xeiaso.net / ircd.rs
Proof of concept mechanical port of ircnet/ircd to Rust as part of a bit about C being insecure for network services
0
Fork 0

Configure Feed

Select the types of activity you want to include in your feed.

ircd.rs / PLAN-P7-progress.md
59 kB

P7 — I/O core + event loop + glue (per-cluster progress)#

One-line summary per cluster. Full entries: docs/progress-log/p7.md. Phase row + plan: PLAN.md P7; plans under docs/superpowers/plans/.

  • P7a DONE: common/bsd.c (socket write leaf) — ported deliver_it (the bottom of the send path: send() + WOULDBLOCK→0/FLAGS_BLOCKED + sendB accumulation + -errno) and the re-arming dummy signal stub to ircd-common/src/bsd.rs; both portable → bsd.o dropped outright (no _link.o). L1 differential (5 cases, full FLAGS_BLOCKED set/clear/untouched matrix) zero-diff vs cref_; L2 = existing golden suite (deliver_it is the universal write path) stays byte-identical; no S2S/no new L2 (utility TU).

  • P7b DONE: common/packet.c (inbound packet reassembler) — ported dopacket (the only exported symbol; ZIP_LINKS/DEBUGMODE off → just the plain while (length>0 && ch2) line-reassembly loop: CR-or-LF framing, receiveB/receiveM counter accumulation on me/cptr/acpt with the acpt==&me guard, cptr->count partial-line carry, BUFSIZE-1 overflow cap, and the parse→FLUSH_BUFFER/IsDead→exit_client/IsServer+UNKCMD return handling) to ircd-common/src/packet.rs; all callees already Rust → packet.o dropped outright (no _link.o). L1 differential (8 cases: single LF/CR, skipped extra CR-LF, two-lines-one-buffer, partial→continuation round-trip, acpt==&me vs distinct-acpt, 600-byte overflow truncation) zero-diff vs cref_; serialized on a GLOBALS_LOCK (shared me/cref_me). L2 = existing golden suite (universal read path) stays byte-identical (golden_registration confirmed); no S2S/no new L2 (utility TU, no IsServer-remote-field formatting).

  • P7c DONE: ircd.c tune-file pair (ircd_writetune/ircd_readtune) — ported the tune-file persistence pair (the 7 sizing globals ww_size/lk_size/_HASHSIZE/_CHANNELHASHSIZE/_SIDSIZE/poolsize/_UIDSIZE serialized one-decimal-per-line via sprintf, parsed back via sscanf, the USE_HOSTHASH/USE_IPHASH mirrors _HOSTNAMEHASHSIZE/_IPHASHSIZE = _HASHSIZE, the BOOT_BADTUNE silent-return-vs-exit(1) branch, and the lk_size = max(lk_size, ww_size) clamp) to ircd-common/src/ircd.rs. First partial port of the central ircd.c → ircd_link.o second-compile (-DPORT_IRCD_TUNE_P7c, carrying ircd.o's IRCD*_PATH/IAUTH machine-path defines so the surviving C is byte-identical); c_ircd_main/me/signals/restart/server_reboot/the tune callers stay C. L1 differential (ircd_tune_diff.rs, 9 cases: writetune byte-identical files incl. lk<ww + zero/INT_MAX/u32-max edges, readtune global round-trip incl. clamp + hash mirrors + missing-file + BOOT_BADTUNE silent return, write→read round-trip) zero-diff vs cref_, serialized on a GLOBALS_LOCK. No new L2 (utility TU, not a msgtab handler; ircd_readtune exercised at boot by the existing golden suite — golden_registration stays byte-identical); no S2S (no remote-field formatting). The exit(1) arm is untested-by-design (would kill the test process).

  • P7d DONE: s_bsd.c socket/file utility leaves — first (partial) port of the central I/O TU s_bsd.c; ported the three pure libc-wrapper leaves that touch none of the event-loop data globals: get_sockerr (getsockopt(SO_ERROR)-or-saved-errno), set_non_blocking (fcntl F_GETFL→F_SETFL|O_NONBLOCK; failure path calls the still-C report_error), and write_pidfile (truncate+create IRCDPID_PATH, sprintf("%5d\n", getpid())) to ircd-common/src/s_bsd.rs. Partial port via s_bsd_link.o (-DPORT_S_BSD_LEAF_P7d, carrying s_bsd.o's IRCDPID_PATH/IAUTH_PATH/IAUTH machine-path defines); the event loop + local[]/highest_fd/timeofday/FdAry + listeners + add_connection/read_message/report_error/get_my_name/add_local_domain/start_iauth stay C. IRCDPID_PATH (a command-line define, absent from bindgen) exposed to Rust via the P6m make---eval+rustc-env pattern → ircd_sys::PID_PATH. L1 differential (s_bsd_leaves_diff.rs, 4 cases: get_sockerr fd<0 errno-passthrough + valid-fd/no-error, set_non_blocking O_NONBLOCK-set-with-untouched-fd-inverse, write_pidfile identical-behavior) zero-diff vs cref_, serialized on GLOBALS_LOCK. No new L2 (utility TU; write_pidfile hit at boot, set_non_blocking/get_sockerr on every connect — covered by the existing golden boot/connect path, golden_registration byte-identical); no S2S (no remote-field formatting). Untested-by-design: get_sockerr's err!=0 branch + set_non_blocking's fcntl-failure→report_error branch (need a pending-error socket / bad fd); write_pidfile's byte rendering is pinned only where IRCDPID_PATH is writable (its dir is absent in the sandbox → both worlds no-op identically).

  • P7e DONE: s_bsd.c name-resolution leaf (add_local_domain) — ported the next-easiest s_bsd.c leaf after the P7d socket/file trio: add_local_domain (strip one trailing . + size++; if the name is unqualified, lazily ircd_res_init() when !(options & RES_INIT), then append "." + ircd_res.defdname iff defdname[0] and strlen(defdname)+2 <= size) to ircd-common/src/s_bsd.rs. Touches none of the event-loop globals — its only dependency is the resolver state (ircd_res/ircd_res_init), already Rust since P6. Partial port via the existing s_bsd_link.o seam with a new guard -DPORT_S_BSD_LEAF_P7e (added alongside -DPORT_S_BSD_LEAF_P7d); get_my_name (its only in-TU caller, needs gethostname/gethostbyname/mysk) stays C. RED confirmed the undefined symbol referenced by the now-Rust s_conf.rs + still-C s_bsd.c (get_my_name/connect_server); after GREEN nm shows add_local_domain as T from Rust. L1 differential (add_local_domain_diff.rs, 6 cases: trailing-dot-strip/no-append, unqualified-append, the size-guard boundary len+1-vs-len+2 inverse, empty-defdname-no-append, the size++-enables-append faithfulness check, and the init-trigger branch via $LOCALDOMAIN for determinism — both worlds run their P6-verified-equivalent ircd_res_init) zero-diff vs cref_add_local_domain, isolated worlds (Rust reads the real ircd_res, oracle reads cref_ircd_res), serialized on GLOBALS_LOCK. No new L2 (callee TU, not a msgtab handler; runs at boot via s_conf.c read_conf + on connect_server — golden_registration byte-identical); no S2S (no remote-field formatting).

