P7 — I/O core + event loop + glue (progress log)#

The last faithful-port phase: s_bsd.c (select/poll loop, local[], highest_fd, timeofday, FdAry), packet.c, bsd.c, ircd.c (main, io_loop, signals, rehash/restart, tune file), plus the s_auth.c socket/ident/iauth-pipe I/O deferred from P5. Ported bottom-up (leaf-first), same mechanism as P6. One-line summaries: PLAN-P7-progress.md.

• 2026-06-05 — P7a (common/bsd.c) merged. First P7 step; the socket write leaf.

  • Cluster choice — bsd.c is the smallest remaining C TU (164 lines, 2 exported bsd_ext.h symbols): deliver_it and dummy. Leaf-first start of P7.
  • Config-resolved body — DEBUGMODE off → the writecalls/writeb[10] write-size histogram and all Debug(()) calls drop. HAVE_RELIABLE_SIGNALS undefined (not in setup.h/config.h) → dummy compiles the #ifndef branch and re-arms via signal() (SIGALRM/SIGPIPE/SIGWINCH; HPUX undefined, SIGWINCH defined on Linux) — the POSIX sigaction branch (#else, gated on POSIX_SIGNALS=1) is NOT compiled. EMSGSIZE defined (Linux) → it joins the WOULDBLOCK errno set in deliver_it.
  • Port — ircd-common/src/bsd.rs: deliver_it = send(2) wrapper mapping EWOULDBLOCK/EAGAIN/EMSGSIZE/ENOBUFS → 0 + FLAGS_BLOCKED, clearing FLAGS_BLOCKED
    • accumulating sendB on cptr/me/cptr->acpt (guarded acpt != &me) on success, returning -savederrno on a fatal error; dummy re-installs itself via libc signal. me via bindgen global (addr_of_mut!(me)); errno via __errno_location. Both #[no_mangle] extern "C" at the exact bsd_ext.h signatures. BSD_LINK_ANCHOR added to lib.rs::link_anchor().
  • Drop — both symbols portable → "bsd.o" added to PORTED in ircd-sys/build.rs and dropped outright (no _link.o, no linkage seam). The cref oracle keeps bsd.o in CREF_OBJS, so cref_deliver_it/cref_dummy (and the renamed cref_me) stay available for L1. Verified: nm target/debug/ircd shows deliver_it/dummy as T (from Rust); RED first confirmed exactly those two symbols undefined (referenced by send.rs::send_queued + C ircd.c/s_bsd.c).
  • Classification — utility/callee TU (neither symbol is a msgtab handler).
  • L1 (ircd-testkit/tests/bsd_diff.rs) — drives the Rust port (c_*) and the cref_* oracle over identically-set-up socketpairs; compares retval / cptr.flags / cptr.sendB / acpt.sendB / the me-global sendB (Rust→me, oracle→cref_me, the isolated-worlds pattern) / bytes the peer received. 5 cases covering the full FLAGS_BLOCKED matrix (the inverse-invariant rule): happy path CLEARS it, WOULDBLOCK (saturated non-blocking socket) SETS it + returns 0 + no counters, error (closed peer → -EPIPE) leaves it UNTOUCHED + no counters; plus the acpt == &me not-double-counted guard and dummy's SIGALRM/SIGPIPE/SIGWINCH re-arming (disposition is a real handler, not SIG_DFL/SIG_IGN — addresses differ Rust-vs-C by construction). Zero-diff. Finding: the tests share the me/ cref_me by-value globals, so they must serialize on a GLOBALS_LOCK mutex — cargo's parallel test threads otherwise race (one test zeroes me while another reads it). This is the L1 analogue of the L2 PORT_LOCK; a positive-only isolated run masked it (the diagnostic passed alone, the suite failed in parallel).
  • L2 — no new test. deliver_it is the universal write path (every reply → send_queued → deliver_it), so the entire existing ircd-golden suite covers it; confirmed golden_channel_join, golden_registration (client write path) and golden_s2s_nick (server write path) stay byte-identical. dummy is a boot-time signal handler with no client-reachable path.
  • S2S — no IsServer(cptr) / remote-field path in either function → no S2S test (the server write path is exercised by the existing s2s golden tests above).

• 2026-06-05 — P7b (common/packet.c) merged. The inbound packet reassembler; second P7 step (leaf-first, after bsd.c).

  • Cluster choice — packet.c is a single-symbol leaf (packet_ext.h exports only dopacket; nm cbuild/packet.o → T dopacket). 172 lines, but every callee is already Rust (parse P4, exit_client P5/s_misc, the me global, the IsDead/IsServer macros), so it ports clean with no new C dependency.
  • Config-resolved body — ZIP_LINKS off → the entire #ifdef ZIP_LINKS machinery (unzipped/unzip_packet/FLAGS_ZIPSTART/FLAGS_ZIP, and the compressed-flow while condition) is compiled out; the body that compiles is the #else loop while (length > 0 && ch2). DEBUGMODE off → no Debug(()).
  • Port — ircd-common/src/packet.rs: dopacket = the line reassembler. Bumps me/cptr/acpt receiveB by length once per call (with the acpt == &me double-count guard), walks the chunk copying into cptr->buffer + cptr->count, frames on CR or LF alone (Avalon's backward-compat rule — never the CR-LF pair), skips leading/blank CR-LF (ch1 == bufptr → continue), and on a complete line bumps the receiveM message counters (same guard), resets cptr->count = 0, and calls parse(): FLUSH_BUFFER → return immediately (cptr gone), IsDead → set exitc (EXITC_REG→EXITC_DEAD) + exit_client with "Max SendQ exceeded"/"Dead Socket", IsServer && FLAGS_UNKCMD → break. Non-terminators advance ch1 only while ch1 < bufptr + sizeof(buffer)-1 (overflow cap; always room for the NUL). Ends with cptr->count = ch1 - bufptr to carry the partial line forward. me via addr_of_mut!(me); inline is_dead/is_server mirror parse.rs; FLUSH_BUFFER/FLAGS_UNKCMD/EXITC_* from bindings. PACKET_LINK_ANCHOR added to lib.rs::link_anchor().
  • Drop — single portable symbol → "packet.o" added to PORTED in ircd-sys/build.rs and dropped outright (no _link.o, no linkage seam). The cref oracle keeps packet.o in CREF_OBJS, so cref_dopacket stays for L1. RED first confirmed exactly dopacket undefined (referenced 3× by C s_bsd.c::read_message); after GREEN, nm target/debug/ircd shows dopacket as T (from Rust).
  • Classification — utility/callee TU (dopacket is not a msgtab handler; it is called from s_bsd.c::read_message).
  • L1 (ircd-testkit/tests/packet_diff.rs) — isolated-worlds (Rust→me, oracle→cref_me); drives both over identically-built clients + buffers and compares full post-state: retval, cptr.count, the whole 512-byte reassembly buffer (parse tokenizes it in place → an end-to-end check), and the receiveB/receiveM counters on cptr/acpt/the me-global. 8 cases honoring the inverse-invariant rule (drive the buffering round-trip, not a happy frame): single LF, single CR (CR alone terminates), skipped extra/leading CR-LF, two lines in one buffer (parse twice), a partial line that does NOT call parse (count == length, receiveM unbumped) + its continuation completing the reassembled line, the acpt == &me guard (counters bumped once, not twice), a distinct acpt (its counters bumped too), and a 600-byte no-terminator line capping count at BUFSIZE-1 (511) with no OOB write. Inputs use parse()'s shallow paths (the parse_diff.rs proven set: ENCAP→m_nop and a 3-digit numeric from a STAT_UNKNOWN non-person) so post-state never diverges in deep handler state. Zero-diff. Finding: like bsd_diff (P7a), the tests share the me/cref_me by-value globals → they must serialize on a GLOBALS_LOCK mutex (cargo's parallel test threads otherwise race; a positive-only isolated run masked it — the diagnostic passed alone, the suite failed in parallel). This is the L1 analogue of the L2 PORT_LOCK.
  • L2 — no new test. dopacket is the universal inbound read path (every line a client/server sends → read_message → dopacket → parse), so the entire existing ircd-golden suite covers it; confirmed golden_registration (the full client read path) stays byte-identical.
  • S2S — the FLUSH_BUFFER / IsDead→exit_client / IsServer+FLAGS_UNKCMD branches need deep fixtures (a quit/sendq path, a linked server) but format no remote-user fields, and dopacket itself has no IsServer-remote-field formatting → no S2S test (the server read path is exercised by the existing s2s golden tests, which drive lines through this same reassembler).

• 2026-06-05 — P7c (ircd.c tune-file pair) merged. The third P7 step and the first (partial) port of the central driver TU ircd.c. Leaf-first within ircd.c.

  • Cluster choice — ircd_writetune/ircd_readtune (ircd.c:1437-1522) are a self-contained leaf: pure file I/O over the 7 runtime sizing globals, all callees already Rust (mybasename P1) or a P8-bound variadic C trampoline (sendto_flag). Both are exported in ircd_ext.h (nm cbuild/ircd.o → T ircd_writetune, T ircd_readtune) → the cref_* oracle already exists, no linkage seam needed.
  • Config-resolved body — USE_HOSTHASH + USE_IPHASH both ON (verified P2: 6 hash tables) → both #ifdef'd mirror assignments (_HOSTNAMEHASHSIZE / _IPHASHSIZE = t_data[2]) compile. USE_SERVICES/LOG_SERVER_CHANNELS OFF → sendto_flag is the plain server-notice path (early-returns when svchans[chan].svc_ptr is NULL, which it is in an uninitialised L1 world → safe to call from the test).
  • Port — ircd-common/src/ircd.rs (new module; pub mod ircd; + IRCD_LINK_ANCHOR in link_anchor()). ircd_writetune: truncate(filename,0) → open(O_CREAT|O_WRONLY,0600) → libc::sprintf the 7 globals with the exact "%d\n"×7 format (using libc so poolsize's u_int bits read through %d are byte-identical) → write → sendto_flag(SCH_NOTICE/SCH_ERROR,…) the outcome via mybasename. ircd_readtune: open(O_RDONLY) → read(…,100) → libc::sscanf the 7 ints; != 7 → close + (BOOT_BADTUNE ? silent return : fprintf(stderr)
    • exit(1)); else assign the 7 globals + the 2 hash mirrors + the lk_size = max(lk_size, ww_size) clamp. sendto_flag declared in a local extern "C" variadic block (void return; fmt: *mut c_char + cast literals). stderr reached via a local extern "C" { static mut stderr }.
  • Drop — partial port → "ircd.o" => "ircd_link.o" map in ircd-sys/build.rs::link_objs(); the ircd_link.o second-compile driven through make with an injected rule (like send_link.o) so make expands the recursive IRCD*_PATH/IAUTH path vars that the surviving C in ircd.c needs byte-identically, plus -DPORT_IRCD_TUNE_P7c. The C bodies are wrapped in #ifndef PORT_IRCD_TUNE_P7c in ircd/ircd.c. CREF_OBJS keeps the unguarded ircd.o → cref_ircd_writetune/cref_ircd_readtune survive for L1. RED first confirmed exactly ircd_writetune/ircd_readtune undefined (referenced by Rust whowas::grow_whowas + hash::bigger_hash_table AND C s_die/server_reboot/ c_ircd_main/io_loop); after GREEN, nm target/debug/ircd shows both as T (from Rust).
  • Classification — utility/callee TU (neither is a msgtab handler). ircd_writetune is called from s_die/server_reboot/rehash/main; ircd_readtune only from main() at boot.
  • L1 (ircd-testkit/tests/ircd_tune_diff.rs) — isolated-worlds (Rust port reads/writes the real bindgen globals; cref_ircd_* oracle reads/writes the cref_* renamed copies, confirmed present in libcref.a). 9 cases honouring the inverse-invariant rule: writetune → byte-identical files for a typical vector, lk_size < ww_size (legal on-disk), and the 0/INT_MAX/u32-max edge vector; readtune → identical 9 globals for a typical vector, the lk clamp (file lk(10) < ww(500) → both clamp to 500), the hash mirrors (both follow field 3), a missing file (globals untouched), and a malformed file + BOOT_BADTUNE (silent return, globals == seed); and the write→read round-trip (values survive, on both worlds + equal). Zero-diff. Serialized on a GLOBALS_LOCK mutex (the documented P7 L1 shared-global hazard — the sizing globals + bootopt + the tune file are process-global). The exit(1) arm (malformed file WITHOUT BOOT_BADTUNE) is untested by design — it would kill the test process — and noted as such.
  • L2 — no new test. ircd_readtune runs at server startup, so the existing ircd-golden boot path covers it; golden_registration confirmed byte-identical. No client command reaches either function under the locked config.
  • S2S — none. Neither function has an IsServer branch or formats remote-user fields.

• 2026-06-05 — P7d (s_bsd.c socket/file utility leaves) merged. The fourth P7 step and the first (partial) port of the central I/O TU s_bsd.c (3435 lines: the select/poll event loop, local[], highest_fd, timeofday, FdAry). Leaf-first within s_bsd.c.

  • Cluster choice — three small, self-contained libc-wrapper leaves that touch none of the event-loop data globals: get_sockerr (s_bsd.c:1503), set_non_blocking (s_bsd.c:1521), write_pidfile (s_bsd.c:817). All exported in s_bsd_ext.h (nm cbuild/s_bsd.o → T each) → the cref_* oracle already exists, no extra linkage seam. The heavier s_bsd leaves are deferred: report_error (an output fn — sendto_flag/sendto_one/syslog; L2-covered like the sendto_* family; set_non_blocking's error path calls it, kept C); and add_local_domain/get_my_name (pull in ircd_res/mysk/find_me/the gethostbyname path → a separate name-resolution cluster).
  • Config-resolved body — SO_ERROR defined → the getsockopt(SO_ERROR) block in get_sockerr compiles; DEBUGMODE off → write_pidfile's open-failure Debug else-branch is a no-op; no other #ifdef-gated bodies in the three.
  • IRCDPID_PATH — write_pidfile bakes in IRCDPID_PATH, a Makefile recursively-expanded path var passed only on s_bsd.o's command line (absent from bindgen). Exposed to Rust exactly as P6m did for IRCDMOTD_PATH: build.rs expands it via make -s --eval and emits cargo:rustc-env=IRCD_PID_PATH=…; ircd-sys/src/lib.rs re-exports pub const PID_PATH = env!("IRCD_PID_PATH"). The Rust write_pidfile opens CString::new(ircd_sys::PID_PATH) → identical path.
  • Port — ircd-common/src/s_bsd.rs (new module; pub mod s_bsd; + S_BSD_LINK_ANCHOR in link_anchor()). get_sockerr: read errno via *libc::__errno_location(), libc::getsockopt(SO_ERROR) when fd >= 0, override only when err != 0. set_non_blocking: libc::fcntl(F_GETFL) → fcntl(F_SETFL, res | O_NONBLOCK); both failure arms call the still-C report_error (declared in a local non-variadic extern "C" block; the two format literals passed as *mut c_char). write_pidfile: libc::truncate → open(O_CREAT|O_WRONLY,0600) → libc::sprintf(buff,"%5d\n",getpid()) → write(strlen) → close (libc verbatim so the rendered bytes are byte-identical).
  • Drop — partial port → "s_bsd.o" => "s_bsd_link.o" map in ircd-sys/build.rs::link_objs(); the s_bsd_link.o second-compile driven through make with an injected rule (like ircd_link.o) carrying -DPORT_S_BSD_LEAF_P7d plus s_bsd.o's -DIRCDPID_PATH/-DIAUTH_PATH/-DIAUTH machine-path defines (so the surviving C — start_iauth etc. — is byte-identical). The three C bodies are wrapped in #ifndef PORT_S_BSD_LEAF_P7d in ircd/s_bsd.c (two regions: write_pidfile, and the adjacent get_sockerr+set_non_blocking). CREF_OBJS keeps the unguarded s_bsd.o → cref_get_sockerr/cref_set_non_blocking/ cref_write_pidfile survive for L1. RED first confirmed exactly those three undefined (referenced by ircd.c, s_auth.c, and s_bsd.c's open_listener/start_iauth/read_message); after GREEN, nm target/debug/ircd shows all three as T (from Rust).
  • Classification — utility/callee TU (none is a msgtab handler). write_pidfile is called from ircd.c main(); set_non_blocking/get_sockerr from the connection-accept/close paths.
  • L1 (ircd-testkit/tests/s_bsd_leaves_diff.rs) — 4 cases, serialized on a GLOBALS_LOCK (the P7 L1 shared-global convention — write_pidfile writes the shared IRCDPID_PATH file and get_sockerr mutates the process errno). get_sockerr: fd<0 returns the saved errno (ECONNREFUSED) identically; a valid socketpair fd with no pending error returns the saved errno (EAGAIN) identically. set_non_blocking: the passed pipe fd gains O_NONBLOCK in both worlds, the fd NOT passed stays blocking (inverse-invariant). write_pidfile: identical file-state between the two worlds, with the exact "%5d\n" rendering pinned where the path is writable. Zero-diff. Untested-by-design (noted): get_sockerr's err != 0 branch (needs a pending-error socket) and set_non_blocking's fcntl-failure→report_error branch (needs a bad fd that passes the C guard).
  • L2 — no new test. write_pidfile runs at boot, set_non_blocking/ get_sockerr on every connect → the existing ircd-golden boot/connect path covers them; golden_registration confirmed byte-identical.
  • S2S — none. No IsServer branch, no remote-user field formatting.

• 2026-06-05 — P7e (s_bsd.c name-resolution leaf add_local_domain) merged. The fifth P7 step; the second leaf plucked from the central I/O TU s_bsd.c (after the P7d socket/file trio). Leaf-first within s_bsd.c.

  • Cluster choice — add_local_domain (s_bsd.c:99), the lone pure, deterministic name-resolution sub-leaf. It touches none of the event-loop data globals (local[]/highest_fd/timeofday/FdAry); its only dependency is the resolver state (ircd_res + ircd_res_init), already Rust since P6 (ircd-common/src/res_init.rs). Deferred: get_my_name (s_bsd.c:2926, its only in-s_bsd.c caller) pulls in gethostname/gethostbyname (real DNS, host- dependent → not L1-deterministic) plus mysk/find_me → a later cluster.
  • Config-resolved body — RES_INIT is defined (resolv_def.h:108) → the whole #ifdef RES_INIT body compiles; DEBUGMODE off → the Debug((DEBUG_DNS,…)) line is a no-op. Live body: strip one trailing . (and size++); if the name has no ., lazily ircd_res_init() when !(ircd_res.options & RES_INIT), then append "." + ircd_res.defdname iff defdname[0] and strlen(defdname)+2 <= size.
  • Port — added to ircd-common/src/s_bsd.rs (existing module). index→ libc::strchr, strcat/strlen verbatim; reads crate::res_init::ircd_res / calls crate::res_init::ircd_res_init() (the Rust resolver defs). RES_INIT as a local const RES_INIT: c_ulong = 0x1 (mirrors res_init.rs; options is u_long). The unguarded hname[strlen(hname)-1] last-char read is replicated faithfully (C does it unguarded; callers never pass an empty string).
  • Drop — partial port via the existing s_bsd_link.o seam: added -DPORT_S_BSD_LEAF_P7e to the s_bsd_link.o make-rule in ircd-sys/build.rs (alongside -DPORT_S_BSD_LEAF_P7d); wrapped the C body (s_bsd.c:99–129) in #ifndef PORT_S_BSD_LEAF_P7e. CREF_OBJS keeps the unguarded s_bsd.o → cref_add_local_domain + cref_ircd_res survive for L1. RED first confirmed the single undefined symbol, referenced by the now-Rust s_conf.rs (attach_Iline) and the still-C s_bsd.c (get_my_name/connect_server); after GREEN nm target/debug/ircd shows add_local_domain as T (from Rust).
  • Classification — utility/callee TU (not a msgtab handler). Called from s_conf.c:504 (now Rust) and s_bsd.c get_my_name/connect_server (still C).
  • L1 (ircd-testkit/tests/add_local_domain_diff.rs) — 6 cases, isolated worlds (the Rust port reads the real Rust ircd_res; the cref_ oracle reads the renamed cref_ircd_res), serialized on GLOBALS_LOCK (ircd_res + $LOCALDOMAIN are process-global). Honouring the inverse-invariant rule: (1) trailing-dot strip on an already-qualified name → no append; (2) unqualified + defdname + room → append; (3) the size guard at the boundary — size = len+1 must NOT append, size = len+2 must (the inverse of case 2); (4) empty defdname → no append; (5) the trailing-dot size++ is load-bearing — "irc." with size = len(defdname)+1 appends only because the strip bumps size to +2; (6) the init-trigger branch — options without RES_INIT + $LOCALDOMAIN set (deterministic, host-independent) → both worlds lazily run their P6-verified-equivalent ircd_res_init, populate defdname from env, append, and gain RES_INIT. Zero-diff vs cref_add_local_domain.
  • L2 — no new test. add_local_domain runs at boot via s_conf.c read_conf and on connect_server; the existing ircd-golden boot path covers it (golden_registration byte-identical). No client command reaches it under the locked config.
  • S2S — none. No IsServer branch, no remote-user field formatting.

• 2026-06-06 — P7f (s_bsd.c delayed-close leaf delay_close) merged. The sixth P7 step; the third leaf plucked from the central I/O TU s_bsd.c (after the P7d socket/file trio and the P7e name-resolution leaf). Leaf-first within s_bsd.c.

