diff --git a/.github/workflows/actionlint.yml b/.github/workflows/actionlint.yml
index 8d30e4096..16a71cb9d 100644
--- a/.github/workflows/actionlint.yml
+++ b/.github/workflows/actionlint.yml
@@ -4,12 +4,6 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
   cancel-in-progress: true
 
-# Static-check the workflow YAML with rhysd/actionlint.  Catches missing
-# secrets, bad expressions, expression-type errors, unsupported runner
-# images, and (via embedded shellcheck) common pitfalls in `run:` scripts.
-# Trigger only on changes under .github/workflows/ so the rest of the
-# matrix isn't billed when nothing here moves.
-
 on:
   push:
     branches: [ master ]
@@ -30,16 +24,20 @@ permissions:
 jobs:
   actionlint:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     name: actionlint
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
       - name: install actionlint
-        # Pin a version so this job is reproducible; bump deliberately.
-        # The download script verifies a SHA256 of the release tarball.
         run: |
-          bash <(curl --proto '=https' --tlsv1.2 -fsSL \
-              https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash) \
-              1.7.12
+          archive=actionlint_1.7.12_linux_amd64.tar.gz
+          curl --proto '=https' --tlsv1.2 -fsSLO \
+            "https://github.com/rhysd/actionlint/releases/download/v1.7.12/$archive"
+          echo "8aca8db96f1b94770f1b0d72b6dddcb1ebb8123cb3712530b08cc387b349a3d8  $archive" \
+            | sha256sum --check --strict
+          tar -xzf "$archive" actionlint
           echo "$PWD" >>"$GITHUB_PATH"
       - name: actionlint --version
         run: actionlint -version
diff --git a/.github/workflows/almalinux-8-build.yml b/.github/workflows/almalinux-8-build.yml
index 8eb4598c3..d7ec965cd 100644
--- a/.github/workflows/almalinux-8-build.yml
+++ b/.github/workflows/almalinux-8-build.yml
@@ -4,12 +4,6 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
   cancel-in-progress: true
 
-# Older-LTS coverage on the Fedora/RHEL family to help with backporting
-# security fixes. AlmaLinux 8 is the RHEL 8 rebuild and is the oldest
-# active LTS in this family (RHEL 8 full support runs to 2029).
-# GitHub Actions has no native runner for this family, so the job runs
-# inside an almalinux:8 container hosted on ubuntu-latest.
-
 on:
   push:
     branches: [ master ]
@@ -24,26 +18,26 @@ on:
   schedule:
     - cron: '42 8 * * *'
 
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ubuntu-latest
+    timeout-minutes: 45
     container:
       image: almalinux:8
     name: Test rsync on AlmaLinux 8
     steps:
     - name: install git
-      # actions/checkout needs git in the container before the checkout step.
       run: dnf -y install git
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       with:
         fetch-depth: 0
+        persist-credentials: false
     - name: prep
-      # PowerTools is needed for libzstd-devel etc; xxhash and lz4 dev
-      # headers live in EPEL on RHEL 8. The default python3 on RHEL 8
-      # is 3.6, which is too old for runtests.py (uses capture_output=
-      # / text= introduced in 3.7), so install python39 and point
-      # /usr/bin/python3 at it.
       run: |
+        # RHEL 8's default Python is too old for the test runner
         dnf -y install epel-release
         dnf config-manager --set-enabled powertools
         dnf -y install gcc gcc-c++ make autoconf automake m4 \
@@ -63,18 +57,13 @@ jobs:
     - name: info
       run: ./rsync --version
     - name: check
-      # In the container we already run as root, so no sudo. The
-      # crtimes-not-supported skip matches the other Linux jobs;
-      # daemon-chroot-acl and proxy-response-line-too-long skip because
-      # the default (secure) transport opens no listening socket.
-      run: RSYNC_EXPECT_SKIPPED=@testsuite/skiplist/common.txt,@testsuite/skiplist/linux.txt make check
+      run: RSYNC_TEST_PROFILES=pipe,non-asan,root,self-peer,linux,no-zstd-threads make check
     - name: check (TCP daemon transport)
-      # Second run exercising the real loopback-TCP daemon path.
-      run: ./runtests.py --rsync-bin="$PWD/rsync" --use-tcp -j 8
+      run: RSYNC_TEST_PROFILES=non-asan,root,self-peer,linux,no-zstd-threads ./testsuite/runtests.py --rsync-bin="$PWD/rsync" --use-tcp --daemon-tests-only -j 8
     - name: ssl file list
       run: ./rsync-ssl --no-motd download.samba.org::rsyncftp/ || true
     - name: save artifact
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       with:
         retention-days: 45
         name: almalinux-8-bin
diff --git a/.github/workflows/android-static-build.yml b/.github/workflows/android-static-build.yml
index 14593a6dc..dc37aa60d 100644
--- a/.github/workflows/android-static-build.yml
+++ b/.github/workflows/android-static-build.yml
@@ -4,15 +4,6 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
   cancel-in-progress: true
 
