xeiaso.net
Proof of concept mechanical port of ircnet/ircd to Rust as part of a bit about C being insecure for network services
176 kB
677 lines
1# P7 — I/O core + event loop + glue (progress log)
2
3The last faithful-port phase: `s_bsd.c` (select/poll loop, `local[]`, `highest_fd`,
4`timeofday`, `FdAry`), `packet.c`, `bsd.c`, `ircd.c` (main, io_loop, signals,
5rehash/restart, tune file), plus the `s_auth.c` socket/ident/iauth-pipe I/O deferred
6from P5. Ported bottom-up (leaf-first), same mechanism as P6. One-line summaries:
7[`PLAN-P7-progress.md`](../../PLAN-P7-progress.md).
8
9- **2026-06-05 — P7a (`common/bsd.c`) merged.** First P7 step; the socket write leaf.
10 - **Cluster choice** — `bsd.c` is the smallest remaining C TU (164 lines, 2 exported
11 `bsd_ext.h` symbols): `deliver_it` and `dummy`. Leaf-first start of P7.
12 - **Config-resolved body** — DEBUGMODE off → the `writecalls`/`writeb[10]` write-size
13 histogram and all `Debug(())` calls drop. `HAVE_RELIABLE_SIGNALS` undefined (not in
14 setup.h/config.h) → `dummy` compiles the `#ifndef` branch and re-arms via `signal()`
15 (SIGALRM/SIGPIPE/SIGWINCH; HPUX undefined, SIGWINCH defined on Linux) — the POSIX
16 `sigaction` branch (`#else`, gated on POSIX_SIGNALS=1) is NOT compiled. EMSGSIZE
17 defined (Linux) → it joins the WOULDBLOCK errno set in `deliver_it`.
18 - **Port** — `ircd-common/src/bsd.rs`: `deliver_it` = `send(2)` wrapper mapping
19 EWOULDBLOCK/EAGAIN/EMSGSIZE/ENOBUFS → 0 + `FLAGS_BLOCKED`, clearing `FLAGS_BLOCKED`
20 + accumulating `sendB` on `cptr`/`me`/`cptr->acpt` (guarded `acpt != &me`) on
21 success, returning `-savederrno` on a fatal error; `dummy` re-installs itself via
22 libc `signal`. `me` via bindgen global (`addr_of_mut!(me)`); `errno` via
23 `__errno_location`. Both `#[no_mangle] extern "C"` at the exact `bsd_ext.h`
24 signatures. `BSD_LINK_ANCHOR` added to `lib.rs::link_anchor()`.
25 - **Drop** — both symbols portable → `"bsd.o"` added to `PORTED` in `ircd-sys/build.rs`
26 and dropped outright (no `_link.o`, no linkage seam). The cref oracle keeps `bsd.o`
27 in `CREF_OBJS`, so `cref_deliver_it`/`cref_dummy` (and the renamed `cref_me`) stay
28 available for L1. Verified: `nm target/debug/ircd` shows `deliver_it`/`dummy` as
29 `T` (from Rust); RED first confirmed exactly those two symbols undefined (referenced
30 by `send.rs::send_queued` + C `ircd.c`/`s_bsd.c`).
31 - **Classification** — utility/callee TU (neither symbol is a `msgtab` handler).
32 - **L1** (`ircd-testkit/tests/bsd_diff.rs`) — drives the Rust port (`c_*`) and the
33 `cref_*` oracle over identically-set-up socketpairs; compares retval / `cptr.flags`
34 / `cptr.sendB` / `acpt.sendB` / the me-global `sendB` (Rust→`me`, oracle→`cref_me`,
35 the isolated-worlds pattern) / bytes the peer received. 5 cases covering the full
36 `FLAGS_BLOCKED` matrix (the inverse-invariant rule): happy path CLEARS it,
37 WOULDBLOCK (saturated non-blocking socket) SETS it + returns 0 + no counters,
38 error (closed peer → `-EPIPE`) leaves it UNTOUCHED + no counters; plus the
39 `acpt == &me` not-double-counted guard and `dummy`'s SIGALRM/SIGPIPE/SIGWINCH
40 re-arming (disposition is a real handler, not SIG_DFL/SIG_IGN — addresses differ
41 Rust-vs-C by construction). Zero-diff. **Finding:** the tests share the `me`/
42 `cref_me` by-value globals, so they must serialize on a `GLOBALS_LOCK` mutex —
43 cargo's parallel test threads otherwise race (one test zeroes `me` while another
44 reads it). This is the L1 analogue of the L2 `PORT_LOCK`; a positive-only isolated
45 run masked it (the diagnostic passed alone, the suite failed in parallel).
46 - **L2** — no new test. `deliver_it` is the universal write path (every reply →
47 `send_queued` → `deliver_it`), so the entire existing `ircd-golden` suite covers it;
48 confirmed `golden_channel_join`, `golden_registration` (client write path) and
49 `golden_s2s_nick` (server write path) stay byte-identical. `dummy` is a boot-time
50 signal handler with no client-reachable path.
51 - **S2S** — no `IsServer(cptr)` / remote-field path in either function → no S2S test
52 (the server write path is exercised by the existing s2s golden tests above).
53
54- **2026-06-05 — P7b (`common/packet.c`) merged.** The inbound packet reassembler;
55 second P7 step (leaf-first, after `bsd.c`).
56 - **Cluster choice** — `packet.c` is a single-symbol leaf (`packet_ext.h` exports
57 only `dopacket`; `nm cbuild/packet.o` → `T dopacket`). 172 lines, but every
58 callee is already Rust (`parse` P4, `exit_client` P5/s_misc, the `me` global,
59 the `IsDead`/`IsServer` macros), so it ports clean with no new C dependency.
60 - **Config-resolved body** — ZIP_LINKS off → the entire `#ifdef ZIP_LINKS`
61 machinery (`unzipped`/`unzip_packet`/`FLAGS_ZIPSTART`/`FLAGS_ZIP`, and the
62 compressed-flow `while` condition) is compiled out; the body that compiles is
63 the `#else` loop `while (length > 0 && ch2)`. DEBUGMODE off → no `Debug(())`.
64 - **Port** — `ircd-common/src/packet.rs`: `dopacket` = the line reassembler.
65 Bumps `me`/`cptr`/`acpt` `receiveB` by `length` once per call (with the
66 `acpt == &me` double-count guard), walks the chunk copying into
67 `cptr->buffer + cptr->count`, frames on CR **or** LF alone (Avalon's
68 backward-compat rule — never the CR-LF pair), skips leading/blank CR-LF
69 (`ch1 == bufptr` → continue), and on a complete line bumps the `receiveM`
70 message counters (same guard), resets `cptr->count = 0`, and calls `parse()`:
71 `FLUSH_BUFFER` → return immediately (cptr gone), `IsDead` → set `exitc`
72 (EXITC_REG→EXITC_DEAD) + `exit_client` with "Max SendQ exceeded"/"Dead Socket",
73 `IsServer && FLAGS_UNKCMD` → break. Non-terminators advance `ch1` only while
74 `ch1 < bufptr + sizeof(buffer)-1` (overflow cap; always room for the NUL).
75 Ends with `cptr->count = ch1 - bufptr` to carry the partial line forward.
76 `me` via `addr_of_mut!(me)`; inline `is_dead`/`is_server` mirror parse.rs;
77 `FLUSH_BUFFER`/`FLAGS_UNKCMD`/`EXITC_*` from bindings. `PACKET_LINK_ANCHOR`
78 added to `lib.rs::link_anchor()`.
79 - **Drop** — single portable symbol → `"packet.o"` added to `PORTED` in
80 `ircd-sys/build.rs` and dropped outright (no `_link.o`, no linkage seam). The
81 cref oracle keeps `packet.o` in `CREF_OBJS`, so `cref_dopacket` stays for L1.
82 RED first confirmed exactly `dopacket` undefined (referenced 3× by C
83 `s_bsd.c::read_message`); after GREEN, `nm target/debug/ircd` shows `dopacket`
84 as `T` (from Rust).
85 - **Classification** — utility/callee TU (`dopacket` is not a `msgtab` handler;
86 it is called from `s_bsd.c::read_message`).
87 - **L1** (`ircd-testkit/tests/packet_diff.rs`) — isolated-worlds (Rust→`me`,
88 oracle→`cref_me`); drives both over identically-built clients + buffers and
89 compares full post-state: retval, `cptr.count`, the whole 512-byte reassembly
90 buffer (parse tokenizes it in place → an end-to-end check), and the
91 `receiveB`/`receiveM` counters on cptr/acpt/the me-global. 8 cases honoring the
92 inverse-invariant rule (drive the buffering round-trip, not a happy frame):
93 single LF, single CR (CR alone terminates), skipped extra/leading CR-LF, two
94 lines in one buffer (parse twice), a **partial** line that does NOT call parse
95 (`count == length`, receiveM unbumped) + its **continuation** completing the
96 reassembled line, the `acpt == &me` guard (counters bumped once, not twice), a
97 distinct acpt (its counters bumped too), and a 600-byte no-terminator line
98 capping `count` at BUFSIZE-1 (511) with no OOB write. Inputs use parse()'s
99 shallow paths (the parse_diff.rs proven set: ENCAP→m_nop and a 3-digit numeric
100 from a STAT_UNKNOWN non-person) so post-state never diverges in deep handler
101 state. Zero-diff. **Finding:** like bsd_diff (P7a), the tests share the
102 `me`/`cref_me` by-value globals → they must serialize on a `GLOBALS_LOCK` mutex
103 (cargo's parallel test threads otherwise race; a positive-only isolated run
104 masked it — the diagnostic passed alone, the suite failed in parallel). This is
105 the L1 analogue of the L2 `PORT_LOCK`.
106 - **L2** — no new test. `dopacket` is the universal inbound read path (every line
107 a client/server sends → `read_message` → `dopacket` → `parse`), so the entire
108 existing `ircd-golden` suite covers it; confirmed `golden_registration` (the
109 full client read path) stays byte-identical.
110 - **S2S** — the FLUSH_BUFFER / IsDead→exit_client / IsServer+FLAGS_UNKCMD branches
111 need deep fixtures (a quit/sendq path, a linked server) but format no
112 remote-user fields, and `dopacket` itself has no `IsServer`-remote-field
113 formatting → no S2S test (the server read path is exercised by the existing s2s
114 golden tests, which drive lines through this same reassembler).
115
116- **2026-06-05 — P7c (`ircd.c` tune-file pair) merged.** The third P7 step and the
117 first (partial) port of the central driver TU `ircd.c`. Leaf-first within ircd.c.
118 - **Cluster choice** — `ircd_writetune`/`ircd_readtune` (ircd.c:1437-1522) are a
119 self-contained leaf: pure file I/O over the 7 runtime sizing globals, all callees
120 already Rust (`mybasename` P1) or a P8-bound variadic C trampoline (`sendto_flag`).
121 Both are exported in `ircd_ext.h` (`nm cbuild/ircd.o` → `T ircd_writetune`,
122 `T ircd_readtune`) → the `cref_*` oracle already exists, no linkage seam needed.
123 - **Config-resolved body** — `USE_HOSTHASH` + `USE_IPHASH` both ON (verified P2:
124 6 hash tables) → both `#ifdef`'d mirror assignments (`_HOSTNAMEHASHSIZE` /
125 `_IPHASHSIZE` = `t_data[2]`) compile. `USE_SERVICES`/`LOG_SERVER_CHANNELS` OFF →
126 `sendto_flag` is the plain server-notice path (early-returns when
127 `svchans[chan].svc_ptr` is NULL, which it is in an uninitialised L1 world → safe
128 to call from the test).
129 - **Port** — `ircd-common/src/ircd.rs` (new module; `pub mod ircd;` +
130 `IRCD_LINK_ANCHOR` in `link_anchor()`). `ircd_writetune`: `truncate(filename,0)`
131 → `open(O_CREAT|O_WRONLY,0600)` → `libc::sprintf` the 7 globals with the exact
132 `"%d\n"×7` format (using libc so `poolsize`'s `u_int` bits read through `%d` are
133 byte-identical) → `write` → `sendto_flag(SCH_NOTICE/SCH_ERROR,…)` the outcome via
134 `mybasename`. `ircd_readtune`: `open(O_RDONLY)` → `read(…,100)` → `libc::sscanf`
135 the 7 ints; `!= 7` → `close` + (`BOOT_BADTUNE` ? silent return : `fprintf(stderr)`
136 + `exit(1)`); else assign the 7 globals + the 2 hash mirrors + the
137 `lk_size = max(lk_size, ww_size)` clamp. `sendto_flag` declared in a local
138 `extern "C"` variadic block (void return; `fmt: *mut c_char` + cast literals).
139 `stderr` reached via a local `extern "C" { static mut stderr }`.
140 - **Drop** — partial port → `"ircd.o" => "ircd_link.o"` map in
141 `ircd-sys/build.rs::link_objs()`; the `ircd_link.o` second-compile driven through
142 `make` with an injected rule (like `send_link.o`) so make expands the recursive
143 IRCD*_PATH/IAUTH path vars that the surviving C in ircd.c needs byte-identically,
144 plus `-DPORT_IRCD_TUNE_P7c`. The C bodies are wrapped in
145 `#ifndef PORT_IRCD_TUNE_P7c` in `ircd/ircd.c`. CREF_OBJS keeps the unguarded
146 `ircd.o` → `cref_ircd_writetune`/`cref_ircd_readtune` survive for L1. RED first
147 confirmed exactly `ircd_writetune`/`ircd_readtune` undefined (referenced by Rust
148 `whowas::grow_whowas` + `hash::bigger_hash_table` AND C `s_die`/`server_reboot`/
149 `c_ircd_main`/`io_loop`); after GREEN, `nm target/debug/ircd` shows both as `T`
150 (from Rust).
151 - **Classification** — utility/callee TU (neither is a `msgtab` handler).
152 `ircd_writetune` is called from `s_die`/`server_reboot`/`rehash`/main;
153 `ircd_readtune` only from `main()` at boot.
154 - **L1** (`ircd-testkit/tests/ircd_tune_diff.rs`) — isolated-worlds (Rust port
155 reads/writes the real bindgen globals; `cref_ircd_*` oracle reads/writes the
156 `cref_*` renamed copies, confirmed present in libcref.a). 9 cases honouring the
157 inverse-invariant rule: writetune → byte-identical files for a typical vector,
158 `lk_size < ww_size` (legal on-disk), and the 0/INT_MAX/u32-max edge vector;
159 readtune → identical 9 globals for a typical vector, the `lk` clamp (file
160 `lk(10) < ww(500)` → both clamp to 500), the hash mirrors (both follow field 3),
161 a missing file (globals untouched), and a malformed file + `BOOT_BADTUNE` (silent
162 return, globals == seed); and the write→read round-trip (values survive, on both
163 worlds + equal). Zero-diff. Serialized on a `GLOBALS_LOCK` mutex (the documented
164 P7 L1 shared-global hazard — the sizing globals + `bootopt` + the tune file are
165 process-global). The `exit(1)` arm (malformed file WITHOUT `BOOT_BADTUNE`) is
166 untested by design — it would kill the test process — and noted as such.
167 - **L2** — no new test. `ircd_readtune` runs at server startup, so the existing
168 `ircd-golden` boot path covers it; `golden_registration` confirmed byte-identical.
169 No client command reaches either function under the locked config.
170 - **S2S** — none. Neither function has an `IsServer` branch or formats remote-user
171 fields.
172
173- **2026-06-05 — P7d (`s_bsd.c` socket/file utility leaves) merged.** The fourth P7
174 step and the **first (partial) port of the central I/O TU `s_bsd.c`** (3435 lines:
175 the select/poll event loop, `local[]`, `highest_fd`, `timeofday`, `FdAry`).
176 Leaf-first within s_bsd.c.
177 - **Cluster choice** — three small, self-contained libc-wrapper leaves that touch
178 **none** of the event-loop data globals: `get_sockerr` (s_bsd.c:1503),
179 `set_non_blocking` (s_bsd.c:1521), `write_pidfile` (s_bsd.c:817). All exported in
180 `s_bsd_ext.h` (`nm cbuild/s_bsd.o` → `T` each) → the `cref_*` oracle already
181 exists, no extra linkage seam. The heavier s_bsd leaves are deferred:
182 `report_error` (an output fn — sendto_flag/sendto_one/syslog; L2-covered like the
183 sendto_* family; `set_non_blocking`'s error path calls it, kept C); and
184 `add_local_domain`/`get_my_name` (pull in `ircd_res`/`mysk`/`find_me`/the
185 gethostbyname path → a separate name-resolution cluster).
186 - **Config-resolved body** — `SO_ERROR` defined → the `getsockopt(SO_ERROR)` block
187 in `get_sockerr` compiles; DEBUGMODE off → `write_pidfile`'s open-failure `Debug`
188 else-branch is a no-op; no other `#ifdef`-gated bodies in the three.
189 - **`IRCDPID_PATH`** — `write_pidfile` bakes in `IRCDPID_PATH`, a Makefile
190 recursively-expanded path var passed only on `s_bsd.o`'s command line (absent from
191 bindgen). Exposed to Rust exactly as P6m did for `IRCDMOTD_PATH`: `build.rs`
192 expands it via `make -s --eval` and emits `cargo:rustc-env=IRCD_PID_PATH=…`;
193 `ircd-sys/src/lib.rs` re-exports `pub const PID_PATH = env!("IRCD_PID_PATH")`. The
194 Rust `write_pidfile` opens `CString::new(ircd_sys::PID_PATH)` → identical path.
195 - **Port** — `ircd-common/src/s_bsd.rs` (new module; `pub mod s_bsd;` +
196 `S_BSD_LINK_ANCHOR` in `link_anchor()`). `get_sockerr`: read `errno` via
197 `*libc::__errno_location()`, `libc::getsockopt(SO_ERROR)` when `fd >= 0`, override
198 only when `err != 0`. `set_non_blocking`: `libc::fcntl(F_GETFL)` →
199 `fcntl(F_SETFL, res | O_NONBLOCK)`; both failure arms call the still-C
200 `report_error` (declared in a local non-variadic `extern "C"` block; the two
201 format literals passed as `*mut c_char`). `write_pidfile`: `libc::truncate` →
202 `open(O_CREAT|O_WRONLY,0600)` → `libc::sprintf(buff,"%5d\n",getpid())` →
203 `write(strlen)` → `close` (libc verbatim so the rendered bytes are byte-identical).
204 - **Drop** — partial port → `"s_bsd.o" => "s_bsd_link.o"` map in
205 `ircd-sys/build.rs::link_objs()`; the `s_bsd_link.o` second-compile driven through
206 `make` with an injected rule (like `ircd_link.o`) carrying
207 `-DPORT_S_BSD_LEAF_P7d` plus s_bsd.o's `-DIRCDPID_PATH/-DIAUTH_PATH/-DIAUTH`
208 machine-path defines (so the surviving C — `start_iauth` etc. — is byte-identical).
209 The three C bodies are wrapped in `#ifndef PORT_S_BSD_LEAF_P7d` in `ircd/s_bsd.c`
210 (two regions: `write_pidfile`, and the adjacent `get_sockerr`+`set_non_blocking`).
211 CREF_OBJS keeps the unguarded `s_bsd.o` → `cref_get_sockerr`/`cref_set_non_blocking`/
212 `cref_write_pidfile` survive for L1. RED first confirmed exactly those three
213 undefined (referenced by `ircd.c`, `s_auth.c`, and s_bsd.c's
214 `open_listener`/`start_iauth`/`read_message`); after GREEN, `nm target/debug/ircd`
215 shows all three as `T` (from Rust).
216 - **Classification** — utility/callee TU (none is a `msgtab` handler).
217 `write_pidfile` is called from `ircd.c` `main()`; `set_non_blocking`/`get_sockerr`
218 from the connection-accept/close paths.
219 - **L1** (`ircd-testkit/tests/s_bsd_leaves_diff.rs`) — 4 cases, serialized on a
220 `GLOBALS_LOCK` (the P7 L1 shared-global convention — `write_pidfile` writes the
221 shared `IRCDPID_PATH` file and `get_sockerr` mutates the process `errno`).
222 `get_sockerr`: fd<0 returns the saved errno (ECONNREFUSED) identically; a valid
223 socketpair fd with no pending error returns the saved errno (EAGAIN) identically.
224 `set_non_blocking`: the passed pipe fd gains `O_NONBLOCK` in both worlds, the
225 fd NOT passed stays blocking (inverse-invariant). `write_pidfile`: identical
226 file-state between the two worlds, with the exact `"%5d\n"` rendering pinned where
227 the path is writable. Zero-diff. Untested-by-design (noted): get_sockerr's
228 `err != 0` branch (needs a pending-error socket) and set_non_blocking's
229 fcntl-failure→report_error branch (needs a bad fd that passes the C guard).
230 - **L2** — no new test. `write_pidfile` runs at boot, `set_non_blocking`/
231 `get_sockerr` on every connect → the existing `ircd-golden` boot/connect path
232 covers them; `golden_registration` confirmed byte-identical.
233 - **S2S** — none. No `IsServer` branch, no remote-user field formatting.
234
235- **2026-06-05 — P7e (`s_bsd.c` name-resolution leaf `add_local_domain`) merged.** The
236 fifth P7 step; the second leaf plucked from the central I/O TU `s_bsd.c` (after the
237 P7d socket/file trio). Leaf-first within s_bsd.c.
238 - **Cluster choice** — `add_local_domain` (s_bsd.c:99), the lone pure, deterministic
239 name-resolution sub-leaf. It touches **none** of the event-loop data globals
240 (`local[]`/`highest_fd`/`timeofday`/`FdAry`); its only dependency is the resolver
241 state (`ircd_res` + `ircd_res_init`), already Rust since P6
242 (`ircd-common/src/res_init.rs`). Deferred: `get_my_name` (s_bsd.c:2926, its only
243 in-`s_bsd.c` caller) pulls in `gethostname`/`gethostbyname` (real DNS, host-
244 dependent → not L1-deterministic) plus `mysk`/`find_me` → a later cluster.
245 - **Config-resolved body** — `RES_INIT` is defined (`resolv_def.h:108`) → the whole
246 `#ifdef RES_INIT` body compiles; `DEBUGMODE` off → the `Debug((DEBUG_DNS,…))` line
247 is a no-op. Live body: strip one trailing `.` (and `size++`); if the name has no
248 `.`, lazily `ircd_res_init()` when `!(ircd_res.options & RES_INIT)`, then append
249 `"." + ircd_res.defdname` iff `defdname[0]` and `strlen(defdname)+2 <= size`.
250 - **Port** — added to `ircd-common/src/s_bsd.rs` (existing module). `index`→
251 `libc::strchr`, `strcat`/`strlen` verbatim; reads `crate::res_init::ircd_res` /
252 calls `crate::res_init::ircd_res_init()` (the Rust resolver defs). `RES_INIT` as a
253 local `const RES_INIT: c_ulong = 0x1` (mirrors res_init.rs; `options` is `u_long`).
254 The unguarded `hname[strlen(hname)-1]` last-char read is replicated faithfully
255 (C does it unguarded; callers never pass an empty string).
256 - **Drop** — partial port via the existing `s_bsd_link.o` seam: added
257 `-DPORT_S_BSD_LEAF_P7e` to the `s_bsd_link.o` make-rule in `ircd-sys/build.rs`
258 (alongside `-DPORT_S_BSD_LEAF_P7d`); wrapped the C body (s_bsd.c:99–129) in
259 `#ifndef PORT_S_BSD_LEAF_P7e`. CREF_OBJS keeps the unguarded `s_bsd.o` →
260 `cref_add_local_domain` + `cref_ircd_res` survive for L1. RED first confirmed the
261 single undefined symbol, referenced by the now-Rust `s_conf.rs` (`attach_Iline`)
262 and the still-C `s_bsd.c` (`get_my_name`/`connect_server`); after GREEN
263 `nm target/debug/ircd` shows `add_local_domain` as `T` (from Rust).
264 - **Classification** — utility/callee TU (not a `msgtab` handler). Called from
265 `s_conf.c:504` (now Rust) and `s_bsd.c` `get_my_name`/`connect_server` (still C).
266 - **L1** (`ircd-testkit/tests/add_local_domain_diff.rs`) — 6 cases, isolated worlds
267 (the Rust port reads the real Rust `ircd_res`; the `cref_` oracle reads the renamed
268 `cref_ircd_res`), serialized on `GLOBALS_LOCK` (`ircd_res` + `$LOCALDOMAIN` are
269 process-global). Honouring the inverse-invariant rule: (1) trailing-dot strip on an
270 already-qualified name → no append; (2) unqualified + defdname + room → append;
271 (3) the size guard at the boundary — `size = len+1` must NOT append, `size = len+2`
272 must (the inverse of case 2); (4) empty defdname → no append; (5) the trailing-dot
273 `size++` is load-bearing — `"irc."` with `size = len(defdname)+1` appends only
274 because the strip bumps `size` to `+2`; (6) the init-trigger branch — options
275 *without* RES_INIT + `$LOCALDOMAIN` set (deterministic, host-independent) → both
276 worlds lazily run their P6-verified-equivalent `ircd_res_init`, populate defdname
277 from env, append, and gain RES_INIT. Zero-diff vs `cref_add_local_domain`.