  • Cluster choice — delay_close (s_bsd.c:3359), the best remaining L1-deterministic s_bsd leaf. It owns a private static linked list of fds awaiting a delayed close(); its behaviour is a pure function of two C globals (timeofday, istat) + the compile constant DELAY_CLOSE, observable through its time_t return (head entry's scheduled-close time, or 0) and the istat.is_delayclose/is_delayclosewait counters. The other remaining s_bsd symbols are static (no cref_ oracle — set_sock_opts), sender-only side effects (report_error), real-DNS (get_my_name), or the event-loop core itself (read_message/add_connection/listeners — deferred, done last with mio).
  • Config-resolved body — gated by #ifdef DELAY_CLOSE (config.h.dist:440 → #define DELAY_CLOSE 15, enabled; nm cbuild/s_bsd.o shows T delay_close). DEBUGMODE off → no Debug(()). MAXCLIENTS = MAXCONNECTIONS-5 = 50-5 = 45. Live body: if fd==-2 → tmpdel = is_delayclosewait (close-all); else if is_delayclosewait > (MAXCLIENTS-is_localc)>>1 → tmpdel = is_delayclosewait>>2 (drop oldest quarter). Sweep the list evicting while tmp->time < timeofday || tmpdel-- > 0; on eviction send(fd, "ERROR :Too rapid connections from your host\r\n", 46, 0) to the new fd, close(tmp->fd), MyFree, is_delayclosewait--. Then if fd>=0: set_non_blocking+ shutdown(SHUT_RD), MyMalloc a node at timeofday+DELAY_CLOSE, append, is_delayclosewait++/is_delayclose++. Return first ? first->time : 0.
  • Port — added to ircd-common/src/s_bsd.rs (existing module). struct fdlog → a private #[repr(C)] struct FdLog + module statics DELAY_CLOSE_FIRST/DELAY_CLOSE_LAST (the list never crosses the ABI — each world keeps its own). Reads the still-C globals via bindgen (ircd_sys::bindings::istat/timeofday); calls the Rust set_non_blocking (P7d, same module) + crate::list::MyMalloc (P2); MyFree→libc::free; send/close/shutdown verbatim. Faithfulness: the unsigned threshold MAXCLIENTS.wrapping_sub(is_localc) >> 1 (C's int - u_long wraps); the || short-circuit so tmpdel is decremented only when the entry is not expired; the 46-byte error literal (43 chars + \r\n + the implicit \0, sent to the function-argument fd, not tmp->fd).
  • Drop — partial port via the existing s_bsd_link.o seam: added -DPORT_S_BSD_DELAY_CLOSE_P7f to the make-rule in ircd-sys/build.rs (alongside -DPORT_S_BSD_LEAF_P7d -DPORT_S_BSD_LEAF_P7e); wrapped the C body (s_bsd.c:3359–3441, inside the #ifdef DELAY_CLOSE block) in #ifndef PORT_S_BSD_DELAY_CLOSE_P7f. CREF_OBJS keeps the unguarded s_bsd.o → cref_delay_close + cref_istat + cref_timeofday survive for L1. RED first confirmed delay_close undefined — referenced by s_serv.rs (m_close, now Rust), ircd.c:1176 (io_loop, still C), and s_bsd.c:1661 (still C); after GREEN nm target/debug/ircd shows delay_close as T (from Rust).
  • Classification — utility/callee TU (not a msgtab handler). Called from the io_loop (delay_close(-1)), m_close (delay_close(-2)), and the connection-close / listener-accept paths.
  • L1 (ircd-testkit/tests/delay_close_diff.rs) — 6 cases, isolated worlds (the Rust port reads/mutates the real istat/timeofday; the cref_ oracle uses cref_istat/cref_timeofday), serialized on GLOBALS_LOCK. Because the static lists persist across #[test]s, each test reset()s first (drains both via delay_close(-2), then zeroes the counters). Honouring the inverse-invariant rule: (1) queue one fd → return now+15, counters (1,1); (2) time eviction (inverse of 1) — advance past the time, sweep with fd<0 → entry gone, return 0, wait 1→0; (3) unexpired entry stays (the time-sorted early break); (4) fd==-2 close-all drains 2 unexpired entries; (5) overflow — is_localc=43 → threshold 1, 4 queued then a 5th → tmpdel=4>>2=1 evicts the oldest while adding (net wait 4, close 5); (6) chronological head — head stays the oldest entry's time until it is evicted. socketpair fds so close/shutdown/send succeed identically; the same fd value drives both worlds. Zero-diff on return value + (is_delayclose, is_delayclosewait) for every call.
  • L2 — no new test. delay_close runs from the io_loop / connection-close paths; the existing ircd-golden boot path covers it (golden_registration byte-identical). No client command reaches it deterministically under the locked config (it needs rapid-connect refusal).
  • S2S — none. No IsServer branch, no remote-user field formatting.

• 2026-06-06 — P7g (s_bsd.c fd-teardown leaf close_client_fd) merged. The next s_bsd.c leaf after P7d (socket/file trio), P7e (add_local_domain), P7f (delay_close). Ported close_client_fd (s_bsd.c:1270) to ircd-common/src/s_bsd.rs.

  • Cluster choice. Picked because its effect is pure post-state on the aClient + the fd arrays (L1-testable by inspection, like delay_close), and all its real callees are already Rust: flush_connections (send.rs, P3), del_fd (list.rs, P2), dbuf_delete (dbuf.rs, P1). The only C dependency is report_error, already declared extern "C" in s_bsd.rs since P7d.
  • Guard / seam. Same s_bsd_link.o partial-compile; added -DPORT_S_BSD_CLOSE_FD_P7g to the recipe in ircd-sys/build.rs and wrapped the C body in #ifndef PORT_S_BSD_CLOSE_FD_P7g. RED confirmed the undefined close_client_fd referenced by the still-C close_connection/add_connection_refuse; after GREEN nm shows it T from Rust. The cref oracle keeps the full unguarded s_bsd.o.
  • Config-resolved body. SO_LINGER defined → the two linger blocks compile (only taken when exitc==EXITC_PING; on a nonzero setsockopt return they call the still-C report_error). ZIP_LINKS OFF → the zip_free call inside the IsServer||IsListener arm is omitted. Faithful: SETSOCKOPT(...,&sockling,sockling) = setsockopt(...,&sockling,sizeof(struct linger)); DBufClear(d) = dbuf_delete(d, d->length); bzero(passwd, sizeof) = memset(passwd,0,21); the IsServer||IsListener / IsClient arms are mutually exclusive (if/else if) but del_fd(&fdall) + local[fd]=NULL + close + the drains run unconditionally for any fd>=0. The linger struct is fully initialized (l_onoff=0,l_linger=0, per the 2014 Kurt Roeckx fix).
  • Classification. Callee TU (no msgtab entry) — reached from close_connection / exit_client / the listener-accept refuse paths.
  • L1. close_client_fd_diff.rs, 6 cases, isolated worlds (Rust reads/mutates the real local/fdas/fdall + calls Rust flush_connections/del_fd; oracle uses cref_local/cref_fdas/cref_fdall + cref_*), me.fd/cref_me.fd pinned to -1 so flush_connections takes the else if fd>=0 branch. Cases: client both-fds; server + listener (the fdas+fdall arm, via FLAGS_LISTEN for the listener); fd<0 (only authfd closed, fd>=0 block skipped, queues/passwd untouched); both-fds<0 no-op; and the inverse-of-insert recvQ-drain + passwd-zero. Each asserts equal post-state + the inverse invariants (fd actually closed → second close() returns EBADF, local[fd]==NULL, array slot freed, fdas/fdall.highest agree, queues drained). Serialized on GLOBALS_LOCK (shared local/fd-arrays/me). Zero-diff vs cref_close_client_fd.
  • Untested-by-design. exitc=0 in every case → the SO_LINGER/report_error failure branches are not exercised (they need a socket whose setsockopt fails). The sendQ flush-then-clear path (live socket I/O through send_queued) is L2, not L1 — queuing sendQ on a synthetic client crashes the live send path; only recvQ (never flushed) is used for the DBufClear drain check.
  • L2 / S2S. No new L2: hit on every disconnect; golden_registration (incl. register_quit_reuse_releases_nick) stays byte-identical. No S2S: formats no remote-user fields.

• 2026-06-06 — P7h (s_bsd.c connection-teardown leaf close_connection) merged. The next s_bsd.c leaf after P7d (socket/file trio), P7e (add_local_domain), P7f (delay_close), P7g (close_client_fd). Ported close_connection (s_bsd.c:1341) to ircd-common/src/s_bsd.rs — the disconnect-bookkeeping layer directly above the P7g fd-teardown leaf.

  • Cluster choice. Picked as the natural next layer up from P7g: close_connection calls close_client_fd, and all its other callees are already resolvable — del_queries/find_conf_exact/det_confs_butmask are Rust (P6), sendto_iauth is the variadic C trampoline (declaring + calling a variadic is stable), close_client_fd is the Rust P7g symbol. Its whole effect is post-state on the aClient + the process globals → L1-testable by inspection.
  • Guard / seam. Same s_bsd_link.o partial-compile; added -DPORT_S_BSD_CLOSE_CONN_P7h to the recipe in ircd-sys/build.rs (alongside the P7d/P7e/P7f/P7g guards) and wrapped the C body (s_bsd.c:1341-1453) in #ifndef PORT_S_BSD_CLOSE_CONN_P7h. RED confirmed close_connection undefined — referenced by the now-Rust s_misc.rs (exit_client) and the still-C s_bsd.c:458; after GREEN nm target/debug/ircd shows it T from Rust. The cref oracle keeps the full unguarded s_bsd.o.
  • Config-resolved body. USE_IAUTH ON → the sendto_iauth("%d D", cptr->fd) notify block (gated !IsListener && !IsConnecting) compiles. DEBUGMODE off → the Debug() lines vanish. No other #ifdef'd branches. Macros reproduced inline: IsHandshake/IsConnecting (status == STAT_HANDSHAKE/STAT_CONNECTING), IsIllegal(aconf) (status & CONF_ILLEGAL), ConfConFreq(aconf) (aconf->class->conFreq, int→time_t), CFLAG (CONF_CONNECT_SERVER|CONF_ZCONNECT_SERVER = 40); HANGONRETRYDELAY=30/HANGONGOODLINK=900 (config.h.dist:656-657, object-like config macros absent from bindgen → Rust consts). Reuses the P7g is_server/is_client/is_listener helpers. The reconnect-reschedule arm short-circuits on IsServer (so find_conf_exact is only called for a server) exactly as C.
  • Classification. Callee/utility TU (no msgtab entry) — reached from exit_client (s_misc.c) and the listener/acceptor cleanup paths.
  • L1. close_connection_diff.rs, 6 cases, isolated worlds (Rust reads/mutates the real ircstp/nextconnect/ListenerLL/local/fdas/fdall/me/istat + calls Rust close_client_fd/del_queries/det_confs_butmask; oracle uses cref_*), serialized on GLOBALS_LOCK. me.fd/cref_me.fd pinned to -1 (inner flush_connections else-branch); adfd/cref_adfd pinned to -1 (sendto_iauth no-op, no live iauth pipe); firsttime/since pinned to constants for deterministic timeofday - firsttime deltas. Cases: (1) server → is_sv/is_sbs/is_sbr/is_sti; (2) client → is_cl/is_cbs/is_cbr/is_cti (inverse: server/ni untouched); (3) unknown → only is_ni; (4) handshake + connecting, nextconnect==0 → nextconnect = now + 30; (5) P-line acceptor refcount 5→4 (inverse: closed client fd torn down); (6) illegal listener (CONF_ILLEGAL, clients<=0) unlinked from a 2-node ListenerLL — inverse invariants: head.next NULL, ListenerLL head intact, target fd -1, from NULL, confs detached. Zero-diff vs cref_close_connection. Fixture note: case 6's det_confs_butmask→detach_conf decrements the unsigned istat.is_conflink once per detached link; seeded is_conflink=1 in both worlds (the real attach_conf would have incremented it) — without it the decrement underflows (C wraps silently, Rust debug-overflow panics, surfacing the unrealistic fixture).
  • Untested-by-design. The recursive close_connection(cptr->acpt) when the acceptor itself becomes illegal (needs a fully-illegal acceptor conf — case 5 covers the non-recursive refcount arm). The find_conf_exact reconnect-reschedule arm (returns NULL with no conf loaded → both worlds skip it identically). The sendto_iauth wire emission (L2, variadic trampoline, like the rest of the sendto_* family).
  • L2 / S2S. No new L2: hit on every disconnect; golden_registration (incl. register_quit_reuse_releases_nick) stays byte-identical. No S2S: formats no remote-user fields (the IsServer branch touches only local stats counters + reconnect scheduling, not wire output).

• 2026-06-06 — P7i (s_bsd.c listener-list teardown leaf close_listeners) merged. The next s_bsd.c leaf after P7d (socket/file trio), P7e (add_local_domain), P7f (delay_close), P7g (close_client_fd), P7h (close_connection). Ported close_listeners (s_bsd.c:427) to ircd-common/src/s_bsd.rs — the listener-GC layer directly above the P7g/P7h teardown leaves.

  • Cluster choice. The cleanest remaining s_bsd leaf: it is a pure walk over the ListenerLL global dispatching to two already-Rust callees (close_client_fd P7g, close_connection P7h) — no socket syscalls of its own, effect fully observable as ListenerLL + per-node aClient post-state. The other remaining s_bsd symbols are the event-loop core (read_message/add_connection), listener construction (inetport/add_listener/open_listener — real socket/bind/listen), sender-only (report_error), real-DNS (get_my_name), or static (no cref_ oracle: set_sock_opts/check_init).
  • Guard / seam. Same s_bsd_link.o partial-compile; added -DPORT_S_BSD_CLOSE_LISTENERS_P7i to the recipe in ircd-sys/build.rs (alongside the P7d/P7e/P7f/P7g/P7h guards) and wrapped the C body (s_bsd.c:427-462) in #ifndef PORT_S_BSD_CLOSE_LISTENERS_P7i. RED confirmed close_listeners undefined — referenced only by the now-Rust s_conf.rs rehash (s_conf.c:1315); after GREEN nm target/debug/ircd shows it T from Rust. The cref oracle keeps the full unguarded s_bsd.o.
  • Config-resolved body. UNIXPORT off (cbuild/config.h:339 #undef UNIXPORT; nm cbuild/s_bsd.o has no unixport) → the entire #ifdef UNIXPORT IsUnixSocket/sprintf(unixpath)/unlink block is not compiled. Resolved body: for (acptr = ListenerLL; acptr; acptr = bcptr) { aconf = acptr->confs->value.aconf; bcptr = acptr->next; if (IsIllegal(aconf)) { if (aconf->clients > 0) close_client_fd(acptr); else close_connection(acptr); } }. The bcptr = acptr->next is read before the teardown because close_connection may unlink acptr (the P7h ListenerLL-unlink arm). IsIllegal reuses the existing conf_is_illegal helper (aconf->status & CONF_ILLEGAL). No new externs — both callees are Rust in the same module.
  • Classification. Callee/utility TU (no msgtab entry) — the rehash listener garbage-collector, called from s_conf.c rehash.
  • L1. close_listeners_diff.rs, 5 cases, isolated worlds (Rust reads/mutates the real ListenerLL/local/fdas/fdall/me/ircstp/istat + calls the Rust close_client_fd/close_connection; oracle uses cref_*), serialized on GLOBALS_LOCK. me.fd/adfd pinned to -1 (inner flush_connections else-branch + sendto_iauth no-op); listeners built with status STAT_ME + flags FLAGS_LISTEN + from = self + a one-element confs Link + a live pipe fd registered in local/fdas/fdall; istat.is_conflink seeded per close_connection-bound node (its det_confs_butmask decrements the unsigned counter once per detached link — underflow else). Each case builds an identical ListenerLL on both worlds, runs close_listeners, and compares the structural walk (surviving node count + per-node (fd_torn, from_null, confs_null) — pointers differ across worlds so the comparison is on observable facts) plus inverse invariants. Cases: (1) illegal clients=0 → close_connection → unlinked (ListenerLL drained, fd -1, from NULL, confs detached); (2) illegal clients>0 → close_client_fd → fd torn BUT node stays linked + from == self + confs NOT detached (inverse of 1); (3) legal → fully untouched (fd still a valid descriptor via fcntl(F_GETFD), still linked); (4) mixed [legal] -> [illegal,c=0] -> [legal] → middle removed, the two legals relinked head↔next with intact fds; (5) all-illegal-c=0 → list fully drained. Zero-diff vs cref_close_listeners.
  • L2 / S2S. No new L2: close_listeners is the rehash listener-GC, exercised at boot/rehash by the existing golden suite (golden_registration byte-identical). No S2S: it formats no remote-user wire fields (its only side effects are the descriptor teardowns + ListenerLL mutation).

• 2026-06-06 — P7j (s_bsd.c listener-reactivation leaf activate_delayed_listeners) merged. The next s_bsd.c leaf after P7d–P7i; the reactivation counterpart to P7i's close_listeners teardown. Ported activate_delayed_listeners (s_bsd.c:526) to ircd-common/src/s_bsd.rs.

  • Cluster choice. The cleanest remaining s_bsd leaf: a pure walk over ListenerLL flipping one flag bit (FLAGS_LISTENINACTIVE) + a listen() syscall + a counter, the natural pair to P7i. Its whole effect is per-node flags/listen-state post-state → L1-testable by list inspection. The other remaining s_bsd symbols are the event-loop core (read_message/add_connection), listener construction (inetport/add_listener/open_listener/reopen_listeners — real socket/bind/listen), sender-only (report_error), process setup (daemonize/init_sys/start_iauth), real-DNS (get_my_name), or static (no cref_ oracle: set_sock_opts/check_init/check_clones).
  • Guard / seam. Same s_bsd_link.o partial-compile; added -DPORT_S_BSD_ACTIVATE_DELAYED_P7j to the recipe in ircd-sys/build.rs (alongside the P7d–P7i guards) and wrapped the C body (s_bsd.c:526-545) in #ifndef PORT_S_BSD_ACTIVATE_DELAYED_P7j. RED confirmed activate_delayed_listeners undefined — referenced by the now-Rust s_serv.rs:739 (m_set burst path) and s_misc.rs:1153 (check_split); after GREEN nm target/debug/ircd shows it T from Rust. The cref oracle keeps the full unguarded s_bsd.o → cref_activate_delayed_listeners.
  • Config-resolved body. No #ifdefs in this function; DEBUGMODE off → no Debug line. IsListenerInactive(x) = (x)->flags & FLAGS_LISTENINACTIVE (0x8000000, bindgen const); ClearListenerInactive(x) = (x)->flags &= ~FLAGS_LISTENINACTIVE; flags is a c_long field so the mask is as c_long. LISTENQUEUE (config.h:622 = 128) is a config #define absent from bindgen → reproduced as a const c_int. listen()'s return is ignored exactly as C → the observable post-state (inactive bit cleared, node kept) is identical regardless of the fd. sendto_flag(SCH_NOTICE, ...) is the existing variadic C trampoline (ircd_sys::bindings::sendto_flag + ServerChannels_SCH_NOTICE); no new extern. It is safe in L1 because it short-circuits when svchans[chan].svc_ptr == NULL (the default un-setup_svchans'd state) → no-op in both worlds.
  • Classification. Callee/utility TU (no msgtab entry) — reached from the server-burst / TS-adjust path (s_serv.c) and s_misc.c check_split. Formats no remote-user fields (only an integer count) → no S2S even though a server path reaches it.
  • L1. activate_delayed_listeners_diff.rs, 5 cases, isolated worlds (Rust reads/mutates the real ListenerLL/me; oracle uses cref_*), serialized on GLOBALS_LOCK. me.fd/adfd pinned to -1 (defensive). Each new_listener(inactive) builds an aClient (status STAT_ME, flags FLAGS_LISTEN [+FLAGS_LISTENINACTIVE]) over a real TCP socket so listen() genuinely succeeds (asserted via getsockopt SO_ACCEPTCONN). Each case builds an identical ListenerLL on both worlds, runs the function, and compares the per-node (still_inactive, accepting) vector + node count (listeners are never removed). Cases: (1) single inactive → activated (bit clear + SO_ACCEPTCONN==1); (2) single active → untouched (inverse — flag stays clear, not re-listened, stays in list); (3) mixed [active,inactive,active] → only middle activated, all 3 kept, order preserved; (4) empty → no-op (cnt=0, sendto_flag not fired, no crash); (5) all-inactive (3 nodes) → all activated. Zero-diff vs cref_activate_delayed_listeners.
  • Untested-by-design. The sendto_flag wire emission (cnt>0) is the variadic-trampoline path; with NULL svc_ptr it is a no-op (L2 territory, like the rest of the sendto_* family). listen()'s failure path is unreachable-by-observation (return ignored).
  • L2 / S2S. No new L2: hit by server-burst/rehash; golden_registration (incl. register_quit_reuse_releases_nick) stays byte-identical. No S2S: formats no remote-user wire fields.

• 2026-06-06 — P7k (s_bsd.c add_connection_refuse, connection-refuse leaf) merged. The next leaf in the central I/O TU after the P7d–P7j socket/file/teardown/listener leaves; the refuse-path companion to add_connection (which stays C).