-# Cross-compiles statically-linked rsync binaries with the Android NDK,
-# suitable for dropping onto a phone (adb push / Termux) with no shared
-# libraries. arm64-v8a covers all modern phones; armeabi-v7a covers older
-# 32-bit devices. The binaries are uploaded as workflow artifacts.
-#
-# These are cross-compiled, so the test suite can't run here; we sanity
-# check that each binary is the right architecture, is static, and that
-# it executes (`--version`) under qemu-user.
-
 on:
   push:
     branches: [ master ]
@@ -28,14 +19,16 @@ on:
     - cron: '42 8 * * 1'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 env:
-  # Minimum supported API level. 24 (Android 7.0) runs on every modern
-  # phone while keeping broad reach; bump if you need newer Bionic APIs.
   ANDROID_API: 24
 
 jobs:
   build:
     runs-on: ubuntu-latest
+    timeout-minutes: 45
     name: ${{ matrix.abi }}
     strategy:
       fail-fast: false
@@ -48,9 +41,10 @@ jobs:
             triple: armv7a-linux-androideabi
             qemu: qemu-arm-static
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Install build prerequisites
         run: sudo apt-get update && sudo apt-get install -y autoconf automake gawk qemu-user-static
@@ -65,19 +59,12 @@ jobs:
           export AR="$TC/llvm-ar" RANLIB="$TC/llvm-ranlib" STRIP="$TC/llvm-strip"
           export CFLAGS="-O2" LDFLAGS="-static"
 
-          # Bionic doesn't declare lchmod()/lutimes() until API 36, but the
-          # symbols link, so configure mis-detects them -- force them off so
-          # rsync uses its fallbacks. The other cache vars restore values
-          # that configure can't probe when cross-compiling (Android runs a
-          # normal Linux kernel, so these match the native Linux result).
+          # Bionic hides lchmod and lutimes before API 36; cross-builds cannot run probes
           export ac_cv_func_lchmod=no ac_cv_func_lutimes=no \
                  rsync_cv_HAVE_SOCKETPAIR=yes \
                  rsync_cv_MKNOD_CREATES_FIFOS=yes \
                  rsync_cv_MKNOD_CREATES_SOCKETS=yes
 
-          # Self-contained build: drop optional external libraries so the
-          # static binary needs nothing at runtime. rsync keeps md5/md4
-          # checksums and its bundled zlib.
           ./configure --host=${{ matrix.triple }} --build=x86_64-pc-linux-gnu \
             --enable-ipv6 \
             --disable-zstd --disable-lz4 --disable-xxhash --disable-openssl --disable-idn \
@@ -86,8 +73,7 @@ jobs:
             --disable-md2man --disable-roll-simd \
             --with-included-popt --with-included-zlib
 
-          # Generate the awk-built headers serially first so the parallel
-          # build can't race on proto.h <- daemon-parm.h.
+          # Generate shared headers before the parallel build
           make proto.h
           make -j"$(nproc)" rsync
           "$STRIP" rsync
@@ -97,12 +83,10 @@ jobs:
         run: |
           set -euo pipefail
           file rsync
-          # Gate: must be a statically-linked executable (no interpreter).
           file rsync | grep -q "statically linked"
           if file rsync | grep -q "dynamically linked"; then
             echo "ERROR: binary is not static" >&2; exit 1
           fi
-          # Best-effort: confirm it actually runs under qemu-user.
           ${{ matrix.qemu }} ./rsync --version | head -3 || \
             echo "WARNING: qemu smoke test did not run cleanly (check on a real device)"
 
@@ -118,7 +102,7 @@ jobs:
           echo "ARTIFACT_NAME=rsync-android-${{ matrix.abi }}" >>"$GITHUB_ENV"
 