  • P7f DONE: s_bsd.c delayed-close leaf (delay_close) — ported the DELAY_CLOSE-gated (=15) delay_close (s_bsd.c:3359): a private static time-sorted linked list of fds awaiting a delayed close(), swept per call (expired entries, or — under fd pressure when is_delayclosewait > (MAXCLIENTS-is_localc)>>1 — the oldest quarter; fd==-2 from m_close forces close-all), then fd>=0 is queued at timeofday+15 (with set_non_blocking+shutdown(SHUT_RD)); returns the head entry's scheduled time or 0. Faithful: the unsigned int-u_long threshold (wraps), the time<now || tmpdel-- >0 short-circuit (tmpdel only decrements when not expired), the 46-byte (43 chars+\r\n+NUL) "Too rapid connections" error sent to the new fd. Same s_bsd_link.o seam, new guard -DPORT_S_BSD_DELAY_CLOSE_P7f; reads the still-C istat (ircd.c) + timeofday (s_bsd.c) globals, calls the Rust set_non_blocking (P7d) + MyMalloc (P2). L1 differential (delay_close_diff.rs, 6 cases: queue-one + inverse time-eviction, unexpired-stays early-break, fd==-2 close-all drain, overflow drop-oldest-quarter, chronological-head ordering) zero-diff vs cref_delay_close, isolated worlds (real istat/timeofday vs cref_*), serialized on GLOBALS_LOCK (incl. a reset() to drain the persistent static lists between tests). No new L2 (callee, not a msgtab handler — hit by the io_loop delay_close(-1)/m_close/connection-close paths; golden_registration byte-identical); no S2S (no remote-field formatting).

  • P7g DONE: s_bsd.c fd-teardown leaf (close_client_fd) — ported the descriptor-teardown leaf close_client_fd (s_bsd.c:1270): closes authfd then fd (flushing its sendQ first via the Rust flush_connections, removing it from fdas/fdall via the Rust del_fd + clearing local[fd]), then drains sendQ/recvQ (DBufClear→dbuf_delete) and zeroes passwd. Config-resolved: SO_LINGER defined (the linger blocks compile, fired only when exitc==EXITC_PING), ZIP_LINKS off (zip_free omitted). All real callees already Rust (flush_connections P3, del_fd P2, dbuf_delete P1); only report_error stays C (already an extern "C" decl since P7d; fires solely on a setsockopt(SO_LINGER) failure). Same s_bsd_link.o seam, new guard -DPORT_S_BSD_CLOSE_FD_P7g; reads the still-C local[]/fdas/fdall globals. L1 differential (close_client_fd_diff.rs, 6 cases: client both-fds, server + listener IsServer||IsListener fdas+fdall arm, fd<0 only-authfd-closed, both-fds<0 no-op, and the inverse-of-insert recvQ-drain + passwd-zero) zero-diff vs cref_close_client_fd, isolated worlds (real local/fdas/fdall + Rust flush_connections/del_fd vs cref_*), serialized on GLOBALS_LOCK; inverse invariants checked (fd actually closed via EBADF, local[fd]==NULL, array slot freed). exitc=0 everywhere → the SO_LINGER/report_error branches untested-by-design; the sendQ flush-then-clear (live socket I/O) is L2. No new L2 (callee, not a msgtab handler — hit on every disconnect via close_connection/exit_client; golden_registration incl. quit/reuse byte-identical); no S2S (no remote-field formatting).

  • P7h DONE: s_bsd.c connection-teardown leaf (close_connection) — ported the bookkeeping layer directly above the P7g close_client_fd: close_connection (s_bsd.c:1341) bumps the per-class ircstp stats (is_sv/is_cl/is_ni + byte/time accumulators), drops outstanding DNS queries (del_queries), reschedules server reconnect (find_conf_exact→nextconnect with the HANGONGOODLINK/HANGONRETRYDELAY clamp), schedules a hang-on retry for an aborted handshake/connect, notifies iauth (sendto_iauth "%d D") + decrements the P-line acceptor's clients refcount (recursing into close_connection(acpt) when the acceptor itself goes illegal), tears the descriptors down via the Rust close_client_fd, unlinks an illegal listener from ListenerLL, then det_confs_butmask(cptr,0) + cptr->from = NULL. Config-resolved: USE_IAUTH ON → the sendto_iauth block compiles; DEBUGMODE off. All callees already resolvable (del_queries/find_conf_exact/det_confs_butmask Rust since P6; sendto_iauth the variadic C trampoline; close_client_fd Rust P7g). Same s_bsd_link.o seam, new guard -DPORT_S_BSD_CLOSE_CONN_P7h; reads the still-C ircstp/nextconnect/ListenerLL/timeofday/me globals. L1 differential (close_connection_diff.rs, 6 cases: server/client/unknown stats accounting, handshake+connecting nextconnect = now+30, P-line acceptor refcount 5→4, illegal-listener ListenerLL unlink with the inverse — node gone, head intact, from NULL, confs detached) zero-diff vs cref_close_connection, isolated worlds (real ircstp/nextconnect/ListenerLL/local/fdas/fdall/me/istat vs cref_*), serialized on GLOBALS_LOCK; me.fd/adfd pinned to -1 (inner flush_connections else-branch + sendto_iauth no-op). No new L2 (callee, not a msgtab handler — hit on every disconnect via exit_client; golden_registration incl. quit/reuse byte-identical); no S2S (formats no remote-user fields). Untested-by-design: the recursive close_connection(acpt) (needs a fully-illegal acceptor conf) + the find_conf_exact reconnect-reschedule arm (NULL with no conf loaded) + the sendto_iauth wire emission (L2, variadic trampoline).

  • P7i DONE: s_bsd.c listener-list teardown leaf (close_listeners) — ported the layer directly above P7g/P7h: close_listeners (s_bsd.c:427) walks the ListenerLL doubly-linked list and tears down every listener whose conf has gone illegal (IsIllegal(aconf)) — clients>0 → the Rust close_client_fd (fd torn, node stays in the list), clients≤0 → the Rust close_connection (fd torn + node unlinked + confs detached + from cleared); legal listeners untouched; the bcptr = acptr->next save handles the in-loop unlink. UNIXPORT off (config.h:339) → the IsUnixSocket/unlink block vanishes; both callees already Rust (P7g/P7h) → no new externs (reuses the existing conf_is_illegal helper). Same s_bsd_link.o seam, new guard -DPORT_S_BSD_CLOSE_LISTENERS_P7i; the only caller is the now-Rust s_conf.rs rehash (s_conf.c:1315). L1 differential (close_listeners_diff.rs, 5 cases: illegal-clients=0 unlinked, illegal-clients>0 stays-linked inverse, legal untouched (fd still open via fcntl), mixed 3-node middle-removed with the two legals relinked, all-illegal drains the list) zero-diff vs cref_close_listeners, isolated worlds, serialized on GLOBALS_LOCK. No new L2 (callee, not a msgtab handler — hit by rehash; golden_registration byte-identical); no S2S (no remote-field formatting).

  • P7j DONE: s_bsd.c listener-reactivation leaf (activate_delayed_listeners) — ported the counterpart to P7i's close_listeners: activate_delayed_listeners (s_bsd.c:526) walks the ListenerLL list and, for every listener flagged FLAGS_LISTENINACTIVE, calls listen(fd, LISTENQUEUE=128), clears the inactive bit, and counts it; if any were reactivated it emits one sendto_flag(SCH_NOTICE, "%d listeners activated", cnt) notice. No #ifdefs (DEBUGMODE off → no Debug); listen()'s return is ignored exactly as C. Same s_bsd_link.o seam, new guard -DPORT_S_BSD_ACTIVATE_DELAYED_P7j; no new still-C externs (sendto_flag is the existing variadic trampoline via ircd_sys::bindings, safe in L1 — short-circuits on NULL svc_ptr; LISTENQUEUE reproduced as a const since it's absent from bindgen). RED confirmed the undefined symbol referenced by the now-Rust s_serv.rs (m_set/burst) + s_misc.rs (check_split); after GREEN nm shows it T from Rust. L1 differential (activate_delayed_listeners_diff.rs, 5 cases: single-inactive→activated (inactive bit clear + socket actually listening via SO_ACCEPTCONN), single-active untouched (inverse), mixed [active,inactive,active] only-middle, empty no-op, all-inactive) zero-diff vs cref_activate_delayed_listeners, isolated worlds over real TCP-socket fds, serialized on GLOBALS_LOCK; inverse invariant — listeners never removed, already-active nodes untouched. No new L2 (callee, not a msgtab handler — hit by server-burst/rehash; golden_registration byte-identical); no S2S (formats only an integer count, no remote-user fields).