  • Cluster choice — add_connection_refuse (s_bsd.c:1594), a true leaf: its only callees are close (libc), free_client (Rust, P2), and a bump of the bindgen ircstp global. Called from add_connection's four refuse paths (clone-check fail, IP-line refuse, DELAY_CLOSE accept throttle, DNSBL/iauth refuse), all later in the same C TU.
  • Guard — partial-ported via s_bsd_link.o with -DPORT_S_BSD_ADD_CONN_REFUSE_P7k added to the build.rs make-eval recipe; the C body wrapped in #ifndef PORT_S_BSD_ADD_CONN_REFUSE_P7k … #endif. The cref oracle keeps the full unguarded s_bsd.o so cref_add_connection_refuse survives.
  • Config-resolved body — DELAY_CLOSE is defined (config.h:440, =15) → the #if !defined(DELAY_CLOSE) arm (delay = 0) is not compiled; delay is honored verbatim. Body: if (delay==0) close(fd); ircstp->is_ref++; acptr->fd = -2; free_client(acptr);.
  • ABI — no *_ext.h prototype (file-local-by-use, defined before its callers in the same TU) but a global T symbol; the #[no_mangle] pub unsafe extern "C" fn add_connection_refuse resolves the C add_connection call sites at link. No bindgen decl needed. free_client called as crate::list::free_client (same crate).
  • Classification — utility/callee TU, not a msgtab handler. → L1 is the gate.
  • L1 (add_connection_refuse_diff.rs, 3 cases) — two isolated worlds (Rust port c_add_connection_refuse vs cref_add_connection_refuse), each with its own backing stats (its ircstp points at it) and its own make_client/free_client. acptr built via that world's make_client(NULL) so free_client is the clean inverse (a calloc'd client would trip free_client's auth != username error arm). acptr is freed inside the call → post-state is a UAF, so the test compares side effects: is_ref delta (+1) and the fd's fate. Case 1 delay==0: fd actually closed (second close → EBADF). Case 2 delay==1: fd left open (our close returns 0) — the happy-path/inverse pair. Case 3: two refuses accumulate is_ref to 2. Zero-diff vs cref_; serialized on GLOBALS_LOCK (the P7 L1 shared-global hazard — ircstp/cref_ircstp process-global).
  • Untested-by-design — acptr->fd = -2 (set immediately before free_client; no surviving reader under the locked config). free_client internals are P2-tested (list_diff.rs).
  • No L2 / no S2S — reached only from add_connection's refuse paths; no client command reaches it deterministically under the locked config, and it formats no remote-user wire fields. Sibling s_bsd L1 tests (P7d–P7j) re-run green after the shared s_bsd_link.o recipe change. cargo build 0 warnings; add_connection_refuse resolves T in target/debug/ircd.

• 2026‑06‑06 — P7l (s_bsd.c setup_ping, UDP CPING‑socket setup leaf) merged. Ported the next s_bsd.c leaf after the P7d–P7k socket/file/teardown/listener/refuse leaves: the one‑shot setup half of the server‑to‑server CPING (UDP ping) feature.

  • Cluster choice. setup_ping (s_bsd.c:3018) is a self‑contained leaf — it binds the single shared udpfd UDP socket and returns its fd. Its only non‑libc deps are inetpton (Rust P1), minus_one (bindgen all‑0xff global), and udpfd (a C global it sets). The CPING‑output siblings send_ping (non‑static) and check_ping/polludp (static) stay C; they share udpfd only, which stays a C global, so no atomic cluster move is needed.
  • Guard / seam. Partial port via the existing s_bsd_link.o second‑compile, new guard -DPORT_S_BSD_SETUP_PING_P7l added alongside the P7d–P7k guards in ircd-sys/build.rs; the C body wrapped in #ifndef PORT_S_BSD_SETUP_PING_P7l.
  • Config‑resolved body. AFINET = AF_INET6 (common/os.h:680) → from is a libc::sockaddr_in6, the SIN_FAMILY/SIN_PORT/SIN_ADDR macros map to sin6_family/sin6_port/sin6_addr. The SETSOCKOPT macro (sys_def.h:29) passes sizeof(int)=4 as the option length, not sizeof(*p). FNDELAY = O_NDELAY = O_NONBLOCK. DEBUGMODE/USE_SYSLOG off → the Debug/syslog lines vanish. IN6ADDRSZ = 16.
  • Faithfulness. Idempotent short‑circuit (udpfd != -1 → return it, ignore aconf); the assign‑then‑test ((udpfd = socket(...)) == -1) reproduced as set‑bindgen‑extern‑then‑check; each later failure does close(fd); udpfd = -1; return -1. Bind address: a numeric aconf->passwd (isdigit(*passwd)) → inetpton(AF_INET6, …), falling back to a 16‑byte bcopy of minus_one on parse failure; else in6addr_any. htons = (port as u16).to_be().
  • Classification. Callee TU, not a msgtab handler — reached only from the now‑Rust s_conf.rs rehash (s_conf.c:2041, a connect{} block with a port). RED confirmed the undefined setup_ping referenced by s_conf.rs; after GREEN nm target/debug/ircd shows setup_ping as T (from Rust).
  • L1. ircd-testkit/tests/setup_ping_diff.rs, 3 cases: (1) fresh setup opens a valid non‑blocking SOCK_DGRAM recorded in udpfd; (2) idempotent second call (the inverse‑of‑state path) returns the same fd unchanged and opens no new socket, even with a different aconf; (3) numeric passwd "::1" drives the inetpton bind‑address branch (loopback bind succeeds) vs the in6addr_any default. Zero‑diff vs cref_setup_ping; isolated worlds (real udpfd vs cref_udpfd), serialized on GLOBALS_LOCK with a reset() that closes the prior socket + restores udpfd = -1 between cases. Because each world opens its own socket, the test compares the fd's properties (open, non‑blocking, SOCK_DGRAM) + the global‑state contract (udpfd set / idempotent), never the integer fd value.
  • L2 / S2S. No new L2 (callee, hit by rehash; golden_registration byte‑identical, 0 warnings). No S2S (formats no remote‑user fields).
  • Untested‑by‑design. The setsockopt/bind/fcntl failure arms (close(fd); udpfd = -1) need an induced syscall failure (privileged/occupied bind) — not deterministic in the sandbox; both worlds take the success path identically. The actual UDP sendto is send_ping's concern (a later leaf).

• 2026‑06‑06 — P7m (s_bsd.c send_ping, UDP CPING‑output leaf) merged. Ported the next s_bsd.c leaf after the P7d–P7l socket/file/teardown/listener/refuse/CPING‑setup leaves: the output half of the server‑to‑server CPING (UDP ping) feature, the sibling to P7l's setup_ping.

  • Cluster choice. send_ping (s_bsd.c:3077) is a self‑contained leaf — its only non‑libc dependency is the udpfd C global it sendtos over (and which stays C, shared with setup_ping/polludp). No ircd callees → no atomic cluster move. The CPING‑input siblings check_ping/polludp (both static, no cref_ oracle) stay C; they share udpfd only.
  • Guard / seam. Partial port via the existing s_bsd_link.o second‑compile, new guard -DPORT_S_BSD_SEND_PING_P7m added alongside the P7d–P7l guards in ircd-sys/build.rs; the C body (s_bsd.c:3077‑3117) wrapped in #ifndef PORT_S_BSD_SEND_PING_P7m. RED confirmed send_ping undefined — referenced by the still‑C ircd.c:405 (try_connections CPING path); after GREEN nm target/debug/ircd shows it T from Rust. The cref oracle keeps the full unguarded s_bsd.o → cref_send_ping.
  • Config‑resolved body. AFINET=AF_INET6 (common/os.h:680) → sin is a libc::sockaddr_in6, SIN_PORT/SIN_FAMILY/SIN_ADDR map to sin6_*. IN6ADDRSZ=16 → bcopy(aconf->ipnum.s6_addr, sin.sin6_addr.s6_addr, 16). DEBUGMODE/USE_SYSLOG off → the Debug line vanishes. PING_CPING=0x02 (struct_def.h:411, bindgen const) → pi.pi_id = htonl(2) (a u_long, network order).
  • Faithfulness. The C guard if (!aconf->ipnum.s6_addr || AND16(...)==255 || !cp->port) — the first disjunct is the address of an array field, so it is always false in C; reproduced as the two real gates only (AND16==255 ≡ all 16 bytes 0xff via iter().fold(0xff, &), the unresolved minus_one sentinel; and cp->port==0). All aCPing counters (ping/seq/lseq/recvd) are u_long → unsigned arithmetic (cp->seq * conFreq > 1200, cp->ping -= cp->ping/cp->recvd). pi.pi_seq = cp->lseq++ is post‑increment (the packet carries the pre‑increment value). The window block does seq++ then conditional seq-- (net 0 when it fires), with recvd-- only when recvd == seq (post‑++). sin.SIN_PORT = htons(cp->port) = (*cp).port.to_be().
  • Classification. Callee/utility TU (no msgtab entry) — reached from the server‑connect / try_connections CPING path, not a client command. Formats no remote‑user fields (only a binary UDP datagram to the configured peer) → no S2S.
  • L1. send_ping_diff.rs, 7 cases, isolated worlds (Rust reads the real udpfd; oracle reads cref_udpfd), serialized on GLOBALS_LOCK. Each case open_udp()s a fresh UDP socket as that world's udpfd, binds a non‑blocking ::1:<ephemeral> receiver, points the conf's destination port at it, drives send_ping, and recvfroms the datagram. Compares Rust‑vs‑oracle the deterministic aCPing post‑state (seq/lseq/recvd/ping) byte‑identical + the world‑independent packet fields (pi_id == htonl(2), pi_seq == pre‑increment lseq); pi_cp (a live pointer) and pi_tv (gettimeofday) are nondeterministic/world‑specific → excluded. Cases: (1) basic send, no window → lseq 0→1, seq 0→1, packet with pi_seq=0; (2) unresolved ipnum (all 0xff, AND16==255) → early return, counters untouched, no packet (inverse of 1); (3) cp->port==0 → early return; (4) conFreq==0 → early return; (5) window recvd>0 (seq=12→13, 13*100>1200 → ping 1000 - 1000/5 = 800, recvd≠seq stays, seq--→12); (6) window recvd==0 (ping→0); (7) window recvd==seq post‑++ (recvd-- also fires: ping 1300-100=1200, recvd 13→12). Zero‑diff vs cref_send_ping.
  • Untested‑by‑design. pi_tv (gettimeofday) + pi_cp (a live pointer) are nondeterministic/world‑specific → excluded from the packet comparison. The sendto failure path is (void)‑ignored by C → unobservable.
  • L2 / S2S. No new L2: callee, hit by the server‑connect CPING path; golden_registration (incl. register_quit_reuse_releases_nick) stays byte‑identical. No S2S: formats no remote‑user wire fields.

• 2026‑06‑06 — P7n (s_bsd.c listener-(re)construction wrappers open_listener/reopen_listeners) merged. The next s_bsd.c leaf after the P7d–P7m socket/file/teardown/listener/CPING leaves — the layer directly above the still-C socket constructor inetport. Ported open_listener (s_bsd.c:467) + reopen_listeners (s_bsd.c:512) to ircd-common/src/s_bsd.rs.

  • Cluster choice. The cleanest remaining s_bsd leaf with no static-callee blocker: reopen_listeners is a pure ListenerLL walk → open_listener; open_listener dispatches to the still-C inetport (real socket/bind/listen, keeps its static callee set_sock_opts with internal linkage in the surviving C) plus the already-Rust add_fd (P2) and set_non_blocking (P7d). The strangler seam holds with inetport staying C, called via the bindgen extern — porting the layer above a still-C leaf is allowed (symbols resolve either direction). The other remaining s_bsd symbols are the event-loop core (read_message/add_connection), listener construction (inetport/add_listener — real syscalls + the static set_sock_opts), sender-only (report_error), process setup (init_sys/daemonize/start_iauth), connection auth (check_client/check_server/check_server_init), real-DNS (get_my_name), or static (no cref_ oracle).
  • Guard / seam. Same s_bsd_link.o partial-compile; added -DPORT_S_BSD_OPEN_LISTENER_P7n to the recipe in ircd-sys/build.rs (alongside the P7d–P7m guards) and wrapped the two C bodies (s_bsd.c:467-525) in a single #ifndef PORT_S_BSD_OPEN_LISTENER_P7n. RED confirmed both symbols undefined — open_listener referenced by the still-C add_listener (s_bsd.c:347), reopen_listeners by the now-Rust s_conf.rs rehash (line 2927); after GREEN nm target/debug/ircd shows both T from Rust. The cref oracle keeps the full unguarded s_bsd.o → cref_open_listener/cref_reopen_listeners.
  • Config-resolved body. UNIXPORT OFF (config.h:339) → open_listener's *aconf->host == '/' unix-socket branch is not compiled; only the inet branch survives. No other #ifdefs. Macros reproduced inline: IsListener(x) (existing is_listener helper), IsConfDelayed(aconf) = aconf->flags & PFLAG_DELAYED (bindgen const, flags is c_long), SetListenerInactive(x) = flags |= FLAGS_LISTENINACTIVE (bindgen const), IsIllegal(aconf) (existing conf_is_illegal helper). firstrejoindone/ListenerLL/fdas/fdall/inetport/add_fd are bindgen externs (inetport/firstrejoindone stay C; add_fd resolves to the Rust list port).
  • Faithfulness. open_listener early-returns on !IsListener(cptr) || cptr->fd > 0 — note > 0 (not >= 0), so fd 0 does not early-return. The delayed branch sets dolisten = 0 AND marks the listener inactive, so inetport skips listen() (socket created, not accepting). inetport returning non-zero resets cptr->fd = -1 ("to allow further inetport calls"); only when cptr->fd >= 0 afterward is the fd registered in fdas/fdall + flipped non-blocking.
  • Classification. Callee/utility TU (no msgtab entry) — reopen_listeners reached from rehash (s_conf.rs), open_listener from add_listener/reopen_listeners. → L1 is the gate; no S2S (formats no remote-user wire fields).
  • L1. open_listener_diff.rs, 6 cases, isolated worlds (Rust port reads/mutates the real ListenerLL/local/fdas/fdall/me/firstrejoindone + calls the real C inetport and the Rust add_fd/set_non_blocking; oracle uses cref_* + cref_inetport), serialized on GLOBALS_LOCK. Each world opens its own socket via inetport (fd integers differ) → the comparison is on the fd's observable properties (fd_valid via fcntl F_GETFD, listening via SO_ACCEPTCONN, nonblocking via O_NONBLOCK), the FLAGS_LISTENINACTIVE bit, fdas/fdall membership, local[fd]==cptr, and port. Listener built with ip=NULL, port=0 (no bind → no addr-family hazard; inetport still does socket/getsockname/listen), ipmask="0.0.0.0"; me.name pointed at me.namebuf and pinned to "irc.test" in both worlds so inetport's ME-based sockhost is identical. Cases: (1) normal listener → listening, non-blocking, registered, not inactive; (2) delayed + firstrejoindone==0 → dolisten=0: created but NOT listening, FLAGS_LISTENINACTIVE set, still registered + non-blocking; (3) delayed + firstrejoindone==1 (inverse of 2) → behaves normal (listening, flag clear); (4) !IsListener → no-op (fd stays -1, nothing registered); (5) fd>0 early-return → fd untouched, not registered; (6) reopen_listeners over [illegal fd<0, legal fd<0, legal fd>0] → only the legal-fd<0 node is opened, the illegal + already-open nodes skipped (the open node's per-world pipe fd compared against its own recorded start value, not cross-world). Zero-diff vs cref_*.
  • Untested-by-design. inetport's failure arms (socket/bind failure → report_error + cptr->fd=-1) need an induced syscall failure; both worlds take the success path identically. The cptr == &me write(0,…) KLUDGE inside inetport is not reached (our cptr != me).
  • L2 / S2S. No new L2: hit at boot/rehash by the existing golden suite (golden_registration byte-identical, 0 warnings). No S2S: formats no remote-user wire fields.

• 2026‑06‑06 — P7o (s_bsd.c add_listener, listener-constructor wrapper) merged. The next s_bsd.c leaf after the P7d–P7n socket/file/teardown/listener/CPING leaves — the listener constructor directly above the now-Rust open_listener (P7n). Ported add_listener (s_bsd.c:330) to ircd-common/src/s_bsd.rs.

  • Cluster choice. The natural next leaf: add_listener is a thin constructor whose every callee is already Rust — make_client/make_link (P2) and open_listener (P7n, which itself calls the still-C inetport + the Rust add_fd/set_non_blocking). Its whole effect is the new listener-stub aClient's fields + the socket open (delegated to open_listener) + the ListenerLL prepend → fully observable as list + per-node post-state. The remaining s_bsd symbols are the event-loop core (read_message/add_connection), the real socket constructor (inetport + its static set_sock_opts), sender-only (report_error), process setup (init_sys/daemonize/start_iauth), connection auth (check_client/check_server/check_server_init + the static check_init), real-DNS (get_my_name), or static (no cref_ oracle).
  • Guard / seam. Same s_bsd_link.o partial-compile; added -DPORT_S_BSD_ADD_LISTENER_P7o to the recipe in ircd-sys/build.rs (alongside the P7d–P7n guards) and wrapped the C body (s_bsd.c:330-358) in #ifndef PORT_S_BSD_ADD_LISTENER_P7o. RED confirmed add_listener undefined — referenced only by the now-Rust s_conf.rs initconf (s_conf.c:2287); after GREEN nm target/debug/ircd shows it T from Rust. The cref oracle keeps the full unguarded s_bsd.o → cref_add_listener.
  • Config-resolved body. No #ifdefs in add_listener itself (the adjacent #ifdef UNIXPORT unixport block is a separate function, untouched). Macros reproduced inline: FLAGS_LISTEN (bindgen const, flags is c_long), ME = me.name (read the bindgen me global's name), SetMe(cptr) = cptr->status = STAT_ME (Status_STAT_ME). make_client(NULL) allocates a CLIENT_LOCAL client (fd = -1, so open_listener does not early-return); make_link() is the one-element confs link.
  • Faithfulness. The order matters: make_client already sets name = namebuf + firsttime = timeofday; add_listener overwrites name = ME and firsttime = time(NULL) (wall clock, not the event-loop timeofday). open_listener is called before the list splice. The prepend is the verbatim C: if (ListenerLL) ListenerLL->prev = cptr; cptr->next = ListenerLL; cptr->prev = NULL; ListenerLL = cptr;.
  • Classification. Callee/utility TU (no msgtab entry) — the listener constructor, called from s_conf.c initconf (boot) and rehash. → L1 is the gate; no S2S (formats no remote-user wire fields).
  • L1. add_listener_diff.rs, 3 cases, isolated worlds (Rust port reads/mutates the real ListenerLL/local/fdas/fdall/me + calls the real C inetport via the Rust open_listener; oracle uses cref_* + cref_inetport), serialized on GLOBALS_LOCK. Each world opens its own socket (fd integers differ) and make_client allocates its own client pointer → the comparison is on observable facts: the listener's flags/status, acpt/from self-pointers (as bools), name string, confs->value.aconf identity (matches the conf handed in) + confs->next == NULL, the ListenerLL prepend linkage (prev == NULL, next == old head), and the fd's properties (fd_valid via fcntl F_GETFD, listening via SO_ACCEPTCONN, nonblocking via O_NONBLOCK) + fdas/fdall/local[fd]==cptr membership + port. me.name pinned to "irc.test" in both worlds so inetport's ME-based sockhost is identical. firsttime = time(NULL) is nondeterministic across the two calls → asserted non-zero, excluded from the cross-world compare. Cases: (1) into empty ListenerLL → sole node, FLAGS_LISTEN/STAT_ME/self pointers/ME name/confs->aconf, listening + non-blocking + registered, prev/next NULL; (2) prepend before an existing node → new head with prev == NULL, next == old head, and the inverse invariant — the old head's prev now points back at the new node; (3) two consecutive calls → head is the 2nd, head->next == 1st, 1st->next == NULL, with both back-links. Zero-diff vs cref_add_listener.
  • Untested-by-design. firsttime = time(NULL) (wall clock) is nondeterministic → asserted non-zero, not compared. inetport's failure arms (socket/bind failure → report_error + fd = -1) need an induced syscall failure; both worlds take the success path identically (covered transitively by P7n's open_listener test notes).
  • L2 / S2S. No new L2: add_listener runs at boot (and rehash) via s_conf.c initconf; the existing golden suite exercises it — golden_registration (incl. register_quit_reuse_releases_nick) stays byte-identical (0 warnings). No S2S: it formats no remote-user wire fields.

• 2026‑06‑06 — P7p (s_bsd.c inetport, listener socket constructor) merged. The next s_bsd.c leaf after the P7d–P7o socket/file/teardown/listener/CPING leaves — the real socket constructor directly below the now-Rust open_listener (P7n). Ported inetport (s_bsd.c:210) + a private twin of its static callee set_sock_opts to ircd-common/src/s_bsd.rs.