       - name: Upload artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           retention-days: 45
           name: ${{ env.ARTIFACT_NAME }}
diff --git a/.github/workflows/asan-build.yml b/.github/workflows/asan-build.yml
index 246a31f9d..acde5752d 100644
--- a/.github/workflows/asan-build.yml
+++ b/.github/workflows/asan-build.yml
@@ -16,61 +16,50 @@ on:
       - '.github/workflows/*.yml'
       - '!.github/workflows/asan-build.yml'
   schedule:
-    # Weekly (Mon 09:42 UTC): catch breakage from a moving ubuntu-latest/clang
-    # toolchain (a new clang can add a UBSan check, or change ASan behaviour)
-    # that no code push would otherwise trigger.  Push/PR already gate every
-    # code change, so daily would just re-run an unchanged tree.
     - cron: '42 9 * * 1'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   asan:
     runs-on: ubuntu-latest
+    timeout-minutes: 45
     name: rsync ASan+UBSan (clang)
     env:
-      # rsync intentionally leaks small allocations at process exit, so leak
-      # detection would be all noise; chase only memory-safety errors.
+      # Process-exit leaks are intentional; memory errors remain fatal
       ASAN_OPTIONS: detect_leaks=0:abort_on_error=1
-      # UBSan is a gate: -fno-sanitize-recover=undefined (below) aborts on the
-      # first finding and halt_on_error=1 makes that fatal, so any undefined
-      # behaviour fails the run.  This needs the tree to be UBSan-clean: the
-      # remaining findings are fixed in code (hashtable/mdfour shifts, xattrs,
-      # and log.c's file_struct, kept aligned via rounding.h); only byteorder.h's
-      # intentional unaligned accessors are suppressed, with no_sanitize.
       UBSAN_OPTIONS: print_stacktrace=1:halt_on_error=1
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       with:
         fetch-depth: 0
+        persist-credentials: false
     - name: prep
       run: |
         sudo apt-get update
         sudo apt-get install -y clang acl libacl1-dev attr libattr1-dev liblz4-dev libzstd-dev libxxhash-dev libidn2-dev openssl
         echo "/usr/local/bin" >>"$GITHUB_PATH"
     - name: configure
-      # -DNDEBUG builds as a shipped release does (assert() compiled out), so
-      # AddressSanitizer catches the over-reads/over-writes that an "assert()
-      # instead of a real bounds check" bug would cause in a production build.
-      # UBSan rides along on the same build; -fno-sanitize-recover=undefined
-      # makes any undefined behaviour abort (and thus fail the run) instead of
-      # merely printing it.
+      # Exercise release behaviour with assertions disabled
       run: |
         CC=clang \
         CFLAGS="-fsanitize=address,undefined -fno-sanitize-recover=undefined -fno-omit-frame-pointer -g -O1 -DNDEBUG" \
         LDFLAGS="-fsanitize=address,undefined" \
         ./configure --with-rrsync --disable-md2man
     - name: make
-      # check-progs builds rsync plus the test helper programs (tls, trimslash,
-      # t_unsafe, ...) that runtests.py requires; plain "make" builds only rsync
-      # and runtests aborts on the missing helpers.
       run: make check-progs
     - name: info
       run: ./rsync --version
     - name: check (stdio-pipe transport)
-      # ASan+UBSan-instrumented coverage of the transfer, daemon, sender,
-      # receiver and metadata paths over the default stdio-pipe transport.
-      run: ./runtests.py --rsync-bin="$PWD/rsync" -j8
+      run: RSYNC_TEST_PROFILES=pipe,nonroot,self-peer,linux ./testsuite/runtests.py --rsync-bin="$PWD/rsync" --receipt=test-results/asan-pipe.json -j8
     - name: check (TCP daemon transport)
-      # --use-tcp also exercises the loopback rsyncd listener and the client's
-      # TCP connection path.
-      run: ./runtests.py --rsync-bin="$PWD/rsync" --use-tcp -j8
+      run: RSYNC_TEST_PROFILES=nonroot,self-peer,linux ./testsuite/runtests.py --rsync-bin="$PWD/rsync" --use-tcp --daemon-tests-only --receipt=test-results/asan-tcp.json -j8
+    - name: upload receipts
+      if: always()
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+      with:
+        retention-days: 45
+        name: asan-receipts
+        path: test-results/*.json
diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index 6e0eccaff..313657641 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -19,14 +19,19 @@ on:
     - cron: '42 9 * * 1'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   coverage:
     runs-on: ubuntu-latest
+    timeout-minutes: 45
     name: gcov coverage
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       with:
         fetch-depth: 0
+        persist-credentials: false
     - name: prep
       run: |
         sudo apt-get update
@@ -38,11 +43,6 @@ jobs:
       run: make
     - name: info
       run: rsync --version
-    # Two coverage runs: the default pipe transport, then a second pass over a
-    # real loopback rsyncd (--use-tcp) which also exercises the require_tcp-only
-    # tests. gcovr's --print-summary line/branch/decision totals go to the step
-    # log (and the job summary below), so the numbers are visible in CI.
-    # `make coverage` exits with the suite's status, so a regression fails CI.
     - name: coverage (pipe transport)
       run: |
         set -o pipefail
@@ -67,7 +67,7 @@ jobs:
         } >> "$GITHUB_STEP_SUMMARY"
     - name: upload HTML reports
       if: always()
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       with:
         retention-days: 45
         name: coverage-html
diff --git a/.github/workflows/cygwin-build.yml b/.github/workflows/cygwin-build.yml
index b82e18b12..c9490bcca 100644
--- a/.github/workflows/cygwin-build.yml
+++ b/.github/workflows/cygwin-build.yml
@@ -18,14 +18,19 @@ on:
   schedule:
     - cron: '42 8 * * *'
 