278 - **L2** — no new test. `add_local_domain` runs at boot via `s_conf.c` `read_conf`
279 and on `connect_server`; the existing `ircd-golden` boot path covers it
280 (`golden_registration` byte-identical). No client command reaches it under the
281 locked config.
282 - **S2S** — none. No `IsServer` branch, no remote-user field formatting.
283
284- **2026-06-06 — P7f (`s_bsd.c` delayed-close leaf `delay_close`) merged.** The
285 sixth P7 step; the third leaf plucked from the central I/O TU `s_bsd.c` (after the
286 P7d socket/file trio and the P7e name-resolution leaf). Leaf-first within s_bsd.c.
287 - **Cluster choice** — `delay_close` (s_bsd.c:3359), the best remaining
288 L1-deterministic s_bsd leaf. It owns a *private static linked list* of fds
289 awaiting a delayed `close()`; its behaviour is a pure function of two C globals
290 (`timeofday`, `istat`) + the compile constant `DELAY_CLOSE`, observable through
291 its `time_t` return (head entry's scheduled-close time, or 0) and the
292 `istat.is_delayclose`/`is_delayclosewait` counters. The other remaining s_bsd
293 symbols are `static` (no `cref_` oracle — `set_sock_opts`), sender-only side
294 effects (`report_error`), real-DNS (`get_my_name`), or the event-loop core
295 itself (`read_message`/`add_connection`/listeners — deferred, done last with mio).
296 - **Config-resolved body** — gated by `#ifdef DELAY_CLOSE` (config.h.dist:440 →
297 `#define DELAY_CLOSE 15`, enabled; `nm cbuild/s_bsd.o` shows `T delay_close`).
298 `DEBUGMODE` off → no `Debug(())`. `MAXCLIENTS` = `MAXCONNECTIONS-5` = `50-5` = 45.
299 Live body: if `fd==-2` → `tmpdel = is_delayclosewait` (close-all); else if
300 `is_delayclosewait > (MAXCLIENTS-is_localc)>>1` → `tmpdel = is_delayclosewait>>2`
301 (drop oldest quarter). Sweep the list evicting while
302 `tmp->time < timeofday || tmpdel-- > 0`; on eviction `send(fd, "ERROR :Too rapid
303 connections from your host\r\n", 46, 0)` to the *new* fd, `close(tmp->fd)`,
304 `MyFree`, `is_delayclosewait--`. Then if `fd>=0`: `set_non_blocking`+
305 `shutdown(SHUT_RD)`, `MyMalloc` a node at `timeofday+DELAY_CLOSE`, append,
306 `is_delayclosewait++`/`is_delayclose++`. Return `first ? first->time : 0`.
307 - **Port** — added to `ircd-common/src/s_bsd.rs` (existing module). `struct fdlog`
308 → a private `#[repr(C)] struct FdLog` + module statics
309 `DELAY_CLOSE_FIRST`/`DELAY_CLOSE_LAST` (the list never crosses the ABI — each
310 world keeps its own). Reads the still-C globals via bindgen
311 (`ircd_sys::bindings::istat`/`timeofday`); calls the Rust `set_non_blocking`
312 (P7d, same module) + `crate::list::MyMalloc` (P2); `MyFree`→`libc::free`;
313 `send`/`close`/`shutdown` verbatim. Faithfulness: the unsigned threshold
314 `MAXCLIENTS.wrapping_sub(is_localc) >> 1` (C's `int - u_long` wraps); the
315 `||` short-circuit so `tmpdel` is decremented only when the entry is *not*
316 expired; the 46-byte error literal (43 chars + `\r\n` + the implicit `\0`, sent
317 to the function-argument `fd`, not `tmp->fd`).
318 - **Drop** — partial port via the existing `s_bsd_link.o` seam: added
319 `-DPORT_S_BSD_DELAY_CLOSE_P7f` to the make-rule in `ircd-sys/build.rs` (alongside
320 `-DPORT_S_BSD_LEAF_P7d -DPORT_S_BSD_LEAF_P7e`); wrapped the C body
321 (s_bsd.c:3359–3441, inside the `#ifdef DELAY_CLOSE` block) in
322 `#ifndef PORT_S_BSD_DELAY_CLOSE_P7f`. CREF_OBJS keeps the unguarded `s_bsd.o` →
323 `cref_delay_close` + `cref_istat` + `cref_timeofday` survive for L1. RED first
324 confirmed `delay_close` undefined — referenced by `s_serv.rs` (`m_close`, now
325 Rust), `ircd.c:1176` (io_loop, still C), and `s_bsd.c:1661` (still C); after GREEN
326 `nm target/debug/ircd` shows `delay_close` as `T` (from Rust).
327 - **Classification** — utility/callee TU (not a `msgtab` handler). Called from the
328 io_loop (`delay_close(-1)`), `m_close` (`delay_close(-2)`), and the
329 connection-close / listener-accept paths.
330 - **L1** (`ircd-testkit/tests/delay_close_diff.rs`) — 6 cases, isolated worlds (the
331 Rust port reads/mutates the real `istat`/`timeofday`; the `cref_` oracle uses
332 `cref_istat`/`cref_timeofday`), serialized on `GLOBALS_LOCK`. Because the static
333 lists persist across `#[test]`s, each test `reset()`s first (drains both via
334 `delay_close(-2)`, then zeroes the counters). Honouring the inverse-invariant
335 rule: (1) queue one fd → return `now+15`, counters `(1,1)`; (2) time eviction
336 (inverse of 1) — advance past the time, sweep with `fd<0` → entry gone, return 0,
337 `wait 1→0`; (3) unexpired entry stays (the time-sorted early `break`); (4)
338 `fd==-2` close-all drains 2 unexpired entries; (5) overflow — `is_localc=43` →
339 threshold 1, 4 queued then a 5th → `tmpdel=4>>2=1` evicts the oldest while adding
340 (net `wait` 4, `close` 5); (6) chronological head — head stays the oldest entry's
341 time until it is evicted. socketpair fds so `close`/`shutdown`/`send` succeed
342 identically; the same fd value drives both worlds. Zero-diff on return value +
343 `(is_delayclose, is_delayclosewait)` for every call.
344 - **L2** — no new test. `delay_close` runs from the io_loop / connection-close
345 paths; the existing `ircd-golden` boot path covers it (`golden_registration`
346 byte-identical). No client command reaches it deterministically under the locked
347 config (it needs rapid-connect refusal).
348 - **S2S** — none. No `IsServer` branch, no remote-user field formatting.
349
350- **2026-06-06 — P7g (`s_bsd.c` fd-teardown leaf `close_client_fd`) merged.** The next `s_bsd.c` leaf after P7d (socket/file trio), P7e (`add_local_domain`), P7f (`delay_close`). Ported `close_client_fd` (s_bsd.c:1270) to `ircd-common/src/s_bsd.rs`.
351 - **Cluster choice.** Picked because its effect is pure post-state on the `aClient` + the fd arrays (L1-testable by inspection, like `delay_close`), and all its real callees are already Rust: `flush_connections` (send.rs, P3), `del_fd` (list.rs, P2), `dbuf_delete` (dbuf.rs, P1). The only C dependency is `report_error`, already declared `extern "C"` in `s_bsd.rs` since P7d.
352 - **Guard / seam.** Same `s_bsd_link.o` partial-compile; added `-DPORT_S_BSD_CLOSE_FD_P7g` to the recipe in `ircd-sys/build.rs` and wrapped the C body in `#ifndef PORT_S_BSD_CLOSE_FD_P7g`. RED confirmed the undefined `close_client_fd` referenced by the still-C `close_connection`/`add_connection_refuse`; after GREEN `nm` shows it `T` from Rust. The cref oracle keeps the full unguarded `s_bsd.o`.
353 - **Config-resolved body.** `SO_LINGER` defined → the two linger blocks compile (only taken when `exitc==EXITC_PING`; on a nonzero `setsockopt` return they call the still-C `report_error`). `ZIP_LINKS` OFF → the `zip_free` call inside the `IsServer||IsListener` arm is omitted. Faithful: `SETSOCKOPT(...,&sockling,sockling)` = `setsockopt(...,&sockling,sizeof(struct linger))`; `DBufClear(d)` = `dbuf_delete(d, d->length)`; `bzero(passwd, sizeof)` = `memset(passwd,0,21)`; the `IsServer||IsListener` / `IsClient` arms are mutually exclusive (`if/else if`) but `del_fd(&fdall)` + `local[fd]=NULL` + `close` + the drains run unconditionally for any `fd>=0`. The linger struct is fully initialized (`l_onoff=0,l_linger=0`, per the 2014 Kurt Roeckx fix).
354 - **Classification.** Callee TU (no `msgtab` entry) — reached from `close_connection` / `exit_client` / the listener-accept refuse paths.
355 - **L1.** `close_client_fd_diff.rs`, 6 cases, isolated worlds (Rust reads/mutates the real `local`/`fdas`/`fdall` + calls Rust `flush_connections`/`del_fd`; oracle uses `cref_local`/`cref_fdas`/`cref_fdall` + `cref_*`), `me.fd`/`cref_me.fd` pinned to -1 so `flush_connections` takes the `else if fd>=0` branch. Cases: client both-fds; server + listener (the fdas+fdall arm, via `FLAGS_LISTEN` for the listener); fd<0 (only authfd closed, fd>=0 block skipped, queues/passwd untouched); both-fds<0 no-op; and the inverse-of-insert recvQ-drain + passwd-zero. Each asserts equal post-state + the inverse invariants (fd actually closed → second `close()` returns EBADF, `local[fd]==NULL`, array slot freed, `fdas`/`fdall.highest` agree, queues drained). Serialized on `GLOBALS_LOCK` (shared `local`/fd-arrays/`me`). Zero-diff vs `cref_close_client_fd`.
356 - **Untested-by-design.** `exitc=0` in every case → the `SO_LINGER`/`report_error` failure branches are not exercised (they need a socket whose `setsockopt` fails). The `sendQ` flush-then-clear path (live socket I/O through `send_queued`) is L2, not L1 — queuing `sendQ` on a synthetic client crashes the live send path; only `recvQ` (never flushed) is used for the `DBufClear` drain check.
357 - **L2 / S2S.** No new L2: hit on every disconnect; `golden_registration` (incl. `register_quit_reuse_releases_nick`) stays byte-identical. No S2S: formats no remote-user fields.
358
359- **2026-06-06 — P7h (`s_bsd.c` connection-teardown leaf `close_connection`) merged.** The next `s_bsd.c` leaf after P7d (socket/file trio), P7e (`add_local_domain`), P7f (`delay_close`), P7g (`close_client_fd`). Ported `close_connection` (s_bsd.c:1341) to `ircd-common/src/s_bsd.rs` — the disconnect-bookkeeping layer directly above the P7g fd-teardown leaf.
360 - **Cluster choice.** Picked as the natural next layer up from P7g: `close_connection` *calls* `close_client_fd`, and all its other callees are already resolvable — `del_queries`/`find_conf_exact`/`det_confs_butmask` are Rust (P6), `sendto_iauth` is the variadic C trampoline (declaring + calling a variadic is stable), `close_client_fd` is the Rust P7g symbol. Its whole effect is post-state on the `aClient` + the process globals → L1-testable by inspection.
361 - **Guard / seam.** Same `s_bsd_link.o` partial-compile; added `-DPORT_S_BSD_CLOSE_CONN_P7h` to the recipe in `ircd-sys/build.rs` (alongside the P7d/P7e/P7f/P7g guards) and wrapped the C body (s_bsd.c:1341-1453) in `#ifndef PORT_S_BSD_CLOSE_CONN_P7h`. RED confirmed `close_connection` undefined — referenced by the now-Rust `s_misc.rs` (`exit_client`) and the still-C `s_bsd.c:458`; after GREEN `nm target/debug/ircd` shows it `T` from Rust. The cref oracle keeps the full unguarded `s_bsd.o`.
362 - **Config-resolved body.** `USE_IAUTH` ON → the `sendto_iauth("%d D", cptr->fd)` notify block (gated `!IsListener && !IsConnecting`) compiles. DEBUGMODE off → the `Debug()` lines vanish. No other `#ifdef`'d branches. Macros reproduced inline: `IsHandshake`/`IsConnecting` (`status == STAT_HANDSHAKE`/`STAT_CONNECTING`), `IsIllegal(aconf)` (`status & CONF_ILLEGAL`), `ConfConFreq(aconf)` (`aconf->class->conFreq`, int→time_t), `CFLAG` (`CONF_CONNECT_SERVER|CONF_ZCONNECT_SERVER` = 40); `HANGONRETRYDELAY`=30/`HANGONGOODLINK`=900 (config.h.dist:656-657, object-like config macros absent from bindgen → Rust consts). Reuses the P7g `is_server`/`is_client`/`is_listener` helpers. The reconnect-reschedule arm short-circuits on `IsServer` (so `find_conf_exact` is only called for a server) exactly as C.
363 - **Classification.** Callee/utility TU (no `msgtab` entry) — reached from `exit_client` (s_misc.c) and the listener/acceptor cleanup paths.
364 - **L1.** `close_connection_diff.rs`, 6 cases, isolated worlds (Rust reads/mutates the real `ircstp`/`nextconnect`/`ListenerLL`/`local`/`fdas`/`fdall`/`me`/`istat` + calls Rust `close_client_fd`/`del_queries`/`det_confs_butmask`; oracle uses `cref_*`), serialized on `GLOBALS_LOCK`. `me.fd`/`cref_me.fd` pinned to -1 (inner `flush_connections` else-branch); `adfd`/`cref_adfd` pinned to -1 (`sendto_iauth` no-op, no live iauth pipe); `firsttime`/`since` pinned to constants for deterministic `timeofday - firsttime` deltas. Cases: (1) server → `is_sv`/`is_sbs`/`is_sbr`/`is_sti`; (2) client → `is_cl`/`is_cbs`/`is_cbr`/`is_cti` (inverse: server/ni untouched); (3) unknown → only `is_ni`; (4) handshake + connecting, `nextconnect==0` → `nextconnect = now + 30`; (5) P-line acceptor refcount 5→4 (inverse: closed client fd torn down); (6) illegal listener (`CONF_ILLEGAL`, `clients<=0`) unlinked from a 2-node `ListenerLL` — inverse invariants: head.next NULL, `ListenerLL` head intact, target fd -1, `from` NULL, `confs` detached. Zero-diff vs `cref_close_connection`. **Fixture note:** case 6's `det_confs_butmask`→`detach_conf` decrements the unsigned `istat.is_conflink` once per detached link; seeded `is_conflink=1` in both worlds (the real `attach_conf` would have incremented it) — without it the decrement underflows (C wraps silently, Rust debug-overflow panics, surfacing the unrealistic fixture).
365 - **Untested-by-design.** The recursive `close_connection(cptr->acpt)` when the acceptor itself becomes illegal (needs a fully-illegal acceptor conf — case 5 covers the non-recursive refcount arm). The `find_conf_exact` reconnect-reschedule arm (returns NULL with no conf loaded → both worlds skip it identically). The `sendto_iauth` wire emission (L2, variadic trampoline, like the rest of the sendto_* family).
366 - **L2 / S2S.** No new L2: hit on every disconnect; `golden_registration` (incl. `register_quit_reuse_releases_nick`) stays byte-identical. No S2S: formats no remote-user fields (the `IsServer` branch touches only local stats counters + reconnect scheduling, not wire output).
367
368- **2026-06-06 — P7i (`s_bsd.c` listener-list teardown leaf `close_listeners`) merged.** The next `s_bsd.c` leaf after P7d (socket/file trio), P7e (`add_local_domain`), P7f (`delay_close`), P7g (`close_client_fd`), P7h (`close_connection`). Ported `close_listeners` (s_bsd.c:427) to `ircd-common/src/s_bsd.rs` — the listener-GC layer directly above the P7g/P7h teardown leaves.
369 - **Cluster choice.** The cleanest remaining s_bsd leaf: it is a pure walk over the `ListenerLL` global dispatching to two already-Rust callees (`close_client_fd` P7g, `close_connection` P7h) — no socket syscalls of its own, effect fully observable as `ListenerLL` + per-node `aClient` post-state. The other remaining s_bsd symbols are the event-loop core (`read_message`/`add_connection`), listener *construction* (`inetport`/`add_listener`/`open_listener` — real `socket`/`bind`/`listen`), sender-only (`report_error`), real-DNS (`get_my_name`), or `static` (no `cref_` oracle: `set_sock_opts`/`check_init`).
370 - **Guard / seam.** Same `s_bsd_link.o` partial-compile; added `-DPORT_S_BSD_CLOSE_LISTENERS_P7i` to the recipe in `ircd-sys/build.rs` (alongside the P7d/P7e/P7f/P7g/P7h guards) and wrapped the C body (s_bsd.c:427-462) in `#ifndef PORT_S_BSD_CLOSE_LISTENERS_P7i`. RED confirmed `close_listeners` undefined — referenced only by the now-Rust `s_conf.rs` rehash (`s_conf.c:1315`); after GREEN `nm target/debug/ircd` shows it `T` from Rust. The cref oracle keeps the full unguarded `s_bsd.o`.
371 - **Config-resolved body.** UNIXPORT off (`cbuild/config.h:339 #undef UNIXPORT`; `nm cbuild/s_bsd.o` has no `unixport`) → the entire `#ifdef UNIXPORT` `IsUnixSocket`/`sprintf(unixpath)`/`unlink` block is not compiled. Resolved body: `for (acptr = ListenerLL; acptr; acptr = bcptr) { aconf = acptr->confs->value.aconf; bcptr = acptr->next; if (IsIllegal(aconf)) { if (aconf->clients > 0) close_client_fd(acptr); else close_connection(acptr); } }`. The `bcptr = acptr->next` is read *before* the teardown because `close_connection` may unlink `acptr` (the P7h `ListenerLL`-unlink arm). `IsIllegal` reuses the existing `conf_is_illegal` helper (`aconf->status & CONF_ILLEGAL`). No new externs — both callees are Rust in the same module.
372 - **Classification.** Callee/utility TU (no `msgtab` entry) — the rehash listener garbage-collector, called from `s_conf.c` `rehash`.
373 - **L1.** `close_listeners_diff.rs`, 5 cases, isolated worlds (Rust reads/mutates the real `ListenerLL`/`local`/`fdas`/`fdall`/`me`/`ircstp`/`istat` + calls the Rust `close_client_fd`/`close_connection`; oracle uses `cref_*`), serialized on `GLOBALS_LOCK`. `me.fd`/`adfd` pinned to -1 (inner `flush_connections` else-branch + `sendto_iauth` no-op); listeners built with status `STAT_ME` + flags `FLAGS_LISTEN` + `from = self` + a one-element confs `Link` + a live pipe fd registered in `local`/`fdas`/`fdall`; `istat.is_conflink` seeded per `close_connection`-bound node (its `det_confs_butmask` decrements the unsigned counter once per detached link — underflow else). Each case builds an identical `ListenerLL` on both worlds, runs `close_listeners`, and compares the structural walk (surviving node count + per-node `(fd_torn, from_null, confs_null)` — pointers differ across worlds so the comparison is on observable facts) plus inverse invariants. Cases: (1) illegal clients=0 → `close_connection` → unlinked (`ListenerLL` drained, fd -1, `from` NULL, confs detached); (2) illegal clients>0 → `close_client_fd` → fd torn BUT node stays linked + `from == self` + confs NOT detached (inverse of 1); (3) legal → fully untouched (fd still a valid descriptor via `fcntl(F_GETFD)`, still linked); (4) mixed `[legal] -> [illegal,c=0] -> [legal]` → middle removed, the two legals relinked head↔next with intact fds; (5) all-illegal-c=0 → list fully drained. Zero-diff vs `cref_close_listeners`.
374 - **L2 / S2S.** No new L2: `close_listeners` is the rehash listener-GC, exercised at boot/rehash by the existing golden suite (`golden_registration` byte-identical). No S2S: it formats no remote-user wire fields (its only side effects are the descriptor teardowns + `ListenerLL` mutation).
375
376- **2026-06-06 — P7j (`s_bsd.c` listener-reactivation leaf `activate_delayed_listeners`) merged.** The next `s_bsd.c` leaf after P7d–P7i; the reactivation counterpart to P7i's `close_listeners` teardown. Ported `activate_delayed_listeners` (s_bsd.c:526) to `ircd-common/src/s_bsd.rs`.
377 - **Cluster choice.** The cleanest remaining s_bsd leaf: a pure walk over `ListenerLL` flipping one flag bit (`FLAGS_LISTENINACTIVE`) + a `listen()` syscall + a counter, the natural pair to P7i. Its whole effect is per-node `flags`/listen-state post-state → L1-testable by list inspection. The other remaining s_bsd symbols are the event-loop core (`read_message`/`add_connection`), listener *construction* (`inetport`/`add_listener`/`open_listener`/`reopen_listeners` — real `socket`/`bind`/`listen`), sender-only (`report_error`), process setup (`daemonize`/`init_sys`/`start_iauth`), real-DNS (`get_my_name`), or `static` (no `cref_` oracle: `set_sock_opts`/`check_init`/`check_clones`).
378 - **Guard / seam.** Same `s_bsd_link.o` partial-compile; added `-DPORT_S_BSD_ACTIVATE_DELAYED_P7j` to the recipe in `ircd-sys/build.rs` (alongside the P7d–P7i guards) and wrapped the C body (s_bsd.c:526-545) in `#ifndef PORT_S_BSD_ACTIVATE_DELAYED_P7j`. RED confirmed `activate_delayed_listeners` undefined — referenced by the now-Rust `s_serv.rs:739` (`m_set` burst path) and `s_misc.rs:1153` (`check_split`); after GREEN `nm target/debug/ircd` shows it `T` from Rust. The cref oracle keeps the full unguarded `s_bsd.o` → `cref_activate_delayed_listeners`.
379 - **Config-resolved body.** No `#ifdef`s in this function; DEBUGMODE off → no `Debug` line. `IsListenerInactive(x)` = `(x)->flags & FLAGS_LISTENINACTIVE` (0x8000000, bindgen const); `ClearListenerInactive(x)` = `(x)->flags &= ~FLAGS_LISTENINACTIVE`; `flags` is a `c_long` field so the mask is `as c_long`. `LISTENQUEUE` (config.h:622 = 128) is a config `#define` absent from bindgen → reproduced as a `const c_int`. `listen()`'s return is ignored exactly as C → the observable post-state (inactive bit cleared, node kept) is identical regardless of the fd. `sendto_flag(SCH_NOTICE, ...)` is the existing variadic C trampoline (`ircd_sys::bindings::sendto_flag` + `ServerChannels_SCH_NOTICE`); no new extern. It is safe in L1 because it short-circuits when `svchans[chan].svc_ptr == NULL` (the default un-`setup_svchans`'d state) → no-op in both worlds.
380 - **Classification.** Callee/utility TU (no `msgtab` entry) — reached from the server-burst / TS-adjust path (`s_serv.c`) and `s_misc.c` `check_split`. Formats **no remote-user fields** (only an integer count) → no S2S even though a server path reaches it.
381 - **L1.** `activate_delayed_listeners_diff.rs`, 5 cases, isolated worlds (Rust reads/mutates the real `ListenerLL`/`me`; oracle uses `cref_*`), serialized on `GLOBALS_LOCK`. `me.fd`/`adfd` pinned to -1 (defensive). Each `new_listener(inactive)` builds an `aClient` (status `STAT_ME`, flags `FLAGS_LISTEN` [+`FLAGS_LISTENINACTIVE`]) over a **real TCP socket** so `listen()` genuinely succeeds (asserted via `getsockopt SO_ACCEPTCONN`). Each case builds an identical `ListenerLL` on both worlds, runs the function, and compares the per-node `(still_inactive, accepting)` vector + node count (listeners are never removed). Cases: (1) single inactive → activated (bit clear + `SO_ACCEPTCONN==1`); (2) single active → untouched (inverse — flag stays clear, not re-listened, stays in list); (3) mixed `[active,inactive,active]` → only middle activated, all 3 kept, order preserved; (4) empty → no-op (cnt=0, `sendto_flag` not fired, no crash); (5) all-inactive (3 nodes) → all activated. Zero-diff vs `cref_activate_delayed_listeners`.
382 - **Untested-by-design.** The `sendto_flag` wire emission (cnt>0) is the variadic-trampoline path; with NULL `svc_ptr` it is a no-op (L2 territory, like the rest of the `sendto_*` family). `listen()`'s failure path is unreachable-by-observation (return ignored).
383 - **L2 / S2S.** No new L2: hit by server-burst/rehash; `golden_registration` (incl. `register_quit_reuse_releases_nick`) stays byte-identical. No S2S: formats no remote-user wire fields.