  • Cluster choice. inetport is the layer open_listener (P7n) and add_listener (P7o) call; porting it completes the listener-construction stack bottom-up. Its only static callee set_sock_opts (s_bsd.c:1468) has no cref_ oracle, so it is ported as a private (non-#[no_mangle]) Rust fn alongside inetport; the C static set_sock_opts is not removed — it stays compiled for its other in-TU callers check_server_init/connect_server (a static + a private-Rust twin coexist with no symbol clash; the duplicate vanishes when those two callers are ported). inetport's effects are fully L1-observable (the created fd's properties + the cptr field writes), the same harness shape as P7n/P7o. The remaining s_bsd symbols are the event-loop core (read_message/add_connection), connection auth (check_client/check_server/check_server_init + the static check_init), sender-only (report_error), process setup (init_sys/daemonize/start_iauth), real-DNS (get_my_name), or static (no cref_ oracle).
  • Guard / seam. Same s_bsd_link.o partial-compile; added -DPORT_S_BSD_INETPORT_P7p to the recipe in ircd-sys/build.rs (alongside the P7d–P7o guards) and wrapped the C inetport body (s_bsd.c:210-323) in #ifndef PORT_S_BSD_INETPORT_P7p (the adjacent static set_sock_opts left untouched). RED confirmed inetport undefined — referenced by the now-Rust open_listener (s_bsd.rs:605) and the still-C ircd.c:1107; after GREEN nm target/debug/ircd shows inetport T from Rust, and the C set_sock_opts survives as a t local (with the mangled ircd_common::s_bsd::set_sock_opts private twin). The cref oracle keeps the full unguarded s_bsd.o → cref_inetport.
  • Config-resolved body. AFINET = AF_INET6 (os.h:680) → server is a libc::sockaddr_in6, SIN_FAMILY/SIN_PORT map to sin6_*; SOCKADDR_IN = sockaddr_in6. __CYGWIN32__ off → no in-body set_non_blocking. LISTENQUEUE = 128 (config const, not in bindgen). ME = me.name. cptr->ip is the bindgen in6_addr (a __in6_u.__u6_addr8 union, not libc's .s6_addr). cptr->port is a u_short. set_sock_opts config-resolution: SO_REUSEADDR (opt=1) + SO_RCVBUF/SO_SNDBUF/SO_SNDLOWAT (opt=8192) all compile; SO_DEBUG is #if … && 0 (never); SO_USELOOPBACK is not defined on Linux (skipped). The SETSOCKOPT macro (sys_def.h:29) passes sizeof(int)=4 as the option length for every call (sizeof(o3) where o3 is the value arg), not sizeof(*p). SO_SNDLOWAT is set quietly (no report_error on failure); the others report_error on failure (kept C).
  • Faithfulness. Order matters: the NULL-ipmask refuse and the ad[i]>>8 invalid-ipmask refuse both return -1 before the sockhost/auth/socket writes (so on those paths fd stays -1, auth NULL). The if (cptr->fd == -1) socket-open is conditional (an already-open fd is reused). The cptr == &me KLUDGE (sprintf(buf, replies[RPL_MYPORTIS], ME, "*", ntohs(port)); write(0, buf, …)) is reproduced verbatim via the bindgen replies incomplete-array + RPL_MYPORTIS const, but is unreachable for a listener stub (cptr != &me). DupString(cptr->auth, ipname) = MyMalloc(strlen+1) (Rust P2) + strcpy. The ipmask canonicalization (sscanf "%d.%d.%d.%d" → sprintf back) and the sprintf "%-.42s.%u" sockhost are done via libc::sscanf/libc::sprintf for byte-exactness. The bind addr: in6addr_any when !ip || (!isxdigit(*ip) && *ip != ':'), else inetpton (Rust P1) with the 16-byte minus_one fallback on parse failure.
  • Classification. Callee/utility TU (no msgtab entry) — inetport is reached from open_listener (boot/rehash) and the inetd me-listener path. → L1 is the gate; no S2S (formats no remote-user wire fields).
  • L1. inetport_diff.rs, 6 cases, isolated worlds (the Rust port reads/mutates the real local/highest_fd/me and calls the real inetpton/MyMalloc; the oracle uses the cref_* copies + cref_inetport), serialized on GLOBALS_LOCK. me.name pinned to "irc.test" in both worlds so the ME-based sockhost matches. Because each world opens its own socket (fd integers differ), the Obs compares the fd's observable properties (fd_valid via fcntl F_GETFD, listening via SO_ACCEPTCONN, the three socket options via getsockopt SO_REUSEADDR/SO_RCVBUF/SO_SNDBUF) + the world-independent struct fields (sockhost, auth, port, ip 16 bytes, local[fd]==cptr, the -1/0 return), never the raw fd; highest_fd is asserted per-world to equal the new fd. Cases: (1) normal port=0 listener (dolisten=1) → full compare: ret 0, listening, sockhost irc.test.0, auth 0.0.0.0, port 0, registered, highest_fd bumped; (2) dolisten=0 (the listen() inverse) → socket created + opts set but NOT listening, still registered; (3) NULL ipmask → return -1 before any socket (the refuse inverse), fd untouched, auth NULL; (4) invalid ipmask 256.0.0.0 (256>>8 != 0) → return -1 before sockhost/auth/socket; (5) wildcard bind (ip=NULL, port=P) → in6addr_any, getsockname → ::, cptr->ip all-zero, sockhost irc.test.<P>; (6) ::1 bind (*ip == ':' → the inetpton branch) → bind ::1, getsockname → ::1, cptr->ip = ::1, sockhost ::1.<P>. The two bind cases (5,6) are serialized per world (run + observe + close Rust, then cref) over one probe_free_port()'d port, since both worlds would otherwise collide on it. Zero-diff vs cref_inetport; sibling P7d–P7o L1 tests + golden_registration re-run green.
  • Untested-by-design. The socket/bind/getsockname failure arms (→ report_error + close + return -1) need an induced syscall failure; both worlds take the success path identically. The cptr == &me KLUDGE (write(0, …)) and the fd >= MAXCLIENTS overflow refuse are unreachable for a listener stub. set_sock_opts's report_error arms fire only on a setsockopt failure (none here).
  • L2 / S2S. No new L2: inetport runs at boot (and rehash) via open_listener; the existing golden suite exercises it — golden_registration (incl. register_quit_reuse_releases_nick) stays byte-identical (0 warnings). No S2S: it formats no remote-user wire fields.

• 2026‑06‑06 — P7q (s_bsd.c report_error, error-reporting output leaf) merged. The genuine clean leaf left in the central I/O TU.

  • Cluster choice. report_error (s_bsd.c:151) calls no other s_bsd.c function → it ports in isolation. The 27 internal call sites (the still‑C add_connection/check_*/connect_server/read_message + the already‑Rust P7d–P7p leaves that called it via an extern "C" decl) now resolve to the Rust definition. The remaining unported s_bsd.c functions (add_connection, read_message, connect_server, get_my_name, init_sys/daemonize/start_iauth, the check_* conf cluster) are all either event-loop cores, fork/destructive glue, or clustered via the file-private static mysk (get_my_name↔connect_server↔check_client) — none is a clean standalone leaf, so report_error was the right next pick.
  • Guard / seam. Partial port via the existing s_bsd_link.o second-compile, new guard -DPORT_S_BSD_REPORT_ERROR_P7q (added alongside P7d–P7p in ircd-sys/build.rs). The Rust port replaces the old extern "C" { fn report_error } decl in s_bsd.rs.
  • Config‑resolved body. SO_ERROR defined → the getsockopt readout compiles (mirrors P7d's get_sockerr); DEBUGMODE off → no Debug; USE_SYSLOG off → no syslog. text is a printf format taking two %s (host, strerror). Faithful: errtmp = errno first; host = get_client_name(cptr, FALSE) or ""; the !IsMe && fd>=0 SO_ERROR refinement; sendto_flag(SCH_ERROR, text, host, strerror); the Connecting||Handshake + serv->byuid[0] + remote‑bysptr NOTICE (:%s NOTICE %s : via strcpy+strncat, then sendto_one(bysptr, fmbuf, ME, bysptr->name, host, strerror)); the serverbooting fprintf(stderr, text, host, strerror) + fprintf(stderr, "\n") echo. The variadic sendto_flag/sendto_one/fprintf are called (legal in stable Rust), not defined — the trampolines stay C until P8. stderr is glibc's extern FILE *stderr symbol (not the macro). Added inline is_me/my_connect helpers + a SCH_ERROR const.
  • Classification. Utility / output leaf — no msgtab entry. Effects: the SCH_ERROR opers notice (variadic wire, L2), the remote bysptr NOTICE (S2S), and the serverbooting stderr echo (L1‑capturable). So L1 gates the deterministic format core; the wire paths are L2/S2S/untested‑by‑design.
  • L1. report_error_diff.rs, 4 cases, isolated worlds (Rust reads the real serverbooting + calls Rust get_client_name; oracle uses cref_serverbooting + cref_get_client_name), serialized on GLOBALS_LOCK. A capture_stderr helper dup/pipe‑redirects fd 2 around each call, fflush(NULL) before+after, reads the pipe, restores fd 2. The same heap aClient (calloc‑zeroed, fd=-1 → !MyConnect → host=name, no SO_ERROR, status=STAT_CLIENT → no bysptr) is passed to both worlds (read‑only). Each case sets both worlds' serverbooting + errno. Cases: (1) serverbooting=1+cptr=NULL → host="", errno=ECONNREFUSED → formatted "…:Connection refused\n"; (2) inverse / the gate — serverbooting=0 → no stderr output (both empty); (3) serverbooting=1+cptr non‑NULL → host=get_client_name=name, errno=EHOSTUNREACH; (4) host embedded mid‑string + varied errno (ETIMEDOUT/EPIPE). Zero‑diff vs cref_report_error.
  • Verification. cargo build (workspace, 0 warnings); nm target/debug/ircd | grep ' T report_error' → defined from Rust; L1 zero‑diff; L2 golden_registration (boot path exercises report_error on errors) byte‑identical.
  • No new L2 / no S2S. Output callee, not a msgtab handler — the SCH_ERROR error notice is covered by the existing golden suite. Untested‑by‑design: the SO_ERROR getsockopt readout (needs a pending‑error socket; fd<0 skips it identically), the sendto_flag SCH_ERROR wire emission (L2, variadic), the bysptr remote NOTICE (S2S — needs a Connecting/Handshake server whose byuid resolves to a remote introducer).

• 2026-06-06 — P7r (s_bsd.c init_sys, fd-table boot leaf) merged. Ported the cleanest remaining leaf in the central I/O TU s_bsd.c.

  • Cluster choice — after the P7d–P7q leaves, the genuinely-clean leaves are nearly exhausted; init_sys is the last one that calls no other s_bsd.c function and shares no private static with still-C code (it touches only the already-exported fdas/fdall/local globals). Contrast: get_my_name shares the private mysk static with still-C check_init/connect_server (a shared-static connected component, deferred); daemonize/start_iauth are blocked on the still-C iauth spawn.
  • Config-resolved body — two #ifdefs collapse the source: RLIMIT_FD_MAX is not defined on Linux (verified via gcc -E) → the entire getrlimit/setrlimit of RLIMIT_FD_MAX+RLIMIT_CORE block (with its exit(-1) arms) does not compile; USE_POLL=1 (setup.h:390) → the #if !defined(USE_POLL) sequent setdtablesize block is excluded; Linux (not PCS/DYNIXPTX/SVR3/HPUX/SVR4) → the setlinebuf(stderr) branch. Resolved body: setlinebuf(stderr); bzero(&fdas)/bzero(&fdall) + fdas.highest=fdall.highest=-1; local[0]=local[1]=local[2]=NULL; for (fd=3; fd<MAXCONNECTIONS=50; fd++){ local[fd]=NULL; close(fd); }. Callees: libc only.
  • Mechanism — partial port via the existing s_bsd_link.o second-compile seam, new guard -DPORT_S_BSD_INIT_SYS_P7r in ircd-sys/build.rs; init_sys wrapped in #ifndef PORT_S_BSD_INIT_SYS_P7r in ircd/s_bsd.c. Rust port in ircd-common/src/s_bsd.rs: setlinebuf via a local extern (reusing the module's stderr extern), fdas/fdall via addr_of_mut!(ircd_sys::bindings::fdas/fdall) + write_bytes(_,0,1), local[] via the existing local_base() helper, MAXCONNECTIONS from bindgen.
  • Classification — boot callee, not a msgtab handler.
  • L1 — init_sys_diff.rs, 3 cases, zero-diff vs cref_init_sys. The close loop closes fds 3..49 in the calling process → destructive to cargo's test fds, so each world runs in a forked child and returns its post-state through an mmap(MAP_SHARED|MAP_ANONYMOUS) region (memory, not an fd → survives the close loop); the parent waitpids and asserts Rust-child == cref-child == expected. Each child pre-dirties its globals (highest=7, fd[] non-zero, local[0]/[5]/[N-1] sentinels) so the test proves the body wrote (inverse-of-dirty), opens a sentinel fd dup'd onto fd 10, and reports: fdas/fdall.highest (=-1), non-NULL local[] count (=0), fd[] fully zeroed, sentinel-fd-closed, fds 1/2 still open. Isolated worlds (real fdas/fdall/local vs cref_*), serialized on GLOBALS_LOCK.
  • L2 / S2S — no new L2 (boot callee; the existing golden suite boots through it, golden_registration byte-identical confirmed); no S2S (formats no remote-user fields). Untested-by-design: setlinebuf(stderr) (unobservable line-buffering); the rlimit/exit arms don't compile under the locked config.

• 2026-06-06 — P7s (s_bsd.c get_my_name, server-own-hostname resolver, + de-static mysk) merged. The most leaf-like remaining s_bsd.c function after the P7d–P7r leaves. Ported get_my_name (s_bsd.c:2940) to ircd-common/src/s_bsd.rs.

  • Cluster choice. After P7d–P7r the genuinely-clean s_bsd.c leaves are exhausted; the remaining exported functions are the event-loop core (add_connection/read_message + statics), the connection-auth cluster (check_init/check_client/check_server/check_server_init), connect_server, and the fork/iauth glue (daemonize/start_iauth). get_my_name is the most leaf-like: its only in-TU callee is add_local_domain (already Rust, P7e); everything else is libc (gethostname/gethostbyname/isdigit/strlen) or already-Rust (find_me P6, inetpton/mycmp P1, minus_one/me bindgen). NB: the utmp_open/utmp_read/utmp_close trio + summon are not remaining leaves — they're #if defined(ENABLE_SUMMON) || defined(USERS_SHOWS_UTMP) (both off) so they don't compile at all (user-confirmed).
  • The mysk blocker / de-static. get_my_name writes the file-private static struct SOCKADDR_IN mysk (s_bsd.c:55); the still-C check_client (s_bsd.c:965, localhost detection) and connect_inet (s_bsd.c:2687/2692, outgoing bind) read it. To split the writer (→ Rust) from the C readers, mysk needs a linkable symbol → changed static struct SOCKADDR_IN mysk; → struct SOCKADDR_IN mysk; (file-scope global) unconditionally (behaviour-preserving: single TU, no other mysk; storage-class only). This also makes the cref archive export cref_mysk (the objcopy --prefix-symbols rename only follows global symbols — the L1 static-symbol limit), so the L1 test gets a full cross-world mysk comparison. mysk stays C-owned (defined in s_bsd_link.o); Rust references it via a local extern "C" { static mut mysk: libc::sockaddr_in6; }.
  • Guard / seam. Partial port via the existing s_bsd_link.o second-compile, new guard -DPORT_S_BSD_GET_MY_NAME_P7s added alongside P7d–P7r in ircd-sys/build.rs; the C body (s_bsd.c:2940-3023) wrapped in #ifndef PORT_S_BSD_GET_MY_NAME_P7s. RED confirmed get_my_name undefined — referenced by the still-C ircd.c:702 (boot); after GREEN nm target/debug/ircd shows get_my_name T from Rust and mysk a B global. The cref oracle keeps the full unguarded s_bsd.o → cref_get_my_name + cref_mysk.
  • Config-resolved body. HAVE_GETIPNODEBYNAME undef (setup.h:53) → the plain gethostbyname(cname) || gethostbyname(name) branch (no getipnodebyname/freehostent). DEBUGMODE off → no Debug at 3015. The mysk.SIN_ADDR write at s_bsd.c:3012 is inside a #if 0 … #endif (dead) → not ported. SOCKADDR_IN = sockaddr_in6 (AFINET=AF_INET6); tmp[HOSTLEN+1] (=64) is a module-private static mut; ME = me.name; BadPtr(cname) = cname.is_null() || *cname == 0; strncpyzt = strncpy + force-NUL.
  • Faithfulness. mysk is bzero'd first → full-struct byte compare is valid (padding/flowinfo/scope_id stay zero). The passwd branch fires only when aconf->passwd && isdigit(*passwd) (so "2001:db8::1" qualifies but "::1" does not — leading char must be a digit); inetpton failure → bcopy(minus_one, …, 16). The alias loop is for (hname=h_name, i=0; hname; hname=h_aliases[i++]) → Rust reads h_aliases[i] then i += 1 (post-increment). gethostbyname is declared via a local extern (absent from the libc crate).
  • Classification. Boot callee / utility TU (no msgtab entry) — called from ircd.c boot + connect_server. → L1 is the gate; no S2S (formats no remote-user wire fields).
  • L1. get_my_name_diff.rs, 6 cases, isolated worlds (Rust writes the real mysk; oracle writes cref_mysk), shared conf/cref_conf M-conf list + shared read-only cptr, me/cref_me ME pinned to irc.test, separate name output buffers, serialized on GLOBALS_LOCK. Determinism: gethostname/gethostbyname are non-deterministic across runs but identical across the two worlds in one run → the differential holds whatever DNS returns; the test asserts the two worlds agree (name bytes + the full 28-byte mysk==cref_mysk), not a fixed string. Cases: (1) M-conf NULL passwd → addr stays zero (family/port set); (2) non-digit passwd "abc" → isdigit false → addr zero (inverse); (3) valid "2001:db8::1" → inetpton fills 20 01 0d b8 … 01; (4) digit-but-invalid "9zz" → inetpton fails → mysk addr all-0xff (minus_one); (5) cname="localhost" → drives the gethostbyname + alias-loop branch; (6) cname="" → BadPtr early return after add_local_domain. Zero-diff vs cref_get_my_name.
  • Verification. cargo build (workspace, 0 warnings); L1 zero-diff; sibling s_bsd L1 (s_bsd_leaves_diff/add_local_domain_diff/init_sys_diff/report_error_diff/close_connection_diff) re-run green; golden_registration byte-identical (boot exercises get_my_name).
  • Untested-by-design. The resolved hostname is host-dependent (asserted as agreement, not a literal); the gethostname == -1 early return needs an induced failure (both worlds take the success path identically).

• 2026-06-06 — P7t (ircd.c calculate_preference, AC preference leaf) merged. Ported calculate_preference (ircd.c:387) to ircd-common/src/ircd.rs.

  • Cluster choice — the cleanest remaining exported leaf in ircd.c: the s_bsd.c clean leaves are exhausted (the rest belong to the deferred event-loop / auth / connect clusters), and calculate_preference's only TU-callee, send_ping, was already ported in P7m. It is the periodic auto-connect (AC) preference recompute invoked from io_loop (ircd.c:1164) when timeofday >= nextpreference.
  • Body — walks the global conf list; skips non-C-lines (status lacking CONF_CONNECT_SERVER|CONF_ZCONNECT_SERVER) and AC-ineligible C-lines (port <= 0); for the rest fires send_ping(aconf) (advances the conf's aCPing sliding window) then sets pref = -1 when there is no usable window (cp==NULL || cp->seq==0 || cp->recvd==0), else computes pref = (u_int)(f*100) from recvd/seq, pow(f,20), ping/recvd with a 0.001 floor and a 100000.0 ceiling. Returns currenttime + 60.
  • Config-resolved body — no #ifdefs; compiles verbatim. CONF_CONNECT_SERVER=0x08, CONF_ZCONNECT_SERVER=0x20.
  • Seam — partial port via the existing ircd_link.o second-compile (which already drops the P7c tune pair); new guard -DPORT_IRCD_CALC_PREF_P7t added to its make --eval line. The C function is wrapped #ifndef PORT_IRCD_CALC_PREF_P7t … #else extern time_t calculate_preference(time_t); #endif — the function is in no *_ext.h, and io_loop (its sole caller, same TU, defined later) relied on the in-file definition for its implicit prototype, so the #else supplies the extern declaration. nm target/debug/ircd confirms T calculate_preference (came from Rust).
  • Faithfulness — calls the libc pow via a local extern "C" { fn pow(f64,f64)->f64; }, NOT f64::powf: the std intrinsic is permitted to differ from the system pow in the last ULP, which would diverge the (u_int)(f*100.0) integer truncation and break L1. The final store reproduces the C double → u_int → int cast chain as (f * 100.0) as u32 as c_int (f is clamped ≤ 100000.0, so f*100 ≤ 1e7 fits u32). send_ping is called before the cp read, faithfully — order matters because it mutates the window the pref math reads.
  • Classification — utility / callee TU (no msgtab entry; reached only from io_loop).
  • L1 — ircd-testkit/tests/calculate_preference_diff.rs, zero-diff vs cref_. Two isolated worlds (Rust reads conf/udpfd; oracle reads cref_conf/cref_udpfd), each builds a parallel conf linked list, runs, then compares every node's pref + aCPing post-state + the currenttime+60 return. 5 cases: non-C-line skip (pref untouched), port<=0 skip (send_ping not even called), recvd==0 sentinel (send_ping bumps seq/lseq, recvd stays 0 → -1), full-window compute (byte-identical pref), and a 5-node mixed list. udpfd left at -1 (send_ping's sendto fails, ignored; the pref math reads only the counters mutated beforehand). Serialized on GLOBALS_LOCK (the P7 L1 shared-global hazard).
  • L2 — no new test: the locked golden config defines no connect{} C-lines, so the loop body is a no-op on a golden boot → golden_registration stays byte-identical (re-confirmed). Same utility-leaf L2 posture as P7c/P7m.
  • S2S — none: formats no remote-user wire fields (only a numeric pref field and a binary UDP datagram via send_ping).
  • Untested-by-design — the cp==NULL clause of the -1 sentinel is dead defensive code: calculate_preference calls send_ping(aconf) first, and send_ping unconditionally dereferences cp->port, so an AC-able C-line with ping==NULL segfaults both implementations identically. It never occurs in practice (config allocates an aCPing for every connect{} line), so the L1 test never builds such a node and the realistic sentinel is exercised via recvd==0.

• 2026-06-06 — P7u (s_auth.c iauth /STATS reporters report_iauth_conf/report_iauth_stats) merged. Opened the last P7 TU, s_auth.c (the socket/ident/iauth-pipe I/O deferred from P5), by porting its two cleanest leaves to ircd-common/src/s_auth.rs.