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: windows-2022
+    timeout-minutes: 60
     name: Test rsync on Cygwin
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       with:
         fetch-depth: 0
+        persist-credentials: false
     - name: cygwin
       run: |
         $setup = Join-Path $Env:RUNNER_TEMP 'setup-x86_64.exe'
@@ -81,21 +86,13 @@ jobs:
     - name: info
       run: bash -c '/usr/local/bin/rsync --version'
     - name: check
-      # chown-fake / devices-fake / xattrs / xattrs-hlink now RUN on Cygwin
-      # (rsyncfns.py drives xattrs via getfattr/setfattr from the `attr`
-      # package installed above), verified on a real Cygwin host. The real
-      # chown/devices tests still skip (need root/mknod), as do the
-      # RESOLVE_BENEATH symlink-race tests. Cygwin runs non-root, so the
-      # namecvt empty-response regression can run despite its common root skip.
-      run: bash -c 'RSYNC_EXPECT_SKIPPED=@testsuite/skiplist/common.txt,@testsuite/skiplist/cygwin.txt,-daemon-namecvt-empty-response make check'
+      run: bash -c 'RSYNC_TEST_PROFILES=pipe,non-asan,nonroot,self-peer,cygwin make check'
     - name: check (TCP daemon transport)
-      # Second run with daemon tests over a real loopback rsyncd; the default
-      # 'make check' above uses the secure stdio-pipe transport.
-      run: bash -c './runtests.py --rsync-bin=`pwd`/rsync.exe --use-tcp -j 8'
+      run: bash -c 'RSYNC_TEST_PROFILES=non-asan,nonroot,self-peer,cygwin ./testsuite/runtests.py --rsync-bin=`pwd`/rsync.exe --use-tcp --daemon-tests-only -j 8'
     - name: ssl file list
       run: bash -c 'PATH="/usr/local/bin:$PATH" rsync-ssl --no-motd download.samba.org::rsyncftp/ || true'
     - name: save artifact
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       with:
         retention-days: 45
         name: cygwin-bin
diff --git a/.github/workflows/fleettest.yml b/.github/workflows/fleettest.yml
deleted file mode 100644
index 40f6f8fc6..000000000
--- a/.github/workflows/fleettest.yml
+++ /dev/null
@@ -1,74 +0,0 @@
-name: Test fleettest harness
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
-  cancel-in-progress: true
-
-# Bitrot check for testsuite/fleettest.py (the developer fleet CI harness).
-# fleettest is meant to be run by developers on a modern Ubuntu box, so this
-# job runs only on ubuntu-latest: it stands up a one-host "fleet" of two
-# targets that both ssh to localhost and runs a real fleettest pass against it.
-# It does not run on the BSD/Solaris/macOS/Cygwin matrix.
-
-on:
-  push:
-    branches: [ master ]
-    paths:
-      - 'testsuite/fleettest.py'
-      - '.github/workflows/fleettest.yml'
-      - 'runtests.py'
-      - 'testsuite/skiplist/**'
-      - 'testsuite/skiplist-spec_test.py'
-  pull_request:
-    types: [opened, synchronize, reopened]
-    paths:
-      - 'testsuite/fleettest.py'
-      - '.github/workflows/fleettest.yml'
-      - 'runtests.py'
-      - 'testsuite/skiplist/**'
-      - 'testsuite/skiplist-spec_test.py'
-  workflow_dispatch:
-  schedule:
-    - cron: '17 7 * * 1'
-
-jobs:
-  fleettest:
-    runs-on: ubuntu-latest
-    name: fleettest against localhost
-    steps:
-    - uses: actions/checkout@v4
-      with:
-        fetch-depth: 0
-    - name: prep
-      run: |
-        sudo apt-get update
-        sudo apt-get install -y gcc g++ gawk autoconf automake \
-          acl libacl1-dev attr libattr1-dev liblz4-dev libzstd-dev libxxhash-dev libidn2-dev \
-          python3-cmarkgfm openssl rsync openssh-server
-    - name: set up ssh to localhost
-      run: |
-        mkdir -p ~/.ssh && chmod 700 ~/.ssh
-        ssh-keygen -t ed25519 -N '' -f ~/.ssh/id_ed25519
-        cat ~/.ssh/id_ed25519.pub >> ~/.ssh/authorized_keys
-        chmod 600 ~/.ssh/authorized_keys
-        sudo systemctl start ssh || sudo service ssh start
-        # fleettest connects with `ssh -o BatchMode=yes localhost`, which won't
-        # answer a host-key prompt -- so pre-trust localhost in known_hosts.
-        ssh-keyscan -H localhost 127.0.0.1 >> ~/.ssh/known_hosts 2>/dev/null
-        ssh -o BatchMode=yes -o ConnectTimeout=15 localhost 'echo ssh-to-localhost-ok'
-    - name: write localhost fleet config
-      run: |
-        cat > fleettest-ci.json <<'EOF'
-        { "targets": [
-          { "name": "local-a", "ssh_host": "localhost", "workflow": "none.yml",
-            "configure_flags": [], "builddir": "rsync-citest-a", "privilege": "sudo" },
-          { "name": "local-b", "ssh_host": "localhost", "workflow": "none.yml",
-            "configure_flags": [], "builddir": "rsync-citest-b", "privilege": "sudo" }
-        ] }
-        EOF
-    - name: fleettest --list (config sanity)
-      run: python3 testsuite/fleettest.py --fleet fleettest-ci.json --list
-    - name: run fleettest against localhost
-      # Two targets both on localhost exercise the parallel multi-target path
-      # and the per-run dir / port isolation; exit 0 iff every cell is OK.
-      run: python3 testsuite/fleettest.py --fleet fleettest-ci.json --timing
diff --git a/.github/workflows/freebsd-build.yml b/.github/workflows/freebsd-build.yml
index fe87913f5..89f288918 100644
--- a/.github/workflows/freebsd-build.yml
+++ b/.github/workflows/freebsd-build.yml
@@ -18,19 +18,32 @@ on:
   schedule:
     - cron: '42 8 * * 1'
 