  • P7k DONE: s_bsd.c add_connection_refuse (connection-refuse leaf) — ported the refuse-path companion to add_connection (stays C): DELAY_CLOSE on → the delay=0 reset is not compiled, so delay is honored verbatim; close(fd) unless delayed, ircstp->is_ref++, acptr->fd = -2, then free_client (Rust, P2). Partial-ported via s_bsd_link.o (-DPORT_S_BSD_ADD_CONN_REFUSE_P7k). L1 differential (3 cases: delay==0 closes the fd, delay==1 leaves it open — the inverse pair, two refuses accumulate is_ref) zero-diff vs cref_; acptr is freed inside the call (UAF post-state) so the test compares side effects (is_ref delta + fd fate), and acptr->fd=-2 is untested-by-design (no surviving reader). No L2/no S2S (callee, not a msgtab handler; formats no remote-user fields).

  • P7l DONE: s_bsd.c setup_ping (UDP CPING-socket setup leaf) — ported the one-shot setup half of the server-to-server CPING feature: bind the single shared udpfd UDP socket. Idempotent (udpfd != -1 → return it, ignore aconf); config-resolved (AFINET=AF_INET6 → from is a sockaddr_in6, the SIN_* macros map to sin6_*; SETSOCKOPT length is sizeof(int)=4 not sizeof(*p); FNDELAY=O_NONBLOCK; DEBUGMODE/USE_SYSLOG off → no Debug/syslog). Faithful assign-then-test: udpfd set from socket() before the ==-1 check, each later failure does close(fd); udpfd=-1. Bind addr from a numeric aconf->passwd via the Rust inetpton (P1, falls back to minus_one=all-0xff) else in6addr_any. Partial port via s_bsd_link.o (-DPORT_S_BSD_SETUP_PING_P7l); udpfd stays a C global (the still-C read_message/polludp/check_ping read it) → Rust reads/writes the bindgen extern; the CPING-output siblings send_ping/check_ping/polludp stay C (share udpfd only, which stays C). RED confirmed the undefined symbol referenced by the now-Rust s_conf.rs rehash (s_conf.c:2041); after GREEN nm shows setup_ping T from Rust. L1 differential (setup_ping_diff.rs, 3 cases: fresh setup opens a non-blocking SOCK_DGRAM recorded in udpfd, idempotent second call returns the same fd unchanged — the inverse-of-state path, numeric-passwd "::1" drives the inetpton bind-addr branch) zero-diff vs cref_setup_ping, isolated worlds (real udpfd vs cref_udpfd), serialized on GLOBALS_LOCK with a reset() closing the prior socket between cases; compares the fd's properties (valid/non-blocking/SOCK_DGRAM) not its integer value (worlds open distinct sockets). No new L2 (callee, not a msgtab handler — hit by s_conf.rs rehash when a connect{} block has a port; golden_registration byte-identical); no S2S (formats no remote-user fields). Untested-by-design: the setsockopt/bind/fcntl failure arms (need an induced syscall failure; both worlds take the success path identically).

  • P7m DONE: s_bsd.c send_ping (UDP CPING-output leaf) — ported the output half of the server-to-server CPING (UDP ping) feature, the sibling to P7l's setup_ping: advance the per-connect{} sliding-window RTT statistics on the conf's aCPing (lseq++, seq++-then-conditional---, the seq*conFreq>1200 window adjusting ping/recvd) and sendto a Ping datagram (pi_cp/pi_id=htonl(PING_CPING)/pi_seq/pi_tv) over the shared udpfd. Config-resolved (AFINET=AF_INET6 → sin is sockaddr_in6; IN6ADDRSZ=16; DEBUGMODE/USE_SYSLOG off → no Debug/syslog; PING_CPING=0x02). Faithful: the C guard's first disjunct !aconf->ipnum.s6_addr is an array address → always false, so only AND16(ipnum)==255 (all-0xff unresolved sentinel) and cp->port==0 gate; all aCPing counters are u_long → unsigned window arithmetic; cp->lseq++ post-increments (the packet carries the old value). Partial port via the existing s_bsd_link.o seam, new guard -DPORT_S_BSD_SEND_PING_P7m; udpfd stays a C global (shared with the still-C setup_ping/polludp), Rust reads the bindgen extern → no new still-C externs (true leaf). L1 differential (send_ping_diff.rs, 7 cases: basic send with packet check, the three early returns — unresolved ipnum/zero port/zero conFreq, window recvd>0/recvd==0/recvd==seq) zero-diff vs cref_send_ping, isolated worlds (real udpfd vs cref_udpfd) each binding a ::1 UDP receiver to recvfrom the datagram; compares the deterministic aCPing post-state + the world-independent packet fields (pi_id/pi_seq), excluding pi_cp (live pointer) + pi_tv (gettimeofday); serialized on GLOBALS_LOCK. No new L2 (callee, not a msgtab handler — reached from the server-connect CPING path; golden_registration byte-identical); no S2S (formats no remote-user wire fields). Untested-by-design: pi_tv/pi_cp nondeterministic; the sendto failure path is (void)-ignored by C → unobservable.

  • P7n DONE: s_bsd.c open_listener/reopen_listeners (listener (re)construction wrappers) — ported the layer directly above the still-C socket constructor inetport: open_listener (s_bsd.c:467) (re)opens one listener (early-return on !IsListener || fd>0; UNIXPORT off → only the inet branch; a delayed-listen P-line before the first rejoin sets dolisten=0 + FLAGS_LISTENINACTIVE; dispatches to the still-C inetport + the Rust add_fd (P2)/set_non_blocking (P7d), registering a created fd in fdas/fdall), and reopen_listeners (s_bsd.c:512) walks ListenerLL reopening every legal closed-fd listener. Partial port via the existing s_bsd_link.o seam (-DPORT_S_BSD_OPEN_LISTENER_P7n); inetport (real socket/bind/listen, with its static set_sock_opts) stays C. L1 differential (open_listener_diff.rs, 6 cases: normal→listening, delayed-before-rejoin→inactive/not-listening, delayed-after-rejoin→listens (inverse), !IsListener no-op, fd>0 no-op, reopen_listeners skips illegal + already-open) zero-diff vs cref_ (observable fd properties — valid/SO_ACCEPTCONN/O_NONBLOCK — + flags/fdas/fdall/local[fd], since each world opens its own socket), serialized on GLOBALS_LOCK. No new L2 (callee, hit at boot/rehash; golden_registration byte-identical); no S2S (no remote-user wire fields).

  • P7o DONE: s_bsd.c add_listener (listener-constructor wrapper) — ported the layer directly above the now-Rust open_listener (P7n): add_listener (s_bsd.c:330) builds the me-like listener-stub aClient via the Rust make_client/make_link (P2) — FLAGS_LISTEN, SetMe (STAT_ME), self acpt/from, name = ME (= me.name), firsttime = time(NULL), a one-element confs link carrying the passed aconf — opens the socket via the Rust open_listener, then prepends the client to ListenerLL (back-linking the old head's prev when non-empty); returns 0. No #ifdefs. Partial port via the existing s_bsd_link.o seam, new guard -DPORT_S_BSD_ADD_LISTENER_P7o; all callees already Rust → no new still-C externs (add_listener referenced by the now-Rust s_conf.rs initconf). L1 differential (add_listener_diff.rs, 3 cases: into empty ListenerLL → sole node listening+registered with prev/next NULL, prepend before an existing node → new head + old head's prev back-linked (inverse), two consecutive calls → chain order + back-links) zero-diff vs cref_add_listener, isolated worlds (each opens its own socket / make_client allocates its own pointer → compares observable facts not raw fd/pointer values; me.name pinned to irc.test so inetport's ME-based sockhost matches; firsttime=time(NULL) asserted non-zero, not compared), serialized on GLOBALS_LOCK. No new L2 (callee, hit at boot/rehash via s_conf.c initconf; golden_registration byte-identical); no S2S (formats no remote-user wire fields).