384
385- **2026-06-06 — P7k (`s_bsd.c` `add_connection_refuse`, connection-refuse leaf) merged.** The next leaf in the central I/O TU after the P7d–P7j socket/file/teardown/listener leaves; the refuse-path companion to `add_connection` (which stays C).
386 - **Cluster choice** — `add_connection_refuse` (`s_bsd.c:1594`), a true leaf: its only callees are `close` (libc), `free_client` (Rust, P2), and a bump of the bindgen `ircstp` global. Called from `add_connection`'s four refuse paths (clone-check fail, IP-line refuse, `DELAY_CLOSE` accept throttle, DNSBL/iauth refuse), all later in the same C TU.
387 - **Guard** — partial-ported via `s_bsd_link.o` with `-DPORT_S_BSD_ADD_CONN_REFUSE_P7k` added to the build.rs make-eval recipe; the C body wrapped in `#ifndef PORT_S_BSD_ADD_CONN_REFUSE_P7k … #endif`. The cref oracle keeps the full unguarded `s_bsd.o` so `cref_add_connection_refuse` survives.
388 - **Config-resolved body** — `DELAY_CLOSE` is defined (`config.h:440`, =15) → the `#if !defined(DELAY_CLOSE)` arm (`delay = 0`) is **not compiled**; `delay` is honored verbatim. Body: `if (delay==0) close(fd); ircstp->is_ref++; acptr->fd = -2; free_client(acptr);`.
389 - **ABI** — no `*_ext.h` prototype (file-local-by-use, defined before its callers in the same TU) but a global `T` symbol; the `#[no_mangle] pub unsafe extern "C" fn add_connection_refuse` resolves the C `add_connection` call sites at link. No bindgen decl needed. `free_client` called as `crate::list::free_client` (same crate).
390 - **Classification** — utility/callee TU, not a `msgtab` handler. → L1 is the gate.
391 - **L1** (`add_connection_refuse_diff.rs`, 3 cases) — two isolated worlds (Rust port `c_add_connection_refuse` vs `cref_add_connection_refuse`), each with its own backing `stats` (its `ircstp` points at it) and its own `make_client`/`free_client`. `acptr` built via that world's `make_client(NULL)` so `free_client` is the clean inverse (a `calloc`'d client would trip `free_client`'s `auth != username` error arm). `acptr` is freed inside the call → post-state is a UAF, so the test compares side effects: `is_ref` delta (+1) and the fd's fate. Case 1 `delay==0`: fd actually closed (second `close` → EBADF). Case 2 `delay==1`: fd left open (our `close` returns 0) — the happy-path/inverse pair. Case 3: two refuses accumulate `is_ref` to 2. Zero-diff vs `cref_`; serialized on `GLOBALS_LOCK` (the P7 L1 shared-global hazard — `ircstp`/`cref_ircstp` process-global).
392 - **Untested-by-design** — `acptr->fd = -2` (set immediately before `free_client`; no surviving reader under the locked config). `free_client` internals are P2-tested (`list_diff.rs`).
393 - **No L2 / no S2S** — reached only from `add_connection`'s refuse paths; no client command reaches it deterministically under the locked config, and it formats no remote-user wire fields. Sibling s_bsd L1 tests (P7d–P7j) re-run green after the shared `s_bsd_link.o` recipe change. `cargo build` 0 warnings; `add_connection_refuse` resolves `T` in `target/debug/ircd`.
394
395- **2026‑06‑06 — P7l (`s_bsd.c` `setup_ping`, UDP CPING‑socket setup leaf) merged.** Ported the next s_bsd.c leaf after the P7d–P7k socket/file/teardown/listener/refuse leaves: the one‑shot setup half of the server‑to‑server CPING (UDP ping) feature.
396 - **Cluster choice.** `setup_ping` (s_bsd.c:3018) is a self‑contained leaf — it binds the single shared `udpfd` UDP socket and returns its fd. Its only non‑libc deps are `inetpton` (Rust P1), `minus_one` (bindgen all‑`0xff` global), and `udpfd` (a C global it sets). The CPING‑output siblings `send_ping` (non‑static) and `check_ping`/`polludp` (static) stay C; they share `udpfd` only, which stays a C global, so no atomic cluster move is needed.
397 - **Guard / seam.** Partial port via the existing `s_bsd_link.o` second‑compile, new guard `-DPORT_S_BSD_SETUP_PING_P7l` added alongside the P7d–P7k guards in `ircd-sys/build.rs`; the C body wrapped in `#ifndef PORT_S_BSD_SETUP_PING_P7l`.
398 - **Config‑resolved body.** `AFINET` = `AF_INET6` (`common/os.h:680`) → `from` is a `libc::sockaddr_in6`, the `SIN_FAMILY`/`SIN_PORT`/`SIN_ADDR` macros map to `sin6_family`/`sin6_port`/`sin6_addr`. The `SETSOCKOPT` macro (`sys_def.h:29`) passes `sizeof(int)`=4 as the option length, **not** `sizeof(*p)`. `FNDELAY` = `O_NDELAY` = `O_NONBLOCK`. `DEBUGMODE`/`USE_SYSLOG` off → the `Debug`/`syslog` lines vanish. `IN6ADDRSZ` = 16.
399 - **Faithfulness.** Idempotent short‑circuit (`udpfd != -1` → return it, ignore `aconf`); the assign‑then‑test (`(udpfd = socket(...)) == -1`) reproduced as set‑bindgen‑extern‑then‑check; each later failure does `close(fd); udpfd = -1; return -1`. Bind address: a numeric `aconf->passwd` (`isdigit(*passwd)`) → `inetpton(AF_INET6, …)`, falling back to a 16‑byte `bcopy` of `minus_one` on parse failure; else `in6addr_any`. `htons` = `(port as u16).to_be()`.
400 - **Classification.** Callee TU, not a `msgtab` handler — reached only from the now‑Rust `s_conf.rs` rehash (`s_conf.c:2041`, a `connect{}` block with a port). RED confirmed the undefined `setup_ping` referenced by `s_conf.rs`; after GREEN `nm target/debug/ircd` shows `setup_ping` as `T` (from Rust).
401 - **L1.** `ircd-testkit/tests/setup_ping_diff.rs`, 3 cases: (1) fresh setup opens a valid non‑blocking `SOCK_DGRAM` recorded in `udpfd`; (2) idempotent second call (the inverse‑of‑state path) returns the same fd unchanged and opens no new socket, even with a different `aconf`; (3) numeric `passwd` `"::1"` drives the `inetpton` bind‑address branch (loopback bind succeeds) vs the `in6addr_any` default. Zero‑diff vs `cref_setup_ping`; isolated worlds (real `udpfd` vs `cref_udpfd`), serialized on `GLOBALS_LOCK` with a `reset()` that closes the prior socket + restores `udpfd = -1` between cases. Because each world opens its own socket, the test compares the fd's *properties* (open, non‑blocking, `SOCK_DGRAM`) + the global‑state contract (`udpfd` set / idempotent), never the integer fd value.
402 - **L2 / S2S.** No new L2 (callee, hit by rehash; `golden_registration` byte‑identical, 0 warnings). No S2S (formats no remote‑user fields).
403 - **Untested‑by‑design.** The `setsockopt`/`bind`/`fcntl` failure arms (`close(fd); udpfd = -1`) need an induced syscall failure (privileged/occupied bind) — not deterministic in the sandbox; both worlds take the success path identically. The actual UDP `sendto` is `send_ping`'s concern (a later leaf).
404
405- **2026‑06‑06 — P7m (`s_bsd.c` `send_ping`, UDP CPING‑output leaf) merged.** Ported the next s_bsd.c leaf after the P7d–P7l socket/file/teardown/listener/refuse/CPING‑setup leaves: the output half of the server‑to‑server CPING (UDP ping) feature, the sibling to P7l's `setup_ping`.
406 - **Cluster choice.** `send_ping` (s_bsd.c:3077) is a self‑contained leaf — its only non‑libc dependency is the `udpfd` C global it `sendto`s over (and which stays C, shared with `setup_ping`/`polludp`). No ircd callees → no atomic cluster move. The CPING‑*input* siblings `check_ping`/`polludp` (both `static`, no `cref_` oracle) stay C; they share `udpfd` only.
407 - **Guard / seam.** Partial port via the existing `s_bsd_link.o` second‑compile, new guard `-DPORT_S_BSD_SEND_PING_P7m` added alongside the P7d–P7l guards in `ircd-sys/build.rs`; the C body (s_bsd.c:3077‑3117) wrapped in `#ifndef PORT_S_BSD_SEND_PING_P7m`. RED confirmed `send_ping` undefined — referenced by the still‑C `ircd.c:405` (`try_connections` CPING path); after GREEN `nm target/debug/ircd` shows it `T` from Rust. The cref oracle keeps the full unguarded `s_bsd.o` → `cref_send_ping`.
408 - **Config‑resolved body.** `AFINET`=`AF_INET6` (`common/os.h:680`) → `sin` is a `libc::sockaddr_in6`, `SIN_PORT`/`SIN_FAMILY`/`SIN_ADDR` map to `sin6_*`. `IN6ADDRSZ`=16 → `bcopy(aconf->ipnum.s6_addr, sin.sin6_addr.s6_addr, 16)`. DEBUGMODE/USE_SYSLOG off → the `Debug` line vanishes. `PING_CPING`=0x02 (`struct_def.h:411`, bindgen const) → `pi.pi_id = htonl(2)` (a `u_long`, network order).
409 - **Faithfulness.** The C guard `if (!aconf->ipnum.s6_addr || AND16(...)==255 || !cp->port)` — the first disjunct is the address of an array field, so it is **always false** in C; reproduced as the two real gates only (`AND16==255` ≡ all 16 bytes `0xff` via `iter().fold(0xff, &)`, the unresolved `minus_one` sentinel; and `cp->port==0`). All `aCPing` counters (`ping`/`seq`/`lseq`/`recvd`) are `u_long` → unsigned arithmetic (`cp->seq * conFreq > 1200`, `cp->ping -= cp->ping/cp->recvd`). `pi.pi_seq = cp->lseq++` is post‑increment (the packet carries the pre‑increment value). The window block does `seq++` then conditional `seq--` (net 0 when it fires), with `recvd--` only when `recvd == seq` (post‑`++`). `sin.SIN_PORT = htons(cp->port)` = `(*cp).port.to_be()`.
410 - **Classification.** Callee/utility TU (no `msgtab` entry) — reached from the server‑connect / `try_connections` CPING path, not a client command. Formats **no remote‑user fields** (only a binary UDP datagram to the configured peer) → no S2S.
411 - **L1.** `send_ping_diff.rs`, 7 cases, isolated worlds (Rust reads the real `udpfd`; oracle reads `cref_udpfd`), serialized on `GLOBALS_LOCK`. Each case `open_udp()`s a fresh UDP socket as that world's `udpfd`, binds a non‑blocking `::1:<ephemeral>` receiver, points the conf's destination port at it, drives `send_ping`, and `recvfrom`s the datagram. Compares Rust‑vs‑oracle the deterministic `aCPing` post‑state (`seq`/`lseq`/`recvd`/`ping`) byte‑identical + the world‑independent packet fields (`pi_id == htonl(2)`, `pi_seq == pre‑increment lseq`); `pi_cp` (a live pointer) and `pi_tv` (`gettimeofday`) are nondeterministic/world‑specific → excluded. Cases: (1) basic send, no window → `lseq` 0→1, `seq` 0→1, packet with `pi_seq=0`; (2) unresolved ipnum (all `0xff`, `AND16==255`) → early return, counters untouched, no packet (inverse of 1); (3) `cp->port==0` → early return; (4) `conFreq==0` → early return; (5) window `recvd>0` (`seq=12`→13, `13*100>1200` → `ping 1000 - 1000/5 = 800`, `recvd`≠`seq` stays, `seq--`→12); (6) window `recvd==0` (`ping`→0); (7) window `recvd==seq` post‑`++` (`recvd--` also fires: `ping 1300-100=1200`, `recvd 13→12`). Zero‑diff vs `cref_send_ping`.
412 - **Untested‑by‑design.** `pi_tv` (`gettimeofday`) + `pi_cp` (a live pointer) are nondeterministic/world‑specific → excluded from the packet comparison. The `sendto` failure path is `(void)`‑ignored by C → unobservable.
413 - **L2 / S2S.** No new L2: callee, hit by the server‑connect CPING path; `golden_registration` (incl. `register_quit_reuse_releases_nick`) stays byte‑identical. No S2S: formats no remote‑user wire fields.
414
415- **2026‑06‑06 — P7n (`s_bsd.c` listener-(re)construction wrappers `open_listener`/`reopen_listeners`) merged.** The next `s_bsd.c` leaf after the P7d–P7m socket/file/teardown/listener/CPING leaves — the layer directly above the still-C socket constructor `inetport`. Ported `open_listener` (s_bsd.c:467) + `reopen_listeners` (s_bsd.c:512) to `ircd-common/src/s_bsd.rs`.
416 - **Cluster choice.** The cleanest remaining s_bsd leaf with no static-callee blocker: `reopen_listeners` is a pure `ListenerLL` walk → `open_listener`; `open_listener` dispatches to the still-C `inetport` (real socket/bind/listen, keeps its static callee `set_sock_opts` with internal linkage in the surviving C) plus the already-Rust `add_fd` (P2) and `set_non_blocking` (P7d). The strangler seam holds with `inetport` staying C, called via the bindgen extern — porting the layer *above* a still-C leaf is allowed (symbols resolve either direction). The other remaining s_bsd symbols are the event-loop core (`read_message`/`add_connection`), listener *construction* (`inetport`/`add_listener` — real syscalls + the static `set_sock_opts`), sender-only (`report_error`), process setup (`init_sys`/`daemonize`/`start_iauth`), connection auth (`check_client`/`check_server`/`check_server_init`), real-DNS (`get_my_name`), or `static` (no `cref_` oracle).
417 - **Guard / seam.** Same `s_bsd_link.o` partial-compile; added `-DPORT_S_BSD_OPEN_LISTENER_P7n` to the recipe in `ircd-sys/build.rs` (alongside the P7d–P7m guards) and wrapped the two C bodies (s_bsd.c:467-525) in a single `#ifndef PORT_S_BSD_OPEN_LISTENER_P7n`. RED confirmed both symbols undefined — `open_listener` referenced by the still-C `add_listener` (s_bsd.c:347), `reopen_listeners` by the now-Rust `s_conf.rs` rehash (line 2927); after GREEN `nm target/debug/ircd` shows both `T` from Rust. The cref oracle keeps the full unguarded `s_bsd.o` → `cref_open_listener`/`cref_reopen_listeners`.
418 - **Config-resolved body.** `UNIXPORT` OFF (config.h:339) → `open_listener`'s `*aconf->host == '/'` unix-socket branch is not compiled; only the inet branch survives. No other `#ifdef`s. Macros reproduced inline: `IsListener(x)` (existing `is_listener` helper), `IsConfDelayed(aconf)` = `aconf->flags & PFLAG_DELAYED` (bindgen const, `flags` is `c_long`), `SetListenerInactive(x)` = `flags |= FLAGS_LISTENINACTIVE` (bindgen const), `IsIllegal(aconf)` (existing `conf_is_illegal` helper). `firstrejoindone`/`ListenerLL`/`fdas`/`fdall`/`inetport`/`add_fd` are bindgen externs (`inetport`/`firstrejoindone` stay C; `add_fd` resolves to the Rust list port).
419 - **Faithfulness.** `open_listener` early-returns on `!IsListener(cptr) || cptr->fd > 0` — note `> 0` (not `>= 0`), so fd 0 does not early-return. The delayed branch sets `dolisten = 0` AND marks the listener inactive, so `inetport` skips `listen()` (socket created, not accepting). `inetport` returning non-zero resets `cptr->fd = -1` ("to allow further inetport calls"); only when `cptr->fd >= 0` afterward is the fd registered in `fdas`/`fdall` + flipped non-blocking.
420 - **Classification.** Callee/utility TU (no `msgtab` entry) — `reopen_listeners` reached from `rehash` (`s_conf.rs`), `open_listener` from `add_listener`/`reopen_listeners`. → L1 is the gate; no S2S (formats no remote-user wire fields).
421 - **L1.** `open_listener_diff.rs`, 6 cases, isolated worlds (Rust port reads/mutates the real `ListenerLL`/`local`/`fdas`/`fdall`/`me`/`firstrejoindone` + calls the real C `inetport` and the Rust `add_fd`/`set_non_blocking`; oracle uses `cref_*` + `cref_inetport`), serialized on `GLOBALS_LOCK`. Each world opens its **own** socket via `inetport` (fd integers differ) → the comparison is on the fd's observable properties (`fd_valid` via `fcntl F_GETFD`, `listening` via `SO_ACCEPTCONN`, `nonblocking` via `O_NONBLOCK`), the `FLAGS_LISTENINACTIVE` bit, `fdas`/`fdall` membership, `local[fd]==cptr`, and `port`. Listener built with `ip=NULL`, `port=0` (no bind → no addr-family hazard; `inetport` still does `socket`/`getsockname`/`listen`), `ipmask="0.0.0.0"`; `me.name` pointed at `me.namebuf` and pinned to `"irc.test"` in both worlds so `inetport`'s `ME`-based `sockhost` is identical. Cases: (1) normal listener → listening, non-blocking, registered, not inactive; (2) delayed + `firstrejoindone==0` → `dolisten=0`: created but NOT listening, `FLAGS_LISTENINACTIVE` set, still registered + non-blocking; (3) delayed + `firstrejoindone==1` (inverse of 2) → behaves normal (listening, flag clear); (4) `!IsListener` → no-op (fd stays -1, nothing registered); (5) `fd>0` early-return → fd untouched, not registered; (6) `reopen_listeners` over `[illegal fd<0, legal fd<0, legal fd>0]` → only the legal-fd<0 node is opened, the illegal + already-open nodes skipped (the open node's per-world pipe fd compared against its own recorded start value, not cross-world). Zero-diff vs `cref_*`.
422 - **Untested-by-design.** `inetport`'s failure arms (socket/bind failure → `report_error` + `cptr->fd=-1`) need an induced syscall failure; both worlds take the success path identically. The `cptr == &me` `write(0,…)` KLUDGE inside `inetport` is not reached (our cptr != `me`).
423 - **L2 / S2S.** No new L2: hit at boot/rehash by the existing golden suite (`golden_registration` byte-identical, 0 warnings). No S2S: formats no remote-user wire fields.
424
425- **2026‑06‑06 — P7o (`s_bsd.c` `add_listener`, listener-constructor wrapper) merged.** The next `s_bsd.c` leaf after the P7d–P7n socket/file/teardown/listener/CPING leaves — the listener *constructor* directly above the now-Rust `open_listener` (P7n). Ported `add_listener` (s_bsd.c:330) to `ircd-common/src/s_bsd.rs`.
426 - **Cluster choice.** The natural next leaf: `add_listener` is a thin constructor whose every callee is already Rust — `make_client`/`make_link` (P2) and `open_listener` (P7n, which itself calls the still-C `inetport` + the Rust `add_fd`/`set_non_blocking`). Its whole effect is the new listener-stub `aClient`'s fields + the socket open (delegated to `open_listener`) + the `ListenerLL` prepend → fully observable as list + per-node post-state. The remaining s_bsd symbols are the event-loop core (`read_message`/`add_connection`), the real socket constructor (`inetport` + its static `set_sock_opts`), sender-only (`report_error`), process setup (`init_sys`/`daemonize`/`start_iauth`), connection auth (`check_client`/`check_server`/`check_server_init` + the static `check_init`), real-DNS (`get_my_name`), or `static` (no `cref_` oracle).
427 - **Guard / seam.** Same `s_bsd_link.o` partial-compile; added `-DPORT_S_BSD_ADD_LISTENER_P7o` to the recipe in `ircd-sys/build.rs` (alongside the P7d–P7n guards) and wrapped the C body (s_bsd.c:330-358) in `#ifndef PORT_S_BSD_ADD_LISTENER_P7o`. RED confirmed `add_listener` undefined — referenced only by the now-Rust `s_conf.rs` initconf (`s_conf.c:2287`); after GREEN `nm target/debug/ircd` shows it `T` from Rust. The cref oracle keeps the full unguarded `s_bsd.o` → `cref_add_listener`.
428 - **Config-resolved body.** No `#ifdef`s in `add_listener` itself (the adjacent `#ifdef UNIXPORT unixport` block is a separate function, untouched). Macros reproduced inline: `FLAGS_LISTEN` (bindgen const, `flags` is `c_long`), `ME` = `me.name` (read the bindgen `me` global's `name`), `SetMe(cptr)` = `cptr->status = STAT_ME` (`Status_STAT_ME`). `make_client(NULL)` allocates a `CLIENT_LOCAL` client (fd = -1, so `open_listener` does not early-return); `make_link()` is the one-element confs link.
429 - **Faithfulness.** The order matters: `make_client` already sets `name = namebuf` + `firsttime = timeofday`; `add_listener` overwrites `name = ME` and `firsttime = time(NULL)` (wall clock, not the event-loop `timeofday`). `open_listener` is called *before* the list splice. The prepend is the verbatim C: `if (ListenerLL) ListenerLL->prev = cptr; cptr->next = ListenerLL; cptr->prev = NULL; ListenerLL = cptr;`.
430 - **Classification.** Callee/utility TU (no `msgtab` entry) — the listener constructor, called from `s_conf.c` initconf (boot) and rehash. → L1 is the gate; no S2S (formats no remote-user wire fields).
431 - **L1.** `add_listener_diff.rs`, 3 cases, isolated worlds (Rust port reads/mutates the real `ListenerLL`/`local`/`fdas`/`fdall`/`me` + calls the real C `inetport` via the Rust `open_listener`; oracle uses `cref_*` + `cref_inetport`), serialized on `GLOBALS_LOCK`. Each world opens its **own** socket (fd integers differ) and `make_client` allocates its **own** client pointer → the comparison is on observable facts: the listener's `flags`/`status`, `acpt`/`from` self-pointers (as bools), `name` string, `confs->value.aconf` identity (matches the conf handed in) + `confs->next == NULL`, the `ListenerLL` prepend linkage (`prev == NULL`, `next == old head`), and the fd's properties (`fd_valid` via `fcntl F_GETFD`, `listening` via `SO_ACCEPTCONN`, `nonblocking` via `O_NONBLOCK`) + `fdas`/`fdall`/`local[fd]==cptr` membership + `port`. `me.name` pinned to `"irc.test"` in both worlds so `inetport`'s `ME`-based `sockhost` is identical. `firsttime = time(NULL)` is nondeterministic across the two calls → asserted non-zero, excluded from the cross-world compare. Cases: (1) into empty `ListenerLL` → sole node, `FLAGS_LISTEN`/`STAT_ME`/self pointers/`ME` name/`confs->aconf`, listening + non-blocking + registered, prev/next NULL; (2) prepend before an existing node → new head with `prev == NULL`, `next == old head`, and the inverse invariant — the old head's `prev` now points back at the new node; (3) two consecutive calls → head is the 2nd, `head->next == 1st`, `1st->next == NULL`, with both back-links. Zero-diff vs `cref_add_listener`.
432 - **Untested-by-design.** `firsttime = time(NULL)` (wall clock) is nondeterministic → asserted non-zero, not compared. `inetport`'s failure arms (socket/bind failure → `report_error` + `fd = -1`) need an induced syscall failure; both worlds take the success path identically (covered transitively by P7n's open_listener test notes).
433 - **L2 / S2S.** No new L2: `add_listener` runs at boot (and rehash) via `s_conf.c` initconf; the existing golden suite exercises it — `golden_registration` (incl. `register_quit_reuse_releases_nick`) stays byte-identical (0 warnings). No S2S: it formats no remote-user wire fields.
434
435- **2026‑06‑06 — P7p (`s_bsd.c` `inetport`, listener socket constructor) merged.** The next `s_bsd.c` leaf after the P7d–P7o socket/file/teardown/listener/CPING leaves — the real socket constructor directly below the now-Rust `open_listener` (P7n). Ported `inetport` (s_bsd.c:210) + a private twin of its `static` callee `set_sock_opts` to `ircd-common/src/s_bsd.rs`.
436 - **Cluster choice.** `inetport` is the layer `open_listener` (P7n) and `add_listener` (P7o) call; porting it completes the listener-construction stack bottom-up. Its only `static` callee `set_sock_opts` (s_bsd.c:1468) has no `cref_` oracle, so it is ported as a **private (non-`#[no_mangle]`) Rust fn** alongside `inetport`; the C `static set_sock_opts` is **not** removed — it stays compiled for its other in-TU callers `check_server_init`/`connect_server` (a static + a private-Rust twin coexist with no symbol clash; the duplicate vanishes when those two callers are ported). `inetport`'s effects are fully L1-observable (the created fd's properties + the `cptr` field writes), the same harness shape as P7n/P7o. The remaining s_bsd symbols are the event-loop core (`read_message`/`add_connection`), connection auth (`check_client`/`check_server`/`check_server_init` + the static `check_init`), sender-only (`report_error`), process setup (`init_sys`/`daemonize`/`start_iauth`), real-DNS (`get_my_name`), or `static` (no `cref_` oracle).
