cluster after PING/PONG — self‑contained, one tiny static.** `m_quit`'s only state is its function‑local `static char comment[TOPICLEN+1]`, reproduced as the private module static `QUIT_COMMENT` (not ABI); `m_post` has no state. They share **no** file‑statics with the C remnant (`buf`/`buf2`/`user_modes` untouched). `m_post` tail‑calls `m_quit` after a `SCH_LOCAL` server‑notice. New bindings imports: `exit_client`/`get_client_host`/`ServerChannels_SCH_LOCAL`; reused `is_server`/`my_connect` helpers.
p5.md:70:  - **Faithfulness notes:** `IsServer(sptr)` → return 0; the MyConnect path is `snprintf(comment, TOPICLEN, "\"%s", parv1)` then `strcat(comment, "\"")` (= `"` + parv1 + `"`), the remote path is `snprintf(comment, TOPICLEN+1, "%s", parv1)` (raw, no quotes — reproduced even though it needs an S2S link to reach); `parv[1]` is `NULL`‑guarded to `""` exactly as C (`(parc>1 && parv[1]) ? parv[1] : ""`).
p5.md:73:  - **Self‑contained — `buf` touched only transiently.** `m_pass` stores `parv[1]` into `cptr->passwd` (`strncpyzt`, 21) and, when PASS precedes USER/SERVICE with extra params, stages `"<p2> <p3> <p4>"` (byte caps 15/100/5) into the shared C file‑static `buf[BUFSIZE]` then **immediately** copies it out via `cptr->info = mystrdup(buf)` — `buf` is never read across calls, so a **private** module static `PASS_BUF: [c_char; BUFSIZE]` is faithful and the C remnant's `buf` (register_user/m_user/m_userhost…) is untouched. No allocators of its own, no list linkage. `MyFree`→libc `free`; `mystrdup`/`DefInfo` are the P1/P2 Rust ports (resolve via bindings); `strncpy`/`strncat` added to the local extern block; `strncpyzt` reproduced as a helper (`strncpy` + `x[N‑1]='\0'`).
p5.md:74:  - **`format!` per user request — N/A for the staged buffer (documented in‑module).** The staged buffer is built from `parv[2..4]` — arbitrary possibly‑non‑UTF‑8 C‑strings under byte‑precision `strncpyzt`/`strncat` truncation caps; per the standing P5c rule a UTF‑8 `String`/`format!` would corrupt those bytes and can't reproduce strncpy NUL‑padding / strncat caps → it stays a faithful byte‑builder (the only literals are the `" "` separators). `passwd` is likewise a byte‑faithful `strncpyzt`. No integer conversions → the P5c `%lu`‑width rule is N/A. `m_pass` emits **no** wire output (returns 1; no `sendto_*`).
p5.md:78:  - **Self‑contained — its own static, no shared state.** `canonize`'s only state is its function‑local `static char cbuf[BUFSIZ]` (BUFSIZ = 8192 on this glibc, verified via `cpp -dM`), reproduced as the module‑private `CANON_BUF: [c_char; 8192]` (not ABI). It shares **no** file‑statics with the C remnant (`buf`/`buf2`/`user_modes` untouched); it calls only `strtoken`+`mycmp` (P1 Rust ports) + libc `strcpy`.
p5.md:80:  - **`format!` per user request — N/A, documented in‑module.** `canonize` copies arbitrary client‑supplied token bytes (channel names / nicks) verbatim via `strcpy` and mutates the buffers in place — there is nothing to format, and a UTF‑8 `String`/`format!` could neither reproduce `strcpy` of non‑ASCII bytes nor the in‑place `strtoken`/comma‑restore surgery. `format!` stays reserved for the ASCII/numeric reply cases (cf. `m_umode` query reply, `who_one` numeric fields).
p5.md:84:  - **Config that shaped the port (verified `cbuild/config.h`):** `NICKLEN`=`LOCALNICKLEN`=**15** (struct_def.h:49, config.h:726) → the length cap is 15 in both server/client contexts (the conditional kept faithfully). **`MINLOCALNICKLEN` is `#undef`** (config.h:732) → its `#ifdef` short‑nick early‑return block is **not compiled** and is omitted. `isvalidnick(c)` = `char_atribs[(u_char)c] & NVALID` (common_def.h:69; `NVALID`=0x40) → reproduced against the P1 `crate::match_::char_atribs` table; `isdigit(*nick)` reproduced as `(*nick as u8).is_ascii_digit()` (byte‑equivalent for the only true range 0x30‑0x39, and safe for high‑bit bytes that C's `isdigit` would pass UB‑ly).
p5.md:85:  - **`format!` per user request — N/A, documented in‑module.** `do_nick_name` mutates the caller's nick buffer in place (`*ch = '\0'`) — there is nothing to format and a UTF‑8 `String` could not reproduce the in‑place byte truncation. `format!` stays reserved for the ASCII/numeric reply cases.