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ubuntu-latest
+    timeout-minutes: 45
     name: Test rsync on FreeBSD
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       with:
         fetch-depth: 0
+        persist-credentials: false
+    - name: prepare VM host
+      timeout-minutes: 10
+      run: |
+        packages=(qemu-utils qemu-system-x86 ovmf)
+        sudo apt-get install -y -q -o Acquire::Retries=3 --no-install-recommends "${packages[@]}" || {
+          sudo apt-get update -q
+          sudo apt-get install -y -q -o Acquire::Retries=3 --no-install-recommends "${packages[@]}"
+        }
     - name: Test in FreeBSD VM
       id: test
-      uses: vmactions/freebsd-vm@v1
+      uses: vmactions/freebsd-vm@c46abacb49f09938ca4e1702d15d836285d694cc # v1.5.9
       with:
-        usesh: true
+        cache-after-prepare: true
         prepare: |
           pkg install -y bash autotools m4 devel/xxhash zstd liblz4 python3 archivers/liblz4 git
         run: |
@@ -38,13 +51,14 @@ jobs:
           ./configure --with-rrsync \
             -disable-zstd --disable-md2man --disable-xxhash --disable-lz4 --disable-idn \
             --enable-roll-simd --enable-roll-asm --enable-md5-asm
-          make
+          make check-progs
           ./rsync --version
-          make check
-          ./runtests.py --rsync-bin=`pwd`/rsync --use-tcp -j 8
+          RSYNC_TEST_PROFILES=pipe,non-asan,root,self-peer,freebsd,no-idn,no-xxhash,no-zstd-threads ./testsuite/runtests.py --rsync-bin="$PWD/rsync" --receipt=test-results/freebsd-pipe.json -j 8
+          RSYNC_TEST_PROFILES=non-asan,root,self-peer,freebsd,no-idn,no-xxhash,no-zstd-threads ./testsuite/runtests.py --rsync-bin="$PWD/rsync" --use-tcp --daemon-tests-only --receipt=test-results/freebsd-tcp.json -j 8
           ./rsync-ssl --no-motd download.samba.org::rsyncftp/ || true
     - name: save artifact
-      uses: actions/upload-artifact@v4
+      if: always()
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       with:
         retention-days: 45
         name: freebsd-bin
@@ -56,3 +70,4 @@ jobs:
           rsyncd.conf.5
           rrsync.1
           rrsync
+          test-results/*.json
diff --git a/.github/workflows/macos-build.yml b/.github/workflows/macos-build.yml
index b20638a8f..8d0662392 100644
--- a/.github/workflows/macos-build.yml
+++ b/.github/workflows/macos-build.yml
@@ -18,14 +18,19 @@ on:
   schedule:
     - cron: '42 8 * * *'
 
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: macos-latest
+    timeout-minutes: 45
     name: Test rsync on macOS
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       with:
         fetch-depth: 0
+        persist-credentials: false
     - name: prep
       run: |
         brew install automake openssl xxhash zstd lz4 libidn2
@@ -45,18 +50,13 @@ jobs:
     - name: info
       run: rsync --version
     - name: check
-      # chown-fake / devices-fake / xattrs / xattrs-hlink now RUN on macOS
-      # (rsyncfns.py drives xattrs via the `xattr` command), verified on a
-      # real macOS host, so they're no longer in the skip set.
-      run: sudo RSYNC_EXPECT_SKIPPED=@testsuite/skiplist/common.txt,@testsuite/skiplist/macos.txt make check
+      run: sudo RSYNC_TEST_PROFILES=pipe,non-asan,root,self-peer,macos make check
     - name: check (TCP daemon transport)
-      # Second run with daemon tests over a real loopback rsyncd; the default
-      # 'make check' above uses the secure stdio-pipe transport.
-      run: sudo ./runtests.py --rsync-bin="$PWD/rsync" --use-tcp -j 8
+      run: sudo RSYNC_TEST_PROFILES=non-asan,root,self-peer,macos ./testsuite/runtests.py --rsync-bin="$PWD/rsync" --use-tcp --daemon-tests-only -j 8
     - name: ssl file list
       run: rsync-ssl --no-motd download.samba.org::rsyncftp/ || true
     - name: save artifact
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       with:
         retention-days: 45
         name: macos-bin
diff --git a/.github/workflows/netbsd-build.yml b/.github/workflows/netbsd-build.yml
index 4d2463b78..a53ec95e6 100644
--- a/.github/workflows/netbsd-build.yml
+++ b/.github/workflows/netbsd-build.yml
@@ -18,32 +18,46 @@ on:
   schedule:
     - cron: '42 8 * * 1'
 