  • Cluster choice. After P7a–P7t the clean leaves of s_bsd.c and ircd.c are exhausted (the rest are the deferred event-loop/auth/connect-server/signal clusters), so the natural next move is s_auth.c. Its iauth-pipe write path (vsendto_iauth/sendto_iauth) is irreducibly C — vsendto_iauth takes va_list and sendto_iauth is variadic (the keystone send-family finding) → P8, not now. The read path read_iauth is the big iauth protocol parser (stays C). The two cleanest leaves are the /STATS reporters: each walks a LineItem (aExtCf/aExtData = struct LineItem { char *line; struct LineItem *next; }) linked list and emits one numeric per node via sendto_one. Their only in-TU dependency is the two list heads read_iauth populates.
  • Config-resolved body. Both live in the #if defined(USE_IAUTH) block (USE_IAUTH ON → compiled). RPL_STATSIAUTH=239, RPL_STATSDEBUG=249 (bindgen consts); ME=me.name. No #ifdef-gated branches inside either body. report_iauth_conf early-returns when adfd < 0 (iauth slave fd); report_iauth_stats has no guard.
  • The seam / de-static. The writer read_iauth stays C, so to split the Rust readers from it the two file-static list heads iauth_conf/iauth_stats (s_auth.c:97-98) are de-static'd (drop static, file-scope global) — behaviour-preserving (single TU, no other symbol of those names; storage-class only), the P7s mysk precedent. This gives the C-owned globals linkable symbols (defined in s_auth_link.o, written by read_iauth; Rust references them via a local extern "C" { static mut … : *mut LineItem }) and makes the cref archive export cref_iauth_conf/cref_iauth_stats (the objcopy --prefix-symbols rename only follows global symbols — the L1 static-symbol limit), giving the L1 differential parallel C-owned heads to populate.
  • Guard / build.rs. Partial port via a new s_auth_link.o second-compile, guard -DPORT_S_AUTH_REPORT_P7u; the C bodies wrapped #ifndef PORT_S_AUTH_REPORT_P7u … #endif. Added "s_auth.o" => "s_auth_link.o" to link_objs() and a plain sh -c compile (s_auth.c references no machine-path macros — start_iauth lives in s_bsd.c, not here — so no make --eval path-var expansion needed, unlike s_bsd_link.o/ircd_link.o). s_auth.o stays in CREF_OBJS (unguarded oracle); not in PORTED (still-C symbols remain). RED confirmed report_iauth_conf/report_iauth_stats undefined — referenced by the already-Rust m_stats (s_serv.rs) and tstats (s_misc.rs); after GREEN nm target/debug/ircd shows both T (from Rust) and iauth_conf/iauth_stats B (C-owned globals).
  • Faithfulness. report_iauth_conf checks adfd < 0 before the walk; both post-increment through ectmp = ectmp->next in declaration order (head first). sendto_one called via a local extern "C" variadic decl (the s_numeric pattern); fmt literal c":%s %d %s :%s".as_ptr() as *mut c_char.
  • Classification. Utility / callee TU (no msgtab entry) — reached only from STATS: report_iauth_conf ← s_serv.c m_stats (/STATS a/i), report_iauth_stats ← s_misc.c tstats (/STATS t). → L1 is the gate.
  • L1. ircd-testkit/tests/iauth_reporters_diff.rs, 6 cases, zero-diff. The reporters' only observable surface is the bytes sendto_one buffers into the recipient's sendQ, so the test builds a shared read-only LineItem list (pointed at by both iauth_conf and cref_iauth_conf — the reporters never mutate it), gives each world its OWN heap recipient aClient (Rust send_message→Rust dbuf_put vs cref_send_message→cref_dbuf_put — separate dbuf pools), drives both reporters, then drains each sendQ with its MATCHING dbuf_get (cross-reading would corrupt the foreign freelist) and asserts byte-identical. Recipient: fd=-1, status=STAT_CLIENT, from/serv/confs NULL (get_sendq returns default QUEUELEN, no deref), acpt = &me/&cref_me so send_message's if (to->acpt != &me) (*to->acpt).sendM++ branch is skipped (a real local client always has a valid acpt; the zeroed NULL would deref — found the hard way). Cases: (1) 3-node conf list, adfd=5 → 3× RPL_STATSIAUTH; (2) inverse/guard non-empty list, adfd=-1 → no output; (3) inverse empty conf list → no output; (4) 3-node stats list → 3× RPL_STATSDEBUG; (5) inverse empty stats list → no output; (6) single node + longer to arg → %s :%s passthrough. Serialized on GLOBALS_LOCK (me/adfd/iauth_conf/iauth_stats are process globals).
  • L2. No new test: golden boots -t -s (no iauth) → adfd<0 + empty lists → both reporters are no-ops, so any STATS path stays byte-identical = no-regression only. golden_registration re-confirmed byte-identical.
  • S2S. None — the reporters format no remote-user wire fields (only the local server name + a config/stat line).
  • Verification. cargo build --workspace (0 warnings); L1 zero-diff (6/6); golden_registration byte-identical.

• 2026-06-06 — P7v (s_auth.c set_clean_username) merged. The last pure-logic leaf of s_auth.c; everything else left in the TU is socket/ident/iauth-pipe I/O kept in C.

  • Cluster choice. set_clean_username (s_auth.c:44) is the only s_auth.c function with no socket/fd dependency — callees are libc-only (strchr/strlen/isspace/strcmp, MyFree→free) plus the istat global (defined in still-C ircd.c, reachable via bindgen) and the interior self-pointer cptr->auth = cptr->username. The remaining s_auth.c symbols are all I/O: read_iauth (iauth-pipe parser, writes the P7u list heads), the variadic sendto_iauth/vsendto_iauth, start_auth + the ident-protocol send_authports/read_authports — per the PLAN these stay C for now.
  • Behaviour. Derives cptr->username (≤USERLEN=10 + NUL) from the raw ident reply: NULL auth → early return; mark "dirty" (prefix a -) if auth contains [/@, strlen>USERLEN, has a leading : (then skip it), or has whitespace followed by more chars; copy up to USERLEN chars dropping @/[/whitespace; if the cleaned name strcmp-equals the original, MyFree(auth) + redirect auth at the interior username buffer (the make_client self-pointer hazard → addr_of_mut!), else the original heap auth survives and istat.is_authmem += strlen+1, istat.is_auth += 1.
  • Guard / seam. set_clean_username was static → nm -g (ircd-testkit's cref renamer) emitted no oracle. De-static'd in s_auth.c (storage-class only, behaviour-preserving — single TU, no other symbol of this name; the P7s mysk / P7u list-head precedent) and the body #ifndef PORT_S_AUTH_CLEAN_USERNAME_P7v-guarded out of s_auth_link.o (-D added to the recipe in ircd-sys/build.rs alongside -DPORT_S_AUTH_REPORT_P7u), with an #else extern prototype so the still-C callers keep a declaration. RED confirmed undefined reference to set_clean_username from both the test and the C callers (read_iauth:410, read_authports:810); after GREEN nm target/debug/ircd shows T set_clean_username (from Rust). The cref oracle keeps the full unguarded s_auth.o → cref_set_clean_username.
  • Classification. Utility/callee (no msgtab entry). Reached only from the still-C read_iauth/start_auth, which need a live iauth/ident peer the golden harness doesn't run (boots -t -s, adfd<0). L1 is the gate.
  • L1. ircd-testkit/tests/set_clean_username_diff.rs: two independent calloc'd heap aClients per case (one driven by c_set_clean_username [→Rust], one by cref_set_clean_username), each with its own auth allocated by libc strdup (the fn may free() it → must be malloc-compatible, not a Rust CString); calloc'd → zeroed username[11] so trailing bytes match. Asserts byte/field-identical across worlds: the full username[11] buffer, the is_auth/is_authmem deltas (istat vs cref_istat, read before/after), and the auth == &username self-pointer predicate (plus, when false, the surviving auth string content). 9 cases: free path ("bob", exact-USERLEN "abcdefghij", empty ""), istat path ("bob@host", "bo[b", "verylongusername", ":bob", "bo b"), inverses ("bob " trailing-whitespace not-dirty-but-unequal, NULL-auth early return). Zero-diff; serialized on GLOBALS_LOCK (istat/cref_istat are process globals).
  • L2 / S2S. No new L2: the only callers are unreachable under the golden harness's -t -s boot (no iauth slave, no ident peer); golden_registration stays byte-identical (no-regression). No S2S — the function formats no remote-user fields / has no IsServer branch.

• 2026-06-06 — P7w (s_auth.c ident-protocol I/O pair send_authports/read_authports) merged. The RFC1413 ident query/reply pair — the leaf relative to the still-C start_auth + the s_bsd.c event loop (s_bsd.c:2363/2368, the FLAGS_WRAUTH/auth-readable arms). Ported to ircd-common/src/s_auth.rs alongside the P7u reporters + P7v set_clean_username.

  • Cluster choice — leaf-first: these are leaves relative to start_auth (which opens the ident connection) and the still-C select/poll loop. They share no file-static with the rest of s_auth.c (the iauth_* statics belong to read_iauth) → independent cluster. The remaining s_auth C = read_iauth (iauth-pipe parser), start_auth (connection setup), the variadic sendto_iauth/vsendto_iauth.
  • Config-resolved body — USE_SYSLOG undef → the get{sock,peer}name-error syslog(...) block (the only get_client_name call) drops to a bare goto authsenderr; DEBUGMODE undef → every Debug((...)) a no-op (its inet_ntop/ipv6string arg never evaluated); AFINET=AF_INET6 → SOCKADDR_IN=sockaddr_in6, SIN_PORT=sin6_port, SOCKADDR=sockaddr, SOCK_LEN_TYPE=socklen_t; BUFSIZE=512 (cptr->buffer is [char;512], count an int); flags FLAGS_AUTH=0x200/FLAGS_WRAUTH=0x400/FLAGS_GOTID=0x1000, ClearAuth=flags&=~FLAGS_AUTH.
  • send_authports — getsockname/getpeername(fd) (short-circuit || preserved), sprintf→Rust format!("{} , {}\r\n", ntohs(them.sin6_port), ntohs(us.sin6_port)), single write(authfd). A short write or a get{sock,peer}name failure is authsenderr: ircstp->is_abad++, close(authfd), walk highest_fd down while local[highest_fd] is NULL, authfd=-1, clear FLAGS_AUTH|FLAGS_WRAUTH. Success → clear only FLAGS_WRAUTH.
  • read_authports — read(authfd, buffer+count, sizeof(buffer)-1-count) (buffered across partial reads via count), then libc::sscanf(buffer, "%hd , %hd : USERID : %*[^:]: %512s", &remp, &locp, ruser) (driven through libc with the exact C format → bit-identical parse). On a match: extract system (the : <type> : field via strrchr + leading-isspace skip + strncpyzt) and ruser (copy non-space/non-: chars). No match but len!=0 and a \n/\r present → clear ruser; no \n/\r yet → early return (keep reading). Then close(authfd) + highest_fd walk + count=0 + authfd=-1 + ClearAuth; !locp||!remp||!*ruser → is_abad++, else is_asuc++; free the old auth (+istat decrement) when it's not the interior username pointer, set auth (OTHER→MyMalloc+'-'+strcpy, else mystrdup), set_clean_username, FLAGS_GOTID.
  • Seam — -DPORT_S_AUTH_AUTHPORTS_P7w added to the s_auth_link.o second-compile; both bodies #ifndef-guarded out of s_auth.c. Both are already global in s_auth_ext.h (unlike the static set_clean_username), so the C callers' prototype comes from the header → no de-static, no #else prototype needed (the P7u report_iauth_* precedent). RED confirmed: cargo build -p ircd-rs → exactly send_authports/read_authports undefined (from s_bsd.c:2363/2368); GREEN: nm target/debug/ircd shows both as T (from Rust). index→strchr, rindex→strrchr, MyFree→free, ntohs→u16::from_be; globals ircstp/highest_fd/local[]/istat + mystrdup/MyMalloc are the ircd-common defs.
  • Classification — utility/callee TU (no msgtab entry); reached only from the still-C ident I/O path. L1 is the gate.
  • L1 — ircd-testkit/tests/authports_diff.rs, 10 cases, zero-diff vs cref_*. Two independent heap aClients + per-world ircstp(+backing stats)/istat/highest_fd/local[] (the cref_* twins), serialized on GLOBALS_LOCK (the P7 L1 shared-global convention). fd I/O over socketpairs. send_authports: both worlds' fd point at one real connected IPv6-loopback socket (connected_inet6) so getsockname/getpeername populate sin6_port identically — an AF_UNIX socketpair leaves the port bytes untouched, so C reads uninitialised stack while Rust reads its zeroed buffer (the one false diff this caught, fixed in the harness, not the port). Each world writes to its own authfd whose bytes are read back and compared. Cases: success (identical written bytes + FLAGS_WRAUTH cleared, FLAGS_AUTH untouched), getsockname-error (fd=-1 → is_abad++, authfd=-1, flags cleared), and the authfd==highest_fd walk to a non-NULL local[] floor. read_authports: each world's authfd is a socketpair read-end fed an identical canned reply. Cases: valid USERID(→is_asuc++, username bob, free path), OTHER(→-bob), bad reply with \n(→is_abad++, no GOTID), ERROR reply, partial read with no \n/\r(→ early return: authfd still open, count advanced, no counter change — the inverse/round-trip case), EOF (read==0 → is_abad++), and a pre-existing heap auth (→ freed + istat decremented). Asserts byte/field identical username[11], auth (string or the auth==&username predicate), flags, count, authfd, and the is_asuc/is_abad + is_auth/is_authmem deltas.
  • L2 / S2S — none. No msgtab entry; the ident path needs a live ident server the ircd-golden harness doesn't run (-t -s, adfd<0). Formats no remote-user wire fields, no IsServer branch → no S2S. Existing golden suite stays byte-identical (golden_registration re-run green as the no-regression check).

• 2026-06-06 — P7x (s_auth.c ident initiator start_auth) merged. Ported start_auth (s_auth.c:544) to ircd-common/src/s_auth.rs — the function that initiates the RFC1413 (ident) query carried out by the P7w pair send_authports/read_authports.

  • Cluster choice — leaf-first: the last ident-protocol leaf in s_auth.c. Remaining C in s_auth.c after this = read_iauth (iauth-pipe parser) + the variadic sendto_iauth/vsendto_iauth (va_list → P8 trampolines).
  • Guard — -DPORT_S_AUTH_START_AUTH_P7x added to the existing s_auth_link.o recipe (alongside _P7u/_P7v/_P7w). The C body is #ifndef-guarded with an #else extern prototype so the still-C callers (s_bsd.c:1272/1732 — check_client/add_connection) keep a declaration.
  • Config-resolved body — NO_IDENT undef → full body (not the empty stub); USE_IAUTH on → the (iauth_options & XOPT_REQUIRED) && adfd<0 early-return + the adfd>=0 iauth-handoff abuf block; USE_SYSLOG undef → the socket()-failure syslog collapses to a bare ircstp->is_abad++; DEBUGMODE undef → every Debug((...)) no-op; AFINET=AF_INET6 → SOCKADDR_IN=sockaddr_in6, SIN_FAMILY/SIN_PORT=sin6_family/sin6_port, SOCK_LEN_TYPE=socklen_t.
  • Faithfulness — ntohs→u16::from_be, htons→u16::to_be; the iauth query is built with libc sprintf through the exact "%d C %s %u "/"%s %u" formats + the global ipv6string scratch the C reused (sequenced them→us, byte-for-byte); IsConfTLS(x)=x->flags & PFLAG_TLS, BadPtr(x)=!x||*x=='\0'. The Rust ports set_non_blocking (P7d)/report_error (P7q)/inetntop/inetpton (P1) resolve through the link seam; the variadic sendto_iauth/sendto_flag are called via a local extern "C" block. errno via *libc::__errno_location() compared to EINPROGRESS.
  • Classification — utility/callee TU (no msgtab entry); reached only from the still-C connection path (add_connection→check_client→start_auth), which needs a live ident peer the ircd-golden harness doesn't run.
  • L1 — ircd-testkit/tests/start_auth_diff.rs, 3 cases, zero-diff vs cref_start_auth, serialized on GLOBALS_LOCK (P7 shared-global convention), per-world adfd/iauth_options/ircstp/highest_fd: (1) XOPT_REQUIRED && adfd<0 early return (authfd/flags untouched); (2) iauth handoff — adfd=socketpair write-end (write succeeds → sendto_iauth returns 0), cptr->fd=a shared real connected IPv6-loopback socket so both worlds' getpeername/getsockname read identical addrs/ports → the query bytes written to adfd are byte-identical, authfd closed, FLAGS_XAUTH set; (3) getpeername failure on an unconnected socket → report_error + authfd=-1 (compares cptr state only; the client needs a real name+STAT_CLIENT since fd>=0 → get_client_name takes the MyConnect/showip branch). Not covered (noted in the test header): the MAXCONNECTIONS-2 fd-exhaustion guard (can't force a high fd) and the bind/connect-to-113 network tail.
  • L2 / S2S — no new test. Utility TU with no client/golden path under the locked config (no ident peer); L1 is the gate. Existing golden suite stays byte-identical (golden_registration green). No S2S — no IsServer branch, formats no remote-user fields.
  • Observation (out of scope, pre-existing P5) — case 3 surfaced a get_client_name(showip=TRUE) divergence on a NULL auth pointer: the Rust port emits tester[@] where glibc sprintf("%.*s", N, NULL) emits tester[(null)@]. Only observable via report_error's stderr (not asserted here); a latent faithfulness gap in the P5 get_client_name port, not P7x.

• 2026-06-06 — P7y (s_auth.c iauth-pipe line parser read_iauth) merged.

  • Cluster choice — read_iauth (s_auth.c:174), the last non-variadic logic in s_auth.c (per [[p7-started]]). Leaf-first relative to the still-C s_bsd.c select/poll loop that calls it when adfd is readable. After this, the only C left in s_auth.c is the variadic sendto_iauth/vsendto_iauth trampolines (→ P8).
  • Guard — -DPORT_S_AUTH_READ_IAUTH_P7y added to the existing s_auth_link.o recipe in ircd-sys/build.rs (alongside _P7u/_P7v/_P7w/_P7x); the C body is #ifndef-guarded with an #else void read_iauth(void); prototype so the still-C callers (the event loop) keep a declaration. The cref oracle keeps the full unguarded s_auth.o → cref_read_iauth + the cref_iauth_* globals survive for L1.
  • Config-resolved body — USE_IAUTH ON (whole body live); AFINET=AF_INET6 → the per-client prefix formats inetntop(AF_INET6, &cptr->ip, ipv6string, sizeof); DEBUGMODE off. No #ifdef inside the function. index→strchr, bcopy(a,b,c)→memmove(b,a,c) (os.h:384), MyFree→ libc free; MyMalloc/mystrdup are the ircd-common allocators. Function-static carry state (obuf/last/olen/ia_dbg) → private module static mut (the debugbuf precedent). File-scope globals iauth_version (de-static'd-by-default, not in any header → declared extern in the module), iauth_conf/iauth_stats (P7u de-static'd), iauth_options/iauth_spawn (bindgen) stay C-owned in s_auth_link.o.
  • Classification — utility/callee TU, no msgtab entry; called from the still-C event loop when a live iauth slave writes the pipe. L1 is the gate. No L2/S2S: the golden harness runs -t -s with adfd<0 (no iauth slave), so the path is unreached there; no IsServer branch, formats no remote-user wire fields. Existing golden suite stays byte-identical (golden_registration 2/2 confirmed, no-regression).
  • L1 — ircd-testkit/tests/read_iauth_diff.rs, 10 cases, zero-diff vs cref_, serialized on GLOBALS_LOCK. Drives read_iauth/cref_read_iauth on independent per-world copies of every touched global (adfd/iauth_options/iauth_spawn/iauth_version/iauth_conf/iauth_stats/istat/me/local[]/timeofday); each world's adfd is the read end of its own non-blocking socketpair fed the identical protocol bytes; timeofday/iauth_spawn pinned so the s-header myctime/spawn line is byte-identical. Cases: O-options (incl. flagless reset), V replace+free, A/a conf add+clear (inverse pair), s/S stats reset+append (inverse pair), U/u per-client ident (fresh auth==username self-pointer → no-free path), U-with-pre-existing-heap-auth (istat-decrement + free, allocated through each world's own MyMalloc/cref_MyMalloc to avoid crossing allocator twins), gone-client / port-mismatch / garbage negatives (client untouched), and the obuf/olen partial-line carry round-trip (split feed == one-shot).
  • Finding — the per-client prefix check formats the client IP through the ported inetntop, which expands ::1→0:0:0:0:0:0:0:1 (a faithful quirk of support.c's ::-expander). In production the iauth daemon echoes the same expanded form (start_auth builds the query with the same inetntop), so the prefix matches; the L1 input lines must carry the expanded IPv6 form, not ::1. Initial test used ::1 → both worlds correctly took the mismatch branch (differential green, expectation wrong) — surfaced the quirk.
  • Not covered (noted) — the recv-error "lost slave" branch (close(adfd)+start_iauth) and the D/K/k finish/kill paths (register_user/exit_client, need a fully-registered client + the event loop) — deterministic only at L2/soak with a live iauth.

• 2026-06-06 — P7z (s_bsd.c check_client) merged. Ported the ordinary-client access check check_client (s_bsd.c:909) to ircd-common/src/s_bsd.rs; guard -DPORT_S_BSD_CHECK_CLIENT_P7z on the s_bsd_link.o recipe.