p5.md:89:  - **Seam — resolves the still‑C *and* the ported‑Rust callers.** `is_allowed` is called from ported `parse.rs` (penalty checks at parse.rs:698/779) *and* still‑C `m_kill`/`s_serv.c`/`s_conf.c`/`channel.c`/`res.c`/`hash.c`/`s_bsd.c`. Removing it from parse.rs's `ircd_sys::bindings` import and `use crate::s_user::is_allowed;` makes the Rust caller resolve to the new local def; the C callers resolve at link once `s_user.o`→`s_user_link.o` drops the symbol (the `canonize`/`send_away` pattern). `IsService`/`IsServer`/`MyConnect` reproduced via the existing `is_service_cl`/`is_server_cl`/`my_connect` helpers; `CONF_OPERATOR`/`ACL_TKLINE`/`ACL_KLINE`/`SERVICE_WANT_TKLINE`/`SERVICE_WANT_KLINE` imported from bindings.
p5.md:96:  - **`format!` per user request — N/A for the buffers (documented in‑module).** m_kill's two `sprintf` targets (`buf` = `"%s%s (%s)"` killer+`(L)`?+comment; `buf2` = `"Local Kill by %s (%s)"` / `"Killed (%s)"`) interpolate **arbitrary client‑supplied bytes** (the KILL comment `parv[2]`/`path` and the `index(path,' ')` killer substring), so per the standing P5c/P5l rule a UTF‑8 `String`/`format!` would corrupt non‑ASCII bytes and can't reproduce the byte‑exact `sprintf` assembly → faithful byte‑builders (private module statics `KILL_BUF`/`KILL_BUF2` replace the shared C `buf`/`buf2`, written only transiently within the call → the C remnant's `buf`/`buf2` are untouched). The wire replies go straight to the C variadic senders (no intermediate string). No sub‑`long` integer reaches the senders → the P5c `%lu`‑width rule is N/A.
p5.md:97:  - **Faithfulness notes:** the killer‑substring walk (`while (killer > path && *killer != '!') killer--; if (killer != path) killer++`) reproduced with raw‑pointer `>`/`.offset(-1)`/`.add(1)`; `path[TOPICLEN]='\0'` oper‑overlong truncation; the `chasing && !IsClient(cptr)` echo‑back; `acptr->flags |= FLAGS_KILLED` set only inside the server‑propagation branch; `exitc = EXITC_KILL` only on the local‑oper‑kill path.
p5.md:104:  - **Faithfulness notes:** the `exit_msg[8]` reject table + its index arithmetic (`if i>-1 {i=-1}; i+=8; if i>8 {i=8}`) reproduced verbatim (valid index for `check_client ∈ [‑8,‑1]`; a contract violation would panic in Rust vs OOB‑read in C — an acceptable divergence for an impossible input); `bzero(passwd)` → `write_bytes`; `aconf = sptr->confs->value.aconf` via the `SLink` union; the leaf‑server UNICK loop walks `fdas.fd[]`/`local[]` (via `local_base()`); the `(*buf)?buf:"+"` UNICK umode arg. `aClient.flags` is `c_long` → all flag masks cast `as c_long`.
p5.md:111:  - **Faithfulness notes:** the umode `+/-` token loop reproduces C's `switch{case '+'/'-':…continue; default:break;}` then `if(what==0)break` as a labeled `'outer` loop (the `default` `break` falls through to the `what==0` check, the for‑loop `break` is `break 'outer`); the RFC‑bit branch (`isdigit(*umodes)` → scan rest digits → `UFLAGS & atoi`) ported via `is_ascii_digit`+`atoi`; the new `is_unknown` helper (`status == STAT_UNKNOWN`). `(*me).serv->refcnt += 1`; `find_server_string((*me).serv->snum)`.
p5.md:117:  - **Faithfulness notes:** m_unick rebuilds a server‑introduced client exactly like m_user (`make_client`→`add_client_to_list`→`make_user`→`servp`/`refcnt`/`server`→`mystrdup(realname)` capped at REALLEN→`strncpyzt` username/host→`reorder_client_in_list`→name/uid/sip set + hash inserts→`m_umode(NULL,acptr,3,pv)` with the stack `pv[4]`→`register_user`); the `(acptr->user)?…:"???"` NULL‑guards on the both‑die nick‑collision report reproduced; `bad_to(acptr->name)` for the ERR_NICKCOLLISION target; `cptr ? cptr->name : ME` and the `cptr ? '!' : ' '` separator in save_user's SAVE propagation; `(*sptr).flags |= FLAGS_KILLED as c_long`. The leading‑`-`/digit/`anonymous` rejects come from the already‑Rust `do_nick_name` (P5n); the SID‑nick‑prefix burn (`strncasecmp(me.serv->sid, nick, SIDLEN)`) and BadNick server‑KILL ported faithfully (S2S).