437 - **Guard / seam.** Same `s_bsd_link.o` partial-compile; added `-DPORT_S_BSD_INETPORT_P7p` to the recipe in `ircd-sys/build.rs` (alongside the P7d–P7o guards) and wrapped the C `inetport` body (s_bsd.c:210-323) in `#ifndef PORT_S_BSD_INETPORT_P7p` (the adjacent `static set_sock_opts` left untouched). RED confirmed `inetport` undefined — referenced by the now-Rust `open_listener` (`s_bsd.rs:605`) and the still-C `ircd.c:1107`; after GREEN `nm target/debug/ircd` shows `inetport` `T` from Rust, and the C `set_sock_opts` survives as a `t` local (with the mangled `ircd_common::s_bsd::set_sock_opts` private twin). The cref oracle keeps the full unguarded `s_bsd.o` → `cref_inetport`.
438 - **Config-resolved body.** `AFINET` = `AF_INET6` (`os.h:680`) → `server` is a `libc::sockaddr_in6`, `SIN_FAMILY`/`SIN_PORT` map to `sin6_*`; `SOCKADDR_IN` = `sockaddr_in6`. `__CYGWIN32__` off → no in-body `set_non_blocking`. `LISTENQUEUE` = 128 (config const, not in bindgen). `ME` = `me.name`. `cptr->ip` is the bindgen `in6_addr` (a `__in6_u.__u6_addr8` union, not libc's `.s6_addr`). `cptr->port` is a `u_short`. `set_sock_opts` config-resolution: SO_REUSEADDR (opt=1) + SO_RCVBUF/SO_SNDBUF/SO_SNDLOWAT (opt=8192) all compile; SO_DEBUG is `#if … && 0` (never); SO_USELOOPBACK is **not defined on Linux** (skipped). The `SETSOCKOPT` macro (`sys_def.h:29`) passes `sizeof(int)`=4 as the option length for every call (`sizeof(o3)` where `o3` is the value arg), not `sizeof(*p)`. SO_SNDLOWAT is set quietly (no `report_error` on failure); the others `report_error` on failure (kept C).
439 - **Faithfulness.** Order matters: the NULL-ipmask refuse and the `ad[i]>>8` invalid-ipmask refuse both `return -1` **before** the `sockhost`/`auth`/`socket` writes (so on those paths `fd` stays -1, `auth` NULL). The `if (cptr->fd == -1)` socket-open is conditional (an already-open fd is reused). The `cptr == &me` KLUDGE (`sprintf(buf, replies[RPL_MYPORTIS], ME, "*", ntohs(port)); write(0, buf, …)`) is reproduced verbatim via the bindgen `replies` incomplete-array + `RPL_MYPORTIS` const, but is unreachable for a listener stub (`cptr != &me`). `DupString(cptr->auth, ipname)` = `MyMalloc(strlen+1)` (Rust P2) + `strcpy`. The ipmask canonicalization (`sscanf "%d.%d.%d.%d"` → `sprintf` back) and the `sprintf "%-.42s.%u"` sockhost are done via `libc::sscanf`/`libc::sprintf` for byte-exactness. The bind addr: `in6addr_any` when `!ip || (!isxdigit(*ip) && *ip != ':')`, else `inetpton` (Rust P1) with the 16-byte `minus_one` fallback on parse failure.
440 - **Classification.** Callee/utility TU (no `msgtab` entry) — `inetport` is reached from `open_listener` (boot/rehash) and the inetd `me`-listener path. → L1 is the gate; no S2S (formats no remote-user wire fields).
441 - **L1.** `inetport_diff.rs`, 6 cases, isolated worlds (the Rust port reads/mutates the real `local`/`highest_fd`/`me` and calls the real `inetpton`/`MyMalloc`; the oracle uses the `cref_*` copies + `cref_inetport`), serialized on `GLOBALS_LOCK`. `me.name` pinned to `"irc.test"` in both worlds so the `ME`-based sockhost matches. Because each world opens its own socket (fd integers differ), the `Obs` compares the fd's observable properties (`fd_valid` via `fcntl F_GETFD`, `listening` via `SO_ACCEPTCONN`, the three socket options via `getsockopt SO_REUSEADDR/SO_RCVBUF/SO_SNDBUF`) + the world-independent struct fields (`sockhost`, `auth`, `port`, `ip` 16 bytes, `local[fd]==cptr`, the -1/0 return), never the raw fd; `highest_fd` is asserted per-world to equal the new fd. Cases: (1) normal port=0 listener (dolisten=1) → full compare: ret 0, listening, sockhost `irc.test.0`, auth `0.0.0.0`, port 0, registered, `highest_fd` bumped; (2) dolisten=0 (the `listen()` inverse) → socket created + opts set but NOT listening, still registered; (3) NULL ipmask → return -1 before any socket (the refuse inverse), fd untouched, auth NULL; (4) invalid ipmask `256.0.0.0` (`256>>8 != 0`) → return -1 before sockhost/auth/socket; (5) wildcard bind (ip=NULL, port=P) → `in6addr_any`, getsockname → `::`, `cptr->ip` all-zero, sockhost `irc.test.<P>`; (6) `::1` bind (`*ip == ':'` → the `inetpton` branch) → bind `::1`, getsockname → `::1`, `cptr->ip` = `::1`, sockhost `::1.<P>`. The two bind cases (5,6) are serialized per world (run + observe + close Rust, then cref) over one `probe_free_port()`'d port, since both worlds would otherwise collide on it. Zero-diff vs `cref_inetport`; sibling P7d–P7o L1 tests + `golden_registration` re-run green.
442 - **Untested-by-design.** The `socket`/`bind`/`getsockname` failure arms (→ `report_error` + close + return -1) need an induced syscall failure; both worlds take the success path identically. The `cptr == &me` KLUDGE (`write(0, …)`) and the `fd >= MAXCLIENTS` overflow refuse are unreachable for a listener stub. `set_sock_opts`'s `report_error` arms fire only on a `setsockopt` failure (none here).
443 - **L2 / S2S.** No new L2: `inetport` runs at boot (and rehash) via `open_listener`; the existing golden suite exercises it — `golden_registration` (incl. `register_quit_reuse_releases_nick`) stays byte-identical (0 warnings). No S2S: it formats no remote-user wire fields.
444
445- **2026‑06‑06 — P7q (`s_bsd.c` `report_error`, error-reporting output leaf) merged.** The genuine clean leaf left in the central I/O TU.
446 - **Cluster choice.** `report_error` (s_bsd.c:151) calls **no** other `s_bsd.c` function → it ports in isolation. The 27 internal call sites (the still‑C `add_connection`/`check_*`/`connect_server`/`read_message` + the already‑Rust P7d–P7p leaves that called it via an `extern "C"` decl) now resolve to the Rust definition. The remaining unported s_bsd.c functions (`add_connection`, `read_message`, `connect_server`, `get_my_name`, `init_sys`/`daemonize`/`start_iauth`, the `check_*` conf cluster) are all either event-loop cores, fork/destructive glue, or clustered via the file-private `static mysk` (`get_my_name`↔`connect_server`↔`check_client`) — none is a clean standalone leaf, so `report_error` was the right next pick.
447 - **Guard / seam.** Partial port via the existing `s_bsd_link.o` second-compile, new guard `-DPORT_S_BSD_REPORT_ERROR_P7q` (added alongside P7d–P7p in `ircd-sys/build.rs`). The Rust port replaces the old `extern "C" { fn report_error }` decl in `s_bsd.rs`.
448 - **Config‑resolved body.** `SO_ERROR` defined → the getsockopt readout compiles (mirrors P7d's `get_sockerr`); `DEBUGMODE` off → no `Debug`; `USE_SYSLOG` off → no `syslog`. `text` is a printf **format** taking two `%s` (`host`, `strerror`). Faithful: `errtmp = errno` first; `host = get_client_name(cptr, FALSE)` or `""`; the `!IsMe && fd>=0` SO_ERROR refinement; `sendto_flag(SCH_ERROR, text, host, strerror)`; the `Connecting||Handshake` + `serv->byuid[0]` + remote‑`bysptr` NOTICE (`:%s NOTICE %s :` via `strcpy`+`strncat`, then `sendto_one(bysptr, fmbuf, ME, bysptr->name, host, strerror)`); the `serverbooting` `fprintf(stderr, text, host, strerror)` + `fprintf(stderr, "\n")` echo. The variadic `sendto_flag`/`sendto_one`/`fprintf` are **called** (legal in stable Rust), not defined — the trampolines stay C until P8. `stderr` is glibc's `extern FILE *stderr` symbol (not the macro). Added inline `is_me`/`my_connect` helpers + a `SCH_ERROR` const.
449 - **Classification.** Utility / output leaf — **no `msgtab` entry**. Effects: the `SCH_ERROR` opers notice (variadic wire, L2), the remote `bysptr` NOTICE (S2S), and the `serverbooting` stderr echo (L1‑capturable). So L1 gates the deterministic format core; the wire paths are L2/S2S/untested‑by‑design.
450 - **L1.** `report_error_diff.rs`, 4 cases, isolated worlds (Rust reads the real `serverbooting` + calls Rust `get_client_name`; oracle uses `cref_serverbooting` + `cref_get_client_name`), serialized on `GLOBALS_LOCK`. A `capture_stderr` helper dup/pipe‑redirects fd 2 around each call, `fflush(NULL)` before+after, reads the pipe, restores fd 2. The same heap `aClient` (`calloc`‑zeroed, `fd=-1` → `!MyConnect` → `host=name`, no SO_ERROR, `status=STAT_CLIENT` → no bysptr) is passed to both worlds (read‑only). Each case sets both worlds' `serverbooting` + `errno`. Cases: (1) `serverbooting=1`+`cptr=NULL` → `host=""`, `errno=ECONNREFUSED` → formatted `"…:Connection refused\n"`; (2) **inverse / the gate** — `serverbooting=0` → **no** stderr output (both empty); (3) `serverbooting=1`+`cptr` non‑NULL → `host=get_client_name=name`, `errno=EHOSTUNREACH`; (4) host embedded mid‑string + varied errno (`ETIMEDOUT`/`EPIPE`). Zero‑diff vs `cref_report_error`.
451 - **Verification.** `cargo build` (workspace, 0 warnings); `nm target/debug/ircd | grep ' T report_error'` → defined from Rust; L1 zero‑diff; L2 `golden_registration` (boot path exercises `report_error` on errors) byte‑identical.
452 - **No new L2 / no S2S.** Output callee, not a `msgtab` handler — the `SCH_ERROR` error notice is covered by the existing golden suite. Untested‑by‑design: the `SO_ERROR` getsockopt readout (needs a pending‑error socket; `fd<0` skips it identically), the `sendto_flag` SCH_ERROR wire emission (L2, variadic), the `bysptr` remote NOTICE (S2S — needs a `Connecting`/`Handshake` server whose `byuid` resolves to a remote introducer).
453
454- **2026-06-06 — P7r (`s_bsd.c` `init_sys`, fd-table boot leaf) merged.** Ported the cleanest remaining leaf in the central I/O TU `s_bsd.c`.
455 - **Cluster choice** — after the P7d–P7q leaves, the genuinely-clean leaves are nearly exhausted; `init_sys` is the last one that calls **no** other `s_bsd.c` function and shares **no** private static with still-C code (it touches only the already-exported `fdas`/`fdall`/`local` globals). Contrast: `get_my_name` shares the private `mysk` static with still-C `check_init`/`connect_server` (a shared-static connected component, deferred); `daemonize`/`start_iauth` are blocked on the still-C iauth spawn.
456 - **Config-resolved body** — two `#ifdef`s collapse the source: `RLIMIT_FD_MAX` is **not defined on Linux** (verified via `gcc -E`) → the entire `getrlimit`/`setrlimit` of `RLIMIT_FD_MAX`+`RLIMIT_CORE` block (with its `exit(-1)` arms) does not compile; `USE_POLL=1` (setup.h:390) → the `#if !defined(USE_POLL)` sequent `setdtablesize` block is excluded; Linux (not PCS/DYNIXPTX/SVR3/HPUX/SVR4) → the `setlinebuf(stderr)` branch. Resolved body: `setlinebuf(stderr)`; `bzero(&fdas)`/`bzero(&fdall)` + `fdas.highest=fdall.highest=-1`; `local[0]=local[1]=local[2]=NULL`; `for (fd=3; fd<MAXCONNECTIONS=50; fd++){ local[fd]=NULL; close(fd); }`. Callees: libc only.
457 - **Mechanism** — partial port via the existing `s_bsd_link.o` second-compile seam, new guard `-DPORT_S_BSD_INIT_SYS_P7r` in `ircd-sys/build.rs`; `init_sys` wrapped in `#ifndef PORT_S_BSD_INIT_SYS_P7r` in `ircd/s_bsd.c`. Rust port in `ircd-common/src/s_bsd.rs`: `setlinebuf` via a local extern (reusing the module's `stderr` extern), `fdas`/`fdall` via `addr_of_mut!(ircd_sys::bindings::fdas/fdall)` + `write_bytes(_,0,1)`, `local[]` via the existing `local_base()` helper, `MAXCONNECTIONS` from bindgen.
458 - **Classification** — boot callee, not a `msgtab` handler.
459 - **L1** — `init_sys_diff.rs`, 3 cases, zero-diff vs `cref_init_sys`. The close loop closes fds `3..49` in the calling process → **destructive to cargo's test fds**, so each world runs in a **forked child** and returns its post-state through an `mmap(MAP_SHARED|MAP_ANONYMOUS)` region (memory, not an fd → survives the close loop); the parent `waitpid`s and asserts Rust-child == cref-child == expected. Each child pre-dirties its globals (`highest=7`, `fd[]` non-zero, `local[0]/[5]/[N-1]` sentinels) so the test proves the body **wrote** (inverse-of-dirty), opens a sentinel fd dup'd onto fd 10, and reports: `fdas`/`fdall.highest` (=-1), non-NULL `local[]` count (=0), `fd[]` fully zeroed, sentinel-fd-closed, fds 1/2 still open. Isolated worlds (real `fdas`/`fdall`/`local` vs `cref_*`), serialized on `GLOBALS_LOCK`.
460 - **L2 / S2S** — no new L2 (boot callee; the existing golden suite boots through it, `golden_registration` byte-identical confirmed); no S2S (formats no remote-user fields). Untested-by-design: `setlinebuf(stderr)` (unobservable line-buffering); the rlimit/`exit` arms don't compile under the locked config.
461
462- **2026-06-06 — P7s (`s_bsd.c` `get_my_name`, server-own-hostname resolver, + de-static `mysk`) merged.** The most leaf-like remaining `s_bsd.c` function after the P7d–P7r leaves. Ported `get_my_name` (s_bsd.c:2940) to `ircd-common/src/s_bsd.rs`.
463 - **Cluster choice.** After P7d–P7r the genuinely-clean s_bsd.c leaves are exhausted; the remaining exported functions are the event-loop core (`add_connection`/`read_message` + statics), the connection-auth cluster (`check_init`/`check_client`/`check_server`/`check_server_init`), `connect_server`, and the fork/iauth glue (`daemonize`/`start_iauth`). `get_my_name` is the most leaf-like: its **only** in-TU callee is `add_local_domain` (already Rust, P7e); everything else is libc (`gethostname`/`gethostbyname`/`isdigit`/`strlen`) or already-Rust (`find_me` P6, `inetpton`/`mycmp` P1, `minus_one`/`me` bindgen). NB: the `utmp_open`/`utmp_read`/`utmp_close` trio + `summon` are **not** remaining leaves — they're `#if defined(ENABLE_SUMMON) || defined(USERS_SHOWS_UTMP)` (both off) so they don't compile at all (user-confirmed).
464 - **The `mysk` blocker / de-static.** `get_my_name` **writes** the file-private `static struct SOCKADDR_IN mysk` (s_bsd.c:55); the still-C `check_client` (s_bsd.c:965, localhost detection) and `connect_inet` (s_bsd.c:2687/2692, outgoing bind) **read** it. To split the writer (→ Rust) from the C readers, `mysk` needs a linkable symbol → changed `static struct SOCKADDR_IN mysk;` → `struct SOCKADDR_IN mysk;` (file-scope global) **unconditionally** (behaviour-preserving: single TU, no other `mysk`; storage-class only). This also makes the cref archive export `cref_mysk` (the `objcopy --prefix-symbols` rename only follows *global* symbols — the L1 static-symbol limit), so the L1 test gets a full cross-world `mysk` comparison. `mysk` stays **C-owned** (defined in `s_bsd_link.o`); Rust references it via a local `extern "C" { static mut mysk: libc::sockaddr_in6; }`.
465 - **Guard / seam.** Partial port via the existing `s_bsd_link.o` second-compile, new guard `-DPORT_S_BSD_GET_MY_NAME_P7s` added alongside P7d–P7r in `ircd-sys/build.rs`; the C body (s_bsd.c:2940-3023) wrapped in `#ifndef PORT_S_BSD_GET_MY_NAME_P7s`. RED confirmed `get_my_name` undefined — referenced by the still-C `ircd.c:702` (boot); after GREEN `nm target/debug/ircd` shows `get_my_name` `T` from Rust and `mysk` a `B` global. The cref oracle keeps the full unguarded `s_bsd.o` → `cref_get_my_name` + `cref_mysk`.
466 - **Config-resolved body.** `HAVE_GETIPNODEBYNAME` **undef** (setup.h:53) → the plain `gethostbyname(cname) || gethostbyname(name)` branch (no `getipnodebyname`/`freehostent`). `DEBUGMODE` off → no `Debug` at 3015. The `mysk.SIN_ADDR` write at s_bsd.c:3012 is inside a `#if 0 … #endif` (dead) → **not** ported. `SOCKADDR_IN` = `sockaddr_in6` (`AFINET`=`AF_INET6`); `tmp[HOSTLEN+1]` (=64) is a module-private `static mut`; `ME` = `me.name`; `BadPtr(cname)` = `cname.is_null() || *cname == 0`; `strncpyzt` = `strncpy` + force-NUL.
467 - **Faithfulness.** `mysk` is `bzero`'d first → full-struct byte compare is valid (padding/flowinfo/scope_id stay zero). The passwd branch fires only when `aconf->passwd && isdigit(*passwd)` (so `"2001:db8::1"` qualifies but `"::1"` does not — leading char must be a digit); `inetpton` failure → `bcopy(minus_one, …, 16)`. The alias loop is `for (hname=h_name, i=0; hname; hname=h_aliases[i++])` → Rust reads `h_aliases[i]` then `i += 1` (post-increment). `gethostbyname` is declared via a local extern (absent from the libc crate).
468 - **Classification.** Boot callee / utility TU (no `msgtab` entry) — called from `ircd.c` boot + `connect_server`. → L1 is the gate; no S2S (formats no remote-user wire fields).
469 - **L1.** `get_my_name_diff.rs`, 6 cases, isolated worlds (Rust writes the real `mysk`; oracle writes `cref_mysk`), shared `conf`/`cref_conf` M-conf list + shared read-only `cptr`, `me`/`cref_me` ME pinned to `irc.test`, separate `name` output buffers, serialized on `GLOBALS_LOCK`. Determinism: `gethostname`/`gethostbyname` are non-deterministic across runs but **identical across the two worlds in one run** → the differential holds whatever DNS returns; the test asserts the two worlds *agree* (`name` bytes + the full 28-byte `mysk`==`cref_mysk`), not a fixed string. Cases: (1) M-conf NULL passwd → addr stays zero (family/port set); (2) non-digit passwd `"abc"` → isdigit false → addr zero (inverse); (3) valid `"2001:db8::1"` → inetpton fills `20 01 0d b8 … 01`; (4) digit-but-invalid `"9zz"` → inetpton fails → `mysk` addr all-`0xff` (minus_one); (5) `cname="localhost"` → drives the `gethostbyname` + alias-loop branch; (6) `cname=""` → `BadPtr` early return after `add_local_domain`. Zero-diff vs `cref_get_my_name`.
470 - **Verification.** `cargo build` (workspace, 0 warnings); L1 zero-diff; sibling s_bsd L1 (`s_bsd_leaves_diff`/`add_local_domain_diff`/`init_sys_diff`/`report_error_diff`/`close_connection_diff`) re-run green; `golden_registration` byte-identical (boot exercises `get_my_name`).
471 - **Untested-by-design.** The resolved hostname is host-dependent (asserted as *agreement*, not a literal); the `gethostname == -1` early return needs an induced failure (both worlds take the success path identically).
472
473- **2026-06-06 — P7t (`ircd.c` `calculate_preference`, AC preference leaf) merged.** Ported `calculate_preference` (ircd.c:387) to `ircd-common/src/ircd.rs`.
474 - **Cluster choice** — the cleanest remaining exported leaf in `ircd.c`: the `s_bsd.c` clean leaves are exhausted (the rest belong to the deferred event-loop / auth / connect clusters), and `calculate_preference`'s only TU-callee, `send_ping`, was already ported in P7m. It is the periodic auto-connect (AC) preference recompute invoked from `io_loop` (ircd.c:1164) when `timeofday >= nextpreference`.
475 - **Body** — walks the global `conf` list; skips non-C-lines (status lacking `CONF_CONNECT_SERVER|CONF_ZCONNECT_SERVER`) and AC-ineligible C-lines (`port <= 0`); for the rest fires `send_ping(aconf)` (advances the conf's `aCPing` sliding window) then sets `pref = -1` when there is no usable window (`cp==NULL || cp->seq==0 || cp->recvd==0`), else computes `pref = (u_int)(f*100)` from `recvd/seq`, `pow(f,20)`, `ping/recvd` with a `0.001` floor and a `100000.0` ceiling. Returns `currenttime + 60`.
476 - **Config-resolved body** — no `#ifdef`s; compiles verbatim. `CONF_CONNECT_SERVER=0x08`, `CONF_ZCONNECT_SERVER=0x20`.
477 - **Seam** — partial port via the existing `ircd_link.o` second-compile (which already drops the P7c tune pair); new guard `-DPORT_IRCD_CALC_PREF_P7t` added to its `make --eval` line. The C function is wrapped `#ifndef PORT_IRCD_CALC_PREF_P7t … #else extern time_t calculate_preference(time_t); #endif` — the function is in no `*_ext.h`, and `io_loop` (its sole caller, same TU, defined later) relied on the in-file definition for its implicit prototype, so the `#else` supplies the `extern` declaration. `nm target/debug/ircd` confirms `T calculate_preference` (came from Rust).
478 - **Faithfulness** — calls the **libc `pow`** via a local `extern "C" { fn pow(f64,f64)->f64; }`, NOT `f64::powf`: the std intrinsic is permitted to differ from the system `pow` in the last ULP, which would diverge the `(u_int)(f*100.0)` integer truncation and break L1. The final store reproduces the C `double → u_int → int` cast chain as `(f * 100.0) as u32 as c_int` (`f` is clamped `≤ 100000.0`, so `f*100 ≤ 1e7` fits `u32`). `send_ping` is called *before* the `cp` read, faithfully — order matters because it mutates the window the pref math reads.
479 - **Classification** — utility / callee TU (no `msgtab` entry; reached only from `io_loop`).
480 - **L1** — `ircd-testkit/tests/calculate_preference_diff.rs`, zero-diff vs `cref_`. Two isolated worlds (Rust reads `conf`/`udpfd`; oracle reads `cref_conf`/`cref_udpfd`), each builds a parallel `conf` linked list, runs, then compares every node's `pref` + `aCPing` post-state + the `currenttime+60` return. 5 cases: non-C-line skip (pref untouched), `port<=0` skip (send_ping not even called), `recvd==0` sentinel (send_ping bumps seq/lseq, recvd stays 0 → `-1`), full-window compute (byte-identical pref), and a 5-node mixed list. `udpfd` left at `-1` (send_ping's `sendto` fails, ignored; the pref math reads only the counters mutated beforehand). Serialized on `GLOBALS_LOCK` (the P7 L1 shared-global hazard).
481 - **L2** — no new test: the locked golden config defines no `connect{}` C-lines, so the loop body is a no-op on a golden boot → `golden_registration` stays byte-identical (re-confirmed). Same utility-leaf L2 posture as P7c/P7m.
482 - **S2S** — none: formats no remote-user wire fields (only a numeric `pref` field and a binary UDP datagram via send_ping).
483 - **Untested-by-design** — the `cp==NULL` clause of the `-1` sentinel is dead defensive code: `calculate_preference` calls `send_ping(aconf)` first, and `send_ping` unconditionally dereferences `cp->port`, so an AC-able C-line with `ping==NULL` segfaults both implementations identically. It never occurs in practice (config allocates an `aCPing` for every `connect{}` line), so the L1 test never builds such a node and the realistic sentinel is exercised via `recvd==0`.
