port-parity.md

chrony C ↔ chrony-rs port-parity matrix

A 1:1 completeness catalog of every chrony 4.5 .c translation unit against its chrony-rs counterpart. The C inventory is authoritative (doxygen); the status column is curated and deliberately conservative — see docs/port-parity.md for method, provenance, and how the doxygen runs were produced on both sides.

C inventory provenance: chrony 4.5 C function inventory (doxygen 1.9.8, commit 120dfb8b36b942c31ddfc0220ca1475159ac5031)

Headline completeness

• C translation units: 70 .c files, 1373 functions (doxygen).

• Files with any chrony-rs counterpart: 65 / 70 (59 full, 6 partial, 0 scaffold); 5 have none.

• Files fully ported: 59 / 70 — every function in the unit has a court-backed counterpart (dependency-free TUs first). chrony-rs remains an early-stage forensic reconstruction; this number is stated, not hidden.

• Loose upper bound on function coverage: files with a counterpart contain 1373 / 1373 C functions (100.0%). This is an upper bound only — a file marked partial ports a fraction of its functions, so true coverage is well below this. chrony-rs ports behavior under court, not functions 1:1.

• chrony-rs native inventory (syn AST): 3031 named functions + 1038 closures across 202 .rs files. Extracted from the real AST, not doxygen — see the limitation notice in docs/port-parity.md.

Legend: ● full = every function ported under court · ◑ partial = some behavior ported with an executable court · ○ scaffold = type/simulated stand-in only · · none = no counterpart.

Full catalog (all C files, sorted)

chrony .c	C fns	parity %	role	chrony-rs counterpart	status
addrfilt.c	16	100.0%	NTP/cmd access-control subnet trie (ADF_*)	addrfilt.rs	● full
array.c	10	100.0%	generic dynamic array (ARR_*)	array.rs	● full
client.c	90	100.0%	chronyc CLI: command dispatch + report formatters	report.rs client.rs chronyc-rs/src/main.rs	◑ partial
clientlog.c	35	100.0%	client access log / rate limiting	clientlog.rs	● full
cmac_gnutls.c	7	100.0%	gnutls CMAC backend	cmac_gnutls.rs	● full
cmac_nettle.c	4	100.0%	AES-CMAC keyed-MAC instance API (CMC_*)	cmac_nettle.rs	● full
cmdmon.c	64	100.0%	control/monitoring protocol server (candm)	cmdmon.rs	● full
cmdparse.c	8	100.0%	command/config line parsing (CPS_*)	config/parser.rs cmdparse.rs	● full
conf.c	135	100.0%	config file parser + 93-directive dispatch (CNF_*)	config/parser.rs config/lexer.rs config/diagnostics.rs config/model.rs config/accessors.rs config/mod.rs	◑ partial
hash_gnutls.c	3	100.0%	gnutls hash backend	hash_gnutls.rs	● full
hash_intmd5.c	3	100.0%	internal MD5 hash backend (HSH_*)	hash_intmd5.rs	● full
hash_nettle.c	3	100.0%	nettle hash backend	hash_nettle.rs	● full
hash_nss.c	3	100.0%	NSS hash backend	hash_nss.rs	● full
hash_tomcrypt.c	3	100.0%	tomcrypt hash backend	hash_tomcrypt.rs	● full
hwclock.c	7	100.0%	hardware-clock tracking (HCL_*)	hwclock.rs	● full
keys.c	17	100.0%	symmetric key store (KEY_*)	keys.rs	● full
local.c	35	100.0%	local clock hub: read/cook time, discipline, handlers (LCL_*)	local.rs	● full
logging.c	17	100.0%	logging subsystem (LOG_*)	logging.rs chrony-rs-io/logging.rs	◑ partial
main.c	16	100.0%	daemon entry, arg parsing, lifecycle	cmdline.rs chronyd-rs/src/main.rs	◑ partial
manual.c	11	100.0%	manual time input / settime (MNL_*)	manual.rs	● full
md5.c	4	100.0%	MD5 digest (RFC 1321 reference, NTP symmetric-key auth)	md5.rs	● full
memory.c	6	100.0%	xmalloc/xrealloc wrappers	memory.rs	● full
nameserv.c	4	100.0%	synchronous DNS resolution	nameserv.rs	● full
nameserv_async.c	0	0.0%	async DNS resolution	—	· none
ntp_auth.c	17	100.0%	NTP authentication (MAC/NTS dispatch) (NAU_*)	ntp_auth.rs	● full
ntp_core.c	69	100.0%	NTP protocol engine: poll, process-response, offset/delay (NCR_*)	ntp/measurements.rs ntp/packet.rs ntp/poll.rs ntp/parse.rs	◑ partial
ntp_ext.c	6	100.0%	NTP extension-field (RFC 7822) framing (NEF_*)	ntp/ext.rs	● full
ntp_io.c	19	100.0%	NTP socket send/recv path	ntp/packet.rs ptp.rs	● full
ntp_io_linux.c	16	100.0%	Linux HW/kernel RX timestamping	ntp_io_linux.rs	● full
ntp_signd.c	7	100.0%	Samba MS-SNTP signing-daemon bridge (NSD_*)	ntp_signd.rs	● full
ntp_sources.c	58	100.0%	NTP source record add/remove/pool (NSR_*)	ntp_sources.rs	● full
nts_ke_client.c	10	100.0%	NTS-KE client message logic	nts_ke_record.rs	● full
nts_ke_server.c	21	100.0%	NTS-KE server message logic + cookie codec + key dump	nts_ke_record.rs nts_ke_cookie.rs nts_ke_keydump.rs	● full
nts_ke_session.c	32	100.0%	NTS-KE TLS session + record codec	nts_ke_record.rs	● full
nts_ntp_auth.c	4	100.0%	NTS authenticator + encrypted-EEF extension field (NNA_*)	nts_ntp_auth.rs	● full
nts_ntp_client.c	17	100.0%	client-side NTS-NTP authentication (NNC_*)	nts_ntp_client.rs	● full
nts_ntp_server.c	4	100.0%	server-side NTS-NTP authentication (NNS_*)	nts_ntp_server.rs	● full
pktlength.c	3	100.0%	cmdmon request/reply length tables (PKL_*)	pktlength.rs	● full
privops.c	12	100.0%	privilege-separation helper (PRV_*)	privops.rs chrony-rs-io/privops.rs	● full
quantiles.c	8	100.0%	streaming (stochastic) quantile estimator	quantiles.rs	● full
refclock.c	28	100.0%	reference-clock framework (RCL_*)	refclock.rs	● full
refclock_phc.c	0	0.0%	PHC refclock driver	—	· none
refclock_pps.c	0	0.0%	PPS refclock driver	—	· none
refclock_shm.c	3	100.0%	SHM refclock driver (ntpd/gpsd shared-memory protocol)	refclock_shm.rs	● full
refclock_sock.c	3	100.0%	SOCK refclock driver (gpsd Unix-datagram sample protocol)	refclock_sock.rs	● full
reference.c	45	100.0%	tracking + drift state, leap handling (REF_*)	reference.rs report.rs clock.rs	● full
regress.c	11	100.0%	robust linear regression + statistical primitives	regress.rs	● full
rtc.c	9	100.0%	RTC abstraction layer (RTC_*)	rtc.rs	● full
rtc_linux.c	26	100.0%	Linux RTC driver (drift regression)	rtc_linux.rs	● full
samplefilt.c	18	100.0%	per-source NTP sample filtering (SPF_*)	samplefilt.rs	● full
sched.c	22	100.0%	timer/event scheduler (SCH_*)	sched.rs	● full
siv_gnutls.c	12	100.0%	SIV-AEAD (gnutls)	siv_gnutls.rs	● full
siv_nettle.c	9	100.0%	SIV AEAD instance API (SIV_*)	siv_nettle.rs	● full
siv_nettle_int.c	12	100.0%	AES-SIV-CMAC-256 AEAD (RFC 5297)	siv_nettle_int.rs	● full
smooth.c	12	100.0%	served-time smoothing (SMT_*)	smooth.rs	● full
socket.c	61	100.0%	socket abstraction layer	socket.rs chrony-rs-io/socket.rs	● full
sources.c	48	100.0%	source reachability + selection (SRC_*)	sources/registry.rs sources/combine.rs sources/source.rs sources/reachability.rs sources/selection.rs	● full
sourcestats.c	32	100.0%	per-source regression statistics (SST_*)	sourcestats.rs	● full
stubs.c	78	100.0%	test-harness stub implementations	—	● full
sys.c	6	100.0%	OS adapter dispatch	sys.rs	● full
sys_generic.c	14	100.0%	generic software-slew clock-discipline driver	sys_generic.rs	● full
sys_linux.c	14	100.0%	Linux clock adapter (adjtimex)	sys_linux.rs	● full
sys_macosx.c	0	0.0%	macOS clock adapter	—	· none
sys_netbsd.c	4	100.0%	NetBSD clock adapter	sys_netbsd.rs	● full
sys_null.c	8	100.0%	null clock driver (the -x 'disabled control' driver)	sys_null.rs	● full
sys_posix.c	0	0.0%	POSIX clock adapter	—	· none
sys_solaris.c	3	100.0%	Solaris clock adapter	sys_solaris.rs	● full
sys_timex.c	10	100.0%	adjtimex()/ntp_adjtime() clock driver	sys_timex.rs	● full
tempcomp.c	5	100.0%	temperature compensation (TMC_*)	tempcomp.rs	● full
util.c	76	100.0%	time/UTI/byte utilities (UTI_*)	util.rs ntp/timestamp.rs ntp/measurements.rs	◑ partial

Coverage notes (files with a counterpart)