  • Cluster choice — check_client is a callee of the Rust register_user (s_user.c:557), reached when a connecting client finishes registration. It resolves the socket peer address, validates the DNS host↔ip mapping, and attaches the matching I:line. The file-static helper check_init (s_bsd.c:868) is shared with the still-C check_server_init (s_bsd.c:1083), so it is NOT dropped: ported as a private Rust twin while the C static check_init stays compiled. After check_client was #ifdef'd out, check_init has exactly one remaining caller (check_server_init) → GCC inlines it and drops the symbol; the build resolves cleanly. This is the P7p set_sock_opts precedent (a static callee ported as a private twin while the C static survives for its other caller).
  • Config-resolved body — NO_OPER_REMOTE undef → the trailing FLAGS_LOCAL/is_loc block (s_bsd.c:961–975) is not compiled, so check_client ends at attach_Iline and makes no mysk use (unlike check_server_init/connect_server). UNIXPORT undef → no IsUnixSocket branch in either fn; hp = cptr->hostp unconditionally. DEBUGMODE off → all Debug(...) no-ops. AFINET=AF_INET6 → sockaddr_in6/sin6_addr/sin6_port/in6_addr.
  • Faithfulness notes — check_init does getpeername(cptr->fd) (isatty branch kept for the inetd-on-tty case → me.sockhost), inetntop into the caller's sockname, bcopy the 16-byte addr into cptr->ip, cptr->port = ntohs(sin6_port). The IP# Mismatch arm reads four c_ulongs from hp->h_addr (a 16-byte addr — a latent C over-read; %08x truncates each to 32 bits) and writes the inetntop result into the real global ipv6string (matching the C side effect). attach_Iline (P6) / inetntop / report_error (P7q) are Rust; the variadic sendto_flag is called (→ P8).
  • Classification / L1 — callee TU (no msgtab entry). cref_check_client is exported → full cross-world L1 differential (ircd-testkit/tests/check_client_diff.rs, 4 cases). Both worlds get separate aClients (check_client mutates ip/port/hostp + attaches confs) but share one real connected IPv6-loopback fd so getpeername is byte-identical; conf/cref_conf both empty → attach_Iline returns -2 EXITC_NOILINE (the loop never runs) — deterministic, no fixture. Cases: (1) no hostp/empty conf → ip/port filled, hostp stays NULL, -2; (2) hostp addr matches ::1 peer → hostp kept; (3 inverse) hostp addr mismatches → IP# Mismatch → hostp cleared to NULL; (4) unconnected socket → getpeername fails → check_init → report_error → -1. Asserts return + ip/port/hostp-nullness agree. Serialized on a GLOBALS_LOCK (conf/ipv6string/me are process globals; see the p7-l1-shared-global-race memory). Fixture finding: the getpeername-failure path → report_error → get_client_name → mycmp(name, sockhost) derefs cptr->name, so the harness client must set a non-NULL name (the real make_client sets name = namebuf).
  • L2 / S2S — L2 = existing ircd-golden golden_registration byte-identical; it drives a real client through registration with a real I:line, exercising the success path (return 0) that L1's empty-conf cases don't. No S2S: check_client has no IsServer(cptr) branch and formats no remote-user fields (servers go through check_server_init/check_server).

• 2026-06-06 — P7aa (s_bsd.c check_server_init + check_server) merged. The server-side access-check cluster — the sibling of the P7z check_client, reached from the Rust m_server/completed_connection on a server link.

  • Cluster choice — check_server_init (s_bsd.c:992) is the entry point; it tail-calls check_server (s_bsd.c:1076), so the two form one connected component over the C/N-line lookup. Ported together under one guard -DPORT_S_BSD_CHECK_SERVER_P7aa.
  • Guard / check_init — both functions #ifndef'd out of s_bsd_link.o. The file-static check_init (s_bsd.c:868, ported as a private Rust twin in P7z) had its two callers check_client (P7z) and check_server (P7aa); with both now ported, the C static check_init + its forward prototype (s_bsd.c:64) lose their last C caller, so they are guarded out under the same PORT_S_BSD_CHECK_SERVER_P7aa symbol (no unused-static warning). The Rust port reuses the existing P7z check_init twin.
  • Config-resolved body — UNIXPORT undef → every IsUnixSocket/#ifdef UNIXPORT branch dropped (the get_sockhost unix guards collapse to always-run; no IsUnixSocket(cptr) in the addr-validation or conf scan); DEBUGMODE off → all Debug(...) no-ops; AFINET=AF_INET6. CFLAG/NFLAG/SCH_DEBUG added as module consts.
  • Faithfulness — the check_serverback goto becomes a loop (validate hp then break; the goto fires only in the else if (cptr->hostp) re-entry); the alias walk for(i=0,name=h_name; name; name=h_aliases[i++]) becomes a while !name.is_null() reading h_aliases[i] then i+=1; the IP# Mismatch arm reads four c_ulongs from hp->h_addr (the same faithful over-read as check_client); the async-DNS stack Link is built via std::mem::zeroed() + lin.value.aconf/lin.flags = ASYNC_CONF; AND16(c_conf->ipnum)==255 (unresolved sentinel) reuses the send_ping fold and copies cptr->ip into the conf's ipnum (dynamic-ip C-line rewrite). index→libc::strchr; sprintf("%s@%s") via a local variadic extern.
  • Callees — attach_confs/find_conf/find_conf_host/find_conf_ip/attach_conf/det_confs_butmask/count_cnlines (P6 s_conf), get_sockhost (P5 s_misc), gethost_byname (P6 res), add_local_domain (P7e), inetntop/strncpyzt (P1/local) all Rust; sendto_flag is called (variadic → P8). nextdnscheck global write via bindgen extern.
  • Classification — utility/callee TU (no msgtab entry). L1 is the differential gate; the C+N success path (return 0, attach, get_sockhost) is exercised by the existing L2-S2S golden suite, not a new L2 file.
  • L1 — ircd-testkit/tests/check_server_diff.rs, 6 cases zero-diff vs cref_: check_server_init with IsUnknown + empty conf → attach_confs NULL → -1 (before check_server); IsHandshake, NULL confs → find_conf NULL → sendto_flag+det_confs_butmask → -1; check_server unconnected fd → check_init getpeername fails → -2; connected ::1 fd no-hostp / hostp-addr-match / hostp-addr-mismatch → all find_conf_* miss → -1, asserting post-state ip/port/sockhost agree. Separate aClients per world (the fns mutate ip/port/sockhost/confs), one shared real ::1-loopback fd so getpeername is byte-identical; serialized on GLOBALS_LOCK (conf/me/ipv6string/nextdnscheck are process globals; the [[p7-l1-shared-global-race]] memory). hostents use a dotted h_name so add_local_domain is a no-op (no resolver/env dependency), with each addr padded to 32 bytes for the mismatch over-read.
  • S2S — no new file: golden_s2s_link/_eob/_who (and the rest of the S2S suite) link a real Peer that the Rust ircd accepts through check_server_init/check_server (s2s.conf carries the C/N lines), so a regression in the success/attach path fails the burst diff. All ran green; golden_registration (local client) also green.

• 2026-06-06 — P7bb (s_bsd.c add_connection + check_clones) merged.

  • Cluster choice — the inbound-connection acceptor add_connection (s_bsd.c:1638), the next leaf bottom-up after the P7d–P7aa socket/teardown/listener/access-check leaves: it is called from the still-C read_listener for each fd accept()ed off a listener. Its only caller-private callee check_clones (s_bsd.c:1572, CLONE_CHECK) is ported alongside it.
  • Guard — -DPORT_S_BSD_ADD_CONN_P7bb wraps two regions under one macro: check_clones (inside the surrounding #ifdef CLONE_CHECK) and add_connection. The P7k add_connection_refuse sitting between them keeps its own guard. add_unixconnection (#ifdef UNIXPORT) is not compiled.
  • check_clones as a private twin — static in C → no cref_ symbol → cannot be L1-diffed directly; ported as a module-private Rust fn with a static mut BACKLOG matching the C function-local struct abacklog list (age out pt+CLONE_PERIOD<timeofday, prepend {ip,now}, count same-ip nodes). MyMalloc (P2) / libc free (the MyFree macro). Observed only through add_connection's clone-reject path. The P7p set_sock_opts / P7z check_init precedent.
  • Config-resolved body — NO_DNS_LOOKUP set (build.rs EXTRA_CFLAGS): the else arm just sets acptr->hostp = NULL, and the USE_IAUTH && !NO_DNS_LOOKUP alias-forwarding block (%d A/%d N to iauth) is compiled out. CLONE_CHECK on (CLONE_MAX=10, CLONE_PERIOD=2) → the clone branch compiles; DELAY_CLOSE=15 → clone reject uses nextdelayclose = delay_close(fd) then add_connection_refuse(fd,acptr,1). UNIXPORT undef, AFINET=AF_INET6 (sin6_*, 16-byte in6_addr), linux → the getpeername-fail arm guards report_error behind errno != ENOTCONN.
  • Callees — make_client/add_client_to_list/add_fd (P2), inetntop (P1), report_error (P7q), add_connection_refuse (P7k), delay_close (P7f), set_non_blocking (P7d), set_sock_opts (P7p private twin), start_auth (P7x) all Rust; get_sockhost/get_client_host/sendto_flog stay C (non-variadic bindgen externs); sendto_flag is called (variadic, → P8). local/highest_fd/fdall/nextdelayclose/ipv6string/timeofday are bindgen statics.
  • Classification — utility/callee TU (not a msgtab handler): reached from read_listener. Universally exercised by L2.
  • L1 — ircd-testkit/tests/add_connection_diff.rs, 3 tests, zero-diff vs cref_. start_auth neutralized in both worlds by iauth_options=XOPT_REQUIRED+adfd=-1 (its top early-return) so its socket side effects drop out of the diff. normal_accept_then_clone_flood (case 1 + 4 merged so the process-static backlog starts pristine): first accept over a SHARED connected ::1 fd → compare full surviving post-state (return non-null, ip=::1, port, sockhost, fd, acpt, hostp=NULL, local[fd], highest_fd, aconf->clients=1); then per world calls #2..#10 succeed and the 11th (count=11>CLONE_MAX) is clone-refused (exercising the backlog twin). getpeername_failure_refuses + illegal_conf_refuses: the two refuse inverses (NULL + ircstp->is_ref+1 + clients untouched + fd closed; own fd per world since the path closes it). Serialized on GLOBALS_LOCK (local/highest_fd/fdall/ipv6string/timeofday/ircstp/iauth_options/adfd/the backlog are process globals; the p7-l1-shared-global-race hazard).
  • L2 — no new test. add_connection is the universal inbound acceptor — every ircd-golden client connection already flows through it; golden_registration (success path) byte-identical, golden_s2s_link green (incoming server links also go through it before m_server/check_server_init).
  • S2S — none. add_connection formats no remote-user fields and has no IsServer(cptr) branch (the client has no name/type yet).

• 2026-06-06 — P7cc (s_bsd.c connect_server + static connect_inet) merged. The outbound server-connection setup (s_bsd.c:2511) — the counterpart of the inbound add_connection (P7bb). Ported to ircd-common/src/s_bsd.rs; guard -DPORT_S_BSD_CONNECT_SERVER_P7cc on the s_bsd_link.o recipe. connect_server now resolves from Rust; the still-C do_dns_async/try_connections and the Rust m_connect call it via the s_bsd_ext.h prototype.

  • Cluster choice — the next leaf bottom-up after the P7d–P7bb socket/teardown/listener/access-check leaves. connect_server's only caller-private callee is the file-static connect_inet (s_bsd.c:2674), ported alongside as a private Rust twin (no cref_ oracle for a static).
  • set_sock_opts lifecycle — ported as a private Rust twin back in P7p, while the C static was kept for its remaining compiled caller. Survey: 268 (inetport, P7p — guarded out), 1731 (add_connection, P7bb — guarded out), 1802 (add_unixconnection, UNIXPORT off — not compiled), 2595 (connect_server — the last one). With connect_server ported, the C static set_sock_opts + its forward proto (s_bsd.c:69) have zero compiled callers → both guarded out under PORT_S_BSD_CONNECT_SERVER_P7cc (the P7aa check_init precedent); the Rust port uses the existing P7p twin.
  • Config-resolved body — UNIXPORT undef → connect_unix not compiled, the *aconf->host == '/' branch drops → always connect_inet; AFINET = AF_INET6 → sockaddr_in6/sin6_*/16-byte in6_addr; DEBUGMODE off → all Debug(...) no-ops (the leading inet_ntop into ipv6string is inside Debug(...) → not evaluated). mysk (P7s de-static'd) is the outbound-bind source; minus_one the all-0xff sentinel.
  • FINDING (faithful) — connect_server's DNS-resolution block (s_bsd.c:2538-2558, guarded by if (!aconf->ipnum.S_ADDR && *aconf->host != '/')) is dead code under AF_INET6. S_ADDR = s6_addr, an embedded array; !aconf->ipnum.s6_addr is the address of that array → always non-NULL → always false. The block never runs (the same !ipnum.s6_addr array-address quirk noted in send_ping/P7m); hp is used directly. Omitted in the port with a comment.
  • Faithfulness — the free_server: goto becomes a connect_server_free(cptr) helper returning -1; SetConnecting = status = STAT_CONNECTING (-4); connect_inet's static struct SOCKADDR server is a module static mut MaybeUninit<sockaddr_in6> (bzero'd every call, the C static semantics); the dup-IP scan compares network-order server.sin6_port to the host-order acptr->port (a faithful C quirk); index→strchr(unused — DNS block dead), htons→u16::to_be. dummy (P7a) is the SIGALRM handler.
  • Callees — find_server (P4), make_client/make_server/free_client/free_server/add_fd/add_client_to_list (P2), attach_confs_host/find_conf_host/det_confs_butmask (P6), get_sockhost/get_client_name (P5), set_non_blocking (P7d), set_sock_opts (P7p twin), inetpton (P1) all Rust; the variadic sendto_flag/sendto_one are called (→ P8). mysk/minus_one/portnum/highest_fd/local/fdall/nextping/timeofday/istat/me are bindgen statics.
  • Classification / L1 — utility/callee TU (not a msgtab handler; reached from m_connect/try_connections/do_dns_async). cref_connect_server exported → cross-world differential (ircd-testkit/tests/connect_server_diff.rs, 3 cases zero-diff). The success path does a live socket/bind/connect to a configured peer → not deterministic at L1. Cases: (1) server_already_present — find_server hit → SCH_NOTICE + return -1 before any make_client/socket work (by=NULL); (2) server_already_present_remote_by — remote IsPerson by (fd<0 → !MyClient) so the extra sendto_one(by,...) arm fires; (3 inverse/cleanup) connect_inet_failure_refused — empty hash → make_client/make_server → connect_inet socket+bind(unconfigured zeroed mysk → AF_UNSPEC) fails → return NULL → free_server cleanup → -1; asserts highest_fd unchanged + the hash left clean. Per-world inithashtables() (else hashtab is NULL → segv); serialized on GLOBALS_LOCK (the [[p7-l1-shared-global-race]] hazard). Findings: hash_find_server's suffix-mask search overwrites '.'→'*' in-place → the conf/lookup strings must be writable heap (not c"…" literals); a remote by needs acpt set (self) or send_message null-derefs (*to).acpt.
  • L2 / S2S — no new file. The existing ircd-golden/boot_s2s harness dials into the ircd (TcpStream::connect = inbound add_connection), so it does not exercise connect_server's outbound dial; deferred to the event-loop/CONNECT L2 (the read_message cluster). Regression check: golden_registration + golden_s2s_link byte-identical (the port doesn't touch inbound paths). No remote-user field formatting → no S2S-specific path.

• 2026-06-06 — P7dd (s_bsd.c start_iauth) merged. The iauth subprocess (re)spawn leaf (s_bsd.c:565) — the deepest remaining leaf in s_bsd.c's boot subtree (daemonize calls it; read_message is the loop top). Ported to ircd-common/src/s_bsd.rs; guard -DPORT_S_BSD_START_IAUTH_P7dd on the s_bsd_link.o recipe.

  • Cluster choice — after P7d–P7cc ported every socket/teardown/listener/access-check/connection leaf, the three C functions left in s_bsd.c are start_iauth, daemonize, and read_message (+ its static siblings polludp/check_ping). daemonize calls start_iauth and read_message is the loop top, so start_iauth is the next leaf bottom-up. It is the only function that creates the adfd pipe the P7u–P7y s_auth.c readers drain.
  • Classification — utility/callee TU (no msgtab entry). Callers: daemonize (boot), io_loop (the restart_iauth/nextiarestart timer, ircd.c:1286), rehash (start_iauth(2) = kill-first, s_conf.c:1303), s_auth.c read_iauth restart requests. All reach it via s_bsd_ext.h. L1 is the differential gate (extern → cref_start_iauth oracle).
  • Config-resolved body — USE_IAUTH on → the whole #if defined(USE_IAUTH) body compiles; IAUTH_BUFFER = 65535; MAXCONNECTIONS = 50 (the child fd-close bound). IAUTH_PATH (= $(server_bin_dir)/$(IAUTH)) and IAUTH are recursively-expanded Makefile vars passed only on s_bsd.o's compile line (absent from bindgen) → build.rs expands both via make and hands them to the crate as ircd_sys::IAUTH_PATH / ircd_sys::IAUTH (the PID_PATH/MOTD_PATH precedent), so the Rust execl spawns the identical binary as reference-C.
  • Faithfulness — the three function statics (last/first/iauth_pid) → module-private static mut START_IAUTH_*; both worlds start first = 1 so the burst-send block is skipped on the first call. vfork() → libc::fork(): behaviorally identical here (the child only runs a close loop + dup2 + execl, so COW fork produces the same result) and Rust's libc deprecates vfork as memory-unsafe (the close-loop/dup2-between-vfork-and-exec is exactly the flagged pattern). The socketpair-failure arm does NOT early-return (faithful). The burst-send pointer arithmetic (s += sprintf(s, "%d O\n", i), the s > e flush, the *(s-1) = '\0' newline-strip) is translated byte-for-byte over a [c_char; BUFSIZ] (libc::BUFSIZ = 8192 on gnu, matching the C <stdio.h> macro). execl CStrings are built before fork.
  • Callees — read_iauth (P7y), set_non_blocking (P7d) Rust; sendto_flag/sendto_iauth are called (variadic → P8); socketpair/setsockopt/fork/dup2/execl/close/kill/_exit/time are libc. adfd/iauth_spawn/bootopt/highest_fd/local are bindgen globals.
  • L1 — ircd-testkit/tests/start_iauth_diff.rs, 3 cases zero-diff vs cref_, serialized on GLOBALS_LOCK (the [[p7-l1-shared-global-race]] hazard; each world keeps its own adfd/iauth_spawn/bootopt). boot_noiauth_returns: BOOT_NOIAUTH → immediate return, adfd stays -1, iauth_spawn unchanged. already_running_returns: not-NOIAUTH but adfd>=0, rcvdsig=0 → returns untouched (the inverse). spawn_sets_adfd: the real meat — the socketpair + setsockopt + set_non_blocking + fork prefix; asserts the observable post-state agrees across worlds and the spawn happened (adfd opened nonblocking via fcntl F_GETFL & O_NONBLOCK, iauth_spawn == 1); the child execls the absent IAUTH_PATH and _exits, reaped via a bounded waitpid(WNOHANG) loop so the test can never hang. The non-first-call burst is skipped (both first = 1) → its differential coverage is deferred to L2/soak (needs a populated local[] + a second post-first call).
  • L2 / S2S — no new file. The golden harness boots -t -s (BOOT_NOIAUTH) → only start_iauth's early return runs (golden_registration byte-identical); the full spawn is a process-lifecycle side effect whose end-to-end gate is the P7-exit L2/soak run with iauth enabled, as for daemonize/server_reboot. No IsServer(cptr) branch / no remote-user field formatting → no S2S path.

• 2026-06-06 — P7ee (s_bsd.c daemonize) merged. Ported the boot detach glue daemonize (s_bsd.c:794), the layer directly above the P7dd start_iauth.

  • Cluster choice. Called once from ircd.c:1152 (still C → resolves to the Rust def once dropped). Now a clean leaf: its only non-libc callees — init_resolver (P6, Rust) and start_iauth (P7dd, Rust) — are already ported. With it gone, the only still-C logic in s_bsd.c is the event loop (read_message + its statics polludp/check_ping).
  • Guard / seam. Partial port via the existing s_bsd_link.o recipe, new guard -DPORT_S_BSD_DAEMONIZE_P7ee; the C body #ifndef-guarded (no #else proto — daemonize is declared in s_bsd_ext.h).
  • Config-resolved body. TIOCNOTTY defined on Linux → the int fd + ioctl block compiles. The setpgrp arm resolves to the #else setpgrp(0, getpid()) branch (verified by preprocessing — none of HPUX/SVR4/DYNIXPTX/_POSIX_SOURCE/SGI/__CYGWIN32__/__APPLE__ are defined); the linked glibc symbol is setpgrp(void) (ignores the args) — declared 2-arg in a local extern to mirror the source verbatim. stdout/stderr/stdin are glibc extern FILE * symbols (not the macros) → local externs (stderr reuses the module-top decl). init_resolver called as crate::res::init_resolver; start_iauth is the local Rust def in this module (called bare, not imported, to avoid shadowing the bindgen decl).
  • Faithfulness. bootopt & BOOT_TTY → short-circuit to init_dgram (no fork/no fd close); else fclose(stdout)/close(1), (unless BOOT_DEBUG) fclose(stderr)/close(2), and when ((bootopt & BOOT_CONSOLE) || isatty(0)) && !(bootopt & BOOT_INETD) → fork() (the parent exit(0)s to detach), open("/dev/tty")+ioctl(TIOCNOTTY)+close, setpgrp(0, getpid()), fclose(stdin)/close(0); then always resfd = init_resolver(0x1f) + start_iauth(0).
  • Classification / L1. Utility/boot callee (no msgtab entry). Mostly untestable by design: the detach path forks (parent exit(0)s) and closes fds 0/1/2 — calling it on that path destroys the test harness, and even fork-isolation (P7r's trick) can't measure a function whose whole job is to detach. The only differentially-safe path is the BOOT_TTY short-circuit (goto init_dgram: no fork, no fd close) — which is also the only path any harness ever takes (golden boots -t = BOOT_TTY). daemonize_diff.rs (1 case): bootopt = cref_bootopt = BOOT_TTY|BOOT_NOIAUTH, adfd=-1, resfd=-99 sentinel → call each world's daemonize → assert resfd != -99 and >= 0 (init_resolver opened the resolver socket), (resfd>=0)==(cref_resfd>=0) (both worlds succeeded identically), and the inverse: adfd == -1 in both (start_iauth(0) reached but short-circuited on BOOT_NOIAUTH, touching nothing). Serialized on GLOBALS_LOCK; the opened resolver sockets are closed afterward. Untested-by-design: the entire detach path (fclose/close of 0/1/2, fork+parent exit, TIOCNOTTY ioctl, setpgrp).
  • L2 / S2S. No new L2 (boot callee, not a msgtab handler — the existing golden suite boots through the BOOT_TTY path of daemonize; golden_registration byte-identical, confirmed). No S2S (formats no remote-user wire fields).