  • P7p DONE: s_bsd.c inetport (listener socket constructor) — ported the layer directly below the now-Rust open_listener (P7n): the real socket constructor inetport (s_bsd.c:210). Creates an AF_INET6 (AFINET) stream socket, optionally bind()s it (if (port) → in6addr_any when ip is unset/non-numeric, else the Rust inetpton with the all-0xff minus_one fallback), applies its static callee set_sock_opts, fills cptr (auth = the ipmask canonicalized to "a.b.c.d" via DupString/MyMalloc; sockhost = "<ip-or-ME>.<port>" via sprintf "%-.42s.%u"; ip = the getsockname result; port), registers local[fd] = cptr, bumps highest_fd, and (when dolisten) listen(fd, 128); returns 0, or -1 on a refused (!ipmask/bad ipmask) or failed (socket/bind/getsockname) open. set_sock_opts is static (no cref_ oracle) → ported as a private Rust twin (config-resolved: SO_REUSEADDR=1, SO_RCVBUF/SO_SNDBUF/SO_SNDLOWAT=8192, sizeof(int) optlen; SO_DEBUG && 0 + SO_USELOOPBACK-undefined-on-Linux skipped); the C static set_sock_opts stays compiled for its other callers check_server_init/connect_server. Partial port via the existing s_bsd_link.o seam, new guard -DPORT_S_BSD_INETPORT_P7p; report_error + the variadic sendto_flag stay C, local/highest_fd/me/minus_one/replies read via bindgen externs. The cptr == &me inetd-on-fd-0 KLUDGE (writes replies[RPL_MYPORTIS] to fd 0) reproduced faithfully but never fires for a listener stub. L1 differential (inetport_diff.rs, 6 cases: normal port=0 listening (full compare — sockhost irc.test.0/auth 0.0.0.0/port/socket-options/local[fd]/highest_fd bump), dolisten=0 not-listening (the listen inverse), NULL-ipmask + invalid-ipmask 256.0.0.0 refuse (return -1 before any socket, the error inverse), wildcard in6addr_any bind → :: ip, ::1 inetpton bind → ::1 ip — the two bind cases serialized per world over one probed free port) zero-diff vs cref_inetport, isolated worlds (each opens its own socket → compares observable fd properties + world-independent struct fields, never the raw fd), serialized on GLOBALS_LOCK. No L2/no S2S (callee, hit at boot/rehash via open_listener; golden_registration byte-identical; formats no remote-user wire fields).

  • P7q DONE: s_bsd.c report_error (error-reporting output leaf) — ported the genuine clean leaf left in the central I/O TU: report_error (s_bsd.c:151) calls no other s_bsd.c function, so it ports in isolation, and the linker now resolves its 27 internal call sites (every still‑C report_error("…", cptr) + the already‑Rust leaves that called it via extern "C") to the Rust definition. Derives host via get_client_name (or "" when cptr==NULL), refines errtmp from the socket's pending SO_ERROR (the getsockopt readout, mirroring P7d's get_sockerr), fires the SCH_ERROR local‑opers notice (sendto_flag), sends a NOTICE back through a half‑open (Connecting/Handshake) server link's remote byuid introducer (find_uid→sendto_one, the :%s NOTICE %s : + text strcpy/strncat construction), then echoes the formatted error to stderr while serverbooting. Config‑resolved: SO_ERROR defined (getsockopt compiles), DEBUGMODE/USE_SYSLOG off (no Debug/syslog). The variadic sendto_flag/sendto_one/fprintf are called, not defined — legal in stable Rust (the trampolines stay C until P8). Partial port via the existing s_bsd_link.o seam, new guard -DPORT_S_BSD_REPORT_ERROR_P7q; reads the still‑C serverbooting/glibc stderr, calls the Rust get_client_name (P5)/find_uid (P4). L1 differential (report_error_diff.rs, 4 cases: serverbooting=1+cptr=NULL formatted stderr echo, the serverbooting=0 inverse gate → no output, cptr non‑NULL host=get_client_name, varied format/errno) captures fd 2 via a pipe redirect and asserts byte‑identical Rust‑vs‑cref stderr; serialized on GLOBALS_LOCK (sets serverbooting/cref_serverbooting + errno per case). No new L2 (output callee, not a msgtab handler — the SCH_ERROR error path is exercised by the existing golden suite; golden_registration byte‑identical); no S2S in L1. Untested‑by‑design: the SO_ERROR readout (needs a pending‑error socket; fd<0 skips it identically), the sendto_flag wire emission (L2, variadic), the bysptr remote NOTICE (S2S — needs a connecting peer with a remote byuid).

  • P7r DONE: s_bsd.c init_sys (fd-table boot leaf) — ported the cleanest remaining leaf in the central I/O TU: init_sys (s_bsd.c:693), called once from ircd.c main at boot. Config-resolved to a libc-only body: RLIMIT_FD_MAX is not defined on Linux → the whole getrlimit/setrlimit + exit(-1) rlimit block is excluded; USE_POLL=1 → the sequent setdtablesize block is excluded; Linux → the setlinebuf(stderr) branch. So the only callees are libc (setlinebuf/bzero/close) and the only state is the already-exported fdas/fdall/local globals (no shared private static with still-C code — unlike get_my_name/mysk). Body: line-buffer stderr, bzero the two fdarrays + highest=-1, NULL local[0..MAXCONNECTIONS=50] while close()ing fds 3..50 (0/1/2 kept — stderr stays open until daemonize). Partial port via the existing s_bsd_link.o seam, new guard -DPORT_S_BSD_INIT_SYS_P7r; fdas/fdall via bindgen externs, local[] via the existing local_base() helper. RED confirmed the undefined symbol referenced by still-C ircd.c:1010; after GREEN nm shows init_sys T from Rust. L1 differential (init_sys_diff.rs, 3 cases: fresh-init zeroes arrays + NULLs local + inverse-of-dirty invariant, closes fds 3..N, keeps 0/1/2 open) zero-diff vs cref_init_sys — fork-isolated per world (the close loop is destructive to the test process's fds → each world runs in a forked child, results returned via mmap(MAP_SHARED|MAP_ANONYMOUS) which survives the close loop), serialized on GLOBALS_LOCK. No new L2 (boot callee, not a msgtab handler — the existing golden suite boots through it, golden_registration byte-identical); no S2S (formats no remote-user fields). Untested-by-design: setlinebuf(stderr) (unobservable); the rlimit/exit arms don't compile under the locked config.