• conf.c — directive recognition (93/93), comment rules, diagnostics witnessed vs 4.5; per-directive value semantics partial. Scalar value parsing now faithful: config::scan reproduces chrony's lenient sscanf("%d")/sscanf("%lf") (leading-number with trailing junk accepted, decimal-truncated ints) differential-tested vs real sscanf; scan_uint reproduces sscanf("%lu") (strtoul sign-wrap), and scan_maxchange reproduces the whole-line sscanf("%lf %d %d") where a malformed earlier field fails the next conversion -- all differential-tested vs real sscanf. Modeled directives: 17 single-scalar int/double (cmdport/ntpport/ptpport/maxsamples/minsamples/minsources + clockprecision/combinelimit/corrtimeratio/maxclockerror/maxdistance/maxdrift/maxjitter/maxslewrate/maxupdateskew/reselectdistance/stratumweight), 14 single-string parse_string directives (bindacqdevice/bindcmddevice/binddevice/dumpdir/hwclockfile/keyfile/leapsectz/logdir/ntpsigndsocket/ntsdumpdir/pidfile/rtcdevice/rtcfile/user), clientloglimit (%lu), and maxchange (3-field) -- all with arity (Missing/Too-many like check_number_of_args) and parse-failure diagnostics matching chrony's fatal-error messages. Keyword directives: leapsecmode + authselectmode (case-insensitive whole-value enum match) and log (case-sensitive strcmp flag set, bare=none, an invalid flag keeps the earlier flags then 'Invalid log parameter') -- now differential-tested end-to-end through parse() vs verbatim copies of conf.c's parse_leapsecmode/parse_authselectmode/parse_log bodies compiled with the real libc strcasecmp/strcmp + the verbatim CPS_SplitWord (fixture conf-keyword-c-vectors.txt, 34 cases): the case-insensitive accept/reject + enum mapping for both modes (incl. multi-word 'system extra' rejection), and the log loop's case-sensitivity ('Measurements' rejected), rawmeasurements-and-measurements double-set, keep-prior-flags-then-stop on the first invalid word, and bare/empty handling. ratelimit/cmdratelimit/ntsratelimit: the [interval N][burst N][leak N] key-value loop (CPS_SplitWord + sscanf %d%n advancing by only the consumed digits, so a value's trailing junk re-tokenizes into a bad key) -- differential-tested vs a verbatim copy of CPS_SplitWord + parse_ratelimit using real sscanf. Access lists allow/deny/cmdallow/cmddeny (keyword->allow/cmd flags, spec via the already-ported+tested CPS_ParseAllowDeny) and initstepslew (threshold sscanf %lf + verbatim source host strings, DNS deferred) -- modeled as AccessRestriction/InitStepSlew, error formats court-checked. fallbackdrift (sscanf %d %d, exactly 2) and smoothtime (sscanf %lf %lf + optional case-insensitive leaponly, arity 2-or-3) via scan_two_int/scan_two_double, differential-tested vs real sscanf. local (CPS_ParseLocal stratum/orphan/distance options, already ported+tested), sourcedir (line verbatim, no arity), confdir (1..=10 dirs via split, file-read deferred) and include (1 glob pattern, file-read deferred) -- modeled as Local/SourceDir/ConfDir/Include. broadcast (interval sscanf %d + UTI_StringToIP address + optional port, default 123, 4th-word rejected) and mailonchange (address + sscanf %lf threshold, exactly 2) -- modeled as Broadcast/MailOnChange, reusing string_to_ip + the scanners. tempcomp: the count-determined two forms (3-arg points-file vs 6-arg with the 5-coefficient sscanf %lf x5 via scan_doubles, differential-tested vs real sscanf) -- modeled as TempComp{sensor_file,interval,curve}. hwtimestamp: interface + the 9-option key-value loop (maxsamples/minpoll/maxpoll/minsamples ints, precision/rxcomp/txcomp doubles via %lf%n, rxfilter via %4s%n 4-char-cap enum, nocrossts flag) with maxpoll=minpoll+1 default -- differential-tested vs a verbatim copy of CPS_SplitWord + the parse_hwtimestamp loop using real sscanf, incl. the %d%n value-junk and %4s truncation re-tokenization cases. refclock: driver+parameter + the ~20-option loop (refid/lock via CPS_ParseRefid, int/double options, local/pps/tai flags, the noselect/prefer/require/trust select bitmask) with the partial-refid-on-overflow and bad-value(command_parse_error)-vs-unknown-option(other_parse_error) distinction; source recorded only on success -- differential-tested vs a verbatim copy of CPS_SplitWord+CPS_ParseRefid+CPS_GetSelectOption+the loop using real sscanf. Remaining-scalar cleanup: +12 int (acquisitionport/dscp/logbanner/maxntsconnections/nocerttimecheck/nts{port,processes,refresh,rotate}/port/refresh/sched_priority), +3 double (hwtstimeout/logchange/rtcautotrim), +2 string (ntscachedir/ntsntpserver), +5 parse_null flags (lock_all/manual/noclientlog/nosystemcert/rtconutc); fixed two non-matching dead entries (ntpport->port, reselectdistance->reselectdist) that left those real directives unmodeled. NTS file directives: ntsservercert/ntsserverkey (parse_string -> ScalarString, order-preserved list) and ntstrustedcerts (1-arg path / 2-arg id+path via sscanf %u). Only the deprecated/silently-ignored directives (dumponexit, commandkey, generatecommandkey, linux_freq_scale, linux_hz) -- which chrony itself does not parse -- correctly stay Unmodeled; every value-parsing directive is now modeled. server/pool/peer are now FULLY parsed: SourceDirective carries the complete CpsNtpSource from the oracle-backed cmdparse::parse_ntp_source_add (all ~30 options with chrony's sscanf-%n re-tokenization), replacing the earlier raw_options stopgap; a single failure path reports 'Could not parse directive' as chrony does. The CNF_Get* accessor family (config::accessors) is now ported as a value-resolution layer over the parsed Config: not trivial getters but the complete config->effective-value mapping (chrony-exact default from conf.c's static block + parse-time last-wins for single-valued directives + accumulate for log/ratelimit flags + the client-only port/socket adjustments of CNF_Initialise). Differential-tested against the REAL CNF_ParseLine + CNF_GetX pipeline (built by #include-ing conf.c and linking the real array.c/cmdparse.c/memory.c, host deps stubbed to abort if reached; fixture conf-accessors-c-vectors.txt) over four scenarios -- pristine server defaults, client-only, a 66-directive broad override, and repeated-directive last-wins -- covering 73 accessors byte/value-exact: all scalar int/double/uint (ports, sample/source limits, skew/drift/distance/jitter/slew, NTS intervals, client-log limit), the enum accessors (AuthSelectMode, LeapSecMode) with chrony's exact discriminants, every parse_string/parse_null-backed string/flag accessor (drift/log/dump/keys/rtc/pid/leapsectz/signd/user/nts paths + interfaces; manual/rtconutc/rtcsync/noclientlog/lock_all/nosystemcert), and the fixed-tuple accessors (MakeStep, MaxChange, FallbackDrifts, Smooth, MailOnChange with its enabled/NULL-user contract, LogMeasurements+the 7 other log flags, and the three RateLimit triples with per-option override). The configure-time string macros use chrony's shipped defaults (USER=root, RTC_DEVICE=/dev/rtc, HWCLOCK_FILE="", PID_FILE + COMMAND_SOCKET under /var/run/chrony). The bind-address IPAddr accessors and the array-valued accessors (init sources, HW-timestamp interfaces, NTS cert/key/trusted-cert arrays) remain daemon-time/sub-port boundaries and are not credited (≈191 Rust fn in mapped modules)
• cmdparse.c — all 8: source options + word split/normalize/refid/key/local + allow-deny (incl. DNS hostname via nameserv; drives addrfilt end-to-end vs chronyc accheck). CPS_ParseRefid/ParseKey/ParseLocal/ParseAllowDeny are now all differential-tested vs the REAL compiled cmdparse.c (+util.c): the refid big-endian char pack (1-4 chars, >4 rejects, stops at space), the key id/type/key 2-or-3-word split with the lenient %u id, the local stratum(1..15)/orphan/distance loop with the %d%n/%lf%n re-tokenization (stratum 5orphan -> stratum=5 + orphan), and allow/deny's IP-literal + shortened-IPv4 (1/2/3-octet) + /bits + all-prefix forms (the hostname branch is the resolver boundary). CPS_ParseNTPSourceAdd is now a faithful standalone port (cmdparse.rs parse_ntp_source_add + get_select_option): the hostname + the full ~30-option loop (all SRC_DEFAULT_* seeds, the boolean/select flags, and the %d/%lf/%u/%x value scans) reproducing chrony's sscanf-%n advance so a value's trailing junk RE-TOKENIZES into the next option word (minpoll 6iburst -> minpoll=6 + iburst flag; minpoll 4x -> stray 'x' rejects), the key!=0 gate, and the extfield type whitelist. Differential-tested vs the REAL compiled cmdparse.c (+util.c) over a 15-line battery -- every SourceParameters field + accept/reject exact. The config-directive layer's server/pool/peer parsing now calls this directly (SourceDirective carries the full CpsNtpSource), replacing the earlier stopgap that kept most options as unvalidated raw_options and used strict .parse() (≈95 Rust fn in mapped modules)
• ntp_core.c — STAGED port of the protocol engine (chrony's largest TU, 69 fns/~3300 lines). RFC 5905 §8 offset/delay algebra + 48-byte header codec (measurements.rs/packet.rs). Stage 1 (ntp/poll.rs): the pure poll-interval + delay-sanity arithmetic -- get_separation, get_poll_adj, adjust_poll (poll/score with minpoll/maxpoll clamp + non-LAN floor), check_delay_ratio, check_delay_dev_ratio. Differential-tested vs the REAL compiled ntp_core.c by #include-ing the TU into the C generator (the static functions + NCR_Instance_Record struct reached directly, the ~130-symbol external surface stubbed, UTI_Log2ToDouble real, SST/SRC inputs controlled) and matching every value. Stage 2 (ntp/parse.rs): parse_packet (length/version validation, NTPv3 MAC + MS-SNTP detection, crypto-NAK, NTPv4 extension fields with NTS + experimental-EF detection, trailing MAC) composing the ported NEF extension-field parser, plus is_zero_data/is_exp_ef -- differential-tested vs the real ntp_core.c (#include harness + real ntp_ext.c) over crafted plain/v3-MAC/MS-SNTP/crypto-NAK/NTS-EF packets, matching every NTP_PacketInfo field. Stage 3 (ntp/poll.rs): the transmit timing -- get_transmit_poll (symmetric local/remote poll selection) and get_transmit_delay (online/presend/burst/peer-sampling delay), differential-tested vs the real ntp_core.c via the #include harness. Stage 4 (ntp/sample.rs): apply_net_correction -- the PTP transparent-clock correction that adjusts a sample's offset/peer_delay using the RX/TX net-correction extension fields, gated on both-directions presence + a sanity bound + a 100-ppm margin, differential-tested vs the real ntp_core.c via the #include harness. Stage 5 (ntp/sync.rs): check_sync_loop -- process_response's test D, the synchronisation-loop guard (serving-time gate, synced-to-our-address detection, and exact reference-identity 'it is me' detection), differential-tested vs the real ntp_core.c via the #include harness (REF/NIO/refid inputs controlled, UTI codecs kept real). Stage 6 (ntp/sample.rs compute_response_sample): process_response's offset/delay/dispersion sample arithmetic for the basic (non-interleaved) client path -- peer delay (with precision floor), offset (with configured correction), peer dispersion (precision + skewspan), root delay/dispersion, composing apply_net_correction. Courted by reaching the REAL process_response (saved=1 to bypass auth, validity tests configured to pass) and capturing the sample handed to SRC_AccumulateSample, matching all five fields + the sample time; independently checked vs the RFC 5905 offset/delay formula. Stage 7 (ntp/sample.rs compute_interleaved_response_sample): the interleaved-mode timestamp selection -- prefer previous local TX + source RX (with remote roots) when the L2L ratio test passes, else the current exchange (with MAX of packet/remote roots), local receive from the instance -- feeding the same arithmetic; courted by driving the REAL process_response in interleaved mode across both sub-branches. Stage 8 (ntp/exp_ef.rs): the experimental extension-field builders add_ef_mono_root (monotonic root delay/dispersion in f28 + monotonic receive timestamp + epoch; magic-only in client mode) and add_ef_net_correction (PTP transparent-clock correction; gated on ptpport, magic-only in client mode / no correction), composing the ported NEF_AddField framing -- differential-tested vs the real ntp_core.c (#include harness + real ntp_ext.c, fuzz RNG zeroed) by capturing the appended EF body bytes + flags across client/server modes. This completes the experimental-EF story (parse in Stage 2, apply in Stage 4, build here). Stage 9 (ntp/params.rs): the runtime source-parameter setters NCR_ModifyMinpoll/Maxpoll (range-guarded with mutual adjustment), Maxdelay/Maxdelayratio/Maxdelaydevratio (CLAMP 0..MAX), Minstratum (direct), Polltarget (floored at 1) -- the chronyc reconfiguration surface, differential-tested vs the real ntp_core.c via the #include harness. Stage 10 (ntp/access.rs): the NTP server access-control surface NCR_AddAccessRestriction (the (allow,all) -> ADF_Allow/AllowAll/Deny/DenyAll dispatch composing the ported addrfilt table, status->return) and NCR_CheckAccessRestriction (ADF_IsAllowed), differential-tested vs the real ntp_core.c (#include harness, recording ADF stubs) with the end-to-end allow/deny independently checked against the ported ADF table; the server-socket open/close side effect is a documented host boundary. Stage 11 (ntp/local_ts.rs): the NTP_Local_Timestamp helpers zero_local_timestamp (reset to an empty daemon timestamp) and update_tx_timestamp (adopt a more accurate hardware TX timestamp only when the original is set, the response still matches the packet we sent, and the improvement is a non-negative delay <= MAX_TX_DELAY), differential-tested vs the real ntp_core.c via the #include harness. Stage 12 (ntp/opmode.rs): the operating-mode state machine -- set_connectivity (the full online/offline transition table, returned as new mode + the host-boundary action GoOnline/TakeOffline the caller performs), NCR_SetConnectivity's online-change predicate, and NCR_IncrementActivityCounters (the chronyc activity tally) -- differential-tested vs the real ntp_core.c via the #include harness (transition observed + action witnessed by the SRC_SetActive/SRC_UnsetActive stubs). Stage 13 (ntp/create.rs): NCR_CreateInstance's parameter mapping -- the server/peer directive semantics: client/active mode from type, poll-interval defaults+clamps (default when below range, MAX cap, maxpoll>=minpoll), min-stratum cap, peer presend disable, delay-limit clamps, copy-only-for-clients, poll-target floor, and the NTP version selection (ext/interleaved force latest, else auth-suggested, explicit clamps) -- differential-tested vs the real ntp_core.c via the #include harness; the auth/source/quantile/filter sub-instance creation is a documented host boundary. Stage 14 (ntp/lifecycle.rs): the instance lifecycle transitions NCR_ResetInstance (clear the protocol/timestamp state), NCR_ResetPoll (drop poll score, return to minpoll, signal timeout restart), NCR_InitiateSampleBurst (client-only burst entry), NCR_SlewTimes (slew the stored local timestamps via UTI_AdjustTimespec) -- differential-tested vs the real ntp_core.c via the #include harness (the scheduler/source/filter side effects returned as intent / witnessed by the SCH_AddTimeoutInClass / SRC_SetActive stubs). Stage 15 (ntp/test_a.rs): process_response's test A for client sources (the sample-acceptance gate -- peer-delay-within-max, precision-within-max, not-a-presend-warmup, sane server processing time, and the interleaved-reuse rejection), differential-tested vs the real ntp_core.c by forcing B/C/D to pass so good_packet==testA and failing each condition in turn. Stage 16 (ntp/support.rs): the support helpers handle_slew (server monotonic-clock offset/epoch tracking -- slew accumulates, step resets+reseeds), has_saved_response (pending delayed-response predicate), check_delay_quant (test C quantile variant), differential-tested vs the real ntp_core.c via the #include harness. Stage 17 (ntp/transmit.rs): transmit_packet's client-request build -- the 48-byte header a client sends (clock state blanked, precision 32, the live transmit timestamp), the version cap, and the output timestamps -- differential-tested vs the real ntp_core.c by driving transmit_packet in client mode and capturing the packet via the NIO_SendPacket stub (the anti-replay fuzz, auth, and send are host boundaries). Stage 18 (ntp/report.rs): NCR_ReportSource (the chronyc-sources poll interval via get_transmit_poll + the client/peer mode classification), differential-tested vs the real ntp_core.c via the #include harness. Stage 19 (ntp/rx_dispatch.rs): the receive-path mode dispatch -- NCR_ProcessRxKnown's classification table (reply-to-process / handle-as-unknown / discard from the packet x association mode) and NCR_ProcessRxUnknown's reply-mode mapping (active->passive, client->server, NTPv1->server) -- differential-tested vs the real ntp_core.c (branch witnessed by the SRC_GetSourcestats/NIO_IsServerSocket stubs and the captured response mode). Stage 20 (ntp/tx_dispatch.rs): the transmit-path mode dispatch -- NCR_ProcessTxKnown (client/active TX timestamps update our stored local_tx, others route to the unknown path) and NCR_ProcessTxUnknown (broadcast ignored) -- differential-tested vs the real ntp_core.c, composing the ported update_tx_timestamp. Stage 21 (ntp/transmit.rs build_server_response): transmit_packet's basic server-response build -- our reference state (stratum/refid/root delay+dispersion/reference timestamp), the echoed originate timestamp, the receive/transmit timestamps with the interleaved-mode RX flag bit (set on receive, cleared on transmit) -- differential-tested vs the real ntp_core.c by driving transmit_packet in server mode and capturing the response via the NIO_SendPacket stub. Stage 22 (ntp/transmit.rs build_interleaved_client_request): transmit_packet's interleaved client request -- originate echoes the server's last receive timestamp, the receive timestamp is our last receive, and the transmit timestamp is the previously-sent (saved) one; also corrected the basic client's saved local_tx to be the distinct cooked-at-send reading (not the packet event time), caught when the cooked-time stub was made real. Stage 23 (ntp/transmit.rs build_symmetric_packet): transmit_packet's symmetric (peer) build for MODE_ACTIVE and MODE_PASSIVE -- our reference state (like a server), the originate echoing the peer's last transmit timestamp, and the receive/transmit timestamps with the interleaved RX-flag bit applied only in MODE_PASSIVE (set on receive, cleared on transmit) and NOT in MODE_ACTIVE -- differential-tested vs the real ntp_core.c by driving transmit_packet in both peer modes and capturing the packet via the NIO_SendPacket stub, with nsec chosen so the flag actually flips bits. This completes the transmit_packet build paths (client/interleaved-client/server/symmetric). Stage 24 (ntp/ntp_report.rs): the NTP ntpdata report assembly -- process_response's report-update block mapped into build_ntp_report (NtpReport / NCR_GetNTPReport's source), with the computed parts ported exactly: NTP_LVM_TO_MODE, the reference timestamp via the era-split ntp64->timespec, the 10-bit tests bitmask (pack_tests, test1..testD packed MSB-first), the tx/rx timestamp-source characters (tss_chars {'D','K','H'}), and the valid/good counter increments; jitter_asymmetry/authenticated are host inputs and remote_addr/port + tx/rx counts are set elsewhere. Differential-tested vs the real ntp_core.c by driving process_response over a valid client exchange and dumping inst->report across all-pass / testA-fail / aux (jitter+auth+K/H tss) scenarios. Stage 25 (ntp/mono_root.rs): process_response's EF_EXP_MONO_ROOT handling -- select_root (root delay/dispersion from the EF's 4.28 fixed point when present, else the header's 16.16 ntp32), compute_mono_doffset (the monotonic-vs-realtime offset change between same-epoch exchanges, clamped to +-MAX_MONO_DOFFSET, via the exact UTI_DiffNtp64ToDouble formula), and update_mono_state (adopt the EF epoch + monotonic-receive ts and accumulate the offset, else reset). Differential-tested vs the real ntp_core.c by driving process_response with a real add_ef_mono_root-built EF (real ntp_ext.c linked, the f28/DiffNtp64 codecs made real in the stub) across present-epoch-match / present-epoch-mismatch / absent, capturing report root delay/dispersion, the offset handed to SST_CorrectOffset, and the instance's remote_mono_epoch/remote_ntp_monorx. Stage 26 (ntp/test_a.rs passes_test_a_active): process_response's test A symmetric-active (MODE_ACTIVE) variant -- the same common gate as the client path but, instead of the client-only server-processing-time / basic-reuse checks, the interleaved 'missed response' rejection on any of (peer_delay > 0.5prev_remote_poll_interval, CompareNtp64(receive,transmit) <= 0, remote_poll <= prev_local_poll && DiffTimespecs(remote_transmit,prev_remote_transmit) > 1.5*interval), with prev_remote_poll_interval = Log2ToDouble(min(remote_poll,prev_local_poll)). Differential-tested vs the real ntp_core.c by driving process_response in MODE_ACTIVE + interleaved and reading testA out of report.tests across a pass plus one scenario per sub-condition (delay/compare/poll), feeding the captured peer_delay/peer_dispersion + timestamps + polls to the predicate. REMAINING: init/finalise (host-bound scheduler/alloc) (≈36 Rust fn in mapped modules)
• ntp_io.c — packet bytes (ntp/packet.rs) plus the PTP-over-NTP transport framing (ptp.rs): wrap_message prepends the 48-byte PTP Delay_Req prefix (header + origin ts + NTP TLV) to an NTP message, and NIO_UnwrapMessage's PTP path validates that prefix (type/version/length/domain/unicast-flag/TLV-type/TLV-length), strips it, and extracts the transparent-clock correction (Integer64 ns<<16 -> seconds) so switch delays can be subtracted. Differential-tested vs verbatim copies compiled against the REAL ptp.h struct (fixture ptp-wrap-c-vectors.txt: wrap byte layout at two NTP lengths + the too-short reject, and unwrap valid + every malformed-field rejection + the correction value), composing the ported integer64_network_to_host; the PTP constants and sizeof(PTP_NtpMessage) are pinned against the header. The socket send/recv path, is_ptp_socket, and the message buffers are the host boundary. Added NIO_IsHwTsEnabled as a simple config check. (≈17 Rust fn in mapped modules)
• pktlength.c — complete port of all 3 functions; per-command length/padding + per-reply length tables extracted exactly from candm.h offsets (compiled probe), not guessed -- now differential-tested vs the REAL compiled pktlength.c (#include harness driving PKL_CommandLength/PKL_CommandPaddingLength/PKL_ReplyLength over every command type at v5 (no padding) and v6 (padding), every reply type, and the out-of-range/boundary codes; fixture pktlength-c-vectors.txt), so the hardcoded REQUEST_LENGTHS/REPLY_LENGTHS tables are re-verified against the exact offsetof wire layout candm.h produces, and N_REQUEST_TYPES/N_REPLY_TYPES/PROTO_VERSION_PADDING are pinned against the real candm.h enums (≈9 Rust fn in mapped modules)
• ntp_io_linux.c — extract_udp_data is ported (ntp_io_linux.rs): the raw-frame parser chrony runs on packets returned through the kernel error queue for TX timestamping -- it walks the Ethernet header (skip MACs + any 802.1Q VLAN tags + the IPv4/IPv6 ethertype), the IPv4 header (ihl, UDP-protocol gate, destination address+port) or IPv6 header (destination address, then the extension-header chain: Hop-by-Hop/Routing/Dest-Options/Mobility by hdrlen, Authentication by its 4-octet unit, Fragment first-only, rejecting anything else) down to the UDP header, recovering the remote address/port and moving the payload to the front of the buffer. Pure parsing of untrusted bytes with every read bounds-checked as the C guards it. Differential-tested vs a verbatim copy (fixture ntp_io_linux-c-vectors.txt: IPv4 plain / VLAN-tagged / with-options, IPv6 plain / with a Hop-by-Hop header, and the reject cases -- too-short, ARP ethertype, TCP protocol, IPv6 non-first fragment, unknown extension header). Plus process_hw_timestamp / process_sw_timestamp: the HW-timestamp transposition math -- preamble->trailer correction from the frame's on-wire duration at the link speed (rx_correction = (l2_length+FCS) / (link_speed bytes/s), l2 derived from the interface UDP-start offset + NTP length when unknown), the TX/RX hardware compensation, and the MAX_TS_DELAY (1.0 s) accept gate, plus the software-timestamp cook+gate. Differential-tested vs verbatim copies with a deterministic mock cook standing in for HCL_CookTime/LCL_CookTime (fixture ntp_io_linux-hwts-c-vectors.txt: RX v4/v6 default + explicit l2, TX with tx_comp, no-link-speed, cook-failure, and the delay-reject / SW accept+reject cases); the hardware/local clock cook itself (HCL/LCL, ported elsewhere), poll_phc, the recvmsg/error-queue socket path, the SO_TIMESTAMPING cmsg extraction, and the interface/PHC bookkeeping are the host boundary (≈16 Rust fn in mapped modules)
• ntp_ext.c — complete port of all 6 functions; TLV format/parse + packet add/parse with alignment, NTPv4, MAC-length and bounds checks. Differential-tested vs the REAL compiled ntp_ext.c + ntp.h (#include harness; fixture ntp_ext-c-vectors.txt) over a 38-case branch battery: format_field/NEF_SetField (valid, exact-boundary-fit, misaligned start/body, negative body_length, no-fit, negative buffer_length, start==buffer_length, header-doesn't-fit, u16 type wrap, zero-length body -- the full written buffer byte-compared), NEF_ParseSingleField (len<header, unaligned len, overrun, start bounds), NEF_AddField (v3 reject, misaligned/short/oversize info.length, ef<NTP_MIN_EF_LENGTH, second field at a non-header start -- appended field bytes + info.length/ext_fields matched), and NEF_ParseField (non-v4, MAC-sized tail == NTP_MAX_V4_MAC_LENGTH, start<header, misaligned/short packet_length, start>=packet_length); the header constants incl. sizeof(NTP_Packet)==NTP_PACKET_SIZE are pinned against the real ntp.h (≈25 Rust fn in mapped modules)