• 2026-06-06 — P7ff (s_bsd.c read_message + 8 statics — the event loop) merged. Ported the select/poll event loop read_message (s_bsd.c:2088) and its eight file-static helpers to ircd-common/src/s_bsd.rs; guard -DPORT_S_BSD_READ_MESSAGE_P7ff on the s_bsd_link.o recipe. This is the body of io_loop and the last logic in s_bsd.c — after it, s_bsd_link.o defines zero functions, only the data globals.

  • Cluster choice — read_message is the only non-static symbol left in s_bsd_link.o; its callees completed_connection (s_bsd.c:1247), read_listener (1835), read_packet (2004), client_packet (1938), ircd_no_fakelag (1930), do_dns_async (3324), polludp (3212), check_ping (3165) are all static (no cref_ oracle) → one connected component, ported together as module-private Rust twins (the check_init/set_sock_opts/connect_inet/check_clones precedent).
  • Config-resolved body — USE_POLL off → the select()/fd_set/FD_*/highfd path compiles; the entire #if defined(USE_POLL) pfd machinery is dead and omitted. USE_IAUTH on (the DoingXAuth/WaitingXAuth/adfd/read_iauth/sendto_iauth arms + do_dns_async's iauth alias-forward block). LISTENER_DELAY = 1 (the listener once-per-second throttle), LISTENER_MAXACCEPT = 10, MAXCLIENTS = 45, CLIENT_FLOOD = 1000, HELLO_MSG/IRC_VERSION resolved as module consts. ZIP_LINKS/UNIXPORT/DEBUGMODE off, DELAY_CLOSE/CACCEPT_DELAYED_CLOSE on, JAPANESE off, AFINET=AF_INET6.
  • Faithfulness — highfd/delay2/ret declared before the for(res=0;;) select-retry loop (persist across retries, never reset — the faithful C quirk). The read_message per-fd dispatch goto deadsocket becomes a dead: bool + structured continues (both goto sites set dead, the deadsocket block runs once). while(max--) in read_listener → a { let cur = max; max -= 1; cur != 0 } head. client_packet's inner long-no-newline while(dolen<=0) drain + FLAGS_NONL break preserved. check_ping's cp->ping = (cp->rtt /= cp->lrecvd) order kept; pow is the libc symbol (NOT f64::powf — last-ULP drift, the P7t precedent). polludp's ntohl/htonl over the u_long pi_id truncate to 32 bits then byteswap (u32::from_be/to_be as u_long); the #if 0 recvfrom-error report and the function statics last/cnt/mlen/lasterr → module static mut. do_dns_async's static Link ln → a module static mut DO_DNS_LN (const-initialised union) so the address handed to get_res is stable; hp->h_addr macro = h_addr_list[0]. The private static char readbuf[READBUF_SIZE] (16384) → a module static mut READBUF.
  • Callees — in-module Rust: add_connection (P7bb), connect_server (P7cc), delay_close (P7f), report_error (P7q), get_sockerr (P7d). bindgen externs (resolve to Rust at link): dopacket (P7b), exit_client/get_client_name (P5), send_queued/flush_connections (P3/send), start_auth/read_iauth/send_authports/read_authports (P7w-y), find_conf/is_allowed (P6), match_/inetntop (P1), dbuf_get/getmsg/put (P1), get_res/del_queries/find_bounce/my_name_for_link, restart. Variadic (called, → P8): sendto_flag/sendto_one/sendto_iauth. The data globals local[]/highest_fd/timeofday/fdas/fdall/readcalls/udpfd/resfd/adfd/ircstp/istat/iconf/conf/nextping/nextdelayclose/ipv6string/me are bindgen statics (still C-owned in s_bsd_link.o).
  • Classification — utility/boot callee (no msgtab entry; reached from io_loop). read_message has a cref_ oracle but is the event loop — every meaningful path select()s real fds, accept()s/recvfrom()s/send()s real sockets, and destructively exit_clients, none of which is differentially deterministic in isolation (the daemonize/P7ee situation). L2 is the real gate.
  • L1 — ircd-testkit/tests/read_message_diff.rs, 2 cases zero-diff vs cref_, serialized on GLOBALS_LOCK (the [[p7-l1-shared-global-race]] hazard; udpfd/resfd/adfd are process globals). The one differentially-safe path: an empty FdAry (highest = -1) + udpfd = resfd = adfd = -1 + delay = 0 → an empty fd_set, select(0, …, 200ms) returns 0, no dispatch, return 0; both worlds agree (ro = 0 and ro = 1). Proves the loop skeleton + the select call + the no-fds-ready dispatch are byte-identical.
  • L2 / S2S — no new file. The entire ircd-golden golden_* + golden_s2s_* suite (111 test files) runs through read_message (it is io_loop's body) — registration, every channel/user/oper command, and the full S2S server-burst/netsplit matrix exercise the accept/read/write/exit + server-link read_packet/completed_connection paths end-to-end. Ran the full 111-file suite with --no-fail-fast: 192 passed, 2 failed, both pre-existing reference-C STATS garbage flakes ([[p5-s2s-stats-flake]]), not P7ff regressions (the reference-C binary is frozen — a Rust edit can't change its output; the Rust side prints the correct value in both): (1) golden_s2s_s_serv_stats s2s_stats_match_reference — uninitialised peer-burst sendq (…965524992kB sq vs Rust 0kB sq); (2) golden_s_misc stats_t_matches_reference — STATS t's "dropped %luSq/%luYg/%luFl" prints ircstp->is_cklQ/is_ckly/is_cklno (u_int, 4 bytes) with %lu (8 bytes) in the still-C variadic sendto_one, so reference-C va_args 4 bytes of call-frame garbage (281470681743360Sq/…) vs Rust 0Sq/0Yg/0Fl — a %lu/u_int width-mismatch in s_misc.c:1079, surfaced (not caused) by P7ff.
  • Untested-by-design (noted) — the destructive accept/read/write/exit dispatch, polludp/check_ping (need a live UDP CPING peer), and do_dns_async (needs a live resolver fd) are deterministic only at L2/soak.

• 2026-06-06 — P7gg (ircd.c try_connections, auto-connect timer) merged. Ported the static io_loop AC timer (ircd.c:226) to ircd-common/src/ircd.rs, the sibling of calculate_preference (P7t).

  • Cluster choice — try_connections is the next io_loop timer helper after calculate_preference. Each AC tick it walks the global conf list, folds the lowest future hold into next, and chooses the single best AC-able connect{} C-line to dial: candidate = status carries CONF_CONNECT_SERVER|CONF_ZCONNECT_SERVER, port > 0, class maxLinks != 0; skipped if future-held / at maxLinks / already linked (find_name/find_mask) / denied (find_denied); best by (lower pref >= 0, else higher class number). The winner is spliced to the list tail (round-robin), its hold penalised by another con_freq, then deferred (AC disabled) or dialed via connect_server (P7cc). Returns the next-call time (0 = nothing pending); BOOT_STANDALONE → 0.
  • Guard / de-static — try_connections is static → no cref_ oracle symbol. De-static'd in ircd.c under #ifndef PORT_IRCD_TRY_CONNECTIONS_P7gg (the mysk/check_init/connect_inet precedent) so the cref archive's prefix-rename exports cref_try_connections; the #else branch is an extern time_t try_connections(time_t) prototype so the still-C io_loop caller (ircd.c:1186) keeps a declaration. -DPORT_IRCD_TRY_CONNECTIONS_P7gg added to the ircd_link.o make rule (alongside the P7c/P7t defines). The full ircd.o (cref oracle, no PORT define) keeps the non-static body.
  • Config-resolved body — DISABLE_DOUBLE_CONNECTS undef → the whole for (i=highest_fd…) duplicate-IP scan + SCH_SERVER "AC postponed" notice block is dead (dropped); DEBUGMODE off → every Debug((…)) no-op.
  • Faithfulness — the tail-splice replicates the C for (pconf=&conf; (aconf=*pconf); pconf=&(aconf->next)) walk exactly: the if (aconf==con_conf) *pconf=aconf->next; removal does NOT short-circuit the pointer advance, and the detached node's own next is left intact so the walk still reaches the real tail through it. Macros inlined: Class(x)=x->class, MaxLinks(x)=x->maxLinks, Links(x)=x->links, ConfClass(x)=x->class->class, get_con_freq (Rust P2). DELAYCHASETIMELIMIT=1800. The variadic sendto_flag is called via the module's local extern "C" block (→ P8); connect_server (P7cc)/find_name/find_mask (P4)/find_denied (P6) resolve through the link seam.
  • Classification — io_loop callee (no msgtab entry), reached only from the periodic AC recompute; formats no remote-user wire fields.
  • L1 — try_connections_diff.rs, 8-case zero-diff vs cref_try_connections over two isolated conf worlds (Rust conf/iconf/bootopt vs the cref_ copies), serialized on GLOBALS_LOCK (the documented P7 shared-global hazard). Covers every path that does NOT reach connect_server: BOOT_STANDALONE early return, empty conf, all skip-continues (non-C-line, port<=0, maxLinks==0, future-held, class-full-before-hold-write, already-linked, denied), and — by pinning iconf.aconnect=0 — the best-conf selection, the tail-splice (winner moved to list end), the hold += get_con_freq penalty, and the "administratively disabled" deferred-notice branch. Compares per-conf hold/pref + the resulting list order (by build index) + the return value. Two initial expectation bugs in the test (wrong BOOT_STANDALONE literal; assuming the class-full skip writes hold) were caught because the Rust↔oracle diff stayed green while the absolute-value asserts failed — fixed the expectations, port unchanged.
  • L2 — the connect_server-reached dial is L2-only: the ircd-golden/S2S harness dials into the ircd and never auto-connects out (the P7cc precedent), so the outbound AC dial is deferred to the event-loop/CONNECT L2. golden_registration confirmed byte-identical (boot/event-loop path unaffected). No S2S (no remote-field formatting).

• 2026-06-06 — P7hh (ircd.c check_pings — the io_loop ping/timeout sweep) merged. Ported the static io_loop timer helper check_pings (ircd.c:525) to ircd-common/src/ircd.rs, the sibling of try_connections (P7gg) and calculate_preference (P7t). The next io_loop callee after the AC timer; one of the two remaining loop helpers (delayed_kills is next).

  • Cluster choice / Scope. Called once per loop tick from io_loop (ircd.c:1277) when timeofday >= nextping. Walks local[highest_fd..0]; per non-listener local connection: pings idle registered links (FLAGS_PINGSENT state machine), times out unregistered/unresponsive ones (exit_client; servers/connecting/handshake get a "No response … closing link" notice, with a remote-oper NOTICE via bysptr; DNS/auth/xauth waiters either get an iauth extension (%d d/%d T) or are reset/exited), and folds the soonest next-check calendar time into oldest (the return), with the +PINGFREQUENCY/+30 clamps.
  • Guard / de-static. check_pings is static → no cref_ oracle symbol. De-static'd in ircd.c under #ifndef PORT_IRCD_CHECK_PINGS_P7hh (the try_connections/mysk precedent) so the cref archive's prefix-rename exports cref_check_pings; the #else branch is an extern time_t check_pings(time_t) proto so the still-C io_loop caller keeps a declaration. -DPORT_IRCD_CHECK_PINGS_P7hh added to the ircd_link.o make recipe (alongside the P7c/P7t/P7gg defines). The full ircd.o (cref oracle, no PORT define) keeps the non-static body.
  • Config-resolved body. TIMEDKLINES off (config.h:207 commented) → the static time_t lkill, the kflag = find_kill(...) block, the if (kflag && IsPerson) kill-notice arm, and the trailing if (currenttime - lkill > 60) all vanish; kflag is permanently 0 → the goto guard reduces to if (IsRegistered && ping >= now-lasttime), the timeout if to ((idle >= 2*ping && PINGSENT) || (!registered && firsttime-too-old)), and the kill/else collapses to always exit_client(... "Ping timeout"). USE_IAUTH on → the iauth extwait/notimeout sendto_iauth block compiles. DEBUGMODE off → every Debug((...)) no-op. ACCEPTTIMEOUT=90, PINGFREQUENCY=120 (plain #defines, inlined as module consts).
  • Faithfulness. The C forward goto ping_timeout (recently-active fast path) is modelled by guarding the whole timeout/ping if/else on the negated recently-active condition and falling through to the timeout computation — no control-flow change. bysptr is declared once outside the loop and never reset inside (faithful: a server-timeout's bysptr persists across later iterations). ME = me.name. Macros inlined as private unsafe fn helpers (copied from s_bsd.rs): is_listener/is_registered/is_server/is_connecting/is_handshake/doing_dns/doing_auth/doing_xauth/clear_auth/clear_dns/clear_xauth/clear_wxauth/set_done_xauth/my_connect/me_ptr/local_base. The variadic sendto_one/sendto_iauth/sendto_flag are called via the module's local extern "C" block (→ P8); exit_client/find_uid/get_client_name/del_queries resolve through the link seam (Rust P5/P6).
  • Classification. io_loop callee (no msgtab entry), reached only from the periodic ping recompute. The only remote read is bysptr (a remote oper) for a NOTICE on server timeout — a server-link path exercised by the L2/S2S loop, not a client command. → L2-gated, with an L1 over the deterministic non-destructive paths.
  • L1 — check_pings_diff.rs, 7-case zero-diff vs cref_check_pings over two isolated worlds (Rust local/highest_fd/me vs the cref_ copies), each building its own parallel client set, serialized on GLOBALS_LOCK (the documented P7 shared-global hazard). Covers every path that does NOT reach exit_client or the server-timeout find_uid/sendto_one: empty local[] (oldest stays 0 → now+PINGFREQUENCY), listener-skip (FLAGS_LISTEN), recently-active registered (ping >= now-lasttime → goto, no ping, flags untouched), the FLAGS_PINGSENT ping-send branch (idle 121 > ping 120, below 2ping → sets FLAGS_PINGSENT + rewrites lasttime = now-ping + sends PING — the inverse of recently-active), young unregistered (firsttime < ACCEPTTIMEOUT, left alone), already-pinged idle below 2ping (folds oldest only), and a mixed multi-fd sweep (listener + recent + idle-pinged + young-unreg) exercising the oldest-fold + final clamps. Asserts each client's post-(flags,lasttime) + the return value identical. Finding: a fresh calloc'd client needs acpt set (real make_client sets it to the listener) or send_message's acpt != &me sendM bump null-derefs; fd = -1 + a sub-1024-byte PING never trips send_queued so there is no real socket write.
  • L2 — no new file. The entire ircd-golden suite runs check_pings every io_loop tick (it is the registration-timeout + ping path). golden_registration (boot/loop/timeout) and golden_channel_join byte-identical; the only failure is the documented pre-existing golden_s_misc stats_t reference-C garbage flake ([[p5-s2s-stats-flake]] / P7ff) — a %lu/u_int width mismatch in the still-C variadic sendto_one (281470681743360Sq from va_arg'd call-frame garbage in the frozen reference-C binary vs the correct 0Sq/0Yg/0Fl from Rust), surfaced not caused. No S2S (no command-driven remote-field formatting).

• 2026-06-06 — P7ii (ircd.c delayed_kills — the io_loop K-line sweep) merged. Ported the static io_loop timer helper delayed_kills (ircd.c:447) to ircd-common/src/ircd.rs, the sibling of check_pings (P7hh). The other of the two remaining loop helpers; io_loop calls it (ircd.c:1294, rehashed = delayed_kills(timeofday)) only while rehashed > 0 — i.e. after a rehash queues a K-line re-evaluation.

  • Cluster choice / Scope. Walks local[dk_lastfd..j] (a batch of at most MAXDELAYEDKILLS); for every local fully-registered person it runs find_kill, and on a match (kflag == -1) notices the oper channel (sendto_flag "Kill line active for %s"), stamps cptr->exitc = EXITC_KLINE, and exit_clients the connection with the kill reason. Returns 1 if work remains queued (incomplete batch, or rehashed == 2 — a rehash arrived mid-sweep), else 0. Persistent function-local statics (dk_rehashed/dk_lastfd/dk_checked/dk_killed) carry the batch cursor across calls; dk_rehashed == 0 re-arms the sweep from highest_fd.
  • Guard / de-static. delayed_kills is static → no cref_ oracle symbol. De-static'd in ircd.c under #ifndef PORT_IRCD_DELAYED_KILLS_P7ii (the check_pings/try_connections/mysk precedent) so the cref archive's prefix-rename exports cref_delayed_kills; the #else branch is an extern int delayed_kills(time_t) proto so the still-C io_loop caller keeps a declaration. -DPORT_IRCD_DELAYED_KILLS_P7ii added to the ircd_link.o make recipe (alongside the P7c/P7t/P7gg/P7hh defines). The full ircd.o (cref oracle, no PORT define) keeps the non-static body.
  • Config-resolved body. MAXDELAYEDKILLS = 200 (config.h:423) and MAXCONNECTIONS = 50 (config.h:150): the #ifdef MAXDELAYEDKILLS batch block IS compiled, but j = dk_lastfd - 199 with dk_lastfd ≤ 49 is always < 0 → clamped to 0, so the whole local[] is swept in a single call and dk_lastfd always reaches -1 → the persistent statics reset every call (no multi-call drain) and the trailing return rehashed (incomplete-batch path) is unreachable under the locked config — ported faithfully regardless. TIMEDKLINES off → find_kill's timedklines arg is 0 (the check_pings finding); DEBUGMODE off → the Debug((DEBUG_DEBUG, "DelayedKills killed…")) no-op.
  • Faithfulness. The C for (i = dk_lastfd; i >= j; i--) with its continue (which still runs i--) and in-loop j-- (on a NULL/non-person slot, only while j > 0) is modelled by a while i >= j loop that decrements i before every continue/iteration end, so the post-loop dk_lastfd = i lands on j-1 identically. IsPerson = user && (STAT_CLIENT || STAT_OPER) and BadPtr inlined as private unsafe fn helpers. The summary sendto_flag(SCH_NOTICE, "DelayedKills checked %d killed %d in %d sec", dk_checked, dk_killed, currenttime - dk_rehashed) passes a time_t (long) to a %d — a faithful C quirk, passed verbatim (the variadic trampoline reads 32 bits; a no-op until the notice channel exists). The variadic sendto_flag is called (→ P8); find_kill (Rust P6i)/get_client_name/exit_client resolve through the link seam.
  • Classification. io_loop callee (no msgtab entry), reached only after a rehash queues K-line re-evaluation (rehashed > 0). → L1-gated: the kill arm is destructive (exit_client) AND requires both a matching K-line conf and rehashed > 0, neither of which the golden suite produces — so unlike check_pings, delayed_kills' body has no L2 path at all (golden never rehashes).
  • L1 — delayed_kills_diff.rs, 6-case zero-diff vs cref_delayed_kills over two isolated worlds (Rust local/highest_fd/rehashed + empty kconf/tkconf → find_kill returns 0, no kill, vs the cref_ copies), serialized on GLOBALS_LOCK (the documented P7 shared-global hazard). Covers the non-kill sweep (the inverse of the destructive kill arm): empty local[] across rehashed ∈ {0,1,2} (→ return {0,0,1} — exercises the requeue logic), an IsPerson client over empty conf (checked, no kill → completes, client left alive: status/flags unchanged + still in local[]), non-person (no user) + userless STAT_CLIENT slots (both !IsPerson → skipped before find_kill), and a mixed multi-fd sweep. Asserts identical return + per-client (status, flags, still-in-local). A with_user client gets a zeroed anUser (username "") so find_kill walks the empty conf and returns 0.
  • Untested-by-design / L2 — the kflag == -1 kill arm (exit_client is destructive — the check_pings/read_message L2-gating precedent — and needs both a K-line conf match and a queued rehash). No new L2 file: golden_registration confirmed byte-identical (no-regression; the boot/event-loop path is unaffected and delayed_kills is never entered without a rehash). No S2S (formats no command-driven remote-user wire fields).

• 2026-06-06 — P7jj (ircd.c setup_me) merged. Ported the boot-time me-singleton initializer to ircd-common/src/ircd.rs, the last substantive non-spine leaf in ircd.c.