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ubuntu-latest
+    timeout-minutes: 45
     name: Test rsync on NetBSD
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       with:
         fetch-depth: 0
+        persist-credentials: false
+    - name: prepare VM host
+      timeout-minutes: 10
+      run: |
+        packages=(qemu-utils qemu-system-x86 ovmf)
+        sudo apt-get install -y -q -o Acquire::Retries=3 --no-install-recommends "${packages[@]}" || {
+          sudo apt-get update -q
+          sudo apt-get install -y -q -o Acquire::Retries=3 --no-install-recommends "${packages[@]}"
+        }
     - name: Test in NetBSD VM
       id: test
-      uses: vmactions/netbsd-vm@v1
+      uses: vmactions/netbsd-vm@c8a0d7ddb84619a7a8cc4e652efa7950b3fd9f92 # v1.5.2
       with:
-        usesh: true
+        cache-after-prepare: true
         prepare: |
           PATH=/usr/sbin:$PATH pkg_add autoconf automake python312
           ln -sf /usr/pkg/bin/python3.12 /usr/pkg/bin/python3
         run: |
           uname -a
           ./configure --with-rrsync --disable-zstd --disable-md2man --disable-xxhash --disable-lz4 --disable-idn
-          make
+          make check-progs
           ./rsync --version
-          make check
-          ./runtests.py --rsync-bin=`pwd`/rsync --use-tcp -j 8
+          RSYNC_TEST_PROFILES=pipe,non-asan,root,self-peer,netbsd,no-idn,no-xxhash,no-zstd-threads ./testsuite/runtests.py --rsync-bin="$PWD/rsync" --receipt=test-results/netbsd-pipe.json -j 8
+          RSYNC_TEST_PROFILES=non-asan,root,self-peer,netbsd,no-idn,no-xxhash,no-zstd-threads ./testsuite/runtests.py --rsync-bin="$PWD/rsync" --use-tcp --daemon-tests-only --receipt=test-results/netbsd-tcp.json -j 8
           ./rsync-ssl --no-motd download.samba.org::rsyncftp/ || true
     - name: save artifact
-      uses: actions/upload-artifact@v4
+      if: always()
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       with:
         retention-days: 45
         name: netbsd-bin
@@ -55,3 +69,4 @@ jobs:
           rsyncd.conf.5
           rrsync.1
           rrsync
+          test-results/*.json
diff --git a/.github/workflows/openbsd-build.yml b/.github/workflows/openbsd-build.yml
index 6218b9a24..c9a4d550e 100644
--- a/.github/workflows/openbsd-build.yml
+++ b/.github/workflows/openbsd-build.yml
@@ -18,19 +18,32 @@ on:
   schedule:
     - cron: '42 8 * * 1'
 