484
485- **2026-06-06 — P7u (`s_auth.c` iauth `/STATS` reporters `report_iauth_conf`/`report_iauth_stats`) merged.** Opened the last P7 TU, `s_auth.c` (the socket/ident/iauth-pipe I/O deferred from P5), by porting its two cleanest leaves to `ircd-common/src/s_auth.rs`.
486 - **Cluster choice.** After P7a–P7t the clean leaves of `s_bsd.c` and `ircd.c` are exhausted (the rest are the deferred event-loop/auth/connect-server/signal clusters), so the natural next move is `s_auth.c`. Its iauth-pipe **write** path (`vsendto_iauth`/`sendto_iauth`) is irreducibly C — `vsendto_iauth` takes `va_list` and `sendto_iauth` is variadic (the keystone send-family finding) → P8, not now. The **read** path `read_iauth` is the big iauth protocol parser (stays C). The two cleanest leaves are the `/STATS` reporters: each walks a `LineItem` (`aExtCf`/`aExtData` = `struct LineItem { char *line; struct LineItem *next; }`) linked list and emits one numeric per node via `sendto_one`. Their only in-TU dependency is the two list heads `read_iauth` populates.
487 - **Config-resolved body.** Both live in the `#if defined(USE_IAUTH)` block (USE_IAUTH **ON** → compiled). `RPL_STATSIAUTH=239`, `RPL_STATSDEBUG=249` (bindgen consts); `ME=me.name`. No `#ifdef`-gated branches inside either body. `report_iauth_conf` early-returns when `adfd < 0` (iauth slave fd); `report_iauth_stats` has no guard.
488 - **The seam / de-static.** The writer `read_iauth` stays C, so to split the Rust readers from it the two file-`static` list heads `iauth_conf`/`iauth_stats` (s_auth.c:97-98) are **de-static'd** (drop `static`, file-scope global) — behaviour-preserving (single TU, no other symbol of those names; storage-class only), the P7s `mysk` precedent. This gives the C-owned globals linkable symbols (defined in `s_auth_link.o`, written by `read_iauth`; Rust references them via a local `extern "C" { static mut … : *mut LineItem }`) **and** makes the cref archive export `cref_iauth_conf`/`cref_iauth_stats` (the `objcopy --prefix-symbols` rename only follows global symbols — the L1 static-symbol limit), giving the L1 differential parallel C-owned heads to populate.
489 - **Guard / build.rs.** Partial port via a new `s_auth_link.o` second-compile, guard `-DPORT_S_AUTH_REPORT_P7u`; the C bodies wrapped `#ifndef PORT_S_AUTH_REPORT_P7u … #endif`. Added `"s_auth.o" => "s_auth_link.o"` to `link_objs()` and a plain `sh -c` compile (s_auth.c references no machine-path macros — `start_iauth` lives in `s_bsd.c`, not here — so no `make --eval` path-var expansion needed, unlike `s_bsd_link.o`/`ircd_link.o`). `s_auth.o` stays in `CREF_OBJS` (unguarded oracle); **not** in `PORTED` (still-C symbols remain). RED confirmed `report_iauth_conf`/`report_iauth_stats` undefined — referenced by the already-Rust `m_stats` (s_serv.rs) and `tstats` (s_misc.rs); after GREEN `nm target/debug/ircd` shows both `T` (from Rust) and `iauth_conf`/`iauth_stats` `B` (C-owned globals).
490 - **Faithfulness.** `report_iauth_conf` checks `adfd < 0` **before** the walk; both post-increment through `ectmp = ectmp->next` in declaration order (head first). `sendto_one` called via a local `extern "C"` variadic decl (the s_numeric pattern); fmt literal `c":%s %d %s :%s".as_ptr() as *mut c_char`.
491 - **Classification.** Utility / callee TU (no `msgtab` entry) — reached only from STATS: `report_iauth_conf` ← `s_serv.c` m_stats (`/STATS a`/`i`), `report_iauth_stats` ← `s_misc.c` `tstats` (`/STATS t`). → L1 is the gate.
492 - **L1.** `ircd-testkit/tests/iauth_reporters_diff.rs`, 6 cases, zero-diff. The reporters' only observable surface is the bytes `sendto_one` buffers into the recipient's `sendQ`, so the test builds a shared read-only `LineItem` list (pointed at by both `iauth_conf` and `cref_iauth_conf` — the reporters never mutate it), gives each world its OWN heap recipient `aClient` (Rust `send_message`→Rust `dbuf_put` vs `cref_send_message`→`cref_dbuf_put` — separate dbuf pools), drives both reporters, then drains each `sendQ` with its MATCHING `dbuf_get` (cross-reading would corrupt the foreign freelist) and asserts byte-identical. Recipient: `fd=-1`, `status=STAT_CLIENT`, `from`/`serv`/`confs` NULL (`get_sendq` returns default QUEUELEN, no deref), `acpt = &me`/`&cref_me` so `send_message`'s `if (to->acpt != &me) (*to->acpt).sendM++` branch is skipped (a real local client always has a valid `acpt`; the zeroed NULL would deref — found the hard way). Cases: (1) 3-node conf list, `adfd=5` → 3× RPL_STATSIAUTH; (2) **inverse/guard** non-empty list, `adfd=-1` → no output; (3) **inverse** empty conf list → no output; (4) 3-node stats list → 3× RPL_STATSDEBUG; (5) **inverse** empty stats list → no output; (6) single node + longer `to` arg → `%s :%s` passthrough. Serialized on `GLOBALS_LOCK` (`me`/`adfd`/`iauth_conf`/`iauth_stats` are process globals).
493 - **L2.** No new test: golden boots `-t -s` (no iauth) → `adfd<0` + empty lists → both reporters are no-ops, so any STATS path stays byte-identical = no-regression only. `golden_registration` re-confirmed byte-identical.
494 - **S2S.** None — the reporters format no remote-user wire fields (only the local server name + a config/stat line).
495 - **Verification.** `cargo build --workspace` (0 warnings); L1 zero-diff (6/6); `golden_registration` byte-identical.
496
497- **2026-06-06 — P7v (`s_auth.c` `set_clean_username`) merged.** The last pure-logic leaf of `s_auth.c`; everything else left in the TU is socket/ident/iauth-pipe I/O kept in C.
498 - **Cluster choice.** `set_clean_username` (s_auth.c:44) is the only `s_auth.c` function with no socket/fd dependency — callees are libc-only (`strchr`/`strlen`/`isspace`/`strcmp`, `MyFree`→`free`) plus the `istat` global (defined in still-C ircd.c, reachable via bindgen) and the interior self-pointer `cptr->auth = cptr->username`. The remaining `s_auth.c` symbols are all I/O: `read_iauth` (iauth-pipe parser, writes the P7u list heads), the variadic `sendto_iauth`/`vsendto_iauth`, `start_auth` + the ident-protocol `send_authports`/`read_authports` — per the PLAN these stay C for now.
499 - **Behaviour.** Derives `cptr->username` (≤USERLEN=10 + NUL) from the raw ident reply: NULL `auth` → early return; mark "dirty" (prefix a `-`) if `auth` contains `[`/`@`, `strlen>USERLEN`, has a leading `:` (then skip it), or has whitespace followed by more chars; copy up to USERLEN chars dropping `@`/`[`/whitespace; if the cleaned name `strcmp`-equals the original, `MyFree(auth)` + redirect `auth` at the interior `username` buffer (the `make_client` self-pointer hazard → `addr_of_mut!`), else the original heap `auth` survives and `istat.is_authmem += strlen+1`, `istat.is_auth += 1`.
500 - **Guard / seam.** `set_clean_username` was `static` → `nm -g` (ircd-testkit's cref renamer) emitted no oracle. De-static'd in s_auth.c (storage-class only, behaviour-preserving — single TU, no other symbol of this name; the P7s `mysk` / P7u list-head precedent) and the body `#ifndef PORT_S_AUTH_CLEAN_USERNAME_P7v`-guarded out of `s_auth_link.o` (`-D` added to the recipe in `ircd-sys/build.rs` alongside `-DPORT_S_AUTH_REPORT_P7u`), with an `#else` extern prototype so the still-C callers keep a declaration. RED confirmed `undefined reference to set_clean_username` from both the test and the C callers (`read_iauth`:410, `read_authports`:810); after GREEN `nm target/debug/ircd` shows `T set_clean_username` (from Rust). The cref oracle keeps the full unguarded `s_auth.o` → `cref_set_clean_username`.
501 - **Classification.** Utility/callee (no `msgtab` entry). Reached only from the still-C `read_iauth`/`start_auth`, which need a live iauth/ident peer the golden harness doesn't run (boots `-t -s`, `adfd<0`). L1 is the gate.
502 - **L1.** `ircd-testkit/tests/set_clean_username_diff.rs`: two independent calloc'd heap `aClient`s per case (one driven by `c_set_clean_username` [→Rust], one by `cref_set_clean_username`), each with its own `auth` allocated by libc `strdup` (the fn may `free()` it → must be malloc-compatible, not a Rust `CString`); calloc'd → zeroed `username[11]` so trailing bytes match. Asserts byte/field-identical across worlds: the full `username[11]` buffer, the `is_auth`/`is_authmem` deltas (`istat` vs `cref_istat`, read before/after), and the `auth == &username` self-pointer predicate (plus, when false, the surviving `auth` string content). 9 cases: free path (`"bob"`, exact-USERLEN `"abcdefghij"`, empty `""`), istat path (`"bob@host"`, `"bo[b"`, `"verylongusername"`, `":bob"`, `"bo b"`), inverses (`"bob "` trailing-whitespace not-dirty-but-unequal, NULL-auth early return). Zero-diff; serialized on `GLOBALS_LOCK` (`istat`/`cref_istat` are process globals).
503 - **L2 / S2S.** No new L2: the only callers are unreachable under the golden harness's `-t -s` boot (no iauth slave, no ident peer); `golden_registration` stays byte-identical (no-regression). No S2S — the function formats no remote-user fields / has no `IsServer` branch.
504
505- **2026-06-06 — P7w (`s_auth.c` ident-protocol I/O pair `send_authports`/`read_authports`) merged.** The RFC1413 ident query/reply pair — the leaf relative to the still-C `start_auth` + the `s_bsd.c` event loop (`s_bsd.c:2363`/`2368`, the `FLAGS_WRAUTH`/auth-readable arms). Ported to `ircd-common/src/s_auth.rs` alongside the P7u reporters + P7v `set_clean_username`.
506 - **Cluster choice** — leaf-first: these are leaves relative to `start_auth` (which opens the ident connection) and the still-C select/poll loop. They share no file-`static` with the rest of `s_auth.c` (the `iauth_*` statics belong to `read_iauth`) → independent cluster. The remaining s_auth C = `read_iauth` (iauth-pipe parser), `start_auth` (connection setup), the variadic `sendto_iauth`/`vsendto_iauth`.
507 - **Config-resolved body** — `USE_SYSLOG` undef → the get{sock,peer}name-error `syslog(...)` block (the only `get_client_name` call) drops to a bare `goto authsenderr`; `DEBUGMODE` undef → every `Debug((...))` a no-op (its `inet_ntop`/`ipv6string` arg never evaluated); `AFINET=AF_INET6` → `SOCKADDR_IN`=`sockaddr_in6`, `SIN_PORT`=`sin6_port`, `SOCKADDR`=`sockaddr`, `SOCK_LEN_TYPE`=`socklen_t`; `BUFSIZE=512` (`cptr->buffer` is `[char;512]`, `count` an `int`); flags `FLAGS_AUTH=0x200`/`FLAGS_WRAUTH=0x400`/`FLAGS_GOTID=0x1000`, `ClearAuth`=`flags&=~FLAGS_AUTH`.
508 - **`send_authports`** — `getsockname`/`getpeername(fd)` (short-circuit `||` preserved), `sprintf`→Rust `format!("{} , {}\r\n", ntohs(them.sin6_port), ntohs(us.sin6_port))`, single `write(authfd)`. A short write or a get{sock,peer}name failure is `authsenderr`: `ircstp->is_abad++`, `close(authfd)`, walk `highest_fd` down while `local[highest_fd]` is NULL, `authfd=-1`, clear `FLAGS_AUTH|FLAGS_WRAUTH`. Success → clear only `FLAGS_WRAUTH`.
509 - **`read_authports`** — `read(authfd, buffer+count, sizeof(buffer)-1-count)` (buffered across partial reads via `count`), then `libc::sscanf(buffer, "%hd , %hd : USERID : %*[^:]: %512s", &remp, &locp, ruser)` (driven through libc with the exact C format → bit-identical parse). On a match: extract `system` (the `: <type> :` field via `strrchr` + leading-`isspace` skip + `strncpyzt`) and `ruser` (copy non-space/non-`:` chars). No match but `len!=0` and a `\n`/`\r` present → clear `ruser`; no `\n`/`\r` yet → **early return** (keep reading). Then `close(authfd)` + `highest_fd` walk + `count=0` + `authfd=-1` + `ClearAuth`; `!locp||!remp||!*ruser` → `is_abad++`, else `is_asuc++`; free the old `auth` (+`istat` decrement) when it's not the interior `username` pointer, set `auth` (`OTHER`→`MyMalloc`+`'-'`+`strcpy`, else `mystrdup`), `set_clean_username`, `FLAGS_GOTID`.
510 - **Seam** — `-DPORT_S_AUTH_AUTHPORTS_P7w` added to the `s_auth_link.o` second-compile; both bodies `#ifndef`-guarded out of `s_auth.c`. Both are already global in `s_auth_ext.h` (unlike the static `set_clean_username`), so the C callers' prototype comes from the header → **no de-static, no `#else` prototype** needed (the P7u `report_iauth_*` precedent). RED confirmed: `cargo build -p ircd-rs` → exactly `send_authports`/`read_authports` undefined (from `s_bsd.c:2363`/`2368`); GREEN: `nm target/debug/ircd` shows both as `T` (from Rust). `index`→`strchr`, `rindex`→`strrchr`, `MyFree`→`free`, `ntohs`→`u16::from_be`; globals `ircstp`/`highest_fd`/`local[]`/`istat` + `mystrdup`/`MyMalloc` are the ircd-common defs.
511 - **Classification** — utility/callee TU (no `msgtab` entry); reached only from the still-C ident I/O path. **L1 is the gate.**
512 - **L1** — `ircd-testkit/tests/authports_diff.rs`, 10 cases, zero-diff vs `cref_*`. Two independent heap `aClient`s + per-world `ircstp`(+backing `stats`)/`istat`/`highest_fd`/`local[]` (the `cref_*` twins), serialized on `GLOBALS_LOCK` (the P7 L1 shared-global convention). fd I/O over socketpairs. **`send_authports`**: both worlds' `fd` point at one *real* connected IPv6-loopback socket (`connected_inet6`) so `getsockname`/`getpeername` populate `sin6_port` identically — an AF_UNIX socketpair leaves the port bytes untouched, so C reads uninitialised stack while Rust reads its zeroed buffer (the one false diff this caught, fixed in the harness, not the port). Each world writes to its own `authfd` whose bytes are read back and compared. Cases: success (identical written bytes + `FLAGS_WRAUTH` cleared, `FLAGS_AUTH` untouched), getsockname-error (`fd=-1` → `is_abad++`, `authfd=-1`, flags cleared), and the `authfd==highest_fd` walk to a non-NULL `local[]` floor. **`read_authports`**: each world's `authfd` is a socketpair read-end fed an identical canned reply. Cases: valid `USERID`(→`is_asuc++`, username `bob`, free path), `OTHER`(→`-bob`), bad reply with `\n`(→`is_abad++`, no `GOTID`), `ERROR` reply, **partial read with no `\n`/`\r`**(→ early return: `authfd` still open, `count` advanced, no counter change — the inverse/round-trip case), EOF (`read`==0 → `is_abad++`), and a pre-existing heap `auth` (→ freed + `istat` decremented). Asserts byte/field identical `username[11]`, `auth` (string or the `auth==&username` predicate), `flags`, `count`, `authfd`, and the `is_asuc`/`is_abad` + `is_auth`/`is_authmem` deltas.
513 - **L2 / S2S** — none. No `msgtab` entry; the ident path needs a live ident server the `ircd-golden` harness doesn't run (`-t -s`, `adfd<0`). Formats no remote-user wire fields, no `IsServer` branch → no S2S. Existing golden suite stays byte-identical (`golden_registration` re-run green as the no-regression check).
514
515- **2026-06-06 — P7x (`s_auth.c` ident initiator `start_auth`) merged.** Ported `start_auth` (s_auth.c:544) to `ircd-common/src/s_auth.rs` — the function that initiates the RFC1413 (ident) query carried out by the P7w pair `send_authports`/`read_authports`.
516 - **Cluster choice** — leaf-first: the last ident-protocol leaf in s_auth.c. Remaining C in s_auth.c after this = `read_iauth` (iauth-pipe parser) + the variadic `sendto_iauth`/`vsendto_iauth` (va_list → P8 trampolines).
517 - **Guard** — `-DPORT_S_AUTH_START_AUTH_P7x` added to the existing `s_auth_link.o` recipe (alongside `_P7u`/`_P7v`/`_P7w`). The C body is `#ifndef`-guarded with an `#else` extern prototype so the still-C callers (`s_bsd.c:1272`/`1732` — `check_client`/`add_connection`) keep a declaration.
518 - **Config-resolved body** — `NO_IDENT` undef → full body (not the empty stub); `USE_IAUTH` on → the `(iauth_options & XOPT_REQUIRED) && adfd<0` early-return + the `adfd>=0` iauth-handoff `abuf` block; `USE_SYSLOG` undef → the `socket()`-failure `syslog` collapses to a bare `ircstp->is_abad++`; `DEBUGMODE` undef → every `Debug((...))` no-op; `AFINET=AF_INET6` → `SOCKADDR_IN`=`sockaddr_in6`, `SIN_FAMILY`/`SIN_PORT`=`sin6_family`/`sin6_port`, `SOCK_LEN_TYPE`=`socklen_t`.
519 - **Faithfulness** — `ntohs`→`u16::from_be`, `htons`→`u16::to_be`; the iauth query is built with libc `sprintf` through the exact `"%d C %s %u "`/`"%s %u"` formats + the global `ipv6string` scratch the C reused (sequenced them→us, byte-for-byte); `IsConfTLS(x)`=`x->flags & PFLAG_TLS`, `BadPtr(x)`=`!x||*x=='\0'`. The Rust ports `set_non_blocking` (P7d)/`report_error` (P7q)/`inetntop`/`inetpton` (P1) resolve through the link seam; the variadic `sendto_iauth`/`sendto_flag` are *called* via a local `extern "C"` block. `errno` via `*libc::__errno_location()` compared to `EINPROGRESS`.
520 - **Classification** — utility/callee TU (no `msgtab` entry); reached only from the still-C connection path (`add_connection`→`check_client`→`start_auth`), which needs a live ident peer the `ircd-golden` harness doesn't run.
521 - **L1** — `ircd-testkit/tests/start_auth_diff.rs`, 3 cases, zero-diff vs `cref_start_auth`, serialized on `GLOBALS_LOCK` (P7 shared-global convention), per-world `adfd`/`iauth_options`/`ircstp`/`highest_fd`: (1) `XOPT_REQUIRED && adfd<0` early return (authfd/flags untouched); (2) iauth handoff — `adfd`=socketpair write-end (write succeeds → `sendto_iauth` returns 0), `cptr->fd`=a shared *real* connected IPv6-loopback socket so both worlds' getpeername/getsockname read identical addrs/ports → the query bytes written to `adfd` are byte-identical, `authfd` closed, `FLAGS_XAUTH` set; (3) getpeername failure on an unconnected socket → `report_error` + `authfd=-1` (compares cptr state only; the client needs a real `name`+`STAT_CLIENT` since fd>=0 → `get_client_name` takes the MyConnect/showip branch). Not covered (noted in the test header): the `MAXCONNECTIONS-2` fd-exhaustion guard (can't force a high fd) and the bind/connect-to-113 network tail.
522 - **L2 / S2S** — no new test. Utility TU with no client/golden path under the locked config (no ident peer); L1 is the gate. Existing golden suite stays byte-identical (`golden_registration` green). No S2S — no `IsServer` branch, formats no remote-user fields.
523 - **Observation (out of scope, pre-existing P5)** — case 3 surfaced a `get_client_name(showip=TRUE)` divergence on a NULL `auth` pointer: the Rust port emits `tester[@]` where glibc `sprintf("%.*s", N, NULL)` emits `tester[(null)@]`. Only observable via `report_error`'s stderr (not asserted here); a latent faithfulness gap in the P5 `get_client_name` port, not P7x.
524
525- **2026-06-06 — P7y (`s_auth.c` iauth-pipe line parser `read_iauth`) merged.**
526 - **Cluster choice** — `read_iauth` (s_auth.c:174), the last non-variadic logic in s_auth.c (per [[p7-started]]). Leaf-first relative to the still-C `s_bsd.c` select/poll loop that calls it when `adfd` is readable. After this, the only C left in s_auth.c is the variadic `sendto_iauth`/`vsendto_iauth` trampolines (→ P8).
527 - **Guard** — `-DPORT_S_AUTH_READ_IAUTH_P7y` added to the existing `s_auth_link.o` recipe in `ircd-sys/build.rs` (alongside `_P7u/_P7v/_P7w/_P7x`); the C body is `#ifndef`-guarded with an `#else void read_iauth(void);` prototype so the still-C callers (the event loop) keep a declaration. The cref oracle keeps the full unguarded `s_auth.o` → `cref_read_iauth` + the `cref_iauth_*` globals survive for L1.
528 - **Config-resolved body** — USE_IAUTH ON (whole body live); AFINET=AF_INET6 → the per-client prefix formats `inetntop(AF_INET6, &cptr->ip, ipv6string, sizeof)`; DEBUGMODE off. No `#ifdef` inside the function. `index`→`strchr`, `bcopy(a,b,c)`→`memmove(b,a,c)` (os.h:384), `MyFree`→ libc `free`; `MyMalloc`/`mystrdup` are the ircd-common allocators. Function-`static` carry state (`obuf`/`last`/`olen`/`ia_dbg`) → private module `static mut` (the `debugbuf` precedent). File-scope globals `iauth_version` (de-static'd-by-default, not in any header → declared extern in the module), `iauth_conf`/`iauth_stats` (P7u de-static'd), `iauth_options`/`iauth_spawn` (bindgen) stay C-owned in s_auth_link.o.
529 - **Classification** — utility/callee TU, no `msgtab` entry; called from the still-C event loop when a live iauth slave writes the pipe. **L1 is the gate.** No L2/S2S: the golden harness runs `-t -s` with `adfd<0` (no iauth slave), so the path is unreached there; no `IsServer` branch, formats no remote-user wire fields. Existing golden suite stays byte-identical (`golden_registration` 2/2 confirmed, no-regression).
530 - **L1** — `ircd-testkit/tests/read_iauth_diff.rs`, 10 cases, zero-diff vs `cref_`, serialized on `GLOBALS_LOCK`. Drives `read_iauth`/`cref_read_iauth` on independent per-world copies of every touched global (`adfd`/`iauth_options`/`iauth_spawn`/`iauth_version`/`iauth_conf`/`iauth_stats`/`istat`/`me`/`local[]`/`timeofday`); each world's `adfd` is the read end of its own non-blocking socketpair fed the identical protocol bytes; `timeofday`/`iauth_spawn` pinned so the `s`-header `myctime`/spawn line is byte-identical. Cases: O-options (incl. flagless reset), V replace+free, A/a conf add+clear (inverse pair), s/S stats reset+append (inverse pair), U/u per-client ident (fresh `auth==username` self-pointer → no-free path), U-with-pre-existing-heap-`auth` (istat-decrement + free, allocated through each world's own `MyMalloc`/`cref_MyMalloc` to avoid crossing allocator twins), gone-client / port-mismatch / garbage negatives (client untouched), and the obuf/olen partial-line carry round-trip (split feed == one-shot).
531 - **Finding** — the per-client prefix check formats the client IP through the ported `inetntop`, which expands `::1`→`0:0:0:0:0:0:0:1` (a faithful quirk of `support.c`'s `::`-expander). In production the iauth daemon echoes the same expanded form (start_auth builds the query with the same `inetntop`), so the prefix matches; the L1 input lines must carry the expanded IPv6 form, not `::1`. Initial test used `::1` → both worlds correctly took the mismatch branch (differential green, expectation wrong) — surfaced the quirk.
532 - **Not covered (noted)** — the recv-error "lost slave" branch (`close(adfd)`+`start_iauth`) and the `D`/`K`/`k` finish/kill paths (`register_user`/`exit_client`, need a fully-registered client + the event loop) — deterministic only at L2/soak with a live iauth.
533
534- **2026-06-06 — P7z (`s_bsd.c` `check_client`) merged.** Ported the ordinary-client access check `check_client` (s_bsd.c:909) to `ircd-common/src/s_bsd.rs`; guard `-DPORT_S_BSD_CHECK_CLIENT_P7z` on the `s_bsd_link.o` recipe.