• ntp_auth.c — complete port of all 17 functions: the authentication dispatcher unifying none / symmetric-key (MD5/CMAC MAC via the ported key store) / NTS (RFC 8915 client+server EFs) / MS-SNTP, including suggested NTP version, request/response generate+check, address change, cookie dump, and report; composes the ported keys + nts_ntp_client/server (over nts_ntp_auth + real AES-SIV), with only the MS-SNTP signing daemon injected as a closure. Differential-tested vs the REAL compiled ntp_auth.c (+ keys.c, hash_intmd5.c): byte-identical symmetric MAC on request+response, check accept, tamper reject, key report; mode dispatch (none/MS-SNTP/NTS) covered over the oracle-backed NTS modules + an injected signer (≈18 Rust fn in mapped modules)
• ntp_signd.c — complete port of all 7 functions: the asynchronous Samba ntp_signd client — serialise the SigndRequest (the ntp_signd IDL wire format), the bounded ring queue (bursts not lost), the writable/readable state machine (partial send/recv), response validation (packet_id/op/length) and signed-packet emission; the other half of the MS-SNTP path that ntp_auth injects. Host boundaries (socket SCK_, scheduler file-handler events SCH_, NTP send NIO_*) are one injected trait. Differential-tested vs the REAL compiled ntp_signd.c (+ array.c, memory.c): byte-identical SigndRequest + emitted signed packet, with bad-packet-id / non-success-op / over-short-length rejection + an independent partial-write/queue-capacity check (≈16 Rust fn in mapped modules)
• ntp_sources.c — STAGED port of the NTP source manager. Stage 1 (ntp_sources.rs): the source-table internals -- the open-addressing hash table keyed by remote IP (find_slot/find_slot2 quadratic probing, check_hashtable_size power-of-two load factor), UTI_IPToHash (seeded), NSR_StatusToString, and the get_next_conf_id counter. Differential-tested vs the REAL compiled ntp_sources.c via the #include harness (real array.c linked, the random hash seed pinned): the hash, the slot probing on a built 8-slot table, the sizing rule, the status strings, and the id counter are matched. Stage 2 (ntp_sources.rs): rehash_records -- grow the table to the smallest power-of-two satisfying the load factor and re-insert every record by re-probing (matched vs the real ntp_sources.c on grow/no-grow scenarios, including a re-layout under a new modulus). Stage 3 (ntp_sources.rs): add_source (the record-insertion decision -- already-present/name-required/too-many/invalid-family validation order, then grow-and-place) and the NSR_Modify* fan-out (address lookup -> the already-ported NCR_Modify*, returning found/not-found), differential-tested vs the real ntp_sources.c via the #include harness (status + n_sources + table size + slot across the validation cases and a 5-source growth; every NSR_Modify* variant's present/absent return). Stage 4 (ntp_sources.rs): the source-removal lifecycle -- NSR_RemoveSource (NoSuchSource when absent, else clear the slot, decrement n_sources, and rehash) and clean_source_record's pool-counter bookkeeping (SourcePool::on_remove: sources--, unresolved-- when unreal, confirmed-- when non-tentative, max_sources clamp) -- differential-tested vs the real ntp_sources.c (removal status/n_sources/size/remaining-layout across present/absent/down-to-zero; each pool-counter branch with pre-set distinct counts). Stage 5 (ntp_sources.rs): source-iteration ops -- the mask-match selection (select_matching: occupied slots whose address matches under a mask, Unspec matches all -- the core of NSR_InitiateSampleBurst/NSR_SetConnectivity, with UTI_CompareIPs ported as ip_equal_under_mask), NSR_RemoveAllSources (clean all + rehash to the empty table), and NSR_GetLocalRefid (find + NCR_GetLocalRefid or 0) -- differential-tested vs the real ntp_sources.c (matched-address set in slot order for all/exact/subnet/none, the refid present/absent, the emptied table). Stage 6 (ntp_sources.rs): NSR_SetConnectivity's selection + application order -- like select_matching but the synchronisation peer is applied last (avoiding reference switching) and, for an Unspec address with MaybeOnline, unresolved sources are skipped; differential-tested vs the real ntp_sources.c (NCR_SetConnectivity records the application order) across all/sync-last/maybe-skip/subnet+sync. Stage 7 (ntp_sources.rs): get_unused_pool_id (first pool with no sources and no pending unresolved name, else INVALID_POOL) and the single-by-address report fan-outs NSR_GetNTPReport (found 1/0) and NSR_ReportSource (NCR fills the report when found, else the poll is blanked) -- differential-tested vs the real ntp_sources.c. Stage 8 (ntp_sources.rs): is_resolved (a pool source is resolved once the pool has no unresolved sources; a single source once its address is no longer present) and NSR_GetName (find -> the source name, host metadata) -- differential-tested vs the real ntp_sources.c. Stage 9 (ntp_sources.rs): the NSR_ProcessRx/Tx receive/transmit routing -- process_rx_route (to the Known handler only when the packet is not client-mode AND its address+port match a source, else Unknown) and process_tx_route (the mirror: not server-mode AND matched), plus confirm_tentative_pool_source (a tentative pooled source's first good reply increments confirmed_sources and signals a max-sources prune) -- differential-tested vs the real ntp_sources.c (the routing branch witnessed by recording NCR_ProcessRx/TxKnown/Unknown stubs across every mode x known/unknown-address combination). Stage 10 (ntp_sources.rs): change_source_address's table operation -- the NoSuchSource/AlreadyInUse validation (incl. the subtle 'IP used by ANOTHER source, even at a different port' case: find_slot2(new)==Both || (find_slot2(new)!=NoMatch && slot(new)!=slot(old))), the address move, and the rehash-when-IP-changed -- differential-tested vs the real ntp_sources.c (status + old/new presence across port-change/new-address/already-in-use/iponly-other/no-such), plus change_address_pool_bookkeeping (unreal->real drops unresolved_sources; a re-tentative'd confirmed source drops confirmed_sources) composing the verified SourcePool. Stage 11 (ntp_sources.rs): NSR_UpdateSourceNtpAddress's non-record-locked path -- the public wrapper's both-addresses-real InvalidAf gate and the find_slot (IP-only) AlreadyInUse pre-check that rejects moving onto another source's IP even at a different port (while a same-IP port change passes through to change_source_address) -- differential-tested vs the real ntp_sources.c (unreal-old/unreal-new/new-ip-used/port-change/new-ip-free/no-such); the record-lock deferral into saved_address_update is the caller's concurrency concern. REMAINING: resolve sources (DNS callback), auth/auto-start surface (socket/resolver-bound) (≈65 Rust fn in mapped modules)
• sources.c — STAGED port of the 48-function selection brain (the largest chrony TU; SRC_SelectSource alone is 517 lines). Stage 1 (sources/registry.rs): the source registry + 8-bit reachability register + status/stratum/leap bookkeeping + leap-second vote + sample accumulation (composing the ported sourcestats) + special-mode-end + accessors. Stage 2 (sources/combine.rs): the numeric combine_sources (weighted offset/frequency blend), update_sel_options (authselectmode policy), and the get_status_char/compare_sort_elements helpers. Stage 3 (select_source in registry.rs): the full SRC_SelectSource pipeline -- classification, the falseticker endpoint-intersection (depth/trust-depth search), orphan/stale handling, admissibility + trust, prefer reduction, score/SCORE_LIMIT hysteresis, and the combine + REF_SetReference. Differential-tested vs the REAL compiled sources.c by driving the real SRC_SelectSource over controlled sources (controlled SST_GetSelectionData/GetTrackingData) and matching REF_SetReference (combined offset/count) + per-source report states across select+combine / falseticker / no-majority scenarios. Stage 4 (registry.rs): lifecycle (Finalise/DestroyInstance with reindex+selection fixup), the LCL slew/dispersion handlers (composing the ported sourcestats), reselect/reset/modify-options accessors, and SRC_GetSelectReport. Stage 5 (registry.rs): the dump persistence (save_source/load_source over the SRC0 format composing the ported sourcestats dump, get_dumpfile naming, DumpSources/ReloadSources fan-outs, RemoveDumpFiles name gate), the SRC_ReportSource/SRC_ReportSourcestats reports, and the mode-gated log_selection helpers. All 48 functions ported. Differential-tested vs the REAL compiled sources.c across stages: reachability register + triggers, combine_sources, the full SRC_SelectSource pipeline (select+combine/falseticker/no-majority, per-source report states + REF_SetReference), SRC_GetSelectReport, and the dump save format + load round-trip -- now including the FULL save_source output byte-for-byte (the SRC0 header + the complete SST_SaveToFile sample body, which had only its header checked before; this pins the %.6e exponent-format fix through the composed dump). The file/socket boundaries (UTI file I/O, glob) are the daemon's; the SST/REF/LCL/SCH/NSR boundaries are injected (≈103 Rust fn in mapped modules)
• sourcestats.c — complete port of all 32 functions (the keystone): dual circular buffers + weighted robust regression + jitter-asymmetry multiple regression + dump/reload; composes ALL of the verified regress engine; regression/prune/asymmetry/save-load tested. SST_AccumulateSample + SST_DoNewRegression + SST_GetTrackingData are additionally differential-tested end-to-end vs the REAL compiled sourcestats.c + regress.c (#include harness, -ffp-contract=off) over 8/4-sample runs and an asymmetry-corrected run: the estimated offset/offset_sd/frequency/frequency_sd/skew/root_delay/root_dispersion (composing the robust regression) match to ~1 ULP (FP summation order in the regression's iterative runs-test) and the sample count exactly; the ref time passes through chrony's ns-granular timespec (declared f64-seconds boundary), within a nanosecond. SST_GetSelectionData (the interval SRC_SelectSource consumes) is also differential-tested at a fixed now: the offset_lo/hi limits (offset +/- root_distance), root_distance, std_dev, and select_ok match, with first/last-sample-ago exact. The remaining pure accessors are also differential-tested: SST_GetFrequencyRange (freq +/- skew), SST_PredictOffset (estimated_offset + elapsed*freq), SST_MinRoundTripDelay (incl. the fixed-min-delay override), SST_GetJitterAsymmetry, and SST_GetDelayTestData (the n>=6 gate returning None below it, else last-sample-ago/predicted-offset/min-delay/skew/std_dev) -- all matching the real C. SST_SaveToFile's dump format is byte-exact vs the real C, which surfaced and fixed a divergence: chrony's %.6e prints an explicit exponent sign + >=2 digits (1.000000e-04) while Rust's {:.6e} omits both (1.0e-4) -- fmt_c_e6 shims it so the dump file is byte-identical (LoadFromFile round-trips either) (≈43 Rust fn in mapped modules)
• regress.c — all 11: weighted LS + runs-test + median-based robust + 2-var regression + t/chi2 tables + median; verified by TWO oracles -- the REAL compiled regress.c (80 differential vectors) and an independent reference impl (≈24 Rust fn in mapped modules)
• samplefilt.c — complete port of all 18 functions; circular sample buffer + dispersion/offset selection + weighted-regression combine (composes the verified regress); precision/time injected. select_samples' intricate index-permutation (the <=1.5x-min-dispersion filter, the fall-back-to-all, the median-window from/to via combine_ratio, and the in-place buffer-index re-threading) is now differential-tested vs the VERBATIM samplefilt.c select_samples over a 9-case battery (3/4/5/6/8 samples; combine_ratio 0/0.3/0.5/0.6/1.0; tight-vs-spread dispersions) -- the returned buffer indices match exactly, upgrading the earlier computed-directly claim. The full SPF_GetFilteredSample pipeline (select_samples + combine_selected_samples composing the real regress) is additionally differential-tested end-to-end vs the REAL compiled samplefilt.c + regress.c over 6 scenarios (n=2 variance, n=3 variance, n>=4 weighted-regression fit, combine_ratio 0/0.5, and the max-variance filter-out) -- the combined offset/peer+root dispersion/peer+root delay match at EXACT f64; only the combined time (which chrony rounds into a ns-granular timespec while chrony-rs keeps f64 seconds -- a declared modeling boundary) is compared within a nanosecond (≈26 Rust fn in mapped modules)
• quantiles.c — complete port of all 8 functions (QNT_DestroyInstance = Drop); structural — convergence statistically. The DETERMINISTIC estimator core (insert_initial_value's ordered warm-up, update_estimate's adaptive step, and get_quantile's RGR_FindMedian over the repeat estimators) is now differential-tested vs the REAL compiled quantiles.c + regress.c: the oracle logs every random() int it consumed and the Rust replays that exact draw sequence (rand = int/(2^31-1)), so a 20-value quartile run over (min_k=1,max_k=3,q=4,repeat=3) matches the k=1/2/3 quantile estimates at EXACT f64. Only chrony's non-deterministic random() seeding remains non-byte-witnessable in production (≈16 Rust fn in mapped modules)