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ubuntu-latest
+    timeout-minutes: 45
     name: Test rsync on OpenBSD
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       with:
         fetch-depth: 0
+        persist-credentials: false
+    - name: prepare VM host
+      timeout-minutes: 10
+      run: |
+        packages=(qemu-utils qemu-system-x86 ovmf)
+        sudo apt-get install -y -q -o Acquire::Retries=3 --no-install-recommends "${packages[@]}" || {
+          sudo apt-get update -q
+          sudo apt-get install -y -q -o Acquire::Retries=3 --no-install-recommends "${packages[@]}"
+        }
     - name: Test in OpenBSD VM
       id: test
-      uses: vmactions/openbsd-vm@v1
+      uses: vmactions/openbsd-vm@5f7b2c933b8846a138361d6843c52af4bef5d945 # v1.4.8
       with:
-        usesh: true
+        cache-after-prepare: true
         prepare: |
           pkg_add -I bash autoconf%2.71 automake%1.16
         run: |
@@ -38,28 +51,17 @@ jobs:
           export AUTOCONF_VERSION=2.71
           export AUTOMAKE_VERSION=1.16
           ./configure --with-rrsync --disable-zstd --disable-md2man --disable-xxhash --disable-lz4 --disable-idn
-          make
+          make check-progs
           ./rsync --version
-          # The flipper (symlink-race) tests are excluded on OpenBSD, as on the
-          # fleet's OpenBSD box: this kernel has a connect()-under-rename-load
-          # lost-wakeup and an FFS rename-storm corruption that hang them to
-          # the 300s timeout for non-rsync reasons (see
-          # dev-notes/openbsd-connect-lost-wakeup-report.txt); the protections
-          # they exercise are verified on the Linux/BSD boxes.
+          # OpenBSD rename storms can hang these races outside rsync
           export RSYNC_EXCLUDE=acl-symlink-race,sender-readlink-atfd,sender-remove-source-secure
-          make check
-          # The --use-tcp daemon tests run at -j2 here (vs -j8 elsewhere): this
-          # job runs inside a nested VM, and at -j8 the many concurrent loopback
-          # daemons occasionally lose a connection-handshake timing race under
-          # that resource pressure, hanging one test to the 300s timeout. It is
-          # an environment artifact, not an rsync bug (the handshake is
-          # deadlock-free and unreproducible elsewhere, even pinned to 1 CPU at
-          # -j8); -j2 keeps the VM from over-subscribing. The pipe `make check`
-          # above stays at the default parallelism.
-          ./runtests.py --rsync-bin=`pwd`/rsync --use-tcp -j 2
+          RSYNC_TEST_PROFILES=pipe,non-asan,root,self-peer,openbsd,no-idn,no-xxhash,no-zstd-threads ./testsuite/runtests.py --rsync-bin="$PWD/rsync" --receipt=test-results/openbsd-pipe.json -j 8
+          # Keep nested-VM loopback daemons below the observed lost-wakeup threshold
+          RSYNC_TEST_PROFILES=non-asan,root,self-peer,openbsd,no-idn,no-xxhash,no-zstd-threads ./testsuite/runtests.py --rsync-bin="$PWD/rsync" --use-tcp --daemon-tests-only --receipt=test-results/openbsd-tcp.json -j 2
           ./rsync-ssl --no-motd download.samba.org::rsyncftp/ || true
     - name: save artifact
-      uses: actions/upload-artifact@v4
+      if: always()
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       with:
         retention-days: 45
         name: openbsd-bin
@@ -71,3 +73,4 @@ jobs:
           rsyncd.conf.5
           rrsync.1
           rrsync
+          test-results/*.json
diff --git a/.github/workflows/scan-build.yml b/.github/workflows/scan-build.yml
index 6aafaa12e..60bd0bcf5 100644
--- a/.github/workflows/scan-build.yml
+++ b/.github/workflows/scan-build.yml
@@ -17,31 +17,27 @@ on:
       - '!.github/workflows/scan-build.yml'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
-  # GATING run: pinned clang-18 on a pinned runner so the checker set -- and
-  # thus the expected zero -- is deterministic.  The tree is kept clean for
-  # clang-18, so --status-bugs (non-zero exit on any report) fails the build
-  # when a new finding appears.  Pin both the analyzer (clang-18/clang-tools-18)
-  # and the runner (ubuntu-24.04, whose apt repos carry those packages).
+  # Pinned analyser and runner form the deterministic gate
   gate-clang18:
     runs-on: ubuntu-24.04
+    timeout-minutes: 45
     name: scan-build gate (clang-18, pinned)
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       with:
         fetch-depth: 0
+        persist-credentials: false
     - name: prep
       run: |
         sudo apt-get update
         sudo apt-get install -y clang-18 clang-tools-18 acl libacl1-dev attr libattr1-dev liblz4-dev libzstd-dev libxxhash-dev libidn2-dev libpopt-dev openssl
     - name: configure (under scan-build)
-      # Run configure under scan-build so its analyzer compiler-wrapper is baked
-      # into the Makefile's $(CC); --disable-md2man avoids the doc toolchain.
       run: scan-build-18 ./configure --with-rrsync --disable-md2man
     - name: scan-build (gating)
-      # --status-bugs makes scan-build exit non-zero if it finds ANY report.
-      # pipefail + 'exit $status' propagate that through the tee so the job goes
-      # red while still printing the summary; the report uploads for triage.
       run: |
         set -o pipefail
         status=0
@@ -51,27 +47,23 @@ jobs:
         exit $status
     - name: upload report
       if: always()
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       with:
         name: scan-build-report-clang18
         path: scan-report
         if-no-files-found: ignore
 
-  # INFORMATIONAL run: whatever clang ubuntu-latest currently ships.  Newer
-  # clang releases enable extra, FP-heavy checkers (e.g. unix.Chroot
-  # "no chdir after chroot", alpha.unix.Stream) that the gate deliberately
-  # avoids, so this is NOT a gate (no --status-bugs).  It surfaces what the
-  # newest analyzer sees -- useful for spotting genuine new findings before a
-  # gate bump -- without blocking merges.  continue-on-error keeps a noisy or
-  # broken run from affecting the workflow's required status.
+  # The moving analyser is informational until its checker set is pinned
   informational-latest:
     runs-on: ubuntu-latest
+    timeout-minutes: 45
     name: scan-build (latest clang, informational)
     continue-on-error: true
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       with:
         fetch-depth: 0
+        persist-credentials: false
     - name: prep
       run: |
         sudo apt-get update
@@ -85,7 +77,7 @@ jobs:
         grep -E 'scan-build: .* bugs? found|scan-build: No bugs found' scan-build.out >>"$GITHUB_STEP_SUMMARY" || true
     - name: upload report
       if: always()
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       with:
         name: scan-build-report-latest
         path: scan-report
diff --git a/.github/workflows/solaris-build.yml b/.github/workflows/solaris-build.yml
index 1b328e4a1..55fdfba97 100644
--- a/.github/workflows/solaris-build.yml
+++ b/.github/workflows/solaris-build.yml
@@ -18,31 +18,45 @@ on:
   schedule:
     - cron: '42 8 * * 1'
 