535 - **Cluster choice** — `check_client` is a callee of the Rust `register_user` (s_user.c:557), reached when a connecting client finishes registration. It resolves the socket peer address, validates the DNS host↔ip mapping, and attaches the matching I:line. The file-`static` helper `check_init` (s_bsd.c:868) is shared with the still-C `check_server_init` (s_bsd.c:1083), so it is NOT dropped: ported as a **private Rust twin** while the C `static check_init` stays compiled. After `check_client` was `#ifdef`'d out, `check_init` has exactly one remaining caller (`check_server_init`) → GCC inlines it and drops the symbol; the build resolves cleanly. This is the P7p `set_sock_opts` precedent (a `static` callee ported as a private twin while the C `static` survives for its other caller).
536 - **Config-resolved body** — `NO_OPER_REMOTE` **undef** → the trailing `FLAGS_LOCAL`/`is_loc` block (s_bsd.c:961–975) is not compiled, so `check_client` ends at `attach_Iline` and makes **no `mysk` use** (unlike `check_server_init`/`connect_server`). `UNIXPORT` undef → no `IsUnixSocket` branch in either fn; `hp = cptr->hostp` unconditionally. `DEBUGMODE` off → all `Debug(...)` no-ops. `AFINET=AF_INET6` → `sockaddr_in6`/`sin6_addr`/`sin6_port`/`in6_addr`.
537 - **Faithfulness notes** — `check_init` does `getpeername(cptr->fd)` (isatty branch kept for the inetd-on-tty case → `me.sockhost`), `inetntop` into the caller's `sockname`, `bcopy` the 16-byte addr into `cptr->ip`, `cptr->port = ntohs(sin6_port)`. The IP# Mismatch arm reads **four `c_ulong`s** from `hp->h_addr` (a 16-byte addr — a latent C over-read; `%08x` truncates each to 32 bits) and writes the `inetntop` result into the real global `ipv6string` (matching the C side effect). `attach_Iline` (P6) / `inetntop` / `report_error` (P7q) are Rust; the variadic `sendto_flag` is *called* (→ P8).
538 - **Classification / L1** — callee TU (no `msgtab` entry). `cref_check_client` is exported → full cross-world L1 differential (`ircd-testkit/tests/check_client_diff.rs`, 4 cases). Both worlds get **separate** aClients (check_client mutates `ip`/`port`/`hostp` + attaches confs) but **share one** real connected IPv6-loopback fd so `getpeername` is byte-identical; `conf`/`cref_conf` both empty → `attach_Iline` returns `-2 EXITC_NOILINE` (the loop never runs) — deterministic, no fixture. Cases: (1) no hostp/empty conf → ip/port filled, hostp stays NULL, -2; (2) hostp addr matches `::1` peer → hostp kept; (3 inverse) hostp addr mismatches → IP# Mismatch → hostp cleared to NULL; (4) unconnected socket → getpeername fails → check_init → report_error → -1. Asserts return + `ip`/`port`/`hostp`-nullness agree. Serialized on a `GLOBALS_LOCK` (`conf`/`ipv6string`/`me` are process globals; see the p7-l1-shared-global-race memory). Fixture finding: the getpeername-failure path → report_error → get_client_name → `mycmp(name, sockhost)` derefs `cptr->name`, so the harness client must set a non-NULL `name` (the real `make_client` sets `name = namebuf`).
539 - **L2 / S2S** — L2 = existing `ircd-golden` `golden_registration` byte-identical; it drives a real client through registration with a real I:line, exercising the **success** path (return 0) that L1's empty-conf cases don't. No S2S: `check_client` has no `IsServer(cptr)` branch and formats no remote-user fields (servers go through `check_server_init`/`check_server`).
540
541- **2026-06-06 — P7aa (`s_bsd.c` `check_server_init` + `check_server`) merged.** The server-side access-check cluster — the sibling of the P7z `check_client`, reached from the Rust `m_server`/`completed_connection` on a server link.
542 - **Cluster choice** — `check_server_init` (s_bsd.c:992) is the entry point; it tail-calls `check_server` (s_bsd.c:1076), so the two form one connected component over the C/N-line lookup. Ported together under one guard `-DPORT_S_BSD_CHECK_SERVER_P7aa`.
543 - **Guard / check_init** — both functions `#ifndef`'d out of `s_bsd_link.o`. The file-`static` `check_init` (s_bsd.c:868, ported as a private Rust twin in P7z) had its two callers `check_client` (P7z) and `check_server` (P7aa); with both now ported, the C `static check_init` + its forward prototype (s_bsd.c:64) lose their last C caller, so they are guarded out under the same `PORT_S_BSD_CHECK_SERVER_P7aa` symbol (no unused-static warning). The Rust port reuses the existing P7z `check_init` twin.
544 - **Config-resolved body** — `UNIXPORT` undef → every `IsUnixSocket`/`#ifdef UNIXPORT` branch dropped (the `get_sockhost` unix guards collapse to always-run; no `IsUnixSocket(cptr)` in the addr-validation or conf scan); `DEBUGMODE` off → all `Debug(...)` no-ops; `AFINET=AF_INET6`. `CFLAG`/`NFLAG`/`SCH_DEBUG` added as module consts.
545 - **Faithfulness** — the `check_serverback` goto becomes a `loop` (validate `hp` then `break`; the goto fires only in the `else if (cptr->hostp)` re-entry); the alias walk `for(i=0,name=h_name; name; name=h_aliases[i++])` becomes a `while !name.is_null()` reading `h_aliases[i]` then `i+=1`; the `IP# Mismatch` arm reads four `c_ulong`s from `hp->h_addr` (the same faithful over-read as `check_client`); the async-DNS stack `Link` is built via `std::mem::zeroed()` + `lin.value.aconf`/`lin.flags = ASYNC_CONF`; `AND16(c_conf->ipnum)==255` (unresolved sentinel) reuses the `send_ping` fold and copies `cptr->ip` into the conf's ipnum (dynamic-ip C-line rewrite). `index`→`libc::strchr`; `sprintf("%s@%s")` via a local variadic extern.
546 - **Callees** — `attach_confs`/`find_conf`/`find_conf_host`/`find_conf_ip`/`attach_conf`/`det_confs_butmask`/`count_cnlines` (P6 s_conf), `get_sockhost` (P5 s_misc), `gethost_byname` (P6 res), `add_local_domain` (P7e), `inetntop`/`strncpyzt` (P1/local) all Rust; `sendto_flag` is *called* (variadic → P8). `nextdnscheck` global write via bindgen extern.
547 - **Classification** — utility/callee TU (no `msgtab` entry). L1 is the differential gate; the C+N **success** path (return 0, attach, `get_sockhost`) is exercised by the existing L2-S2S golden suite, not a new L2 file.
548 - **L1** — `ircd-testkit/tests/check_server_diff.rs`, 6 cases zero-diff vs `cref_`: `check_server_init` with `IsUnknown` + empty conf → `attach_confs` NULL → -1 (before `check_server`); `IsHandshake`, NULL confs → `find_conf` NULL → `sendto_flag`+`det_confs_butmask` → -1; `check_server` unconnected fd → `check_init` `getpeername` fails → -2; connected ::1 fd no-hostp / hostp-addr-match / hostp-addr-mismatch → all `find_conf_*` miss → -1, asserting post-state `ip`/`port`/`sockhost` agree. Separate aClients per world (the fns mutate `ip`/`port`/`sockhost`/`confs`), one shared real ::1-loopback fd so `getpeername` is byte-identical; serialized on `GLOBALS_LOCK` (`conf`/`me`/`ipv6string`/`nextdnscheck` are process globals; the [[p7-l1-shared-global-race]] memory). hostents use a dotted `h_name` so `add_local_domain` is a no-op (no resolver/env dependency), with each addr padded to 32 bytes for the mismatch over-read.
549 - **S2S** — no new file: `golden_s2s_link`/`_eob`/`_who` (and the rest of the S2S suite) link a real `Peer` that the Rust ircd accepts through `check_server_init`/`check_server` (`s2s.conf` carries the C/N lines), so a regression in the success/attach path fails the burst diff. All ran green; `golden_registration` (local client) also green.
550
551- **2026-06-06 — P7bb (`s_bsd.c` `add_connection` + `check_clones`) merged.**
552 - **Cluster choice** — the inbound-connection acceptor `add_connection` (s_bsd.c:1638), the next leaf bottom-up after the P7d–P7aa socket/teardown/listener/access-check leaves: it is called from the still-C `read_listener` for each fd `accept()`ed off a listener. Its only caller-private callee `check_clones` (s_bsd.c:1572, `CLONE_CHECK`) is ported alongside it.
553 - **Guard** — `-DPORT_S_BSD_ADD_CONN_P7bb` wraps two regions under one macro: `check_clones` (inside the surrounding `#ifdef CLONE_CHECK`) and `add_connection`. The P7k `add_connection_refuse` sitting between them keeps its own guard. `add_unixconnection` (`#ifdef UNIXPORT`) is not compiled.
554 - **`check_clones` as a private twin** — `static` in C → no `cref_` symbol → cannot be L1-diffed directly; ported as a module-private Rust `fn` with a `static mut BACKLOG` matching the C function-local `struct abacklog` list (age out `pt+CLONE_PERIOD<timeofday`, prepend `{ip,now}`, count same-ip nodes). `MyMalloc` (P2) / libc `free` (the `MyFree` macro). Observed only through `add_connection`'s clone-reject path. The P7p `set_sock_opts` / P7z `check_init` precedent.
555 - **Config-resolved body** — `NO_DNS_LOOKUP` set (build.rs `EXTRA_CFLAGS`): the `else` arm just sets `acptr->hostp = NULL`, and the `USE_IAUTH && !NO_DNS_LOOKUP` alias-forwarding block (`%d A`/`%d N` to iauth) is compiled out. `CLONE_CHECK` on (CLONE_MAX=10, CLONE_PERIOD=2) → the clone branch compiles; `DELAY_CLOSE`=15 → clone reject uses `nextdelayclose = delay_close(fd)` then `add_connection_refuse(fd,acptr,1)`. `UNIXPORT` undef, `AFINET=AF_INET6` (`sin6_*`, 16-byte `in6_addr`), `linux` → the getpeername-fail arm guards `report_error` behind `errno != ENOTCONN`.
556 - **Callees** — `make_client`/`add_client_to_list`/`add_fd` (P2), `inetntop` (P1), `report_error` (P7q), `add_connection_refuse` (P7k), `delay_close` (P7f), `set_non_blocking` (P7d), `set_sock_opts` (P7p private twin), `start_auth` (P7x) all Rust; `get_sockhost`/`get_client_host`/`sendto_flog` stay C (non-variadic bindgen externs); `sendto_flag` is *called* (variadic, → P8). `local`/`highest_fd`/`fdall`/`nextdelayclose`/`ipv6string`/`timeofday` are bindgen statics.
557 - **Classification** — utility/callee TU (not a `msgtab` handler): reached from `read_listener`. Universally exercised by L2.
558 - **L1** — `ircd-testkit/tests/add_connection_diff.rs`, 3 tests, zero-diff vs `cref_`. `start_auth` neutralized in both worlds by `iauth_options=XOPT_REQUIRED`+`adfd=-1` (its top early-return) so its socket side effects drop out of the diff. `normal_accept_then_clone_flood` (case 1 + 4 merged so the process-`static` backlog starts pristine): first accept over a SHARED connected ::1 fd → compare full surviving post-state (return non-null, `ip`=::1, `port`, `sockhost`, `fd`, `acpt`, `hostp`=NULL, `local[fd]`, `highest_fd`, `aconf->clients`=1); then per world calls #2..#10 succeed and the 11th (count=11>CLONE_MAX) is clone-refused (exercising the backlog twin). `getpeername_failure_refuses` + `illegal_conf_refuses`: the two refuse inverses (NULL + `ircstp->is_ref`+1 + `clients` untouched + fd closed; own fd per world since the path closes it). Serialized on `GLOBALS_LOCK` (`local`/`highest_fd`/`fdall`/`ipv6string`/`timeofday`/`ircstp`/`iauth_options`/`adfd`/the backlog are process globals; the p7-l1-shared-global-race hazard).
559 - **L2** — no new test. `add_connection` is the universal inbound acceptor — every `ircd-golden` client connection already flows through it; `golden_registration` (success path) byte-identical, `golden_s2s_link` green (incoming server links also go through it before `m_server`/`check_server_init`).
560 - **S2S** — none. `add_connection` formats no remote-user fields and has no `IsServer(cptr)` branch (the client has no name/type yet).
561
562- **2026-06-06 — P7cc (`s_bsd.c` `connect_server` + static `connect_inet`) merged.** The outbound server-connection setup (s_bsd.c:2511) — the counterpart of the inbound `add_connection` (P7bb). Ported to `ircd-common/src/s_bsd.rs`; guard `-DPORT_S_BSD_CONNECT_SERVER_P7cc` on the `s_bsd_link.o` recipe. `connect_server` now resolves from Rust; the still-C `do_dns_async`/`try_connections` and the Rust `m_connect` call it via the `s_bsd_ext.h` prototype.
563 - **Cluster choice** — the next leaf bottom-up after the P7d–P7bb socket/teardown/listener/access-check leaves. `connect_server`'s only caller-private callee is the file-`static` `connect_inet` (s_bsd.c:2674), ported alongside as a private Rust twin (no `cref_` oracle for a `static`).
564 - **`set_sock_opts` lifecycle** — ported as a private Rust twin back in P7p, while the C `static` was kept for its remaining compiled caller. Survey: 268 (`inetport`, P7p — guarded out), 1731 (`add_connection`, P7bb — guarded out), 1802 (`add_unixconnection`, UNIXPORT off — not compiled), 2595 (`connect_server` — the last one). With `connect_server` ported, the C `static set_sock_opts` + its forward proto (s_bsd.c:69) have zero compiled callers → both guarded out under `PORT_S_BSD_CONNECT_SERVER_P7cc` (the P7aa `check_init` precedent); the Rust port uses the existing P7p twin.
565 - **Config-resolved body** — `UNIXPORT` undef → `connect_unix` not compiled, the `*aconf->host == '/'` branch drops → always `connect_inet`; `AFINET = AF_INET6` → `sockaddr_in6`/`sin6_*`/16-byte `in6_addr`; `DEBUGMODE` off → all `Debug(...)` no-ops (the leading `inet_ntop` into `ipv6string` is inside `Debug(...)` → not evaluated). `mysk` (P7s de-static'd) is the outbound-bind source; `minus_one` the all-`0xff` sentinel.
566 - **FINDING (faithful)** — `connect_server`'s DNS-resolution block (s_bsd.c:2538-2558, guarded by `if (!aconf->ipnum.S_ADDR && *aconf->host != '/')`) is **dead code** under AF_INET6. `S_ADDR` = `s6_addr`, an embedded array; `!aconf->ipnum.s6_addr` is the address of that array → always non-NULL → always false. The block never runs (the same `!ipnum.s6_addr` array-address quirk noted in `send_ping`/P7m); `hp` is used directly. Omitted in the port with a comment.
567 - **Faithfulness** — the `free_server:` goto becomes a `connect_server_free(cptr)` helper returning -1; `SetConnecting` = `status = STAT_CONNECTING (-4)`; `connect_inet`'s `static struct SOCKADDR server` is a module `static mut MaybeUninit<sockaddr_in6>` (bzero'd every call, the C `static` semantics); the dup-IP scan compares network-order `server.sin6_port` to the host-order `acptr->port` (a faithful C quirk); `index`→`strchr`(unused — DNS block dead), `htons`→`u16::to_be`. `dummy` (P7a) is the `SIGALRM` handler.
568 - **Callees** — `find_server` (P4), `make_client`/`make_server`/`free_client`/`free_server`/`add_fd`/`add_client_to_list` (P2), `attach_confs_host`/`find_conf_host`/`det_confs_butmask` (P6), `get_sockhost`/`get_client_name` (P5), `set_non_blocking` (P7d), `set_sock_opts` (P7p twin), `inetpton` (P1) all Rust; the variadic `sendto_flag`/`sendto_one` are *called* (→ P8). `mysk`/`minus_one`/`portnum`/`highest_fd`/`local`/`fdall`/`nextping`/`timeofday`/`istat`/`me` are bindgen statics.
569 - **Classification / L1** — utility/callee TU (not a `msgtab` handler; reached from `m_connect`/`try_connections`/`do_dns_async`). `cref_connect_server` exported → cross-world differential (`ircd-testkit/tests/connect_server_diff.rs`, 3 cases zero-diff). The success path does a live `socket`/`bind`/`connect` to a configured peer → not deterministic at L1. Cases: (1) `server_already_present` — `find_server` hit → `SCH_NOTICE` + return -1 before any `make_client`/socket work (`by`=NULL); (2) `server_already_present_remote_by` — remote `IsPerson` `by` (fd<0 → `!MyClient`) so the extra `sendto_one(by,...)` arm fires; (3 inverse/cleanup) `connect_inet_failure_refused` — empty hash → `make_client`/`make_server` → `connect_inet` `socket`+`bind`(unconfigured zeroed `mysk` → AF_UNSPEC) fails → `return NULL` → `free_server` cleanup → -1; asserts `highest_fd` unchanged + the hash left clean. Per-world `inithashtables()` (else `hashtab` is NULL → segv); serialized on `GLOBALS_LOCK` (the [[p7-l1-shared-global-race]] hazard). Findings: `hash_find_server`'s suffix-mask search overwrites `'.'`→`'*'` in-place → the conf/lookup strings must be writable heap (not `c"…"` literals); a remote `by` needs `acpt` set (self) or `send_message` null-derefs `(*to).acpt`.
570 - **L2 / S2S** — no new file. The existing `ircd-golden`/`boot_s2s` harness dials **into** the ircd (`TcpStream::connect` = inbound `add_connection`), so it does not exercise `connect_server`'s outbound dial; deferred to the event-loop/CONNECT L2 (the `read_message` cluster). Regression check: `golden_registration` + `golden_s2s_link` byte-identical (the port doesn't touch inbound paths). No remote-user field formatting → no S2S-specific path.
571
572- **2026-06-06 — P7dd (`s_bsd.c` `start_iauth`) merged.** The iauth subprocess (re)spawn leaf (s_bsd.c:565) — the deepest remaining leaf in `s_bsd.c`'s boot subtree (`daemonize` calls it; `read_message` is the loop top). Ported to `ircd-common/src/s_bsd.rs`; guard `-DPORT_S_BSD_START_IAUTH_P7dd` on the `s_bsd_link.o` recipe.
573 - **Cluster choice** — after P7d–P7cc ported every socket/teardown/listener/access-check/connection leaf, the three C functions left in `s_bsd.c` are `start_iauth`, `daemonize`, and `read_message` (+ its `static` siblings `polludp`/`check_ping`). `daemonize` calls `start_iauth` and `read_message` is the loop top, so `start_iauth` is the next leaf bottom-up. It is the only function that creates the `adfd` pipe the P7u–P7y `s_auth.c` readers drain.
574 - **Classification** — utility/callee TU (no `msgtab` entry). Callers: `daemonize` (boot), `io_loop` (the `restart_iauth`/`nextiarestart` timer, ircd.c:1286), `rehash` (`start_iauth(2)` = kill-first, s_conf.c:1303), `s_auth.c` `read_iauth` restart requests. All reach it via `s_bsd_ext.h`. L1 is the differential gate (`extern` → `cref_start_iauth` oracle).
575 - **Config-resolved body** — `USE_IAUTH` on → the whole `#if defined(USE_IAUTH)` body compiles; `IAUTH_BUFFER = 65535`; `MAXCONNECTIONS = 50` (the child fd-close bound). `IAUTH_PATH` (= `$(server_bin_dir)/$(IAUTH)`) and `IAUTH` are recursively-expanded Makefile vars passed only on `s_bsd.o`'s compile line (absent from bindgen) → build.rs expands both via `make` and hands them to the crate as `ircd_sys::IAUTH_PATH` / `ircd_sys::IAUTH` (the `PID_PATH`/`MOTD_PATH` precedent), so the Rust `execl` spawns the identical binary as reference-C.
576 - **Faithfulness** — the three function `static`s (`last`/`first`/`iauth_pid`) → module-private `static mut START_IAUTH_*`; both worlds start `first = 1` so the burst-send block is skipped on the first call. `vfork()` → `libc::fork()`: behaviorally identical here (the child only runs a close loop + `dup2` + `execl`, so COW `fork` produces the same result) and Rust's libc deprecates `vfork` as memory-unsafe (the close-loop/dup2-between-vfork-and-exec is exactly the flagged pattern). The socketpair-failure arm does NOT early-return (faithful). The burst-send pointer arithmetic (`s += sprintf(s, "%d O\n", i)`, the `s > e` flush, the `*(s-1) = '\0'` newline-strip) is translated byte-for-byte over a `[c_char; BUFSIZ]` (`libc::BUFSIZ` = 8192 on gnu, matching the C `<stdio.h>` macro). `execl` CStrings are built *before* `fork`.
577 - **Callees** — `read_iauth` (P7y), `set_non_blocking` (P7d) Rust; `sendto_flag`/`sendto_iauth` are *called* (variadic → P8); `socketpair`/`setsockopt`/`fork`/`dup2`/`execl`/`close`/`kill`/`_exit`/`time` are libc. `adfd`/`iauth_spawn`/`bootopt`/`highest_fd`/`local` are bindgen globals.
578 - **L1** — `ircd-testkit/tests/start_iauth_diff.rs`, 3 cases zero-diff vs `cref_`, serialized on `GLOBALS_LOCK` (the [[p7-l1-shared-global-race]] hazard; each world keeps its own `adfd`/`iauth_spawn`/`bootopt`). `boot_noiauth_returns`: `BOOT_NOIAUTH` → immediate return, `adfd` stays -1, `iauth_spawn` unchanged. `already_running_returns`: not-NOIAUTH but `adfd>=0`, `rcvdsig=0` → returns untouched (the inverse). `spawn_sets_adfd`: the real meat — the socketpair + setsockopt + `set_non_blocking` + fork prefix; asserts the observable post-state agrees across worlds and the spawn happened (`adfd` opened nonblocking via `fcntl F_GETFL & O_NONBLOCK`, `iauth_spawn == 1`); the child `execl`s the absent `IAUTH_PATH` and `_exit`s, reaped via a bounded `waitpid(WNOHANG)` loop so the test can never hang. The non-first-call burst is skipped (both `first = 1`) → its differential coverage is deferred to L2/soak (needs a populated `local[]` + a second post-`first` call).
579 - **L2 / S2S** — no new file. The golden harness boots `-t -s` (`BOOT_NOIAUTH`) → only `start_iauth`'s early return runs (`golden_registration` byte-identical); the full spawn is a process-lifecycle side effect whose end-to-end gate is the P7-exit L2/soak run with iauth enabled, as for `daemonize`/`server_reboot`. No `IsServer(cptr)` branch / no remote-user field formatting → no S2S path.
580
581- **2026-06-06 — P7ee (`s_bsd.c` `daemonize`) merged.** Ported the boot detach glue `daemonize` (s_bsd.c:794), the layer directly above the P7dd `start_iauth`.
582 - **Cluster choice.** Called once from `ircd.c:1152` (still C → resolves to the Rust def once dropped). Now a clean leaf: its only non-libc callees — `init_resolver` (P6, Rust) and `start_iauth` (P7dd, Rust) — are already ported. With it gone, the only still-C logic in `s_bsd.c` is the event loop (`read_message` + its statics `polludp`/`check_ping`).
583 - **Guard / seam.** Partial port via the existing `s_bsd_link.o` recipe, new guard `-DPORT_S_BSD_DAEMONIZE_P7ee`; the C body `#ifndef`-guarded (no `#else` proto — `daemonize` is declared in `s_bsd_ext.h`).
584 - **Config-resolved body.** `TIOCNOTTY` defined on Linux → the `int fd` + ioctl block compiles. The `setpgrp` arm resolves to the `#else` `setpgrp(0, getpid())` branch (verified by preprocessing — none of `HPUX`/`SVR4`/`DYNIXPTX`/`_POSIX_SOURCE`/`SGI`/`__CYGWIN32__`/`__APPLE__` are defined); the linked glibc symbol is `setpgrp(void)` (ignores the args) — declared 2-arg in a local extern to mirror the source verbatim. `stdout`/`stderr`/`stdin` are glibc `extern FILE *` symbols (not the macros) → local externs (`stderr` reuses the module-top decl). `init_resolver` called as `crate::res::init_resolver`; `start_iauth` is the local Rust def in this module (called bare, not imported, to avoid shadowing the bindgen decl).