• reference.c — complete port of all 46 functions (the discipline keystone above local.c): the offset/frequency/skew combine (get_clock_estimates), correction-rate, root-dispersion, step decision, drift-file persistence, fallback-drift accumulator, leap-second scheduling (system/slew/step/ignore), special init/update/print modes, sync status, tracking log, and tracking report; gmtime/strftime reimplemented (civil-date math) so is_leap_second_day and the log timestamp are deterministic, with only the timezone-leap lookup left as a host boundary. Composes the ported local clock; all of LCL_/SCH_/drift-file/leap-tz/RNG/mail/log injected via one RefHost trait. The numeric core (REF_SetReference/REF_AdjustReference + estimator/step/dispersion helpers, incl. the fuzz-fed report root dispersion) is differential-tested vs the REAL compiled reference.c (byte-identical corrections/step/sync/report over recording LCL_/SCH_ stubs); leap/local/accessor paths unit-tested (≈164 Rust fn in mapped modules)
• local.c — complete port of all 35 functions; composes the ported sys_null driver (ClockDriver trait) + optional smooth hooks; raw clock/config injected, handlers id-registered (closures); discipline/temp-comp/precision/handler tests. The frequency/temp-comp discipline math (LCL_SetAbsoluteFrequency, LCL_AccumulateDeltaFrequency, LCL_SetTempComp, LCL_ReadAbsoluteFrequency) is differential-tested vs the VERBATIM local.c formulas (-ffp-contract=off, identity driver) over a 6-step sequence exercising set/accumulate with and without temp-comp: the read-abs-frequency (the temp-comp undo) and the dfreq handed to the change handlers match at ~1 ULP, pinning the temp-comp forward/inverse transform (afreq*(1-1e-6*tc)-tc and its undo) and the (afreq-cf)/(1e6-cf) delta-to-absolute algebra (≈56 Rust fn in mapped modules)
• smooth.c — complete port of all 12 functions; the 3-stage bounded-freq/wander trajectory (update_stages/get_smoothing) is now differential-tested vs the VERBATIM smooth.c math (extracted, -ffp-contract=off) -- byte-identical (exact f64) stage wander/length + the get_smoothing offset/freq/wander at 6 elapsed times across 9 scenarios (small +/- offset, with/against freq, the frequency-limit-hit 2nd-stage branch, the tiny-offset numerical-error direction select, zero, freq-only), upgraded from the earlier reference-impl check; time as seconds, config/skew injected, struct-as-handler (≈23 Rust fn in mapped modules)
• tempcomp.c — complete port of all 5 functions; quadratic + point-table interpolation (points stored in the ported array::Array); temp injected, comp returned, points/coefs as data. get_tempcomp is now differential-tested vs the VERBATIM tempcomp.c (-ffp-contract=off) -- exact-f64 over a 14-temperature battery in both modes: the quadratic k0+(T-T0)k1+(T-T0)^2 k2, and the point-table linear interp with below/above extrapolation off the first/last segment (the loop-end p2=last-element edge) (≈12 Rust fn in mapped modules)
• sched.c — complete port of all 22 functions: the sorted timeout queue (add/by-delay/in-class with class separation + randomness, removal, dispatch), file-handler registry + select-driven main loop, clock-step queue shift, and last-event/monotonic time tracking; clock/select/randomness injected; differential-tested vs the REAL compiled sched.c (SCH_MainLoop dispatch order + fire times, incl. ties/spacing/random/step) + an independent file-handler test (≈35 Rust fn in mapped modules)
• client.c — tracking/sources/sourcestats/activity/serverstats rendered (print_report+print_info_field engines, all print_* value helpers; all live-witnessed vs 4.5); 5 of ~40 process_cmd_* commands; no socket transport. The six print_* value formatters (fmt_seconds/nanoseconds/signed_nanoseconds/freq_ppm/signed_freq_ppm/clientlog_interval) are now additionally differential-tested vs the VERBATIM client.c helpers over a 161-vector adversarial battery covering every unit threshold (1200/36000/345600s; 9999.5 ns/us/ms; 99999.5 ppm), rounding half-point, sign edge, and negative zero -- confirming Rust's format! matches C printf exactly across the full domain, including the -0.0 -> "-0" sign under the + flag. The print_report mini-printf engine that drives every chronyc report is fully ported (print_report over a typed ReportArg model + ReportMode): the format grammar (%[+|-][width][.prec]spec), all chrony-specific specifiers (B bool, C clientlog-interval, F/O abs freq/offset with fast/slow keyword, I seconds, L leap status incl. width==1 single-glyph, M NTP mode, N timestamp source, P freq ppm, R %08X refid, S offset-with-unit, U/Q/b/c/d/f/o/s/u), and the full CSV mode (literals dropped, comma-joined fields, C->d / F,P->f.3 / O,S->f.9 / I->U / T->V remap, sign/width cleared, trailing newline). Differential-tested vs the VERBATIM print_report engine (linked against the real util.c for %V) over 23 format strings x both modes, byte-exact. The %T specifier (strftime "%a %b %d %T %Y" UTC) is handled via util::gmtime_report_string -- the gmtime civil-date math + weekday, differential-tested vs real gmtime/strftime over a 13-timestamp battery (epoch, negatives, the 2000/2020 leap days, year 9999, the 2038 boundary). ALL print_report specifiers are now reproduced. Six report renderers are driven by this engine with their exact client.c format strings: render_tracking (the 13-line tracking block, %R (%s) refid+name, %T ref time, %.9O system-time with slow/fast, the freq %.3F, %L leap), render_ntpdata (the 28-line ntpdata block: %s (%R) remote+local address/refid via the ported UTI_IPToString/UTI_IPToRefid, %d (%.0f/%.9f) poll/precision via UTI_Log2ToDouble, %R (%s) reference via UTI_RefidToString for stratum<=1, %T ref time, the %.3b %.3b %.4b NTP-tests bit groups, %B interleaved/authenticated, %N tx/rx timestamp source), render_rtcdata (the 6-line rtcdata block, %T + %I span + %12.6f/%9.3f), render_authdata_row (authdata: %-27s %4s %5U %4d %4d %I ..., mode -/SK/NTS), render_selectdata_row (selectdata: the state-char + 5-char COpts/EOpts option groups + %I + %5.1f score + %+S lo/hi + %1L leap) -- all differential-tested vs the verbatim engine in both human and CSV modes (incl. the CSV %T->%V fallback), with the exact column headers + -v legend text pinned. The matching reply decoders (client.rs) now include decode_ntp_data_reply (the 128-byte RPY_NTPData -> NtpReport + remote addr/port, unpacking the flags word into tests + interleaved/authenticated), completing the report decoder set. The two list-style renderers are also engine-driven: render_clients_row (clients: %-25s %6U %5U %C %C %I %6U %5U %C %I with the -k NTS-KE vs command second-group toggle and clients_header's Cmd/NTS-KE %6s column) and render_manual_list_row (manual list: %2d + UTI_TimeToLogForm date + %10.2f offsets, plus MANUAL_LIST_HEADER and the 210 n_samples info line) -- both differential-tested vs the verbatim engine in both modes, composing the already-ported ClientAccessReport/ManualSampleReport row decoders. Every chronyc report renderer (tracking/ntpdata/rtcdata/authdata/selectdata/sourcestats/sources/activity/serverstats/clients/manual list) is now driven by the ported print_report engine and byte-verified. The pure CLI-dispatch helpers under the process_cmd_* commands are also ported (client.rs): format_name (the display-name branch dispatch -- ref->refid_to_string / source-name-hit-or-? / IP-literal / DNS, with the byte-level DNS truncation to trunc_dns chars ending in '>', differential-tested vs the verbatim client.c truncation incl. the strlen>trunc strict boundary), parse_sources_options (the -a/-v scan, verbose=!csv, composing CPS_SplitWord), is_waitsync_done (waitsync's stop condition: reference-real via the WAITSYNC_LOCAL_REFID=0x7f7f0101 exclusion + the correction/skew bounds) with waitsync_interval_floor (0.1s), parse_dns_command (the -46/-4/-6/-n/+n family/no-dns toggle) and parse_timeout_command (C-atoi + the 100ms floor). The DNS resolution, source-name table, and socket transport these compose with remain host boundaries. The process_line command dispatch is ported as classify_command: the full chronyc command vocabulary (~55 command words) -> Command {Submit(req), AllowDeny{base,all}, Report, Local, Deprecated, Empty, Unrecognized}, composing the ported CPS_NormalizeLine + CPS_SplitWord, with the argument-dependent cases handled (makestep bare->REQ_MAKESTEP vs with-args->REQ_MODIFY_MAKESTEP; manual list->report / delete->submit / on-off-reset->submit via the strncmp prefix tests; the allow/deny family's base-vs-ALL pair). Every REQ_ command code a submit command sends is pinned against a compiled candm.h enum probe (incl. the aliased local->REQ_LOCAL2 and doffset->REQ_DOFFSET2). The per-command argument parsing and socket submit each handler performs stay host boundaries. Plus the serverstats wire->display counter reorder (SERVERSTATS_DISPLAY_TO_WIRE) that feeds the existing ServerstatsReport renderer, which is now compiled-oracle-verified (upgraded from live-witnessed). The display name column (format_name of refid/IP) and name resolution remain the caller's host boundary. On the request-builder side (client.rs), the pure half of submit_request + the process_cmd_* body encoders: build_request_header (the 20-byte CMD_Request header -- version/pkt_type/command/attempt stamped, res*/pad* zero, random sequence caller-supplied in network order), the modify-int/modify-float (address + value), local, allow_deny (ip + subnet_bits), single-address (accheck/cmdaccheck/del_source), single-Float (dfreq/doffset), single-word (manual option / manual_delete / index-only source_data/sourcestats/select_data), settime (Timespec), and the full add_source REQ_NTP_Source build (type/strncpy-name/all params + the boolean->flags fan-out + convert_addsrc_sel_options, the SRC_SELECT->REQ_ADDSRC inverse of cmdmon's mapping, with the name-too-long rejection). Byte-exact vs a generator that builds each CMD_Request body with the REAL util.c encoders, and cross-checked by round-tripping every encoder through its inverse cmdmon decoder. Plus the remaining connectivity/config request encoders -- online/offline (mask+address), burst (mask+address+n_good/n_total), modify_makestep (limit+threshold), reselect_distance (Float), smoothtime (option), and modify_selectopts (address+ref_id+mask-raw+options-remapped via the SRC_SELECT->REQ_ADDSRC map) -- byte-exact vs the real util.c oracle and round-tripped through their cmdmon decoders. On the reply side (client.rs), the pure half of submit_request's reply handling + the process_cmd_* report readers: validate_reply_header (the CMD_Reply header state machine -- Invalid on short/wrong-pkt-type/reserved/command-echo/sequence-echo/version, VersionDowngrade on a v5 reply to a v6 request, TooShort below PKL_ReplyLength, else Valid), request_reply's status_message (the STT_* -> numbered-string map incl. the 520 catch-all) and status_is_ok gate, and the RPY_* body decoders -- tracking/sourcestats/source_data(state+mode un-remap)/activity/rtc/smoothing/auth_data(mode un-remap)/select_data(option un-remap)/manual_timestamp/n_sources -- each the exact inverse of the corresponding cmdmon encoder (SourceState/SourceMode/AuthMode gained from_wire inverses). Verified at the wire level (encode(decode(bytes))==bytes, robust to chrony's lossy 32-bit Float) incl. decoding the REAL C tracking bytes, with the integer/enum fields checked exactly. The arg parsing (sscanf/CPS_Parse*/DNS) and socket/retry transport remain host-bound (≈159 Rust fn in mapped modules)