  • Cluster choice — setup_me (ircd.c:723) is the boot helper main() calls once (ircd.c:1113) after bzero(&me) + make_server(&me) + config read have populated me.serv->namebuf (server name; make_server self-points me.name → serv->namebuf), me.serv->sid, me.info. The remaining ircd.c leaves are setup_signals (blocked on the still-static signal handlers s_rehash/s_slave), bad_command (exit, untestable), open_debugfile (empty under DEBUGMODE-off) — setup_me is the only one with real, L2-observable logic.
  • Seam / Guard — #ifndef PORT_IRCD_SETUP_ME_P7jj around the body, static removed, extern void setup_me(aClient *mp); after #endif so the guarded ircd_link.o's main() resolves the call to the Rust #[no_mangle] setup_me (the cref oracle keeps the full unguarded ircd.o). -DPORT_IRCD_SETUP_ME_P7jj appended to the ircd_link.o make recipe. Confirmed nm target/debug/ircd shows T setup_me (from Rust).
  • Faithfulness — getpwuid(getuid())->pw_name (or "unknown") feeds both username copies; me.info == DefInfo compares the global me.info pointer (via addr_of_mut!(me)) against the DefInfo constant (list.c); ME = me.name; SetMe=status=STAT_ME, SetEOB=flags|=FLAGS_EOB; strncpyzt (local macro twin) + strcpy(user->host, mp->name) use the exact bindgen array lengths; PATCHLEVEL resolved to the locked patchlevel.h literal "0211030000". No variadic senders called.
  • Callees — get_my_name (P7s), find_server_num/find_server_string (P5 s_serv), make_user (P2 list), add_to_client_hash_table/add_to_sid_hash_table (P2 hash), setup_server_channels (P5 channel), mystrdup (P1) — all Rust, imported from ircd_sys::bindings.
  • Classification / L2-gated (no L1) — not a msgtab handler. setup_me mutates four shared process-global tables (client hash, SID hash, server_name[] interning, channel hash) plus the me singleton and istat; an L1 differential on the real Rust-side globals can't be isolated/cleaned without leaking channel-hash entries into other ircd-common L1 tests. Its entire output is observable on every ircd-golden boot (server name in numerics, SID, 004/005, LUSERS is_users, oper+EOB status, server channels, verstr/info in the S2S burst), so the golden suite is the gate (P7dd/ee/ff L2-gating precedent).
  • L2 — golden registration (x2), s_serv_lusers, s2s_server (introduce), s2s_s_serv_info, s2s_s_serv_map, and 3/4 s_misc all byte-identical. The s_misc::stats_t failure is the documented pre-existing reference-C uninitialized-garbage flake (...743360Sq/...452800Yg/... on the reference side; Rust correctly emits 0Sq/0Yg/0Fl) — see the p5-s2s-stats-flake note, not a regression.
  • S2S — none needed: setup_me formats no command-driven remote-user wire fields.

• 2026-06-06 — P7kk (ircd.c signal-handler + reboot cluster) merged. Ported the contiguous signal block ircd.c:73–215 — the SIGTERM/SIGUSR1/SIGHUP/SIGINT handlers (s_die/s_slave/s_rehash/s_restart) plus the restart→server_reboot shutdown path — to ircd-common/src/ircd.rs.

  • Cluster choice — a connected component: the four signal handlers set the io_loop flags (dorehash/dorestart/restart_iauth), restart (called by Rust list.rs/s_bsd.rs/s_serv.rs + still-C io_loop) calls server_reboot. Deliberately excludes setup_signals (the installer — needs dummy + edits the shared forward-proto line 34; its own sub-phase), io_loop, open_debugfile, bad_command, c_ircd_main.
  • Seam / Guard — one #ifndef PORT_IRCD_SIGNALS_P7kk over 73–215; the #else branch re-declares s_rehash/s_slave (not in ircd_ext.h) so the still-C setup_signals (line 1370) keeps its prototypes — s_die/s_restart/restart/server_reboot are header-declared. -DPORT_IRCD_SIGNALS_P7kk appended to the ircd_link.o recipe; the cref oracle keeps the full unguarded ircd.o. Confirmed nm target/debug/ircd shows T for all six from Rust.
  • De-static — dorehash/dorestart/restart_iauth (volatile static int → volatile int): read by the still-C io_loop, written by the Rust handlers, so one definition must serve both — they stay C-defined in ircd_link.o, Rust references them through a local extern "C" block; de-static also yields cref_dorehash/… for L1. s_rehash/s_slave (+ the line-37 forward proto) de-static'd so the prefix-rename exports cref_s_rehash/cref_s_slave (the L1-cref-static-symbol limit).
  • Config-resolved body — POSIX_SIGNALS=1 (the sigaction re-arm in each handler compiles), RETSIGTYPE=void, USE_IAUTH ON (s_slave + the SIGCHLD arm), USE_SYSLOG UNDEF (every syslog/closelog/openlog arm dropped), UNIXPORT UNDEF (s_die's unix-socket unlink loop dropped), DEBUGMODE OFF (Debug() no-ops), not __FreeBSD__. MAXCONNECTIONS=50; SCH_NOTICE=ServerChannels_SCH_NOTICE.
  • Faithfulness — the sbrk(0)-sbrk0 byte delta is (brk as usize).wrapping_sub(sbrk0 as usize) as u32 fed to the variadic %u; s_die broadcasts :%s SDIE via sendto_serv_v with (*me.serv).sid; restart/server_reboot notice via sendto_flag(SCH_NOTICE,…); s_restart's BOOT_TTY→fprintf(stderr)+exit arm uses the module's stderr_ptr() helper; the fd-close sweep is for i in 3..MAXCONNECTIONS. IRCD_PATH (Makefile var, absent from bindgen) plumbed via build.rs cargo:rustc-env=IRCD_SERVER_PATH → ircd_sys::SERVER_PATH for server_reboot's execv(IRCD_PATH, myargv) (the MOTD/PID/IAUTH path precedent). The fn as usize sigaction-handler casts go through an explicit unsafe extern "C" fn(c_int) pointer (no warning).
  • Callees — flush_connections/logfiles_close/mybasename (Rust/P1), ircd_writetune (P7c, Rust), variadic sendto_serv_v/sendto_flag (C trampolines → P8); libc sigaction/sigemptyset/sigaddset/sbrk/close/isatty/execv/exit/fprintf. Globals me/tunefile/sbrk0/myargv/bootopt from bindings; the de-static'd flags from the local extern block.
  • L1 — ircd_signals_diff.rs (3 tests): s_rehash ratchet 0→1, 1→2, 2→2; s_slave sets restart_iauth; s_restart sets dorestart with BOOT_TTY cleared — each zero-diff vs the cref_ oracle on the respective flag. Serialized on GLOBALS_LOCK (the P7 L1 shared-global hazard); SIGHUP/SIGINT/SIGUSR1 dispositions snapshotted+restored (the handlers re-arm themselves). The terminating arms (s_die/restart/server_reboot exit/execv; s_restart's BOOT_TTY exit) are not run — faithful by inspection.
  • L2 — boot gate: the still-C setup_signals now installs the Rust handlers on every ircd-golden boot; golden_registration (x2), golden_s_serv_shutdown (die/restart/rehash reject + rehash_success — the io_loop reading the de-static'd dorehash), golden_s_serv_maint (die/restart reject) all byte-identical. golden_s_misc::stats_t fails on the documented pre-existing reference-C uninitialized-garbage flake (…743360Sq on the reference side; Rust correctly emits 0Sq/0Yg/0Fl) — see the p5-s2s-stats-flake note, not a regression.
  • S2S — none needed: the signal cluster formats no command-driven remote-user wire fields.

• 2026-06-07 — P7ll (ircd.c setup_signals — the boot signal installer) merged. Ported the static setup_signals(void) (ircd.c:1388) to ircd-common/src/ircd.rs. It is the boot-time signal-disposition installer main() calls once (ircd.c:1033, after config read). P7kk deliberately left it to "its own sub-phase" because it references dummy and the four signal handlers — all of which are only now Rust, making it a clean leaf.

  • Cluster choice / Scope. A self-contained installer: builds a struct sigaction and sigaction()s it onto SIGWINCH/SIGPIPE (SIG_IGN), SIGALRM (dummy), SIGHUP (s_rehash), SIGINT (s_restart), SIGTERM (s_die), SIGUSR1 (s_slave), SIGCHLD (SIG_IGN+SA_NOCLDWAIT). All callees are Rust: dummy (bsd.rs, P7a), s_rehash/s_restart/s_die/s_slave (ircd.rs, P7kk). The remaining ircd.c leaves are now only bad_command (usage→exit, untestable), open_debugfile (empty under DEBUGMODE-off), and the c_ircd_main/io_loop spine.
  • Guard / de-static. setup_signals was static (declared in the line-34 group static void open_debugfile(void), setup_signals(void), io_loop(void);) → no cref_ oracle symbol. Split it out: open_debugfile/io_loop stay in the static group; setup_signals becomes a plain void setup_signals(void); forward proto + its body wrapped in #ifndef PORT_IRCD_SETUP_SIGNALS_P7ll (the P7kk/P7jj precedent). The cref archive compiles without the PORT define → keeps the de-static'd body → the prefix-rename exports cref_setup_signals; ircd_link.o compiles with -DPORT_IRCD_SETUP_SIGNALS_P7ll (appended to the recipe in ircd-sys/build.rs) → body removed, main()'s call resolves to the Rust #[no_mangle] setup_signals. nm target/debug/ircd confirms T setup_signals from Rust.
  • Config-resolved body. POSIX_SIGNALS=1 (setup.h:347) → the sigaction branch (not the signal() #else). SIGWINCH defined on Linux → its sigaddset+sigaction compile. USE_IAUTH ON → the SIGUSR1→s_slave arm + the SIGCHLD arm (with act.sa_flags = SA_NOCLDWAIT, defined on glibc/musl) compile. not __FreeBSD__ → no SIGTRAP arm. RESTARTING_SYSTEMCALLS undef → no trailing siginterrupt.
  • Faithfulness. The sa_mask is cumulative — sigemptyset is called exactly twice (once at the top before the SIG_IGN/dummy trio, once before SIGHUP), so SIGWINCH/SIGPIPE/SIGALRM share mask {PIPE,ALRM,WINCH} and SIGHUP…SIGCHLD accrete {HUP}→{HUP,INT}→{HUP,INT,TERM}→…,USR1}→…,CHLD}. Modelled exactly. The C struct sigaction act; leaves sa_restorer uninitialised, but glibc supplies its own restorer inside the sigaction(2) wrapper, so the installed (queried-back) disposition is identical in both worlds regardless; Rust std::mem::zeroed() for act is harmless. The fn as usize handler casts go through an explicit unsafe extern "C" fn(c_int) pointer.
  • Classification. Boot callee (no msgtab entry), reached once from main(). → L1 differential + L2 boot gate. Unlike the wholly-terminating handlers (P7kk), the installer is differentially testable: it mutates process signal dispositions, not shared memory, and those snapshot/restore cleanly.
  • L1 — setup_signals_diff.rs, 1-case zero-diff vs cref_setup_signals, serialized on GLOBALS_LOCK (process-global dispositions; the P7 shared-global hazard). Snapshot all 8 dispositions → setup_signals() (Rust) → query the 8 → cref_setup_signals() → query the 8 → restore the originals. Asserts, per signal: sa_flags identical between worlds, sa_mask byte-identical (memcmp the sigset_t), and the world-correct handler is wired — SIG_IGN for SIGPIPE/SIGWINCH/SIGCHLD (identical across worlds), else the world's own symbol (Rust dummy/s_rehash/s_restart/s_die/s_slave vs cref_dummy/…); handler pointers differ by design (Rust vs cref symbol), the verified claim being "right handler on right signal with the right mask/flags". Plus a SIGCHLD SA_NOCLDWAIT / SIGWINCH+SIGPIPE flags-0 spot-check.
  • L2 — no new file. The still-C main() calls setup_signals on every ircd-golden boot, installing the Rust handlers; golden_registration (x2), golden_s_serv_shutdown (die/restart reject), golden_s_serv_maint (close/rehash reject + rehash_success — the io_loop reading the handler-set dorehash) all byte-identical = no regression.
  • S2S — none: setup_signals formats no command-driven remote-user wire fields.

• 2026‑06‑07 — P7mm (ircd.c io_loop) merged. The event-loop body — the per-tick driver that the still-C main runs as while (1) io_loop(); — is now Rust.

  • Cluster choice — io_loop is the last substantive piece of I/O-core logic in ircd.c; only c_ircd_main (the boot/init sequence) and the trivial helpers bad_command/open_debugfile remain C, left for the final P7 drop step that removes c_ircd_main and ircd.o/ircd_link.o entirely.
  • Seam — io_loop was static void io_loop(void). Body guarded with #ifndef PORT_IRCD_IO_LOOP_P7mm; under the guard the file-top forward decl is split into a static proto for open_debugfile + extern void io_loop(void); so the still-C main (in ircd_link.o) resolves io_loop() to the Rust #[no_mangle] symbol. -DPORT_IRCD_IO_LOOP_P7mm appended to the ircd_link.o recipe in ircd-sys/build.rs. No cref-archive change (io_loop is static → no oracle needed).
  • Config‑resolved body — locked config: DELAY_CLOSE OFF (the nextdelayclose/delay_close timer arm and its delay = MIN(nextdelayclose, delay) line dropped), TKLINE ON (if (nexttkexpire && timeofday >= nexttkexpire) nexttkexpire = tkline_expire(0); kept), DEBUGMODE OFF (the two Debug(...) no-ops and the trailing checklists() dropped). TIMESEC = 60, MIN(a,b) → a.min(b).
  • Classification — static utility, no msgtab entry, called only from main. No L1: io_loop is static so the cref archive exports no cref_io_loop (l1-cref-static-symbol-limit).
  • Faithfulness — static time_t delay → a function-local let mut delay (it is unconditionally assigned before every read each call, so behaviorally identical). The while (maxs--) drain loop preserves the post-decrement semantics. Already-Rust siblings (calculate_preference P7t, try_connections P7gg, check_pings P7hh, delayed_kills P7ii, restart P7kk, ircd_writetune P7c) called directly; tkline_expire/collect_channel_garbage/timeout_query_list/expire_cache/read_message/flush_fdary/start_iauth/flush_connections/rehash and the next*/fdas/fdall globals via bindgen; nextpreference/nextiarestart (not in any *_ext.h) via a local extern "C" block — they remain C globals in ircd_link.o. &me/&fdas/&fdall via std::ptr::addr_of_mut!; time(NULL) → libc::time(null); restart("Caught SIGINT") via a c"…" literal cast.
  • Verify — cargo build -p ircd-rs 0 warnings; nm target/debug/ircd | grep io_loop shows global T io_loop (Rust, was static t). L2 byte-identical across golden_registration, golden_channel_join, golden_debug (STATS m/u → count_memory/send_usage), golden_s2s_link (link burst + remote WHOIS + remote-quit round-trip) — every booted Rust ircd drives this loop.
  • Plan — docs/superpowers/plans/2026-06-07-p7mm-io_loop.md.

• 2026-06-07 — P7nn (ircd.c CLI boot helpers bad_command + open_debugfile) merged. The last non-spine logic in ircd.c — two file-static helpers called only from c_ircd_main. Plan: docs/superpowers/plans/2026-06-07-p7nn-ircd-cli-helpers.md.

  • Cluster choice — bad_command (ircd.c:809) and open_debugfile (ircd.c:1372): two independent leaves with no shared state, both reached only from the boot spine (bad_command on argv-parse failure, open_debugfile unconditionally at boot). Ported together as the penultimate P7 step so the final step is c_ircd_main alone.
  • Config-resolved body — CMDLINE_CONFIG undef → bad_command's [-f config] %s slot = ""; DEBUGMODE undef → its [-x loglevel] %s slot = "" and open_debugfile's entire body (#ifdef DEBUGMODE) compiles out → a pure no-op return. The Rust bad_command issues the two libc::printfs (the format literal with both %s args = c"") then libc::exit(-1); open_debugfile is an empty fn.
  • Seam — de-static'd both definitions and their prototypes (split open_debugfile out of the P7mm io_loop static-proto group, added a top-of-file void bad_command(void); so the still-C c_ircd_main keeps a declaration once the body is guarded out). Both bodies #ifndef PORT_IRCD_CLI_HELPERS_P7nn-guarded; new define added to the ircd_link.o recipe in ircd-sys/build.rs. The unguarded cref compile keeps the de-static'd bodies → cref_bad_command/cref_open_debugfile. RED confirmed (undefined bad_command/open_debugfile at link before the Rust defs); GREEN nm target/debug/ircd shows both T from Rust.
  • Classification / L1 — utility/callee helpers (no msgtab entry). ircd_cli_helpers_diff.rs, 2 cases, zero-diff vs cref_, serialized on GLOBALS_LOCK: (1) bad_command is fork()-isolated per world — child dups stdout into a pipe, calls the fn (prints + exit(-1)), parent drains the pipe + waitpid; asserts captured stdout byte-identical and wait status identical (exit(-1) → WEXITSTATUS==255). (2) open_debugfile no-op contract via the inverse invariant: snapshot fd 2's fstat dev/ino, call both worlds, assert fd 2 unchanged (DEBUGMODE off → it must NOT redirect stderr).
  • L2 / S2S — golden_registration byte-identical (open_debugfile no-op on every boot; bad_command unreachable from a valid boot). No S2S — neither helper formats remote-user wire fields.

• 2026-06-07 — P7oo (ircd.c c_ircd_main — the boot spine) merged. THE LAST C FUNCTION WITH LOGIC.

  • Cluster choice — main (renamed c_ircd_main via -Dmain=c_ircd_main; ircd.c:837–1226), the boot spine and the final unguarded C logic in the tree. Every other ircd.c function (P7c/P7t/P7gg–P7nn) was already ported leaf-first; this is the spine they hang off. After it, ircd_link.o holds only data globals (me, bootopt, the next* timers, tunefile, dorehash, …).
  • Seam — #[no_mangle] pub unsafe extern "C" fn c_ircd_main(argc, argv) -> c_int in ircd-common/src/ircd.rs; guarded out of ircd_link.o with a new -DPORT_IRCD_MAIN_P7oo (single #ifndef over the whole int main(...){…} body). ircd-rs/src/main.rs is unchanged — it still calls ircd_sys::c_ircd_main (the manual extern decl in ircd-sys/src/lib.rs), which now resolves to the Rust definition at link. The cref archive keeps the full unguarded ircd.o, so cref_c_ircd_main still exists (un-runnable as an oracle). nm target/debug/ircd shows T c_ircd_main; nm cbuild/ircd_link.o shows no main/c_ircd_main, only data globals (bootopt, me, nextping, tunefile, …).
  • Config-resolved body (verified in cbuild/config.h) — CHROOTDIR undef → no chdir/chroot/ircd_res_init; the #if !defined(CHROOTDIR) setuid(euid) block compiled. ZIP_LINKS undef → no zlib_version check; -v prints zlib "not used". CMDLINE_CONFIG undef → no -f case (-f→default→bad_command). USE_SYSLOG undef → no openlog/syslog. DEBUGMODE undef → Debug() no-ops, -t does no setuid, -x errors+exit(0), no -t-without--x check, open_debugfile no-op (P7nn), banner trailing %s="\n". IRC_UID/IRC_GID undef → the setuid-root guard compiled, the inner UID/GID block not. USE_IAUTH on → the vfork/execl(IAUTH_PATH,IAUTH,"-X")/wait iauth-presence check compiled. IRCDCONF_DELIMITER='|' reproduced as a literal for the -v banner.
  • Faithfulness notes — me.serv->sid is [c_char; 5] (an array): C's if (!me.serv->sid) compares its address to NULL → always-false dead code; reproduced as a never-taken branch ((*me.serv).sid.as_ptr().is_null(), #[allow(useless_ptr_null_checks)]). configfile/tunefile keep their C static-initializers (IRCDCONF_PATH/IRCDTUNE_PATH) — Rust reads the globals, never re-inits defaults. Paths via the existing ircd_sys consts (MOTD_PATH for read_motd; IAUTH_PATH/IAUTH for the iauth execl). stderr fatal messages via the existing stderr_ptr() + libc::fprintf; banner/-v via libc::printf. The argv walk is a literal translation of --argc > 0 && (*++argv)[0] == '-' with a raw *mut *mut c_char cursor + short-circuit-preserving control flow. vfork kept (#[allow(deprecated)]) to match C (child immediately execs/_exits). flags is c_long, aConfItem::status is u32 (cast accordingly).
  • Classification / L1 / L2 / S2S — boot spine, not a msgtab handler. L2-gated, no L1 (forks iauth, daemonizes, loop { io_loop() } never returns, mutates every global table + the me singleton → not unit-testable; the P7mm/P7jj precedent). Verification: the whole ircd-golden L2 suite boots the Rust ircd through this exact function and stays byte-identical vs reference-C. The lone failure is golden_s2s_s_serv_stats's STATS "sq" (sendq) field — the documented pre-existing flake (p5-s2s-stats-flake): uninitialized-sendq garbage, non-deterministic (value changes every run). Proven NOT a regression by stashing P7oo and re-running on clean HEAD, where the Rust side shows the same non-deterministic garbage (259171211542528kB vs the P7oo run's 3544950…kB). Flag arms beyond -t/-s/-p standalone, the iauth vfork (skipped by -s), the setuid-root guard, and the BOOT_INETD block are faithful-by-inspection (not reached by golden). No S2S (the function emits no command-driven remote-user wire fields).
  • → P7 COMPLETE. All C logic is now Rust. The remaining C in ircd-sys is data globals + the ~25 variadic sender trampolines (sendto_one/sendto_flag/sendto_serv_butone/… in send_link.o, sendto_iauth/vsendto_iauth in s_auth_link.o) — deleted in P8 when call sites adopt a non-variadic Rust sender API.