585 - **Faithfulness.** `bootopt & BOOT_TTY` → short-circuit to `init_dgram` (no fork/no fd close); else `fclose(stdout)`/`close(1)`, (unless `BOOT_DEBUG`) `fclose(stderr)`/`close(2)`, and when `((bootopt & BOOT_CONSOLE) || isatty(0)) && !(bootopt & BOOT_INETD)` → `fork()` (the parent `exit(0)`s to detach), `open("/dev/tty")`+`ioctl(TIOCNOTTY)`+`close`, `setpgrp(0, getpid())`, `fclose(stdin)`/`close(0)`; then always `resfd = init_resolver(0x1f)` + `start_iauth(0)`.
586 - **Classification / L1.** Utility/boot callee (no `msgtab` entry). **Mostly untestable by design:** the detach path forks (parent `exit(0)`s) and closes fds 0/1/2 — calling it on that path destroys the test harness, and even fork-isolation (P7r's trick) can't measure a function whose whole job is to detach. The only differentially-safe path is the `BOOT_TTY` short-circuit (`goto init_dgram`: no fork, no fd close) — which is also the only path any harness ever takes (golden boots `-t` = `BOOT_TTY`). `daemonize_diff.rs` (1 case): `bootopt = cref_bootopt = BOOT_TTY|BOOT_NOIAUTH`, `adfd=-1`, `resfd=-99` sentinel → call each world's `daemonize` → assert `resfd != -99` and `>= 0` (init_resolver opened the resolver socket), `(resfd>=0)==(cref_resfd>=0)` (both worlds succeeded identically), and the inverse: `adfd == -1` in both (`start_iauth(0)` reached but short-circuited on `BOOT_NOIAUTH`, touching nothing). Serialized on `GLOBALS_LOCK`; the opened resolver sockets are closed afterward. Untested-by-design: the entire detach path (`fclose`/`close` of 0/1/2, `fork`+parent `exit`, `TIOCNOTTY` ioctl, `setpgrp`).
587 - **L2 / S2S.** No new L2 (boot callee, not a `msgtab` handler — the existing golden suite boots through the `BOOT_TTY` path of `daemonize`; `golden_registration` byte-identical, confirmed). No S2S (formats no remote-user wire fields).
588
589- **2026-06-06 — P7ff (`s_bsd.c` `read_message` + 8 statics — the event loop) merged.** Ported the select/poll event loop `read_message` (s_bsd.c:2088) and its eight file-`static` helpers to `ircd-common/src/s_bsd.rs`; guard `-DPORT_S_BSD_READ_MESSAGE_P7ff` on the `s_bsd_link.o` recipe. This is the body of `io_loop` and the **last *logic* in `s_bsd.c`** — after it, `s_bsd_link.o` defines **zero functions**, only the data globals.
590 - **Cluster choice** — `read_message` is the only non-`static` symbol left in `s_bsd_link.o`; its callees `completed_connection` (s_bsd.c:1247), `read_listener` (1835), `read_packet` (2004), `client_packet` (1938), `ircd_no_fakelag` (1930), `do_dns_async` (3324), `polludp` (3212), `check_ping` (3165) are all `static` (no `cref_` oracle) → one connected component, ported together as module-private Rust twins (the `check_init`/`set_sock_opts`/`connect_inet`/`check_clones` precedent).
591 - **Config-resolved body** — `USE_POLL` **off** → the `select()`/`fd_set`/`FD_*`/`highfd` path compiles; the entire `#if defined(USE_POLL)` pfd machinery is dead and omitted. `USE_IAUTH` on (the `DoingXAuth`/`WaitingXAuth`/`adfd`/`read_iauth`/`sendto_iauth` arms + do_dns_async's iauth alias-forward block). `LISTENER_DELAY` = 1 (the listener once-per-second throttle), `LISTENER_MAXACCEPT` = 10, `MAXCLIENTS` = 45, `CLIENT_FLOOD` = 1000, `HELLO_MSG`/`IRC_VERSION` resolved as module consts. `ZIP_LINKS`/`UNIXPORT`/`DEBUGMODE` off, `DELAY_CLOSE`/`CACCEPT_DELAYED_CLOSE` on, `JAPANESE` off, `AFINET=AF_INET6`.
592 - **Faithfulness** — `highfd`/`delay2`/`ret` declared before the `for(res=0;;)` select-retry loop (persist across retries, never reset — the faithful C quirk). The `read_message` per-fd dispatch `goto deadsocket` becomes a `dead: bool` + structured `continue`s (both goto sites set `dead`, the deadsocket block runs once). `while(max--)` in `read_listener` → a `{ let cur = max; max -= 1; cur != 0 }` head. `client_packet`'s inner long-no-newline `while(dolen<=0)` drain + `FLAGS_NONL` break preserved. `check_ping`'s `cp->ping = (cp->rtt /= cp->lrecvd)` order kept; `pow` is the libc symbol (NOT `f64::powf` — last-ULP drift, the P7t precedent). `polludp`'s `ntohl`/`htonl` over the `u_long pi_id` truncate to 32 bits then byteswap (`u32::from_be`/`to_be as u_long`); the `#if 0` recvfrom-error report and the function `static`s `last`/`cnt`/`mlen`/`lasterr` → module `static mut`. `do_dns_async`'s `static Link ln` → a module `static mut DO_DNS_LN` (const-initialised union) so the address handed to `get_res` is stable; `hp->h_addr` macro = `h_addr_list[0]`. The private `static char readbuf[READBUF_SIZE]` (16384) → a module `static mut READBUF`.
593 - **Callees** — in-module Rust: `add_connection` (P7bb), `connect_server` (P7cc), `delay_close` (P7f), `report_error` (P7q), `get_sockerr` (P7d). bindgen externs (resolve to Rust at link): `dopacket` (P7b), `exit_client`/`get_client_name` (P5), `send_queued`/`flush_connections` (P3/send), `start_auth`/`read_iauth`/`send_authports`/`read_authports` (P7w-y), `find_conf`/`is_allowed` (P6), `match_`/`inetntop` (P1), `dbuf_get`/`getmsg`/`put` (P1), `get_res`/`del_queries`/`find_bounce`/`my_name_for_link`, `restart`. Variadic (*called*, → P8): `sendto_flag`/`sendto_one`/`sendto_iauth`. The data globals `local[]`/`highest_fd`/`timeofday`/`fdas`/`fdall`/`readcalls`/`udpfd`/`resfd`/`adfd`/`ircstp`/`istat`/`iconf`/`conf`/`nextping`/`nextdelayclose`/`ipv6string`/`me` are bindgen statics (still C-owned in `s_bsd_link.o`).
594 - **Classification** — utility/boot callee (no `msgtab` entry; reached from `io_loop`). `read_message` has a `cref_` oracle but is the event loop — every meaningful path `select()`s real fds, `accept()`s/`recvfrom()`s/`send()`s real sockets, and *destructively* `exit_client`s, none of which is differentially deterministic in isolation (the `daemonize`/P7ee situation). **L2 is the real gate.**
595 - **L1** — `ircd-testkit/tests/read_message_diff.rs`, 2 cases zero-diff vs `cref_`, serialized on `GLOBALS_LOCK` (the [[p7-l1-shared-global-race]] hazard; `udpfd`/`resfd`/`adfd` are process globals). The one differentially-safe path: an empty `FdAry` (`highest = -1`) + `udpfd = resfd = adfd = -1` + `delay = 0` → an empty fd_set, `select(0, …, 200ms)` returns 0, no dispatch, return 0; both worlds agree (`ro = 0` and `ro = 1`). Proves the loop skeleton + the `select` call + the no-fds-ready dispatch are byte-identical.
596 - **L2 / S2S** — no new file. The *entire* `ircd-golden` `golden_*` + `golden_s2s_*` suite (111 test files) runs through `read_message` (it is `io_loop`'s body) — registration, every channel/user/oper command, and the full S2S server-burst/netsplit matrix exercise the accept/read/write/exit + server-link `read_packet`/`completed_connection` paths end-to-end. Ran the full 111-file suite with `--no-fail-fast`: **192 passed, 2 failed**, both **pre-existing reference-C STATS garbage flakes** ([[p5-s2s-stats-flake]]), not P7ff regressions (the reference-C binary is frozen — a Rust edit can't change its output; the Rust side prints the correct value in both): (1) `golden_s2s_s_serv_stats` `s2s_stats_match_reference` — uninitialised peer-burst sendq (`…965524992kB sq` vs Rust `0kB sq`); (2) `golden_s_misc` `stats_t_matches_reference` — STATS t's "dropped %luSq/%luYg/%luFl" prints `ircstp->is_cklQ/is_ckly/is_cklno` (`u_int`, 4 bytes) with `%lu` (8 bytes) in the still-C variadic `sendto_one`, so reference-C `va_arg`s 4 bytes of call-frame garbage (`281470681743360Sq/…`) vs Rust `0Sq/0Yg/0Fl` — a `%lu`/`u_int` width-mismatch in s_misc.c:1079, surfaced (not caused) by P7ff.
597 - **Untested-by-design (noted)** — the destructive accept/read/write/exit dispatch, `polludp`/`check_ping` (need a live UDP CPING peer), and `do_dns_async` (needs a live resolver fd) are deterministic only at L2/soak.
598
599- **2026-06-06 — P7gg (`ircd.c` `try_connections`, auto-connect timer) merged.** Ported the static `io_loop` AC timer (ircd.c:226) to `ircd-common/src/ircd.rs`, the sibling of `calculate_preference` (P7t).
600 - **Cluster choice** — `try_connections` is the next `io_loop` timer helper after `calculate_preference`. Each AC tick it walks the global `conf` list, folds the lowest future `hold` into `next`, and chooses the single best AC-able `connect{}` C-line to dial: candidate = status carries `CONF_CONNECT_SERVER|CONF_ZCONNECT_SERVER`, `port > 0`, class `maxLinks != 0`; skipped if future-held / at `maxLinks` / already linked (`find_name`/`find_mask`) / denied (`find_denied`); best by (lower `pref >= 0`, else higher class number). The winner is spliced to the list **tail** (round-robin), its `hold` penalised by another `con_freq`, then deferred (AC disabled) or dialed via `connect_server` (P7cc). Returns the next-call time (`0` = nothing pending); `BOOT_STANDALONE` → `0`.
601 - **Guard / de-static** — `try_connections` is `static` → no `cref_` oracle symbol. De-static'd in ircd.c under `#ifndef PORT_IRCD_TRY_CONNECTIONS_P7gg` (the `mysk`/`check_init`/`connect_inet` precedent) so the cref archive's prefix-rename exports `cref_try_connections`; the `#else` branch is an `extern time_t try_connections(time_t)` prototype so the still-C `io_loop` caller (ircd.c:1186) keeps a declaration. `-DPORT_IRCD_TRY_CONNECTIONS_P7gg` added to the `ircd_link.o` make rule (alongside the P7c/P7t defines). The full `ircd.o` (cref oracle, no PORT define) keeps the non-static body.
602 - **Config-resolved body** — `DISABLE_DOUBLE_CONNECTS` undef → the whole `for (i=highest_fd…)` duplicate-IP scan + `SCH_SERVER` "AC postponed" notice block is dead (dropped); `DEBUGMODE` off → every `Debug((…))` no-op.
603 - **Faithfulness** — the tail-splice replicates the C `for (pconf=&conf; (aconf=*pconf); pconf=&(aconf->next))` walk **exactly**: the `if (aconf==con_conf) *pconf=aconf->next;` removal does NOT short-circuit the pointer advance, and the detached node's own `next` is left intact so the walk still reaches the real tail through it. Macros inlined: `Class(x)=x->class`, `MaxLinks(x)=x->maxLinks`, `Links(x)=x->links`, `ConfClass(x)=x->class->class`, `get_con_freq` (Rust P2). `DELAYCHASETIMELIMIT`=1800. The variadic `sendto_flag` is *called* via the module's local `extern "C"` block (→ P8); `connect_server` (P7cc)/`find_name`/`find_mask` (P4)/`find_denied` (P6) resolve through the link seam.
604 - **Classification** — `io_loop` callee (no `msgtab` entry), reached only from the periodic AC recompute; formats no remote-user wire fields.
605 - **L1** — `try_connections_diff.rs`, 8-case zero-diff vs `cref_try_connections` over two isolated conf worlds (Rust `conf`/`iconf`/`bootopt` vs the `cref_` copies), serialized on `GLOBALS_LOCK` (the documented P7 shared-global hazard). Covers every path that does NOT reach `connect_server`: `BOOT_STANDALONE` early return, empty conf, all skip-`continue`s (non-C-line, `port<=0`, `maxLinks==0`, future-held, class-full-before-hold-write, already-linked, denied), and — by pinning `iconf.aconnect=0` — the best-conf selection, the tail-splice (winner moved to list end), the `hold += get_con_freq` penalty, and the "administratively disabled" deferred-notice branch. Compares per-conf `hold`/`pref` + the resulting list order (by build index) + the return value. Two initial expectation bugs in the test (wrong `BOOT_STANDALONE` literal; assuming the class-full skip writes `hold`) were caught because the Rust↔oracle diff stayed green while the absolute-value asserts failed — fixed the expectations, port unchanged.
606 - **L2** — the `connect_server`-reached dial is L2-only: the `ircd-golden`/S2S harness dials *into* the ircd and never auto-connects out (the P7cc precedent), so the outbound AC dial is deferred to the event-loop/CONNECT L2. `golden_registration` confirmed byte-identical (boot/event-loop path unaffected). No S2S (no remote-field formatting).
607
608- **2026-06-06 — P7hh (`ircd.c` `check_pings` — the io_loop ping/timeout sweep) merged.** Ported the static `io_loop` timer helper `check_pings` (ircd.c:525) to `ircd-common/src/ircd.rs`, the sibling of `try_connections` (P7gg) and `calculate_preference` (P7t). The next `io_loop` callee after the AC timer; one of the two remaining loop helpers (`delayed_kills` is next).
609 - **Cluster choice / Scope.** Called once per loop tick from `io_loop` (ircd.c:1277) when `timeofday >= nextping`. Walks `local[highest_fd..0]`; per non-listener local connection: pings idle registered links (`FLAGS_PINGSENT` state machine), times out unregistered/unresponsive ones (`exit_client`; servers/connecting/handshake get a "No response … closing link" notice, with a remote-oper NOTICE via `bysptr`; DNS/auth/xauth waiters either get an iauth extension (`%d d`/`%d T`) or are reset/exited), and folds the soonest next-check calendar time into `oldest` (the return), with the `+PINGFREQUENCY`/`+30` clamps.
610 - **Guard / de-static.** `check_pings` is `static` → no `cref_` oracle symbol. De-static'd in ircd.c under `#ifndef PORT_IRCD_CHECK_PINGS_P7hh` (the `try_connections`/`mysk` precedent) so the cref archive's prefix-rename exports `cref_check_pings`; the `#else` branch is an `extern time_t check_pings(time_t)` proto so the still-C `io_loop` caller keeps a declaration. `-DPORT_IRCD_CHECK_PINGS_P7hh` added to the `ircd_link.o` make recipe (alongside the P7c/P7t/P7gg defines). The full `ircd.o` (cref oracle, no PORT define) keeps the non-static body.
611 - **Config-resolved body.** `TIMEDKLINES` off (config.h:207 commented) → the `static time_t lkill`, the `kflag = find_kill(...)` block, the `if (kflag && IsPerson)` kill-notice arm, and the trailing `if (currenttime - lkill > 60)` all vanish; `kflag` is permanently 0 → the goto guard reduces to `if (IsRegistered && ping >= now-lasttime)`, the timeout `if` to `((idle >= 2*ping && PINGSENT) || (!registered && firsttime-too-old))`, and the kill/else collapses to always `exit_client(... "Ping timeout")`. `USE_IAUTH` on → the iauth extwait/notimeout `sendto_iauth` block compiles. `DEBUGMODE` off → every `Debug((...))` no-op. `ACCEPTTIMEOUT`=90, `PINGFREQUENCY`=120 (plain `#define`s, inlined as module consts).
612 - **Faithfulness.** The C forward `goto ping_timeout` (recently-active fast path) is modelled by guarding the whole timeout/ping if/else on the **negated** recently-active condition and falling through to the timeout computation — no control-flow change. `bysptr` is declared **once outside** the loop and never reset inside (faithful: a server-timeout's `bysptr` persists across later iterations). `ME` = `me.name`. Macros inlined as private `unsafe fn` helpers (copied from s_bsd.rs): `is_listener`/`is_registered`/`is_server`/`is_connecting`/`is_handshake`/`doing_dns`/`doing_auth`/`doing_xauth`/`clear_auth`/`clear_dns`/`clear_xauth`/`clear_wxauth`/`set_done_xauth`/`my_connect`/`me_ptr`/`local_base`. The variadic `sendto_one`/`sendto_iauth`/`sendto_flag` are *called* via the module's local `extern "C"` block (→ P8); `exit_client`/`find_uid`/`get_client_name`/`del_queries` resolve through the link seam (Rust P5/P6).
613 - **Classification.** `io_loop` callee (no `msgtab` entry), reached only from the periodic ping recompute. The only remote read is `bysptr` (a remote oper) for a NOTICE on server timeout — a server-link path exercised by the L2/S2S loop, not a client command. → **L2-gated**, with an L1 over the deterministic non-destructive paths.
614 - **L1** — `check_pings_diff.rs`, 7-case zero-diff vs `cref_check_pings` over two isolated worlds (Rust `local`/`highest_fd`/`me` vs the `cref_` copies), each building its own parallel client set, serialized on `GLOBALS_LOCK` (the documented P7 shared-global hazard). Covers every path that does NOT reach `exit_client` or the server-timeout `find_uid`/`sendto_one`: empty `local[]` (oldest stays 0 → `now+PINGFREQUENCY`), listener-skip (`FLAGS_LISTEN`), recently-active registered (`ping >= now-lasttime` → goto, no ping, flags untouched), the `FLAGS_PINGSENT` ping-send branch (idle 121 > ping 120, below 2*ping → sets `FLAGS_PINGSENT` + rewrites `lasttime = now-ping` + sends PING — the inverse of recently-active), young unregistered (firsttime < ACCEPTTIMEOUT, left alone), already-pinged idle below 2*ping (folds oldest only), and a mixed multi-fd sweep (listener + recent + idle-pinged + young-unreg) exercising the oldest-fold + final clamps. Asserts each client's post-`(flags,lasttime)` + the return value identical. Finding: a fresh `calloc`'d client needs `acpt` set (real `make_client` sets it to the listener) or `send_message`'s `acpt != &me` sendM bump null-derefs; `fd = -1` + a sub-1024-byte PING never trips `send_queued` so there is no real socket write.
615 - **L2** — no new file. The entire `ircd-golden` suite runs `check_pings` every `io_loop` tick (it is the registration-timeout + ping path). `golden_registration` (boot/loop/timeout) and `golden_channel_join` byte-identical; the only failure is the documented pre-existing `golden_s_misc` `stats_t` reference-C garbage flake ([[p5-s2s-stats-flake]] / P7ff) — a `%lu`/`u_int` width mismatch in the still-C variadic `sendto_one` (`281470681743360Sq` from `va_arg`'d call-frame garbage in the frozen reference-C binary vs the correct `0Sq/0Yg/0Fl` from Rust), surfaced not caused. No S2S (no command-driven remote-field formatting).
616
617- **2026-06-06 — P7ii (`ircd.c` `delayed_kills` — the io_loop K-line sweep) merged.** Ported the static `io_loop` timer helper `delayed_kills` (ircd.c:447) to `ircd-common/src/ircd.rs`, the sibling of `check_pings` (P7hh). The other of the two remaining loop helpers; `io_loop` calls it (ircd.c:1294, `rehashed = delayed_kills(timeofday)`) **only while `rehashed > 0`** — i.e. after a rehash queues a K-line re-evaluation.
618 - **Cluster choice / Scope.** Walks `local[dk_lastfd..j]` (a batch of at most `MAXDELAYEDKILLS`); for every local fully-registered person it runs `find_kill`, and on a match (`kflag == -1`) notices the oper channel (`sendto_flag "Kill line active for %s"`), stamps `cptr->exitc = EXITC_KLINE`, and `exit_client`s the connection with the kill reason. Returns 1 if work remains queued (incomplete batch, or `rehashed == 2` — a rehash arrived mid-sweep), else 0. Persistent function-local statics (`dk_rehashed`/`dk_lastfd`/`dk_checked`/`dk_killed`) carry the batch cursor across calls; `dk_rehashed == 0` re-arms the sweep from `highest_fd`.
619 - **Guard / de-static.** `delayed_kills` is `static` → no `cref_` oracle symbol. De-static'd in ircd.c under `#ifndef PORT_IRCD_DELAYED_KILLS_P7ii` (the `check_pings`/`try_connections`/`mysk` precedent) so the cref archive's prefix-rename exports `cref_delayed_kills`; the `#else` branch is an `extern int delayed_kills(time_t)` proto so the still-C `io_loop` caller keeps a declaration. `-DPORT_IRCD_DELAYED_KILLS_P7ii` added to the `ircd_link.o` make recipe (alongside the P7c/P7t/P7gg/P7hh defines). The full `ircd.o` (cref oracle, no PORT define) keeps the non-static body.
620 - **Config-resolved body.** `MAXDELAYEDKILLS` = 200 (config.h:423) and `MAXCONNECTIONS` = 50 (config.h:150): the `#ifdef MAXDELAYEDKILLS` batch block IS compiled, but `j = dk_lastfd - 199` with `dk_lastfd ≤ 49` is **always < 0 → clamped to 0**, so the whole `local[]` is swept in a single call and `dk_lastfd` always reaches -1 → the persistent statics reset every call (no multi-call drain) and the trailing `return rehashed` (incomplete-batch path) is **unreachable** under the locked config — ported faithfully regardless. `TIMEDKLINES` off → `find_kill`'s `timedklines` arg is 0 (the `check_pings` finding); `DEBUGMODE` off → the `Debug((DEBUG_DEBUG, "DelayedKills killed…"))` no-op.
621 - **Faithfulness.** The C `for (i = dk_lastfd; i >= j; i--)` with its `continue` (which still runs `i--`) and in-loop `j--` (on a NULL/non-person slot, only while `j > 0`) is modelled by a `while i >= j` loop that decrements `i` before every `continue`/iteration end, so the post-loop `dk_lastfd = i` lands on `j-1` identically. `IsPerson` = `user && (STAT_CLIENT || STAT_OPER)` and `BadPtr` inlined as private `unsafe fn` helpers. The summary `sendto_flag(SCH_NOTICE, "DelayedKills checked %d killed %d in %d sec", dk_checked, dk_killed, currenttime - dk_rehashed)` passes a `time_t` (long) to a `%d` — a faithful C quirk, passed verbatim (the variadic trampoline reads 32 bits; a no-op until the notice channel exists). The variadic `sendto_flag` is *called* (→ P8); `find_kill` (Rust P6i)/`get_client_name`/`exit_client` resolve through the link seam.
622 - **Classification.** `io_loop` callee (no `msgtab` entry), reached only after a rehash queues K-line re-evaluation (`rehashed > 0`). → **L1-gated**: the kill arm is destructive (`exit_client`) AND requires both a matching K-line conf and `rehashed > 0`, neither of which the golden suite produces — so unlike `check_pings`, `delayed_kills`' body has no L2 path at all (golden never rehashes).
623 - **L1** — `delayed_kills_diff.rs`, 6-case zero-diff vs `cref_delayed_kills` over two isolated worlds (Rust `local`/`highest_fd`/`rehashed` + empty `kconf`/`tkconf` → `find_kill` returns 0, no kill, vs the `cref_` copies), serialized on `GLOBALS_LOCK` (the documented P7 shared-global hazard). Covers the **non-kill** sweep (the inverse of the destructive kill arm): empty `local[]` across `rehashed` ∈ {0,1,2} (→ return {0,0,1} — exercises the requeue logic), an `IsPerson` client over empty conf (checked, no kill → completes, **client left alive**: status/flags unchanged + still in `local[]`), non-person (no `user`) + userless STAT_CLIENT slots (both `!IsPerson` → skipped before `find_kill`), and a mixed multi-fd sweep. Asserts identical return + per-client `(status, flags, still-in-local)`. A `with_user` client gets a zeroed `anUser` (username "") so `find_kill` walks the empty conf and returns 0.
624 - **Untested-by-design / L2** — the `kflag == -1` kill arm (`exit_client` is destructive — the `check_pings`/`read_message` L2-gating precedent — and needs both a K-line conf match and a queued rehash). No new L2 file: `golden_registration` confirmed byte-identical (no-regression; the boot/event-loop path is unaffected and `delayed_kills` is never entered without a rehash). No S2S (formats no command-driven remote-user wire fields).
625
626- **2026-06-06 — P7jj (`ircd.c` `setup_me`) merged.** Ported the boot-time `me`-singleton initializer to `ircd-common/src/ircd.rs`, the last substantive non-spine leaf in `ircd.c`.