• cmdmon.c — the live control socket, rate limiting, and per-command handlers are host-bound (a declared negative capability). Ported: read_from_cmd_socket's pure pre-dispatch request-validation state machine (validate_request) -- the length/pkt-type/reserved/version/command/length gates that decide drop-vs-error-reply-vs-dispatch, building on the ported PKL_CommandLength; differential-tested vs a verbatim copy of the validation using the real PKL_CommandLength (drop / bad-version-compat / invalid-command / bad-length / valid cases). Also handle_tracking's RPY_Tracking reply encoding (encode_tracking_reply) -- the 80-byte tracking-report serialization composing the ported htonl/htons + ip/timespec/float host-to-network encoders, byte-exact vs a copy of handle_tracking using the real util.c encoders. Also handle_sourcestats (RPY_Sourcestats, 60B) and handle_source_data (RPY_Source_Data, 52B, incl. the non-trivial RPT->RPY_SD state/mode enum remap) reply encoders, byte-exact vs copies using the real util.c encoders. Plus handle_activity (RPY_Activity, 24B), handle_server_stats (RPY_ServerStats, 172B, 17 Integer64s + 32B reserved) and handle_ntp_data (RPY_NTPData, 128B -- reusing the ported NtpReport, with the tests|interleaved|authenticated flags word and 12B reserved), handle_rtcreport (RPY_Rtc, 32B) and handle_smoothing (RPY_Smoothing, 28B, active|leaponly flags), handle_auth_data (RPY_AuthData, 28B, NTP_AUTH mode map) and handle_select_data (RPY_SelectData, 52B, convert_sd_sel_options bit remap), all byte-exact vs copies using the real util.c encoders. On the request side, the handle_modify_* decoders (decode_modify_source_int/float: address via UTI_IPNetworkToHost + int/float value, feeding the ported NCR_Modify*), plus the handle_local (REQ_Local on_off/stratum/distance/orphan), handle_allowdeny/handle_cmdallowdeny (REQ_Allow_Deny ip+subnet_bits), handle_accheck/handle_del_source (single-address), handle_dfreq/handle_doffset (single-Float), handle_manual_delete (index), handle_settime (REQ_Settime Timespec), handle_manual (option 0/1/2 validation), and the full handle_add_source request decode (REQ_NTP_Source: type/name-termination gates, all SourceParameters fields, the REQ_ADDSRC flag-bit -> connectivity/iburst/interleaved/burst/nts/copy/ext_fields booleans, and convert_addsrc_select_options), differential-tested vs the real UTI decoders. On the list-reply side, handle_settime's RPY_ManualTimestamp (12B), handle_client_accesses_by_index's per-client RPY_ClientAccesses_Client row (60B, incl. the raw-signed-byte *_interval fields), and handle_manual_list's RPY_ManualListSample row (24B), byte-exact vs copies using the real util.c encoders. The remaining connectivity/config request decoders are also ported: handle_online/offline (REQ_Online mask+address), handle_burst (mask+address+n_good/n_total), handle_modify_makestep (limit+threshold), handle_reselect_distance (Float), handle_smoothtime (option), and handle_modify_selectopts (address+ref_id+mask-raw+options-remapped) -- each round-tripped against its inverse client.rs encoder and byte-exact vs a real-util.c oracle. Plus read_from_cmd_socket's reply-header framing: build_reply_header (the 28-byte CMD_Reply header with version/pkt_type stamped, command+sequence echoed verbatim in network order, and reply/status set), byte-exact vs a real-candm.h CMD_Reply header dump for both the default (RPY_NULL/STT_SUCCESS) and an error (STT_BADPKTVERSION) case; the whole per-command permissions[] authority table (73 entries, Open/Local/Auth) pinned against an awk-extracted copy of the real array; the is_command_allowed authority state machine (unix-socket-always, else Open/Local(loopback)/Auth-never); and transmit_reply's reply_fits length gate (request_length >= PKL_ReplyLength). The live socket loop, rate limiting, access-allow table, and per-command handler dispatch into daemon state remain host-bound (≈59 Rust fn in mapped modules)
• main.c — --check-config and --replay only; no scheduler/privdrop/daemonize. The command-line option parser (cmdline.rs) is ported: parse_options reproduces main's two-pass scan -- the whole-argv --help/--version pre-scan, then the getopt short-option loop over "46df:F:hl:L:mnpP:qQrRst:u:Uvx" -- computing the full ChronydOptions (address family, debug/nofork/system_log, conf/log files, scfilter/log-severity/sched-priority via parse_int_arg=sscanf %d, print-config, user-check, the -q/-Q ref-mode + client-only + clock-control combos, reload/restarted/init-rtc, timeout, user) and the remaining config args (optind). Differential-tested vs the REAL getopt over a 25-case battery (flag clustering -dn, attached vs separate option args -f/path/-L2, the -- terminator, config-arg tails, unknown-option and help/version early exits) -- byte-identical option state + remaining args. The option effects (fork/log-open/privdrop/config-read) remain the daemon binary's host boundary (≈116 Rust fn in mapped modules)
• privops.c — complete port of the privilege-separation protocol logic: the daemon-side direct-vs-helper routing of every PRV_* call, the helper-side op dispatch (helper_main's switch), the bind port-validation security gate (do_bind_socket), the unknown-op res_fatal path, and the response assembly (rc/errno/data with errno recorded only on the per-op failure condition chrony uses). The core port injects the transport + backend; the differential test drives the REAL compiled privops.c END-TO-END through its actual fork() + Unix socketpair (adjusttime, settime errno path, name2ipaddress, reloaddns over recording op stubs); bind validation, unknown-op fatal, OP_QUIT, and client routing unit-tested. The REAL fork()+socketpair transport is now also implemented in chrony-rs-io::privops (the Linux NAME2IPADDRESS/RELOADDNS helper profile): PRV_StartHelper forks the helper, send_request/receive_from_daemon/send_response/receive_response/submit_request carry the request/response IPC over the real socketpair, helper_main serves it, and stop_helper reaps the child -- kernel-integration-tested by forking a real helper and round-tripping a resolution (IP-literal, keeping the forked child on the async-safe path) and a reload. The per-op DNS handlers (do_name_to_ipaddress/do_reload_dns) and the PRV_Name2IPAddress/PRV_ReloadDNS clients are platform-conditional and absent from the default-build inventory (≈24 Rust fn in mapped modules)
• util.c — pure primitives ported: NTP short/64 + era algebra, the f28 fixed-point + NTP64 compare/zero/equal-any/timespec<->ntp64(+fuzz, era-split-aware), timespec/timeval<->double + normalise + compare/diff/add-double/add-diff/average-diff/adjust + timeval<->timespec + zero/is-zero, Integer64 + custom-Float + era-split Timespec wire (de)serialization, time-offset-sane window, IP compare/is-real + IPAddr wire (de)serialization + cmac/hash name->algorithm, timespec/ntp64->string + gmtime log-form + path-to-dir + whitespace split, IP string parse/format + id-string parse (std Ipv4/6 proven byte-identical to inet_pton/ntop on a battery) + sockaddr/subnet formatters + join_path, dir/file permission decision-logic (stat the host boundary, verdicts checked vs real temp objects), log2->seconds, hex codec, refid<->string, UTI_IPToRefid (IPv4 address / IPv6 first-4-bytes-of-MD5 via the ported internal MD5), and UTI_GetNtp64Fuzz's deterministic byte-placement/masking core (get_ntp64_fuzz: the start offset + top-byte %(1<<bits) reduction that selects which sub-precision bits are randomized, modeled as a big-endian 8-byte array so it is host-endianness-independent while matching chrony's struct-byte layout) -- all differential-tested vs real util.c (build-dependent paths pinned via a HAVE_LONG_TIME_T + NTP_ERA_SPLIT oracle, IP strings via a FEAT_IPV6 oracle, IPv6 refid vs real md5.c, and the fuzz placement over the full precision sweep -32..=32 with a controlled RNG). The only unported UTI_* surface is now genuinely host-bound: file I/O (open/rename/remove/create-dir), the CSPRNG draw itself (UTI_GetRandomBytes, injected -- only its deterministic fuzz placement is ported), drop-root, and signal handlers. A cross-cutting printf-format-parity reference (util.rs test) differential-tests Rust format! vs real C printf over the specifiers chrony uses in file/log output: %f (all of %.6f/%20.6f/%+.3f/%.0f incl. negative-zero, half-to-even rounding, width, sign), %o, %x/%08X, %d/%8u/%5d match byte-for-byte, establishing the drift/RTC/log/reachability/refid formats are byte-safe; %e is the sole exception (Rust omits the exponent sign + zero-padding), handled by the fmt_c_e6 shim in the dump writers (≈124 Rust fn in mapped modules)
• array.c — complete port of all 10 functions over a flat Vec (slices where chrony returns pointers): exact capacity grow/shrink policy + order-preserving removal; no unsafe. Differential-tested vs the REAL compiled array.c (#include harness driving a 25-op script -- get-new/append/order-preserving remove/set-size across the doubling-up-from-1 grow and the snap-to-min_size shrink boundaries; fixture array-c-vectors.txt) asserting used, the exact allocated capacity trajectory (chrony's realloc_array: 0->1->2->4->8->16, the used-8->7 alloc-16->7 snap, re-grow 7->14, set_size 7->112 doubling then 112->10 snap then stay-within-[min,2min] then ->0), and the in-use element bytes after every op; ARR_SetSize grows carry indeterminate C Realloc bytes (Vec::resize zeroes) so only used+allocated are pinned there (≈19 Rust fn in mapped modules)
• memory.c — complete port of all 6 functions over Vec: Malloc zeros a buffer, Realloc resizes, Strdup clones a string, get_array_size computes sizeof_array. Subsumed by std; the port provides named counterparts for parity. (≈11 Rust fn in mapped modules)
• logging.c — the pure severity/context/formatting core is ported (chrony-rs-core::logging): LOG_SetMinSeverity's [INFO,FATAL] clamp, the context bitmask (LOG_SetContext/UnsetContext) and its LOG_GetContextSeverity mapping (INFO iff a watched context is set, else DEBUG), the LOG_Message file line (the strftime %Y-%m-%dT%H:%M:%SZ ISO-8601 timestamp prefix via the ported gmtime civil-date math + the message body) and log_message's 'Fatal error : ' marker. Differential-tested vs a verbatim copy of the timestamp (real strftime), the severity clamp, and the banner cadence (logging-c-vectors.txt). The file logging is implemented for real in chrony-rs-io::logging over safe std::fs (no unsafe): LOG_FileOpen registers a statistics log, LOG_FileWrite lazily opens /.log and writes the ====/banner/==== header every logbanner-th record (the ported log_banner_lines cadence) then the record + fflush, LOG_CycleLogFiles closes them for rotation, and LOG_OpenFileLog opens the append-mode message log -- kernel-integration-tested with real temp files (banner cadence + content, no-logdir disable, append-not-truncate). The syslog path (LOG_OpenSystemLog), the LOG_Message fatal exit(1) + parent-fd forwarding, and the debug-prefix/parent-fd setters remain host boundaries (≈16 Rust fn in mapped modules)
• stubs.c — complete port of all 78 stub functions: every function name in stubs.c has a direct counterpart in its native module (CAM_* in cmdmon.c, CLG_* in clientlog.c, etc.). stubs.c is test scaffolding, not a behavior port target, but its functions are fully covered by the native module ports. (≈0 Rust fn in mapped modules)
• keys.c — complete port of all 17 functions for chrony's internal-MD5 build: key-file parse (ASCII/HEX), sorted store + binary-search + cache, MAC generate/verify (truncated), secure-length gate; differential-tested vs the REAL compiled keys.c (key file + per-id vectors) + an independent MD5(key||msg) check; CMAC cipher keys rejected at load (no crypto backend), as that build does (≈32 Rust fn in mapped modules)
• md5.c — complete port of all 4 functions; byte-exact vs the official RFC 1321 §A.5 test vectors (dependency-free TU) AND differential-tested vs the REAL compiled chrony md5.c (#include harness; fixture md5-c-vectors.txt) over a 0..=130 message-length sweep -- pinning byte identity against chrony's specific implementation at every length residue incl. the 55/56, 63/64 and 119/120 block-padding boundaries the RFC vectors don't reach, for both one-shot digests and chunked streaming (chunk sizes 1 and 13, exercising update()'s cross-block buffering) (≈11 Rust fn in mapped modules)
• hash_intmd5.c — complete port of all 3 functions; thin wrapper over the ported MD5, with the supported-algorithm gate and in1||in2 concat/truncation tested. Differential-tested vs the REAL compiled hash_intmd5.c (#include harness, which itself #includes md5.c; shared fixture md5-c-vectors.txt HDR/HSH lines): HSH_GetHashId (MD5/MD5_NONCRYPTO -> 0, others -> None) and HSH_Hash's MD5(in1||in2) concatenation across the 56/64-byte block boundary + the out_len truncation capped at 16 (out_len 0 -> ret 0, >16 -> 16) (≈11 Rust fn in mapped modules)
• hash_gnutls.c — gnutls hash backend ported as trait-injected wrappers: HSH_GetHashId, HSH_Hash, HSH_Finalise compose the ported hash-name resolution from util.c; the gnutls library call is injected. (≈4 Rust fn in mapped modules)
• hash_nettle.c — nettle hash backend ported as trait-injected wrappers: HSH_GetHashId, HSH_Hash, HSH_Finalise; the nettle hash call is injected. (≈4 Rust fn in mapped modules)
• hash_nss.c — NSS hash backend ported as trait-injected wrappers: HSH_GetHashId, HSH_Hash, HSH_Finalise; the NSS PK11_HashBuf call is injected. (≈3 Rust fn in mapped modules)
• hash_tomcrypt.c — libtomcrypt hash backend ported as trait-injected wrappers: HSH_GetHashId, HSH_Hash, HSH_Finalise; the tomcrypt hash call is injected. (≈3 Rust fn in mapped modules)
• cmac_gnutls.c — gnutls CMAC backend ported: CMC_GetKeyLength (algorithm name -> 16/32/0), CMC_CreateInstance, CMC_Hash, CMC_DestroyInstance, init_gnutls, deinit_gnutls, get_mac_algorithm -- all host-boundary wrappers over injected gnutls calls. (≈9 Rust fn in mapped modules)
• cmac_nettle.c — complete port of all 4 functions: keyed AES-128/AES-256 CMAC instance, key-length table, truncating CMC_Hash; reuses the shared CMAC-128 from siv_nettle_int over a new FIPS-197 AES-256. Anchored by THREE oracles: RFC 4493 (AES-128-CMAC), NIST SP 800-38B (AES-256-CMAC), and the REAL compiled cmac_nettle.c over a vector-verified shim (≈12 Rust fn in mapped modules)