  • P7s DONE: s_bsd.c get_my_name (server-own-hostname resolver) + de-static mysk — ported the most leaf-like remaining s_bsd.c function after P7d–P7r: get_my_name (s_bsd.c:2940), which at boot resolves the server's canonical hostname into me.name (gethostname → add_local_domain → gethostbyname(cname)||gethostbyname(name) + the h_aliases walk, picking the mycmp(ME) match) and initialises the outgoing-bind source address mysk (bzero + sin6_family=AF_INET6/sin6_port=0, then the M-line find_me()->passwd via inetpton with the minus_one all-0xff fallback when it's a digit-led non-v6). Its only in-TU callee add_local_domain is already Rust (P7e); all other callees are libc or already-Rust (find_me P6, inetpton/mycmp P1, minus_one/me bindgen). The single blocker — the file-private static struct SOCKADDR_IN mysk (s_bsd.c:55) shared with the still-C check_client (localhost detect) / connect_inet (outgoing bind) — was broken by de-static'ing mysk (a behaviour-preserving storage-class change: single TU, no other mysk), which also makes the cref archive export cref_mysk (the objcopy prefix-rename only follows global symbols — the L1 static-symbol limit), giving the L1 test a full cross-world mysk compare. Config-resolved: HAVE_GETIPNODEBYNAME undef → plain gethostbyname; DEBUGMODE off; the mysk.SIN_ADDR write at s_bsd.c:3012 is dead #if 0. Partial port via the existing s_bsd_link.o seam, new guard -DPORT_S_BSD_GET_MY_NAME_P7s; gethostbyname declared via a local extern (absent from the libc crate). L1 differential (get_my_name_diff.rs, 6 cases: M-conf NULL-passwd addr-zero, non-digit-passwd addr-zero inverse, valid 2001:db8::1 → parsed addr, digit-but-invalid 9zz → minus_one, resolvable localhost cname → gethostbyname+alias-loop, empty cname → BadPtr early return) zero-diff vs cref_get_my_name — both worlds call the same libc gethostname/gethostbyname (identical results in one run) + a shared conf/cref_conf M-conf, and the shared-but-isolated me/cref_me ME is pinned to irc.test; asserts the name output buffer + the full 28-byte mysk/cref_mysk agree, serialized on GLOBALS_LOCK. No L2/no S2S (boot callee, not a msgtab handler; the existing golden boot exercises it — golden_registration byte-identical; formats no remote-user wire fields). Untested-by-design: the resolved hostname is host-dependent (the test asserts the two worlds agree, not a fixed string); the gethostname == -1 early return needs an induced failure (both worlds take the success path identically).

  • P7t DONE: ircd.c calculate_preference (AC preference leaf) — ported calculate_preference (ircd.c:387, the auto-connect preference recompute called periodically from io_loop): walks the global conf list, fires the already-Rust send_ping (P7m) on every AC-able connect{} C-line (CONF_CONNECT_SERVER|CONF_ZCONNECT_SERVER + port>0), then derives pref from that conf's aCPing window stats (or the -1 sentinel when seq==0/recvd==0). Partial-port via the existing ircd_link.o second-compile, new guard -DPORT_IRCD_CALC_PREF_P7t (the C body #ifndef-guarded with an #else extern prototype so the still-C io_loop caller keeps a declaration). Faithfulness: calls the libc pow symbol (not f64::powf — last-ULP drift would corrupt the (u_int)(f*100.0) truncation); final cast reproduces C double→u_int→int pref. L1 differential (5 cases: skips, recvd==0 sentinel, full-window compute, mixed list) zero-diff vs cref_ (isolated conf/cref_conf worlds, serialized on GLOBALS_LOCK). L2 = existing golden boot stays byte-identical (locked config has no connect{} C-lines → loop body is a no-op); no S2S (utility, no remote-user wire fields). Note: the cp==NULL sentinel clause is dead defensive code — send_ping dereferences cp->port first.

  • P7u DONE: s_auth.c iauth /STATS reporters (report_iauth_conf/report_iauth_stats) — opened the last P7 TU by porting its two cleanest leaves: list-walking reporters that emit RPL_STATSIAUTH/RPL_STATSDEBUG per iauth_conf/iauth_stats LineItem node via the variadic sendto_one (report_iauth_conf gated on adfd >= 0). De-static'd the two file-static list heads (the P7s mysk precedent) so the still-C read_iauth writer keeps them while the Rust readers reference them via extern; partial-ported via new s_auth_link.o (-DPORT_S_AUTH_REPORT_P7u). L1 sendQ-capture differential zero-diff (6 cases incl. adfd<0 + empty-list inverses); golden byte-identical (no iauth in golden → reporters are no-ops); no S2S (no remote-user fields).

  • P7v DONE: s_auth.c set_clean_username (last pure-logic leaf) — ported set_clean_username (s_auth.c:44; derives cptr->username ≤USERLEN+NUL from the raw ident reply cptr->auth: dirty-prefix - on [/@/over-length/leading-:/embedded-whitespace, copy ≤USERLEN chars dropping @/[/whitespace, then free+redirect auth at the interior username buffer when equal else bump istat.is_auth/is_authmem) to ircd-common/src/s_auth.rs. De-static'd (behaviour-preserving — single TU) so nm -g emits cref_set_clean_username and the still-C callers (read_iauth/start_auth) resolve to the Rust def once the body is #ifndef PORT_S_AUTH_CLEAN_USERNAME_P7v-guarded out of s_auth_link.o. L1 differential (9 cases: free path clean-fits/exact-USERLEN/empty, istat path @/[/over-length/leading-:/interior-whitespace, inverses trailing-whitespace-not-dirty-but-unequal + NULL-auth early-return) zero-diff vs cref_ on the full username[11] buffer + is_auth/is_authmem deltas + the auth==&username self-pointer predicate; serialized on GLOBALS_LOCK (shared istat). L1 is the gate (utility/callee TU, reached only from the still-C iauth/ident I/O the golden harness doesn't run); golden_registration stays byte-identical (no-regression); no S2S (no remote-user fields).

  • P7w DONE: s_auth.c ident-protocol I/O pair send_authports/read_authports — ported the RFC1413 ident query/reply pair to ircd-common/src/s_auth.rs (the leaf relative to the still-C start_auth + the s_bsd.c event loop at s_bsd.c:2363/2368). send_authports: getsockname/getpeername(fd)→"theirport , ourport\r\n"→write(authfd), with the authsenderr failure path (ircstp->is_abad++, close authfd, highest_fd walk past NULL local[], authfd=-1, clear FLAGS_AUTH|FLAGS_WRAUTH); success clears only FLAGS_WRAUTH. read_authports: read buffered across partial reads via cptr->count, sscanf the "%hd , %hd : USERID : %*[^:]: %512s" grammar, set auth (OTHER→--prefixed MyMalloc, else mystrdup) + set_clean_username (P7v sibling) + FLAGS_GOTID; no \n/\r yet → early return; bad/empty → is_abad++. Config-resolved (USE_SYSLOG/DEBUGMODE off → no syslog/get_client_name/Debug; AFINET=AF_INET6 → sockaddr_in6/sin6_port; BUFSIZE=512). index→strchr, rindex→strrchr, MyFree→free, ntohs→u16::from_be; sscanf driven through libc with the exact C format. Seam: -DPORT_S_AUTH_AUTHPORTS_P7w on s_auth_link.o; both already global in s_auth_ext.h → no de-static, the prototype comes from the header. L1 (authports_diff.rs, 10 cases) zero-diff vs cref_: send_authports over a real IPv6-loopback connected socket (so getsockname/getpeername populate sin6_port — an AF_UNIX socketpair leaves the port bytes untouched, a false diff) + the error/highest_fd-walk paths; read_authports over socketpair read-ends covering valid/OTHER/bad/ERROR/partial-early-return/EOF + the pre-auth free + istat decrement. Serialized on GLOBALS_LOCK. No L2/no S2S (utility TU, no msgtab entry, no live ident peer in the golden harness, no remote-user fields); existing golden suite (golden_registration) stays byte-identical.