627 - **Cluster choice** — `setup_me` (ircd.c:723) is the boot helper `main()` calls once (ircd.c:1113) after `bzero(&me)` + `make_server(&me)` + config read have populated `me.serv->namebuf` (server name; `make_server` self-points `me.name → serv->namebuf`), `me.serv->sid`, `me.info`. The remaining `ircd.c` leaves are `setup_signals` (blocked on the still-static signal handlers `s_rehash`/`s_slave`), `bad_command` (exit, untestable), `open_debugfile` (empty under DEBUGMODE-off) — `setup_me` is the only one with real, L2-observable logic.
628 - **Seam / Guard** — `#ifndef PORT_IRCD_SETUP_ME_P7jj` around the body, `static` removed, `extern void setup_me(aClient *mp);` after `#endif` so the guarded `ircd_link.o`'s `main()` resolves the call to the Rust `#[no_mangle] setup_me` (the cref oracle keeps the full unguarded `ircd.o`). `-DPORT_IRCD_SETUP_ME_P7jj` appended to the `ircd_link.o` make recipe. Confirmed `nm target/debug/ircd` shows `T setup_me` (from Rust).
629 - **Faithfulness** — `getpwuid(getuid())->pw_name` (or `"unknown"`) feeds both `username` copies; `me.info == DefInfo` compares the **global** `me.info` pointer (via `addr_of_mut!(me)`) against the `DefInfo` constant (list.c); `ME` = `me.name`; `SetMe`=`status=STAT_ME`, `SetEOB`=`flags|=FLAGS_EOB`; `strncpyzt` (local macro twin) + `strcpy(user->host, mp->name)` use the exact bindgen array lengths; `PATCHLEVEL` resolved to the locked `patchlevel.h` literal `"0211030000"`. No variadic senders called.
630 - **Callees** — `get_my_name` (P7s), `find_server_num`/`find_server_string` (P5 s_serv), `make_user` (P2 list), `add_to_client_hash_table`/`add_to_sid_hash_table` (P2 hash), `setup_server_channels` (P5 channel), `mystrdup` (P1) — all Rust, imported from `ircd_sys::bindings`.
631 - **Classification / L2-gated (no L1)** — not a `msgtab` handler. `setup_me` mutates four shared process-global tables (client hash, SID hash, `server_name[]` interning, channel hash) plus the `me` singleton and `istat`; an L1 differential on the real Rust-side globals can't be isolated/cleaned without leaking channel-hash entries into other `ircd-common` L1 tests. Its entire output is observable on every `ircd-golden` boot (server name in numerics, SID, 004/005, LUSERS `is_users`, oper+EOB status, server channels, `verstr`/`info` in the S2S burst), so the golden suite is the gate (P7dd/ee/ff L2-gating precedent).
632 - **L2** — golden `registration` (x2), `s_serv_lusers`, `s2s_server` (introduce), `s2s_s_serv_info`, `s2s_s_serv_map`, and 3/4 `s_misc` all byte-identical. The `s_misc::stats_t` failure is the documented pre-existing reference-C uninitialized-garbage flake (`...743360Sq/...452800Yg/...` on the **reference** side; Rust correctly emits `0Sq/0Yg/0Fl`) — see the p5-s2s-stats-flake note, not a regression.
633 - **S2S** — none needed: `setup_me` formats no command-driven remote-user wire fields.
634- **2026-06-06 — P7kk (`ircd.c` signal-handler + reboot cluster) merged.** Ported the contiguous signal block `ircd.c:73–215` — the SIGTERM/SIGUSR1/SIGHUP/SIGINT handlers (`s_die`/`s_slave`/`s_rehash`/`s_restart`) plus the `restart`→`server_reboot` shutdown path — to `ircd-common/src/ircd.rs`.
635 - **Cluster choice** — a connected component: the four signal handlers set the io_loop flags (`dorehash`/`dorestart`/`restart_iauth`), `restart` (called by Rust `list.rs`/`s_bsd.rs`/`s_serv.rs` + still-C `io_loop`) calls `server_reboot`. Deliberately *excludes* `setup_signals` (the installer — needs `dummy` + edits the shared forward-proto line 34; its own sub-phase), `io_loop`, `open_debugfile`, `bad_command`, `c_ircd_main`.
636 - **Seam / Guard** — one `#ifndef PORT_IRCD_SIGNALS_P7kk` over 73–215; the `#else` branch re-declares `s_rehash`/`s_slave` (not in `ircd_ext.h`) so the still-C `setup_signals` (line 1370) keeps its prototypes — `s_die`/`s_restart`/`restart`/`server_reboot` are header-declared. `-DPORT_IRCD_SIGNALS_P7kk` appended to the `ircd_link.o` recipe; the cref oracle keeps the full unguarded `ircd.o`. Confirmed `nm target/debug/ircd` shows `T` for all six from Rust.
637 - **De-static** — `dorehash`/`dorestart`/`restart_iauth` (`volatile static int` → `volatile int`): read by the still-C `io_loop`, written by the Rust handlers, so one definition must serve both — they stay C-defined in `ircd_link.o`, Rust references them through a local `extern "C"` block; de-static also yields `cref_dorehash`/… for L1. `s_rehash`/`s_slave` (+ the line-37 forward proto) de-static'd so the prefix-rename exports `cref_s_rehash`/`cref_s_slave` (the L1-cref-static-symbol limit).
638 - **Config-resolved body** — `POSIX_SIGNALS`=1 (the `sigaction` re-arm in each handler compiles), `RETSIGTYPE`=void, `USE_IAUTH` ON (`s_slave` + the SIGCHLD arm), `USE_SYSLOG` UNDEF (every syslog/closelog/openlog arm dropped), `UNIXPORT` UNDEF (`s_die`'s unix-socket unlink loop dropped), `DEBUGMODE` OFF (`Debug()` no-ops), not `__FreeBSD__`. `MAXCONNECTIONS`=50; `SCH_NOTICE`=`ServerChannels_SCH_NOTICE`.
639 - **Faithfulness** — the `sbrk(0)-sbrk0` byte delta is `(brk as usize).wrapping_sub(sbrk0 as usize) as u32` fed to the variadic `%u`; `s_die` broadcasts `:%s SDIE` via `sendto_serv_v` with `(*me.serv).sid`; `restart`/`server_reboot` notice via `sendto_flag(SCH_NOTICE,…)`; `s_restart`'s `BOOT_TTY`→`fprintf(stderr)`+`exit` arm uses the module's `stderr_ptr()` helper; the fd-close sweep is `for i in 3..MAXCONNECTIONS`. `IRCD_PATH` (Makefile var, absent from bindgen) plumbed via build.rs `cargo:rustc-env=IRCD_SERVER_PATH` → `ircd_sys::SERVER_PATH` for `server_reboot`'s `execv(IRCD_PATH, myargv)` (the MOTD/PID/IAUTH path precedent). The `fn as usize` sigaction-handler casts go through an explicit `unsafe extern "C" fn(c_int)` pointer (no warning).
640 - **Callees** — `flush_connections`/`logfiles_close`/`mybasename` (Rust/P1), `ircd_writetune` (P7c, Rust), variadic `sendto_serv_v`/`sendto_flag` (C trampolines → P8); libc `sigaction`/`sigemptyset`/`sigaddset`/`sbrk`/`close`/`isatty`/`execv`/`exit`/`fprintf`. Globals `me`/`tunefile`/`sbrk0`/`myargv`/`bootopt` from bindings; the de-static'd flags from the local extern block.
641 - **L1** — `ircd_signals_diff.rs` (3 tests): `s_rehash` ratchet 0→1, 1→2, 2→2; `s_slave` sets `restart_iauth`; `s_restart` sets `dorestart` with `BOOT_TTY` cleared — each zero-diff vs the `cref_` oracle on the respective flag. Serialized on `GLOBALS_LOCK` (the P7 L1 shared-global hazard); SIGHUP/SIGINT/SIGUSR1 dispositions snapshotted+restored (the handlers re-arm themselves). The terminating arms (`s_die`/`restart`/`server_reboot` `exit`/`execv`; `s_restart`'s `BOOT_TTY` exit) are not run — faithful by inspection.
642 - **L2** — boot gate: the still-C `setup_signals` now installs the Rust handlers on every `ircd-golden` boot; `golden_registration` (x2), `golden_s_serv_shutdown` (die/restart/rehash *reject* + `rehash_success` — the io_loop reading the de-static'd `dorehash`), `golden_s_serv_maint` (die/restart reject) all byte-identical. `golden_s_misc::stats_t` fails on the documented pre-existing reference-C uninitialized-garbage flake (`…743360Sq` on the **reference** side; Rust correctly emits `0Sq/0Yg/0Fl`) — see the p5-s2s-stats-flake note, not a regression.
643 - **S2S** — none needed: the signal cluster formats no command-driven remote-user wire fields.
644
645- **2026-06-07 — P7ll (`ircd.c` `setup_signals` — the boot signal installer) merged.** Ported the static `setup_signals(void)` (ircd.c:1388) to `ircd-common/src/ircd.rs`. It is the boot-time signal-disposition installer `main()` calls once (ircd.c:1033, after config read). P7kk deliberately left it to "its own sub-phase" because it references `dummy` and the four signal handlers — all of which are only now Rust, making it a clean leaf.
646 - **Cluster choice / Scope.** A self-contained installer: builds a `struct sigaction` and `sigaction()`s it onto SIGWINCH/SIGPIPE (SIG_IGN), SIGALRM (`dummy`), SIGHUP (`s_rehash`), SIGINT (`s_restart`), SIGTERM (`s_die`), SIGUSR1 (`s_slave`), SIGCHLD (SIG_IGN+`SA_NOCLDWAIT`). All callees are Rust: `dummy` (bsd.rs, P7a), `s_rehash`/`s_restart`/`s_die`/`s_slave` (ircd.rs, P7kk). The remaining `ircd.c` leaves are now only `bad_command` (usage→exit, untestable), `open_debugfile` (empty under DEBUGMODE-off), and the `c_ircd_main`/`io_loop` spine.
647 - **Guard / de-static.** `setup_signals` was `static` (declared in the line-34 group `static void open_debugfile(void), setup_signals(void), io_loop(void);`) → no `cref_` oracle symbol. Split it out: `open_debugfile`/`io_loop` stay in the static group; `setup_signals` becomes a plain `void setup_signals(void);` forward proto + its body wrapped in `#ifndef PORT_IRCD_SETUP_SIGNALS_P7ll` (the P7kk/P7jj precedent). The cref archive compiles without the PORT define → keeps the de-static'd body → the prefix-rename exports `cref_setup_signals`; `ircd_link.o` compiles with `-DPORT_IRCD_SETUP_SIGNALS_P7ll` (appended to the recipe in `ircd-sys/build.rs`) → body removed, `main()`'s call resolves to the Rust `#[no_mangle] setup_signals`. `nm target/debug/ircd` confirms `T setup_signals` from Rust.
648 - **Config-resolved body.** `POSIX_SIGNALS`=1 (setup.h:347) → the `sigaction` branch (not the `signal()` `#else`). `SIGWINCH` defined on Linux → its `sigaddset`+`sigaction` compile. `USE_IAUTH` ON → the SIGUSR1→`s_slave` arm + the SIGCHLD arm (with `act.sa_flags = SA_NOCLDWAIT`, defined on glibc/musl) compile. not `__FreeBSD__` → no SIGTRAP arm. `RESTARTING_SYSTEMCALLS` undef → no trailing `siginterrupt`.
649 - **Faithfulness.** The `sa_mask` is **cumulative** — `sigemptyset` is called exactly twice (once at the top before the SIG_IGN/dummy trio, once before SIGHUP), so SIGWINCH/SIGPIPE/SIGALRM share mask `{PIPE,ALRM,WINCH}` and SIGHUP…SIGCHLD accrete `{HUP}→{HUP,INT}→{HUP,INT,TERM}→…,USR1}→…,CHLD}`. Modelled exactly. The C `struct sigaction act;` leaves `sa_restorer` uninitialised, but glibc supplies its own restorer inside the `sigaction(2)` wrapper, so the *installed* (queried-back) disposition is identical in both worlds regardless; Rust `std::mem::zeroed()` for `act` is harmless. The `fn as usize` handler casts go through an explicit `unsafe extern "C" fn(c_int)` pointer.
650 - **Classification.** Boot callee (no `msgtab` entry), reached once from `main()`. → **L1 differential + L2 boot gate.** Unlike the wholly-terminating handlers (P7kk), the installer is differentially testable: it mutates process *signal dispositions*, not shared memory, and those snapshot/restore cleanly.
651 - **L1** — `setup_signals_diff.rs`, 1-case zero-diff vs `cref_setup_signals`, serialized on `GLOBALS_LOCK` (process-global dispositions; the P7 shared-global hazard). Snapshot all 8 dispositions → `setup_signals()` (Rust) → query the 8 → `cref_setup_signals()` → query the 8 → restore the originals. Asserts, per signal: `sa_flags` identical between worlds, `sa_mask` byte-identical (memcmp the `sigset_t`), and the **world-correct** handler is wired — SIG_IGN for SIGPIPE/SIGWINCH/SIGCHLD (identical across worlds), else the world's own symbol (Rust `dummy`/`s_rehash`/`s_restart`/`s_die`/`s_slave` vs `cref_dummy`/…); handler pointers differ *by design* (Rust vs cref symbol), the verified claim being "right handler on right signal with the right mask/flags". Plus a SIGCHLD `SA_NOCLDWAIT` / SIGWINCH+SIGPIPE flags-0 spot-check.
652 - **L2** — no new file. The still-C `main()` calls `setup_signals` on every `ircd-golden` boot, installing the Rust handlers; `golden_registration` (x2), `golden_s_serv_shutdown` (die/restart reject), `golden_s_serv_maint` (close/rehash reject + `rehash_success` — the io_loop reading the handler-set `dorehash`) all byte-identical = no regression.
653 - **S2S** — none: `setup_signals` formats no command-driven remote-user wire fields.
654
655- **2026‑06‑07 — P7mm (`ircd.c` `io_loop`) merged.** The event-loop body — the per-tick driver that the still-C `main` runs as `while (1) io_loop();` — is now Rust.
656 - **Cluster choice** — `io_loop` is the last substantive piece of I/O-core *logic* in `ircd.c`; only `c_ircd_main` (the boot/init sequence) and the trivial helpers `bad_command`/`open_debugfile` remain C, left for the final P7 drop step that removes `c_ircd_main` and `ircd.o`/`ircd_link.o` entirely.
657 - **Seam** — `io_loop` was `static void io_loop(void)`. Body guarded with `#ifndef PORT_IRCD_IO_LOOP_P7mm`; under the guard the file-top forward decl is split into a `static` proto for `open_debugfile` + `extern void io_loop(void);` so the still-C `main` (in `ircd_link.o`) resolves `io_loop()` to the Rust `#[no_mangle]` symbol. `-DPORT_IRCD_IO_LOOP_P7mm` appended to the `ircd_link.o` recipe in `ircd-sys/build.rs`. No cref-archive change (io_loop is `static` → no oracle needed).
658 - **Config‑resolved body** — locked config: `DELAY_CLOSE` OFF (the `nextdelayclose`/`delay_close` timer arm and its `delay = MIN(nextdelayclose, delay)` line dropped), `TKLINE` ON (`if (nexttkexpire && timeofday >= nexttkexpire) nexttkexpire = tkline_expire(0);` kept), `DEBUGMODE` OFF (the two `Debug(...)` no-ops and the trailing `checklists()` dropped). `TIMESEC` = 60, `MIN(a,b)` → `a.min(b)`.
659 - **Classification** — static utility, no `msgtab` entry, called only from `main`. **No L1**: `io_loop` is `static` so the cref archive exports no `cref_io_loop` (`l1-cref-static-symbol-limit`).
660 - **Faithfulness** — `static time_t delay` → a function-local `let mut delay` (it is unconditionally assigned before every read each call, so behaviorally identical). The `while (maxs--)` drain loop preserves the post-decrement semantics. Already-Rust siblings (`calculate_preference` P7t, `try_connections` P7gg, `check_pings` P7hh, `delayed_kills` P7ii, `restart` P7kk, `ircd_writetune` P7c) called directly; `tkline_expire`/`collect_channel_garbage`/`timeout_query_list`/`expire_cache`/`read_message`/`flush_fdary`/`start_iauth`/`flush_connections`/`rehash` and the `next*`/`fdas`/`fdall` globals via bindgen; `nextpreference`/`nextiarestart` (not in any `*_ext.h`) via a local `extern "C"` block — they remain C globals in `ircd_link.o`. `&me`/`&fdas`/`&fdall` via `std::ptr::addr_of_mut!`; `time(NULL)` → `libc::time(null)`; `restart("Caught SIGINT")` via a `c"…"` literal cast.
661 - **Verify** — `cargo build -p ircd-rs` 0 warnings; `nm target/debug/ircd | grep io_loop` shows global `T io_loop` (Rust, was static `t`). **L2** byte-identical across `golden_registration`, `golden_channel_join`, `golden_debug` (STATS m/u → count_memory/send_usage), `golden_s2s_link` (link burst + remote WHOIS + remote-quit round-trip) — every booted Rust ircd drives this loop.
662 - **Plan** — `docs/superpowers/plans/2026-06-07-p7mm-io_loop.md`.
663
664- **2026-06-07 — P7nn (`ircd.c` CLI boot helpers `bad_command` + `open_debugfile`) merged.** The last *non-spine* logic in `ircd.c` — two file-`static` helpers called only from `c_ircd_main`. Plan: [`docs/superpowers/plans/2026-06-07-p7nn-ircd-cli-helpers.md`](../superpowers/plans/2026-06-07-p7nn-ircd-cli-helpers.md).
665 - **Cluster choice** — `bad_command` (ircd.c:809) and `open_debugfile` (ircd.c:1372): two independent leaves with no shared state, both reached only from the boot spine (`bad_command` on argv-parse failure, `open_debugfile` unconditionally at boot). Ported together as the penultimate P7 step so the final step is `c_ircd_main` alone.
666 - **Config-resolved body** — `CMDLINE_CONFIG` undef → `bad_command`'s `[-f config]` `%s` slot = `""`; `DEBUGMODE` undef → its `[-x loglevel]` `%s` slot = `""` **and** `open_debugfile`'s entire body (`#ifdef DEBUGMODE`) compiles out → a pure no-op `return`. The Rust `bad_command` issues the two `libc::printf`s (the format literal with both `%s` args = `c""`) then `libc::exit(-1)`; `open_debugfile` is an empty fn.
667 - **Seam** — de-static'd both definitions **and** their prototypes (split `open_debugfile` out of the P7mm `io_loop` static-proto group, added a top-of-file `void bad_command(void);` so the still-C `c_ircd_main` keeps a declaration once the body is guarded out). Both bodies `#ifndef PORT_IRCD_CLI_HELPERS_P7nn`-guarded; new define added to the `ircd_link.o` recipe in `ircd-sys/build.rs`. The unguarded cref compile keeps the de-static'd bodies → `cref_bad_command`/`cref_open_debugfile`. RED confirmed (undefined `bad_command`/`open_debugfile` at link before the Rust defs); GREEN `nm target/debug/ircd` shows both `T` from Rust.
668 - **Classification / L1** — utility/callee helpers (no `msgtab` entry). `ircd_cli_helpers_diff.rs`, 2 cases, zero-diff vs `cref_`, serialized on `GLOBALS_LOCK`: (1) `bad_command` is `fork()`-isolated per world — child dups stdout into a pipe, calls the fn (prints + `exit(-1)`), parent drains the pipe + `waitpid`; asserts captured stdout byte-identical **and** wait status identical (`exit(-1)` → `WEXITSTATUS==255`). (2) `open_debugfile` no-op contract via the inverse invariant: snapshot fd 2's `fstat` dev/ino, call both worlds, assert fd 2 unchanged (DEBUGMODE off → it must NOT redirect stderr).
669 - **L2 / S2S** — `golden_registration` byte-identical (`open_debugfile` no-op on every boot; `bad_command` unreachable from a valid boot). No S2S — neither helper formats remote-user wire fields.
670
671- **2026-06-07 — P7oo (`ircd.c` `c_ircd_main` — the boot spine) merged. THE LAST C FUNCTION WITH LOGIC.**
672 - **Cluster choice** — `main` (renamed `c_ircd_main` via `-Dmain=c_ircd_main`; ircd.c:837–1226), the boot spine and the final unguarded C logic in the tree. Every other `ircd.c` function (P7c/P7t/P7gg–P7nn) was already ported leaf-first; this is the spine they hang off. After it, `ircd_link.o` holds only data globals (`me`, `bootopt`, the `next*` timers, `tunefile`, `dorehash`, …).
673 - **Seam** — `#[no_mangle] pub unsafe extern "C" fn c_ircd_main(argc, argv) -> c_int` in `ircd-common/src/ircd.rs`; guarded out of `ircd_link.o` with a new `-DPORT_IRCD_MAIN_P7oo` (single `#ifndef` over the whole `int main(...){…}` body). `ircd-rs/src/main.rs` is **unchanged** — it still calls `ircd_sys::c_ircd_main` (the manual extern decl in `ircd-sys/src/lib.rs`), which now resolves to the Rust definition at link. The cref archive keeps the full unguarded `ircd.o`, so `cref_c_ircd_main` still exists (un-runnable as an oracle). `nm target/debug/ircd` shows `T c_ircd_main`; `nm cbuild/ircd_link.o` shows no `main`/`c_ircd_main`, only data globals (`bootopt`, `me`, `nextping`, `tunefile`, …).
674 - **Config-resolved body** (verified in `cbuild/config.h`) — `CHROOTDIR` undef → no `chdir`/`chroot`/`ircd_res_init`; the `#if !defined(CHROOTDIR)` `setuid(euid)` block compiled. `ZIP_LINKS` undef → no `zlib_version` check; `-v` prints zlib "not used". `CMDLINE_CONFIG` undef → no `-f` case (`-f`→default→`bad_command`). `USE_SYSLOG` undef → no `openlog`/`syslog`. `DEBUGMODE` undef → `Debug()` no-ops, `-t` does no `setuid`, `-x` errors+`exit(0)`, no `-t`-without-`-x` check, `open_debugfile` no-op (P7nn), banner trailing `%s`=`"\n"`. `IRC_UID`/`IRC_GID` undef → the setuid-root guard compiled, the inner UID/GID block not. `USE_IAUTH` on → the `vfork`/`execl(IAUTH_PATH,IAUTH,"-X")`/`wait` iauth-presence check compiled. `IRCDCONF_DELIMITER='|'` reproduced as a literal for the `-v` banner.
675 - **Faithfulness notes** — `me.serv->sid` is `[c_char; 5]` (an array): C's `if (!me.serv->sid)` compares its address to NULL → always-false dead code; reproduced as a never-taken branch (`(*me.serv).sid.as_ptr().is_null()`, `#[allow(useless_ptr_null_checks)]`). `configfile`/`tunefile` keep their C static-initializers (`IRCDCONF_PATH`/`IRCDTUNE_PATH`) — Rust reads the globals, never re-inits defaults. Paths via the existing `ircd_sys` consts (`MOTD_PATH` for `read_motd`; `IAUTH_PATH`/`IAUTH` for the iauth `execl`). `stderr` fatal messages via the existing `stderr_ptr()` + `libc::fprintf`; banner/`-v` via `libc::printf`. The argv walk is a literal translation of `--argc > 0 && (*++argv)[0] == '-'` with a raw `*mut *mut c_char` cursor + short-circuit-preserving control flow. `vfork` kept (`#[allow(deprecated)]`) to match C (child immediately execs/_exits). `flags` is `c_long`, `aConfItem::status` is `u32` (cast accordingly).
676 - **Classification / L1 / L2 / S2S** — boot spine, not a `msgtab` handler. **L2-gated, no L1** (forks iauth, daemonizes, `loop { io_loop() }` never returns, mutates every global table + the `me` singleton → not unit-testable; the P7mm/P7jj precedent). **Verification:** the whole `ircd-golden` L2 suite boots the Rust ircd through this exact function and stays byte-identical vs reference-C. The lone failure is `golden_s2s_s_serv_stats`'s STATS "sq" (sendq) field — the **documented pre-existing flake** (`p5-s2s-stats-flake`): uninitialized-sendq garbage, non-deterministic (value changes every run). Proven NOT a regression by stashing P7oo and re-running on clean HEAD, where the Rust side shows the same non-deterministic garbage (`259171211542528kB` vs the P7oo run's `3544950…kB`). Flag arms beyond `-t`/`-s`/`-p standalone`, the iauth `vfork` (skipped by `-s`), the setuid-root guard, and the `BOOT_INETD` block are faithful-by-inspection (not reached by golden). No S2S (the function emits no command-driven remote-user wire fields).
677 - **→ P7 COMPLETE.** All C *logic* is now Rust. The remaining C in `ircd-sys` is data globals + the ~25 variadic sender trampolines (`sendto_one`/`sendto_flag`/`sendto_serv_butone`/… in `send_link.o`, `sendto_iauth`/`vsendto_iauth` in `s_auth_link.o`) — deleted in P8 when call sites adopt a non-variadic Rust sender API.