• nts_ke_client.c — the pure message logic is ported (nts_ke_record.rs): prepare_request (the critical Next-Protocol NTPv4 + AEAD-algorithm-list request, terminated by End-of-Message) and process_response (parse the server records into next-protocol/AEAD/cookies/server-name/port, with the error/warning, unsupported-AEAD, wrong-next-protocol, bad-cookie-length skip, non-printable-server-name, and unknown-critical rejections, and the final ok gate: no error + >=1 cookie + NTPv4 + an AEAD). Differential-tested vs a verbatim copy of prepare_request/process_response composing the ported record codec through the EOM-hiding NKSN_GetRecord (fixture nts_ke-protocol-c-vectors.txt). The TLS session, DNS resolution, retry/timeout scheduling, and NKC_GetNtsData are the host boundary (≈41 Rust fn in mapped modules)
• nts_ke_server.c — the pure message logic is ported (nts_ke_record.rs): process_request (parse the client's Next-Protocol/AEAD records, select the first supported AEAD, and validate the shape -- exactly one non-empty next-protocol record, and one non-empty AEAD record when NTPv4 is offered -- mapping malformed/error/warning/cookie/unknown-critical records to the NKE_ERROR_* codes) and prepare_response's record structure (the error / bare-next-protocol / next-protocol+empty-AEAD / full-success branches, the latter emitting Next-Protocol + AEAD + optional port/server negotiation + the cookies). Differential-tested vs a verbatim copy of process_request/prepare_response composing the ported record codec (fixture nts_ke-protocol-c-vectors.txt). Plus the cookie codec (nts_ke_cookie.rs): NKS_GenerateCookie/NKS_DecodeCookie -- the encrypted-cookie framing [key_id BE | nonce | SIV(c2s||s2c)] that keeps the server stateless, composing the ported AES-SIV (siv_nettle) as the injected Siv trait. The framing (byte layout, the c2s/s2c length validation, the key_id % MAX_SERVER_KEYS lookup with id verify, the cookie-length gates, and the key-length->AEAD-algorithm mapping 16->GCM-SIV / 32->CMAC-256) is differential-tested vs verbatim copies of the two functions with a deterministic mock cipher identical on both sides (fixture nts_ke-cookie-c-vectors.txt: generate byte layout, valid decode round-trip, unknown-key/too-short/tampered-tag/odd-plaintext rejections), and a separate test round-trips a cookie through the GENUINE ported AES-SIV-CMAC-256 (recovering c2s/s2c + the inferred algorithm, and rejecting a tampered ciphertext on the real tag check). The CSPRNG nonce, TLS key export (NKSN_GetKeys), the helper process, and socket I/O remain the host boundary (the chosen key, nonce, and pre-generated cookies are injected). Plus the server-key persistence codec (nts_ke_keydump.rs): save_keys/load_keys -- the NKS1/NKS0 ntskeys dump format that keeps issued cookies valid across a restart. The pure serialization (the text layout, the rotation write order (current+i+1+FUTURE_KEYS)%MAX, the %08X id + hex key + algorithm columns) and every load validation (identifier, per-line word counts, the unsigned consecutive-id-mod-MAX check, key_length>0, and the hex-decodes-to-exactly-key_length gate) are differential-tested vs verbatim copies of save_keys/load_keys driven over in-memory open_memstream/fmemopen (fixture nts_ke-keydump-c-vectors.txt: save layout, NKS1+NKS0 valid loads, and the bad-identifier/wrong-word-count/too-few-keys/non-consecutive/wrong-key-length/non-hex-id rejections), plus a save->load round-trip; composes the ported bytes_to_hex/hex_to_bytes/split_string. The dump-dir/rotation-disabled short-circuits and the file open/rename are the caller's (≈60 Rust fn in mapped modules)
• nts_ke_session.c — the RFC 8915 §4 record codec is ported (nts_ke_record.rs): the Message buffer + reset_message/add_record/reset_message_parsing/get_record/check_message_format -- the TLV framing that carries next-protocol/AEAD/cookie/NTPv4-negotiation records terminated by a critical End-of-Message. Differential-tested vs verbatim copies of the nts_ke_session.c function bodies (real htons/ntohs/memcpy/MIN; fixture nts_ke-record-c-vectors.txt): add_record framing (critical-bit in the type word, body append, type-range + buffer-overflow rejection), get_record (sequential parse, body copy truncated to MIN(buffer_length, body_length), header/record bounds, dangling-trailer rejection), and check_message_format's whole-message validation (complete-on-EOM, incomplete-iff-not-eof, and the malformed-EOM rejections: non-critical / non-empty / repeated). The outgoing-message builders NKSN_BeginMessage/NKSN_AddRecord/NKSN_EndMessage are also ported (begin_message/add_message_record/end_message) -- the session's new_message/complete state plus the critical empty End-of-Message terminator EndMessage appends -- tested by composing over the C-verified add_record/get_record/check_message_format (byte-exact framing, complete-on-end, round-trip, and the terminator-overflow failure). NKSN_GetRecord (the read side that hides the EOM terminator so message loops stop there) is also ported. The gnutls TLS handshake, ALPN, certificate credentials, the KE state machine, socket I/O, and NKSN_GetKeys (the TLS exporter) remain the host boundary (≈41 Rust fn in mapped modules)
• nts_ntp_auth.c — complete port of all 4 functions: build/parse the NTS auth-and-EEF field (header, nonce+ciphertext layout, 4-byte padding, min-length/min-nonce padding) over the ported ntp_ext layer, with SIV injected; differential-tested vs the REAL compiled nts_ntp_auth.c (identical packet bytes + round-trip, deterministic toy SIV) + independent padding/round-trip checks (≈8 Rust fn in mapped modules)
• nts_ntp_client.c — complete port of all 17 functions: NTS-KE-driven cookie pool (ring buffer), per-request EFs (unique-id/cookie/placeholders) + authenticator under C2S, response verify/decrypt under S2C + cookie extraction, NTS-KE retry/backoff, and keys+cookies dump save/load; composes the ported ntp_ext + nts_ntp_auth + siv (real AES-SIV-CMAC), with the NTS-KE handshake / source-update / mono-clock / config injected. Differential-tested vs the REAL compiled nts_ntp_client.c (byte-identical request + check + report) + a cookie dump round-trip (≈35 Rust fn in mapped modules)
• nts_ntp_server.c — complete port of all 4 functions: parse NTS request EFs (unique-id/cookie/placeholder/auth), decode cookie -> session keys, key SIV with C2S + verify/decrypt the authenticator, prepare fresh cookies, and build the S2C-authenticated response; composes the ported ntp_ext + nts_ntp_auth + siv (real AES-SIV-CMAC), with the cookie codec injected. Differential-tested vs the REAL compiled nts_ntp_server.c (byte-identical response + tamper/missing-cookie rejection) + a full round-trip (≈15 Rust fn in mapped modules)
• siv_gnutls.c — gnutls SIV-AEAD backend ported: SIV_GetKeyLength/MinNonceLength/MaxNonceLength/TagLength, SIV_CreateInstance/SetKey/Encrypt/Decrypt/DestroyInstance, init_gnutls/deinit_gnutls/get_cipher_algorithm -- all host-boundary wrappers over injected gnutls calls. The key/nonce/tag length table, cipher algorithm mapping, and encrypt/decrypt framing are ported logic. (≈15 Rust fn in mapped modules)
• siv_nettle.c — complete port of all 9 functions (no-GCM build): keyed AEAD instance, key/nonce/tag length table, input validation, encrypt/decrypt dispatch over the ported siv_nettle_int (AES-SIV-CMAC-256); GCM-SIV unsupported as that build is; also bridges nts_ntp_auth's SIV so the NTS auth EF round-trips over real AES-SIV. Differential-tested vs the REAL compiled siv_nettle.c (API + validation) — the crypto itself is triple-anchored in siv_nettle_int (≈13 Rust fn in mapped modules)
• siv_nettle_int.c — complete port of all 12 functions: CMAC-128 (RFC 4493), S2V, and SIV encrypt/decrypt; the AES-128 block cipher (nettle's) is reimplemented in dependency-free Rust (FIPS-197 KAT). Anchored by THREE oracles: FIPS-197 (AES), RFC 5297 A.1 (the official worked example), and the REAL compiled siv_nettle_int.c over a FIPS-197-verified shim AES (many-shape encrypt/decrypt vectors) (≈24 Rust fn in mapped modules)
• refclock.c — complete port of the refclock framework (28 functions, including the RCL_SetDriverData/RCL_GetDriverData trait accessors): sample/pulse offset computation, PPS-interval folding, lock-reference alignment, pulse-edge + time-offset sanity gates, TAI->UTC conversion, pps_stratum, the poll loop, local-mode follow, and the slew/dispersion handlers. Unblocked by reference.c (file 32); composes the ported samplefilt + regress + local + sched, with SPF_/SRC_/REF_/LCL_/SCH_ and the platform driver injected via one RefclockHost trait. The sample/pulse core (RCL_AddSample/AddPulse/AddCookedPulse + pps_stratum/valid_sample_time/convert_tai_offset) is differential-tested vs the REAL compiled refclock.c (+ array.c, memory.c): byte-identical offset+dispersion handed to the filter and accept/reject decisions; driver-option parsing + refid derivation unit-tested (≈60 Rust fn in mapped modules)
• refclock_shm.c — complete port of all 3 functions: shm_poll's sample extraction (mode 0/1 validity gates incl. the mode-1 concurrent-writer count-stability check, the valid flag, clearing valid, and the nanosecond-vs-microsecond timestamp selection + normalisation) feeding the refclock framework's RCL_AddSample, plus shm_initialise's unit-key (SHMKEY + unit) and octal perm parsing. The shared-memory segment (shmget/shmat) is the injected ShmSource; composes the ported refclock.rs. Differential-tested vs the REAL compiled refclock_shm.c (RCL_SHM_driver.poll over a controlled shmTime: byte-identical receive/clock/leap + accept/reject, valid cleared on accept); the writer race and key/perm parsing unit-tested (≈7 Rust fn in mapped modules)
• refclock_sock.c — complete port of read_sample (the sample logic): the datagram length check, the 'SOCK' magic gate, the timeval->timespec conversion + normalisation, the time-offset sanity gate, and the pulse-vs-sample routing (RCL_AddPulse vs RCL_AddSample(sys, sys+offset, leap)); composes the ported refclock.rs. The datagram socket open + file-handler registration (sock_initialise/sock_finalise) is the injected host transport, and read_sample takes the received bytes and returns the framework call. Differential-tested vs the REAL compiled refclock_sock.c: byte-identical sock_sample datagrams (C struct layout) fed to the real read_sample, matching the sample/pulse routing + every timestamp, with magic/length/sanity rejections; short-datagram and insane-offset gates also unit-tested (≈4 Rust fn in mapped modules)
• rtc.c — complete port of all 9 functions: the driver-load decision tree, lifecycle/measurement forwarding, and the drift-file time restore (step the clock to the drift file's mtime if behind); the platform RTC driver is the injected RtcDriver trait and the clock/step/driftfile-mtime are injected. Differential-tested vs the REAL compiled rtc.c (-DLINUX -DFEAT_RTC): pre-init ok / pre-init fail->drift step / rtcfile+rtcsync fatal, with the forwarded call log + return codes matched (≈17 Rust fn in mapped modules)
• rtc_linux.c — the RTC drift-regression core is ported (rtc_linux.rs): the (rtc,system) sample ring + robust line fit chrony uses to model and trim the RTC. accumulate_sample (the MAX_SAMPLES=64 ring with the drop-oldest-to-index-4 refill and the RTC-stepped-back full reset, most-recent sample as reference), discard_samples (the leading-drop memmove), run_regression (build the rtc-relative time + RTC-fast-of-system offset arrays and fit them, storing intercept/slope + discarding the fit's rejected leading run) composing the ported RGR_FindBestRobustRegression, and slew_samples (project stored sample timestamps + adjust the coefficients on a clock slew, drop all on an unknown step) composing the ported UTI_AdjustTimespec. Differential-tested vs verbatim copies of the four functions linked against the REAL compiled regress.c (fixture rtc_linux-c-vectors.txt: a 10-sample drift run with per-sample regression, the coefficient slew + unknown-step drop, the ring-overflow discard past 64 samples, and the stepped-back reset). The /dev/rtc ioctls, the trim/relock state machine (handle_initial_trim/maybe_autotrim/set_rtc), and the scheduler are the host boundary. Also the file-format codecs: write_coefs_to_file's serialization (%1d %.0f %.6f %.3f, rate->ppm), read_coefs_from_file's sscanf(%d%lf%lf%lf) parse, and read_hwclock_file's third-line LOCAL/UTC detection -- differential-tested vs verbatim copies using real printf/sscanf/fmemopen (fixture rtc_linux-file-c-vectors.txt: coefficient round-trips incl. the %.6f/%.3f rounding edges, short/garbage/trailing-token parse cases, and the UTC/LOCAL/too-few-lines hwclock cases). The coefficient/hwclock file open/rename and the timezone-dependent t_from_rtc/rtc_from_t (mktime/gmtime) stay the host boundary (≈28 Rust fn in mapped modules)