  • P7x DONE: s_auth.c ident initiator start_auth — ported the RFC1413 query initiator (-DPORT_S_AUTH_START_AUTH_P7x on the s_auth_link.o recipe): opens the non-blocking authfd socket, derives local/peer addrs from getpeername/getsockname(cptr->fd), optionally overrides the bind source from the P-line TLS source_ip, then either hands off to iauth (adfd>=0: build "<fd> C <themip> <themport> <usip> <usport>" via inetntop+ipv6string+libc sprintf, sendto_iauth; success → close authfd/authfd=-1/FLAGS_XAUTH/return) or bind/connects to [peer]:113 (arm FLAGS_WRAUTH|FLAGS_AUTH, bump highest_fd). Config-resolved: NO_IDENT off (full body), USE_IAUTH on (early-return + handoff), USE_SYSLOG/DEBUGMODE off (no syslog/Debug), AFINET=AF_INET6. Calls the Rust set_non_blocking/report_error/inetntop/inetpton; calls the variadic sendto_iauth/sendto_flag (stay C). L1 differential (3 cases: XOPT_REQUIRED && adfd<0 early return; iauth-handoff query bytes byte-identical over a shared real IPv6-loopback cptr->fd; getpeername-failure authfd-reset) zero-diff vs cref_, serialized on GLOBALS_LOCK. Utility/callee TU (no msgtab) — L1 is the gate; golden suite stays byte-identical (golden_registration confirmed); no S2S (no IsServer/remote-field path).

  • P7y DONE: s_auth.c iauth-pipe line parser read_iauth — ported the last non-variadic logic in s_auth.c (s_auth.c:174; the slave-auth pipe drain: persistent obuf/olen partial-line carry + per-opcode dispatch >/G/O/V/a/A/s/S/U/u/o/D/K/k/garbage) to ircd-common/src/s_auth.rs; guarded the C body out via -DPORT_S_AUTH_READ_IAUTH_P7y on the s_auth_link.o recipe (#else extern proto for the still-C callers); the file-scope globals iauth_version/iauth_conf/iauth_stats/iauth_options/iauth_spawn stay C-owned in s_auth_link.o, referenced via extern; the variadic sendto_iauth/sendto_flag are CALLED (stay C). L1 differential (10 cases: O-options incl. flagless-reset, V replace+free, A/a conf add+clear, s/S stats reset+append, U/u ident, U with istat-decrement via per-world MyMalloc/cref_MyMalloc, gone/mismatch/garbage negatives, obuf/olen partial-line carry round-trip) zero-diff vs cref_; serialized on GLOBALS_LOCK. Finding: the per-client prefix uses the ported inetntop which expands ::1→0:0:0:0:0:0:0:1 (a faithful support.c quirk), so the iauth line must carry the expanded IPv6 form. No L2/S2S (utility TU, no msgtab entry, no IsServer/remote-field formatting; reached only via a live iauth slave the golden harness doesn't run). Only sendto_iauth/vsendto_iauth (variadic → P8) remain C in s_auth.c.

  • P7z DONE: s_bsd.c check_client (ordinary-client access check) — ported check_client (the access check run from the Rust register_user): resolve the getpeername peer addr → cptr->ip/port (via a private Rust twin of the file-static check_init), verify the DNS host↔ip mapping both ways (IP# Mismatch → clear hostp), then attach_Iline. NO_OPER_REMOTE/UNIXPORT undef → no trailing FLAGS_LOCAL block / no unix branch (so no mysk use). check_init stays compiled in s_bsd_link.o for the still-C check_server_init (GCC inlines it into that sole remaining caller) — the P7p set_sock_opts private-twin precedent. Guard -DPORT_S_BSD_CHECK_CLIENT_P7z. L1 4-case zero-diff (check_client_diff.rs: no-hostp/empty-conf→-2, hostp-addr-match→kept, hostp-mismatch→cleared, getpeername-fail→-1) over a shared real IPv6-loopback fd + empty conf/cref_conf; L2 = existing golden_registration (the success path: real I:line → 0 → client registers) byte-identical; no S2S (no IsServer branch — servers go through check_server_init/check_server).

  • P7aa DONE: s_bsd.c check_server_init + check_server (server-side access check) — ported the sibling of P7z check_client (-DPORT_S_BSD_CHECK_SERVER_P7aa): check_server_init attaches the C/N lines for the server name, confirms a C+N pair for a dialed link (IsConnecting/IsHandshake), fires an async DNS lookup of the conf host (count_cnlines + a stack Link{value.aconf, flags=ASYNC_CONF} + gethost_byname, nextdnscheck=1), then defers to check_server; check_server runs check_init (the P7z private Rust twin), validates the resolved host↔ip mapping (IP# Mismatch → drop hp, faithful four-c_ulong over-read), searches C/N lines by hostname/sockhost/ip#, det_confs_butmask, then on a C+N match attach_confs both + the AND16(ipnum)==255 dynamic-ip adoption + get_sockhost(c_conf->host). Both dropped from s_bsd_link.o; the file-static check_init (+ its prototype) loses its last C caller so it is guarded out under the same P7aa symbol. Config-resolved: UNIXPORT/DEBUGMODE off. Callees (attach_confs/find_conf/find_conf_host/find_conf_ip/attach_conf/det_confs_butmask/count_cnlines/gethost_byname/get_sockhost/add_local_domain) are Rust; sendto_flag is called (variadic → P8). L1 6-case zero-diff (check_server_diff.rs: init unknown/handshake deny; check_server bad-socket→-2; connected ::1 no-hostp/hostp-match/hostp-mismatch→-1 with agreeing ip/port/sockhost); the C+N success path (return 0/attach) is covered by the existing L2-S2S golden suite (golden_s2s_link/_eob/_who link a real peer the Rust ircd accepts through check_server_init — all green). No new L2 file.

  • P7bb DONE: s_bsd.c add_connection (inbound-connection acceptor) + private check_clones twin — port the per-accept() local-client constructor (make_client → resolve peer addr into ip/port/sockhost → clone-rate check → register fd in local[]/fdall/client list → start_auth) plus its file-static clone-rate callee check_clones (CLONE_CHECK; persistent backlog list, ported as a private Rust twin — no cref_ oracle) via -DPORT_S_BSD_ADD_CONN_P7bb. Config-resolved: NO_DNS_LOOKUP (hostp=NULL, no async lookup, USE_IAUTH alias-forwarding block compiled out), DELAY_CLOSE/CLONE_CHECK on, UNIXPORT off, AF_INET6. L1 differential (normal accept post-state + clone flood over the backlog + the getpeername-fail/IsIllegal refuse inverses; start_auth neutralized via iauth_options=XOPT_REQUIRED+adfd=-1) zero-diff vs cref_; L2 = golden_registration (every client connection flows through it) byte-identical, golden_s2s_link green (incoming server links too); no new S2S (formats no remote-user fields, no IsServer branch).

  • P7cc DONE: s_bsd.c connect_server + static connect_inet — the outbound server-connection setup (counterpart of P7bb add_connection): refuse if already linked, else build a client/server stub, connect_inet (socket/bind to mysk + dup-IP scan), connect(), re-attach+verify C/N lines, register the fd. connect_inet ported as a private Rust twin; set_sock_opts (last compiled C caller now gone) guarded out under the same -DPORT_S_BSD_CONNECT_SERVER_P7cc. Finding: the DNS block is dead under AF_INET6 (!aconf->ipnum.S_ADDR = array address, always false). L1 3-case zero-diff (already-present ±remote by, connect_inet-failure cleanup); no new L2 (golden/S2S dials into the ircd → outbound dial deferred to the event-loop/CONNECT L2).