p5.md:144:  - **Faithfulness notes:** `del_invite`/`add_invite` reproduce the original's **crossed** istat bookkeeping verbatim — `add_invite` channel‑side does `is_useri++`, client‑side `is_banmem += len`/`is_invite++`; `del_invite` channel‑side `is_invite‑‑`, client‑side `is_banmem ‑= strlen(who)+1`/`is_useri‑‑` (note the original's `+= len` vs `‑= len+1` off‑by‑one is kept). The `who` string (`"<nick>!<user>@<host>"`) is built into a `[u8;91]` (`NICKLEN+USERLEN+HOSTLEN+3`) then `MyMalloc`+`strcpy`'d, byte‑exact. `m_invite` mirrors the two `chptr ? chptr->chname : parv2` ternaries and the `MyConnect(acptr) && chptr && sptr->user && is_chan_op` add_invite guard.
p5.md:153:  - **Faithfulness notes:** `match_modeid` reproduces the `for`‑loop post‑`continue` advance (`tmp = tmp->next; continue;` at each `continue` site, the natural advance at the bottom for the flags‑mismatch fall‑through), the `isdigit(nick[0])` UID‑ban fallback, the n!u→host/sockhost/sip/CIDR cascade, and the oper conf‑chain scroll (`acf = acf->next` when `IsAnOper`); arrays (`username`/`uid`/`host`/`sip`/`sockhost`) passed via `addr_of_mut!`, `name`/`alist->nick` are pointers. `can_send` computes `member` + `lp` unconditionally, returns 0 for `!MyConnect`, and the `+be` ban path only when the sender is a non‑op/non‑voice member.
p5.md:178:  - **Config (verified `cbuild/config.h`):** `LIST_ALIS_NOTE` **defined** (config.h:516) → **both** `#ifdef LIST_ALIS_NOTE` NOTICE blocks compile and are ported (the opening notice when `MyConnect(sptr)` in the bare branch, and the trailing notice when `MyConnect && listedchannels > 24`); the note string is reproduced as a byte‑exact `c"…"` const (incl. the embedded quotes around `/squery alis help`). `CHREPLLEN`=8192 (config.h:363). Numerics: RPL_LIST=322 (`:%s 322 %s %s %d :%s`), RPL_LISTEND=323, ERR_TOOMANYMATCHES=416. New helpers: `secret_channel`/`hidden_channel`/`pub_channel`/`show_channel`/`dbuf_length`; new bindings imports `channel`(as `channel_list`)/`get_sendq`/`hunt_server`/`RPL_LIST`/`RPL_LISTEND`/`ERR_TOOMANYMATCHES`.
p5.md:296:  - **`report_array` reproduced resolved to TKLINE‑on.** A module‑private `static REPORT_ARRAY: [[c_int; 3]; 18]` — the 14 base rows + the two `#ifdef TKLINE` `{CONF_T*KILL, RPL_STATSKLINE, 'k'/'K'}` rows (present, not the `#else {0,0,0}` placeholders) + the `{0,0,0}` sentinel + the implicit 18th zero row. The C `for (p = &report_array[0][0]; *p; p += 3)` walk is ported as "iterate rows until `row[0]==0`"; the `if (!*p) continue` no‑match path preserved. **XLINE off** → `report_x_lines` (`#ifdef XLINE`) not compiled, not ported (`STATS X` is a no‑op).
p5.md:349:  - **L2 is the gate.** `golden_s_serv_set` (4 scenarios, ref‑C == Rust byte‑identical after `canonicalize()`): the new `set_oper.conf` (O‑line flag `e` = ACL_SET, s_conf.c:321) drives `OPER alice secret` then — bare `SET` → the showall path (`acmd = TSET_SHOWALL`) echoing `:POOLSIZE = N` / `:ACONNECT = OFF` / `:CACCEPT = ON`; `SET ACONNECT OFF` → apply + the `:ACONNECT = OFF` echo; `SET BOGUS` → `:… :Invalid option BOGUS` with **no** trailing echo (acmd stays 0 — the inverse of a recognized option); the **inverse** via `oper.conf` (O‑line with no flags) drives `SET` → `481 ERR_NOPRIVILEGES` (the handler‑internal `is_allowed(ACL_SET)`→`m_nopriv` branch, distinct from the col‑1 parse‑table reject). `cargo build` 0 warnings; the new golden binary + the s_serv golden regression suite (`golden_s_serv_maint`/`golden_s_serv_stats`/`golden_s_serv_stubs`) green; no new canonicalizer masks (the POOLSIZE value + the echo strings are deterministic under the pinned harness). **Pre‑existing flake noted (not P5tt):** `golden_s2s_s_serv_stats` diverges on the volatile `…kB sq` (peer sendQ) field of `report_myservers` — reference‑C reads uninitialized memory for a freshly‑linked fake peer (value varies run‑to‑run); confirmed failing identically on clean HEAD (pre‑P5tt), a masking gap in that test from P5oo, untouched by this cluster.
p5.md:397:  - **Pre-existing flake noted** — `golden_s2s_s_serv_stats.rs` fails on clean HEAD too (reference-C reads uninitialized peer sendq during BURST: `…3544950785030750208kB sq…`); unrelated to P5yy, confirmed by stash-and-rerun.