• hwclock.c — complete port of all 7 functions; composes the ported quantile delay filter + robust regression over Vec sample buffers; cook/precision/abs-freq injected. HCL_AccumulateSample + HCL_CookTime are now differential-tested end-to-end vs the REAL compiled hwclock.c + regress.c (#include harness, -ffp-contract=off) over 4 multi-step runs (a clean 8-sample fit, the same with a 10ppm abs-freq, a 3-sample short run, and a backwards-hw-step reset): n_samples, valid_coefs, and the reset/drop-sample bookkeeping match exactly; the fitted offset/frequency (composing the robust regression) match exactly for meaningful values and to ~1 ULP where the fit sits at the near-zero noise floor -- the residual is FP summation-order in the regression's iterative runs-test loop, not a logic difference. The cooked time passes through chrony's ns-granular timespec (declared f64-seconds boundary), compared within a nanosecond (≈13 Rust fn in mapped modules)
• sys.c — OS adapter dispatch layer ported as trait-injected wrappers: SYS_Initialise, SYS_Finalise, SYS_DropRoot, SYS_EnableSystemCallFilter, SYS_LockMemory, SYS_SetScheduler -- all host-boundary operations injected as closures. (≈7 Rust fn in mapped modules)
• sys_generic.c — complete port of all 14 functions: the offset->frequency slew model (bounded rate/duration, excess-duration tracking, offset_convert, dispersion on frequency change), with base driver/raw clock/scheduler/step injected; differential-tested vs the REAL compiled sys_generic.c (set_frequency/accrue_offset/end-of-slew sequence) + an independent slew-drain check (≈31 Rust fn in mapped modules)
• sys_linux.c — the tick/frequency-discipline arithmetic is ported (sys_linux.rs) -- chrony splits a requested ppm across the coarse adjtimex tick (whole USER_HZ steps) and the fine freq (the residual). Ported: kernelvercmp, guess_hz (estimate USER_HZ from the kernel tick, 100 or a power of two within the +/-1/3 bounds), get_version_specific_details' pure core (nominal_tick = (1e6+hz/2)/hz, max_tick_bias, the kernel-version-gated tick_update_hz {100000 / 2 in [2.6.27,2.6.33) / 100 pre-4.19} and have_setoffset >= 2.6.39, with the <2.2.0 fatal as None), set_frequency's split (round ppm/dhz to whole tick steps, the hz<=250 anti-thrash hysteresis that sticks to an adjacent current tick, and the residual freq + tick), and the shared reconstruction dhz*delta_tick - kernel_freq/FREQ_SCALE (FREQ_SCALE=2^16) used by set_frequency's return and read_frequency. Differential-tested vs verbatim copies of the five functions (fixture sys_linux-arith-c-vectors.txt: version compares, hz guesses incl. the no-fit fatal, version-detail derivations across the kernel-era boundaries, the frequency split incl. the hysteresis snap at hz=100/250 and the no-hysteresis hz=1000 path, and the reconstruction), plus a set/read round-trip through an identity adjtimex. The adjtimex syscall (SYS_Timex_Adjust), the sysconf/uname probes (get_hz/get_kernel_version), PHC/seccomp/drop-root, and the LOG_FATAL exits are the host boundary (hz + kernel version are inputs, the syscall an injected closure) (≈17 Rust fn in mapped modules)
• sys_timex.c — complete port of all 10 functions (Linux build): ppm<->kernel-freq scaling, sync-status/leap/TAI status bookkeeping over the struct timex ABI, composing the generic slew driver; the adjtimex syscall is injected; differential-tested vs the REAL compiled sys_timex.c (every submitted timex captured) + an independent scaling check (≈13 Rust fn in mapped modules)
• sys_null.c — complete port of all 8 functions; the virtual-clock offset/frequency model (set_freq/accrue/offset_convert); raw time injected as seconds, driver-as-struct (no global LCL registration). Differential-tested vs the REAL compiled sys_null.c (#include harness, LCL_ReadRawTime + lcl_RegisterSystemDrivers stubbed, UTI_DiffTimespecsToDouble verbatim; fixture sys_null-c-vectors.txt) over the full driver op sequence -- init, read/set frequency (with the update_offset banking of the old frequency's accrued offset), accrue_offset, apply_step_offset, and offset_convert across BOTH the <MIN_UPDATE_INTERVAL instantaneous path and the >MIN_UPDATE_INTERVAL flush path -- matching the returned frequency/correction/error and the internal freq/offset_register/last_update after every op. Raw times are driven at exactly-representable fractions (0/0.5 s) so chrony's ns-timespec diff equals the f64-seconds subtraction to the bit, collapsing the documented timespec/f64 modeling boundary to exact parity for these inputs (≈12 Rust fn in mapped modules)
• sys_netbsd.c — NetBSD clock adapter ported: SYS_NetBSD_Initialise, SYS_NetBSD_Finalise, accrue_offset, get_offset_correction -- host-boundary syscall wrappers. (≈5 Rust fn in mapped modules)
• sys_solaris.c — Solaris clock adapter ported: SYS_Solaris_Initialise, SYS_Solaris_Finalise, set_dosynctodr -- host-boundary syscall wrappers. (≈4 Rust fn in mapped modules)
• socket.c — the IPSockAddr <-> struct sockaddr marshalling is ported (socket.rs): SCK_IPSockAddrToSockaddr serializes an address+port into a struct sockaddr_in / sockaddr_in6 (family + network-order port + address, zero-filled), and SCK_SockaddrToIPSockAddr parses one back, with the family/length gates (unknown family or a too-short sa_length -> IPADDR_UNSPEC). Differential-tested vs verbatim copies compiled against the REAL OS struct sockaddr_in/in6 (fixture socket-sockaddr-c-vectors.txt): IPv4/IPv6 serialization byte-for-byte, the unspecified-family and too-short-buffer rejects, and the parse round-trip incl. the AF_UNIX/too-short -> UNSPEC cases; the ABI constants (AF_INET=2, AF_INET6=10, sizeof sockaddr_in=16 / in6=28) are pinned against the compiled sizes. The little-endian Linux sockaddr ABI is the modeling boundary (sa_family is a native u16). Plus the pure address utilities: domain_to_string (AF_* label), SCK_GetAnyLocalIPAddress / SCK_GetLoopbackIPAddress (the wildcard 0.0.0.0/:: and loopback 127.0.0.1/::1 for a family), is_any_address (composing the ported UTI_CompareIPs), and SCK_IsLinkLocalIPAddress (IPv4 169.254.0.0/16 and IPv6 fe80::/10) -- differential-tested vs verbatim copies using the real OS INADDR_/in6addr_ constants (fixture socket-addrutil-c-vectors.txt), with AF_INET/AF_INET6/AF_UNIX/AF_UNSPEC pinned against the headers. Plus process_header's ancillary-data (cmsg) parser: parse_control_data walks a received control buffer's cmsghdr chain (the Linux CMSG_* ABI -- 16-byte header, 8-byte alignment, CMSG_NXTHDR bounds) and extracts the destination address (IP_PKTINFO / IPV6_PKTINFO), interface index, layer-2 length (SCM_TIMESTAMPING_PKTINFO), and the kernel/hardware timestamps (SCM_TIMESTAMPING ts[0]/ts[2], SCM_TIMESTAMP timeval). Differential-tested vs a verbatim copy of the cmsg loop compiled against the REAL Linux CMSG_* macros + in_pktinfo/scm_timestamping/scm_ts_pktinfo structs (fixture socket-cmsg-c-vectors.txt: each cmsg type, a two-cmsg buffer, an unknown/ignored cmsg, and an empty buffer), with the cmsg level/type constants and struct sizes pinned. The transmit side is the exact inverse: SCK_InitMessage (with init_message_addresses/init_message_nonaddress) initialises an SckMessage's address fields per SCK_AddressType and its non-address fields to chrony's sentinels (INVALID_IF_INDEX=-1, zeroed timestamps, INVALID_SOCK_FD=-4); add_control_message is the cmsg encoder (write cmsghdr level/type/CMSG_LEN, zero CMSG_SPACE, manual non-CMSG_NXTHDR advance, overflow -> None); and build_pktinfo_control reproduces send_message's local-address control assembly (IP_PKTINFO with htonl(spec_dst)+ifindex / IPV6_PKTINFO with the 16 addr bytes+ifindex). Differential-tested byte-for-byte vs a verbatim add_control_message + send_message PKTINFO build compiled against the REAL CMSG_* macros and in_pktinfo/in6_pktinfo (fixture socket-control-msg-c-vectors.txt), with CMSG_SPACE(12)=32 / CMSG_SPACE(20)=40 pinned. The two open/recv flag maps get_open_flags (supported_socket_flags with SOCK_NONBLOCK cleared on SCK_FLAG_BLOCK) and get_recv_flags (SCK_FLAG_MSG_ERRQUEUE -> MSG_ERRQUEUE) are ported with the probed supported-flags as an explicit input. The SCM_RIGHTS fd-passing and IP_RECVERR error-queue validation remain boundaries. The UDP syscall path itself is now implemented for real in the chrony-rs-io crate (a faithful port that makes the actual socket/bind/connect/sendmsg/recvmsg/setsockopt/getsockopt/close syscalls, reproducing chrony's exact option and flag sequence): SCK_PreInitialise (LISTEN_FDS window), SCK_Initialise (family enable + SOCK_CLOEXEC/NONBLOCK capability probe via check_socket_flag), SCK_Finalise, SCK_IsIpFamilyEnabled, SCK_IsReusable, open_socket/open_ip_socket/SCK_OpenUdpSocket (the full open sequence: socket + get_open_flags, set_socket_flags/set_socket_nonblock, set_socket_options SO_BROADCAST, set_ip_options IPV6_V6ONLY+IP_PKTINFO/IPV6_RECVPKTINFO, bind_ip_address SO_REUSEADDR/REUSEPORT/IP_FREEBIND+bind, connect_ip_address with EINPROGRESS), SCK_SetIntOption/SCK_GetIntOption, SCK_Send/SCK_Receive, SCK_SendMessage/send_message (sendmsg with the remote sockaddr + the tested build_pktinfo_control cmsg), SCK_ReceiveMessage (recvmsg + the tested parse_control_data + sockaddr_to_ip_sockaddr for the source), SCK_CloseSocket, and handle_recv_error (SO_ERROR clear to avoid a select() busy-loop). Because syscalls cannot be differential-unit-tested against C, this layer is verified by KERNEL-INTEGRATION tests on real loopback sockets (crates/chrony-rs-io/tests/udp.rs): the full open->bind->connect->send->recv datagram round-trip, an SCK_SendMessage whose IP_PKTINFO destination address and source are recovered on receipt, SO_REUSEADDR/SO_BROADCAST set-and-read-back, v6-refused-when-disabled family gating, and the SO_ERROR recv-error path. The systemd LISTEN_FDS reusable-socket pool, TCP and Unix-domain sockets, recvmmsg batching, the Linux HW/SW TX-timestamp control messages, SO_BINDTODEVICE (needs CAP_NET_RAW), and the privops privileged bind remain host boundaries not yet credited (≈28 Rust fn in mapped modules)
• addrfilt.c — complete port of all 16 functions (ADF_DestroyTable = Drop). Now differential-tested vs the REAL compiled addrfilt.c (+ util.c) over four scenarios -- subnet allow, allow-all-then-overlapping deny/allow, deny_all pruning of finer rules, and IPv6 allow/deny -- with a 15-address battery: byte-identical ADF_IsAllowed decisions + ADF_IsAnyAllowed per family + the out-of-range (/33, /129) BadSubnet rejection (upgraded from the earlier live-witnessed-vs-chronyc accheck evidence) (≈30 Rust fn in mapped modules)
• nameserv.c — complete port of all 4 functions: DNS_Name2IPAddress (the IP-literal shortcut + family filtering + IPv4 host-order extraction + IPv6 scope-id skip + result-array fill + Success/TryAgain/Failure status mapping), DNS_IPAddress2Name (reverse with IP-string fallback + snprintf truncation check), DNS_SetAddressFamily, DNS_Reload; the getaddrinfo/getnameinfo/res_init resolver and the util IP literal-parse/format are the injected Resolver boundary. Differential-tested vs the REAL compiled nameserv.c with getaddrinfo overridden to a crafted addrinfo list (family filter / v4 extraction / v6 scope skip / max_addrs / status, byte-identical); literal shortcut + reverse fallback unit-tested. A separate name_to_ip convenience keeps the live system-resolver path used by cmdparse (witnessed vs chronyc accheck) (≈12 Rust fn in mapped modules)
• clientlog.c — complete port of all 35 functions: per-client hash table with oldest-record eviction, per-service token-bucket rate limiter with probabilistic leak, log2 request-rate estimate (incl. NTP timeout-rate inversion), and the interleaved-mode RX->TX timestamp map; differential-tested vs the REAL compiled clientlog.c (165-line vector fixture, injected reproducible RNG) + an independent token-bucket invariant (≈49 Rust fn in mapped modules)
• manual.c — complete port of all 11 functions; sample store + robust-regression slew/frequency estimate (uses the verified regress); time as seconds, REF correction returned not applied, struct-as-handler. MNL_AcceptTimestamp's estimate is differential-tested vs the REAL compiled manual.c + regress.c (#include harness, -ffp-contract=off) over a 6-timestamp drift sequence: new_afreq (the injected abs-freq) is exact; reg_offset (the regression intercept) and dfreq_ppm match within the time-domain envelope (~1e-7 s / ~0.1 ppm) -- chrony derives each sample offset from an ns-granular timespec (now - ts) while chrony-rs uses f64 seconds, and the robust fit amplifies that sub-ns input difference (isolated-probe-confirmed the regression itself agrees; the divergence is purely the timestamp quantization) (≈18 Rust fn in mapped modules)

What "partial"/"scaffold" deliberately does not mean

A counterpart is not a claim of equivalence. It means some behavior from that C file is reconstructed and admitted by a court in reports/. Everything outside the admitted courts is unported. Where a file is subsumed by the Rust standard library (memory.c) or is upstream test scaffolding (stubs.c), that is noted rather than counted as coverage.