  • P7dd DONE: s_bsd.c start_iauth (iauth subprocess respawn) — the deepest boot-subtree leaf (daemonize calls it). (Re)spawns the external iauth helper over an AF_UNIX socketpair, recording the parent end in adfd: BOOT_NOIAUTH + adfd>=0 + 90s-throttle guards, then socketpair → Rust set_non_blocking both ends → setsockopt(SO_SNDBUF/RCVBUF, IAUTH_BUFFER=65535) → fork (← vfork; identical here, libc deprecates vfork) → child close-loop/dup2/execl(IAUTH_PATH, IAUTH) → parent close; the non-first-call live-client burst as "<fd> O" lines. Statics last/first/iauth_pid → module-private; IAUTH_PATH/IAUTH expanded by build.rs into ircd_sys::IAUTH_PATH/IAUTH (the PID_PATH precedent). Guard -DPORT_S_BSD_START_IAUTH_P7dd on s_bsd_link.o. L1 3-case zero-diff (NOIAUTH + already-running early returns + the spawn post-state — adfd nonblocking, iauth_spawn++ — with bounded child reaping); burst + full spawn end-to-end → L2/soak (golden boots -t -s = BOOT_NOIAUTH); no S2S.

  • P7ee DONE: s_bsd.c daemonize (boot detach + resolver/iauth init) — ported the layer directly above the P7dd start_iauth (called once from ircd.c main at boot), now a clean leaf since its only non-libc callees init_resolver (P6) and start_iauth (P7dd) are Rust. Config-resolved: TIOCNOTTY defined on Linux (the ioctl block compiles); the setpgrp arm is the #else setpgrp(0, getpid()) branch (glibc setpgrp(void) ignores the args; declared 2-arg to mirror the source). Faithful: bootopt & BOOT_TTY → short-circuit straight to init_dgram (no fork/no fd close); else fclose(stdout)/close(1), (unless BOOT_DEBUG) fclose(stderr)/close(2), and on a console/tty-not-inetd fork() (parent exit(0)s to detach) → TIOCNOTTY ioctl → setpgrp → fclose(stdin)/close(0); then always resfd = init_resolver(0x1f) + start_iauth(0). Partial port via the s_bsd_link.o seam (-DPORT_S_BSD_DAEMONIZE_P7ee). L1 differential (daemonize_diff.rs, 1 case: the BOOT_TTY|BOOT_NOIAUTH short-circuit — init_resolver opens a valid resfd socket, start_iauth(0) reached-but-no-op under BOOT_NOIAUTH leaving adfd=-1 — the inverse check; both worlds identical) zero-diff vs cref_daemonize, serialized on GLOBALS_LOCK. Mostly untestable by design: the detach path forks (parent exit(0)s) + closes 0/1/2 — calling it destroys the harness, and even fork-isolation can't measure a function whose job is to detach; the only differentially-safe path (and the only one any harness takes — golden boots -t = BOOT_TTY) is the BOOT_TTY short-circuit. No new L2 (boot callee; golden_registration byte-identical via this path); no S2S (no remote-user fields). Only read_message (+ its statics polludp/check_ping) remains C in s_bsd.c.

  • P7ff DONE: s_bsd.c event-loop cluster read_message + 8 statics (completed_connection/read_listener/read_packet/client_packet/ircd_no_fakelag/do_dns_async/polludp/check_ping) — the body of io_loop and the last logic in s_bsd.c: build the read/write fd_set over fdp+udpfd/resfd/adfd → select() → dispatch resolver/UDP/iauth reads + auth-fd I/O + listener accept()s + writable sendQ flushes + readable packets + dead-socket exit_client. USE_POLL off → the select() path; the 8 statics → module-private Rust twins (no cref_ oracle); guard -DPORT_S_BSD_READ_MESSAGE_P7ff. With read_message ported, s_bsd_link.o has zero functions left — only the data globals. L1 = the differentially-safe empty-loop path (read_message_diff.rs, 2 cases zero-diff); L2 = the entire golden_*+golden_s2s_* suite byte-identical (every byte flows through it; only the known golden_s2s_s_serv_stats reference-C uninitialised-sendq flake fails — [[p5-s2s-stats-flake]]); destructive accept/read/write/exit + polludp/do_dns_async are L2-only by design.

  • P7gg DONE: ircd.c try_connections (auto-connect timer) — ported the static io_loop AC timer (walks conf, picks the best AC-able connect{} C-line by lowest-hold/best-pref/highest-class, splices the winner to the list tail, penalises its hold, then defers or dials via connect_server); de-static'd (mysk precedent) so the cref archive exports cref_try_connections, guarded -DPORT_IRCD_TRY_CONNECTIONS_P7gg in ircd_link.o with an #else extern proto for the still-C io_loop caller. DISABLE_DOUBLE_CONNECTS undef → dup-IP scan dead. L1 8-case zero-diff (all non-connect_server paths incl. the tail-splice + deferred-notice via iconf.aconnect=0); the dial path is L2-only (golden dials into the ircd — P7cc precedent); no S2S.

  • P7hh DONE: ircd.c check_pings (io_loop ping/timeout sweep) — ported the static io_loop timer helper (ircd.c:525): walks local[highest_fd..0], pings idle registered links (FLAGS_PINGSENT state machine), times out unresponsive ones (exit_client; servers get a "No response … closing link" notice; DNS/auth waiters reset or handed to iauth via sendto_iauth), and folds the soonest next-check time into the return value. De-static'd under -DPORT_IRCD_CHECK_PINGS_P7hh (the try_connections P7gg precedent) on the ircd_link.o recipe; #else extern proto for the still-C io_loop caller. Config-resolved: TIMEDKLINES off → kflag permanently 0 (find_kill/kill-notice + static lkill gone, timeout arm always "Ping timeout"); USE_IAUTH on; DEBUGMODE off. C goto ping_timeout modelled by guarding the if/else on the negated recently-active condition; bysptr kept outside the loop (never reset). L1 (check_pings_diff.rs, 7 cases) zero-diff vs cref_check_pings over isolated worlds (real local/highest_fd/me vs cref_*), serialized on GLOBALS_LOCK: empty, listener-skip, recently-active-no-ping, the PINGSENT ping-send branch (its inverse), young-unregistered, already-pinged-idle-below-2*ping, mixed multi-fd sweep — asserts per-client (flags,lasttime)+return. The exit_client timeout paths are L2-gated (destructive+variadic, the read_message/P7ff precedent). L2 = the ircd-golden suite runs check_pings every io_loop tick; golden_registration+golden_channel_join byte-identical, only the documented stats_t reference-C garbage flake remains. No S2S (no command-driven remote-field formatting).

  • P7ii DONE: ircd.c delayed_kills (io_loop K-line sweep) — ported the second io_loop timer helper (sibling of P7hh check_pings, ircd.c:447): runs only while rehashed > 0, walks local[dk_lastfd..j] and find_kills every local person, exit_clienting K-line matches. De-static'd under -DPORT_IRCD_DELAYED_KILLS_P7ii on ircd_link.o (the check_pings precedent; #else extern proto for the still-C io_loop caller). Config-resolved: MAXDELAYEDKILLS=200 > MAXCONNECTIONS=50 → j always clamps to 0 → the sweep always completes in one call (persistent statics reset every call; the return rehashed incomplete-batch path unreachable); TIMEDKLINES off → find_kill timedklines=0. L1 (delayed_kills_diff.rs, 6 cases) zero-diff vs cref_delayed_kills over isolated worlds (real local/highest_fd/rehashed vs cref_* + empty kconf → no kill), serialized on GLOBALS_LOCK: empty across rehashed∈{0,1,2}→return{0,0,1}, person-no-kline completes & survives (the inverse of the kill arm), non-person/NULL skipped, mixed sweep — asserts return + per-client (status,flags,still-in-local). The kflag==-1 kill arm (exit_client, destructive) is untested-by-design AND has no L2 path (golden never rehashes → delayed_kills' body isn't reached); golden_registration byte-identical (no-regression). No S2S (no remote-user wire fields).

  • P7jj DONE: ircd.c setup_me boot initializer — ported the me-singleton initializer (ircd.c:723, de-static'd + extern-declared, -DPORT_IRCD_SETUP_ME_P7jj on ircd_link.o) to ircd-common/src/ircd.rs: passwd-derived username/auth, get_my_name sockhost, the STAT_ME/FLAGS_OPER/FLAGS_EOB/SV_UID bits, server-name interning (find_server_num/find_server_string), make_user, istat.is_users/is_eobservers, client+SID hash registration, verstr=PATCHLEVEL, setup_server_channels. All callees already Rust; no variadic senders. L2-gated, no L1 (mutates 4 shared global tables + the me singleton + istat → not L1-isolatable; the P7dd/ee/ff precedent) — golden registration/lusers/s2s_server/s2s_info/s2s_map + 3 s_misc byte-identical (stats_t = documented pre-existing reference-C garbage flake). No S2S (no command wire output).

  • P7kk DONE: ircd.c signal-handler + reboot cluster (s_die/s_slave/s_rehash/s_restart/restart/server_reboot, ircd.c:73–215) — ported the SIGTERM/SIGUSR1/SIGHUP/SIGINT handlers + the restart→server_reboot shutdown path to ircd-common/src/ircd.rs via -DPORT_IRCD_SIGNALS_P7kk (single guard over the contiguous block; #else re-declares the two non-header handlers for the still-C setup_signals); de-static'd the dorehash/dorestart/restart_iauth flags (shared with the still-C io_loop; one C definition, Rust writes via a local extern "C" block) and s_rehash/s_slave (cref oracle). IRCD_PATH plumbed as ircd_sys::SERVER_PATH for server_reboot's execv. L1 differential (ircd_signals_diff.rs, 3 tests: s_rehash 0→1→2→2 ratchet, s_slave restart_iauth set, s_restart dorestart-when-not-tty) zero-diff vs cref_, serialized on GLOBALS_LOCK, signal dispositions saved/restored. L2 = boot gate (setup_signals installs the Rust handlers) + golden_s_serv_shutdown/_maint (die/restart/rehash reject + rehash_success io_loop path) byte-identical; the terminating arms (exit/execv) are faithful-by-inspection. No S2S (no command-driven remote-user wire fields).

  • P7ll DONE: ircd.c setup_signals (boot signal installer) — ported the static setup_signals (ircd.c:1388, called once from the still-C main) to ircd-common/src/ircd.rs, the last clean leaf before the c_ircd_main/io_loop spine; all callees are now Rust (dummy P7a; s_rehash/s_restart/s_die/s_slave P7kk). Config-resolved: POSIX_SIGNALS=1 (the sigaction branch), SIGWINCH defined, USE_IAUTH ON (s_slave+SIGCHLD/SA_NOCLDWAIT arms), not __FreeBSD__, no RESTARTING_SYSTEMCALLS; faithful cumulative sa_mask (sigemptyset called exactly twice). De-static'd under -DPORT_IRCD_SETUP_SIGNALS_P7ll (split out of the line-34 static proto group; the cref archive keeps the de-static'd body → exports cref_setup_signals) on the ircd_link.o recipe; nm confirms T setup_signals from Rust. L1 (setup_signals_diff.rs, 1 case) zero-diff vs cref_: snapshot all 8 dispositions → call Rust setup_signals → query → call cref_setup_signals → query → restore; asserts per-signal sa_flags + sa_mask byte-identical between worlds and the world-correct handler wired (SIG_IGN for PIPE/WINCH/CHLD identical; else Rust dummy/s_rehash/… vs cref_dummy/… — handler ptrs differ by design), serialized on GLOBALS_LOCK. L2 = the still-C main installs the Rust handlers on every golden boot → golden_registration/golden_s_serv_shutdown/golden_s_serv_maint (die/restart reject + rehash_success) byte-identical. No S2S (no command-driven remote-user wire fields).

  • P7mm DONE: ircd.c io_loop (the event-loop body) — ported the per-tick loop body (while(1) io_loop() in the still-C main now calls the Rust symbol) to ircd-common/src/ircd.rs via the ircd_link.o seam (-DPORT_IRCD_IO_LOOP_P7mm, io_loop de-static'd to extern). Config-resolved: DELAY_CLOSE off (timer+delay-MIN arms dropped), TKLINE on (tkline_expire arm kept), DEBUGMODE off (no Debug/checklists). Calls already-Rust siblings directly (calculate_preference/try_connections/check_pings/delayed_kills/restart/ircd_writetune); nextpreference/nextiarestart via a local extern "C" block (absent from *_ext.h). No L1 (static → no cref_io_loop oracle); L2 = whole golden suite (every booted Rust ircd runs the loop) byte-identical — registration/channel-join/debug-stats/s2s-link confirmed.

  • P7nn DONE: ircd.c CLI boot helpers (bad_command + open_debugfile) — ported the last two non-spine file-static helpers (both called only from c_ircd_main): bad_command (usage banner + exit(-1); config-resolved CMDLINE_CONFIG/DEBUGMODE off → both %s slots "") and open_debugfile (entire body #ifdef DEBUGMODE → a pure no-op under the locked config). De-static'd both (+ split the proto out of the P7mm io_loop group) so the cref prefix-rename exports cref_bad_command/cref_open_debugfile; guarded the bodies out of ircd_link.o under a single new -DPORT_IRCD_CLI_HELPERS_P7nn. L1 differential (ircd_cli_helpers_diff.rs, 2 cases) zero-diff vs cref_: a fork()-isolated stdout+exit-status diff for the terminating bad_command (byte-identical banner + WEXITSTATUS==255) and the no-op-contract inverse for open_debugfile (fd 2 fstat identity unchanged — it must NOT redirect stderr). L2 = golden_registration byte-identical (open_debugfile runs no-op on every boot). No S2S (no remote-user wire fields). Only c_ircd_main remains C in ircd.c.

  • P7oo DONE: ircd.c c_ircd_main — THE BOOT SPINE, the last C function with logic — ported main (renamed c_ircd_main via -Dmain=c_ircd_main, ircd.c:837) to ircd-common/src/ircd.rs as #[no_mangle] c_ircd_main, config-resolved to the locked build (CHROOTDIR/ZIP_LINKS/CMDLINE_CONFIG/USE_SYSLOG/DEBUGMODE/IRC_UID/IRC_GID OFF; USE_IAUTH/TKLINE ON; IRCDCONF_DELIMITER='|'): sbrk0/uid setup, the argv flag-parse loop, the setuid-root guard, the vfork/execl(IAUTH_PATH,IAUTH,"-X") iauth-presence check, the init*/initconf/listener-scan/M-line/SID/split checks + make_isupport, setup_me/check_class/ircd_writetune, the BOOT_INETD block, the startup banner, mysrand/daemonize/logfiles_open/write_pidfile/dbuf_init, and loop { io_loop() }. Guarded out of ircd_link.o by -DPORT_IRCD_MAIN_P7oo; ircd-rs/src/main.rs unchanged (still calls ircd_sys::c_ircd_main → resolves to the Rust def; nm confirms T c_ircd_main from Rust, and ircd_link.o now defines no main/c_ircd_main — only data globals). L2-gated, no L1 (the boot spine forks iauth, daemonizes, never returns — the P7mm/P7jj precedent): the whole ircd-golden suite boots through it byte-identical (the lone failure, golden_s2s_s_serv_stats's "sq" field, is the documented pre-existing p5-s2s-stats-flake uninitialized-sendq garbage — proven by re-running on clean HEAD, where the Rust side shows the same non-deterministic garbage). Flag arms beyond -t/-s/-p standalone, the iauth vfork (skipped by -s), the setuid-root guard, and BOOT_INETD are faithful-by-inspection. No S2S. → P7 COMPLETE: all C logic is now Rust; only data globals + the ~25 variadic sender trampolines remain.