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ubuntu-latest
+    timeout-minutes: 45
     name: Test rsync on Solaris
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       with:
         fetch-depth: 0
+        persist-credentials: false
+    - name: prepare VM host
+      timeout-minutes: 10
+      run: |
+        packages=(qemu-utils qemu-system-x86 ovmf)
+        sudo apt-get install -y -q -o Acquire::Retries=3 --no-install-recommends "${packages[@]}" || {
+          sudo apt-get update -q
+          sudo apt-get install -y -q -o Acquire::Retries=3 --no-install-recommends "${packages[@]}"
+        }
     - name: Test in Solaris VM
       id: test
-      uses: vmactions/solaris-vm@v1
+      uses: vmactions/solaris-vm@87d3c436511cef802cd1637f86f73b1a97715c8c # v1.4.1
       with:
-        usesh: true
+        cache-after-prepare: true
         prepare: |
           pkg install bash automake gnu-m4 pkg://solaris/runtime/python-35 autoconf gcc git
         run: |
           uname -a
           ./configure --with-rrsync -disable-zstd --disable-md2man --disable-xxhash --disable-lz4 --disable-idn
-          make
+          make check-progs
           ./rsync --version
-          make check
-          ./runtests.py --rsync-bin=`pwd`/rsync --use-tcp -j 8
+          RSYNC_TEST_PROFILES=pipe,non-asan,root,self-peer,solaris,no-idn,no-xxhash,no-zstd-threads ./testsuite/runtests.py --rsync-bin="$PWD/rsync" --receipt=test-results/solaris-pipe.json -j 8
+          RSYNC_TEST_PROFILES=non-asan,root,self-peer,solaris,no-idn,no-xxhash,no-zstd-threads ./testsuite/runtests.py --rsync-bin="$PWD/rsync" --use-tcp --daemon-tests-only --receipt=test-results/solaris-tcp.json -j 8
           ./rsync-ssl --no-motd download.samba.org::rsyncftp/ || true
     - name: save artifact
-      uses: actions/upload-artifact@v4
+      if: always()
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       with:
         retention-days: 45
         name: solaris-bin
@@ -54,3 +68,4 @@ jobs:
           rsyncd.conf.5
           rrsync.1
           rrsync
+          test-results/*.json
diff --git a/.github/workflows/ubuntu-22.04-build.yml b/.github/workflows/ubuntu-22.04-build.yml
deleted file mode 100644
index ce05cf1a2..000000000
--- a/.github/workflows/ubuntu-22.04-build.yml
+++ /dev/null
@@ -1,70 +0,0 @@
-name: Test rsync on Ubuntu 22.04
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
-  cancel-in-progress: true
-
-# Older-LTS coverage to help with backporting security fixes. ubuntu-22.04
-# is currently the oldest GitHub Actions runner image (20.04 was retired
-# in April 2025).
-
-on:
-  push:
-    branches: [ master ]
-    paths-ignore:
-      - '.github/workflows/*.yml'
-      - '!.github/workflows/ubuntu-22.04-build.yml'
-  pull_request:
-    types: [opened, synchronize, reopened]
-    paths-ignore:
-      - '.github/workflows/*.yml'
-      - '!.github/workflows/ubuntu-22.04-build.yml'
-  schedule:
-    - cron: '42 8 * * *'
-
-jobs:
-  test:
-    runs-on: ubuntu-22.04
-    name: Test rsync on Ubuntu 22.04
-    steps:
-    - uses: actions/checkout@v4
-      with:
-        fetch-depth: 0
-    - name: prep
-      run: |
-        sudo apt-get update
-        sudo apt-get install acl libacl1-dev attr libattr1-dev liblz4-dev libzstd-dev libxxhash-dev libidn2-dev python3-cmarkgfm openssl
-        echo "/usr/local/bin" >>"$GITHUB_PATH"
-    - name: configure
-      run: ./configure --with-rrsync
-    - name: make
-      run: make
-    - name: install
-      run: sudo make install
-    - name: info
-      run: rsync --version
-    - name: check
-      run: sudo RSYNC_EXPECT_SKIPPED=@testsuite/skiplist/common.txt,@testsuite/skiplist/linux.txt make check
-    - name: check30
-      run: sudo RSYNC_EXPECT_SKIPPED=@testsuite/skiplist/common.txt,@testsuite/skiplist/linux.txt,@testsuite/skiplist/proto30.txt make check30
-    - name: check29
-      run: sudo RSYNC_EXPECT_SKIPPED=@testsuite/skiplist/common.txt,@testsuite/skiplist/linux.txt,@testsuite/skiplist/proto29.txt make check29
-    - name: check (TCP daemon transport)
-      # Second run with daemon tests over a real loopback rsyncd; the default
-      # 'make check' above uses the secure stdio-pipe transport.
-      run: sudo ./runtests.py --rsync-bin="$PWD/rsync" --use-tcp -j 8
-    - name: ssl file list
-      run: rsync-ssl --no-motd download.samba.org::rsyncftp/ || true
-    - name: save artifact
-      uses: actions/upload-artifact@v4
-      with:
-        retention-days: 45
-        name: ubuntu-22.04-bin
-        path: |
-          rsync
-          rsync-ssl
-          rsync.1
-          rsync-ssl.1
-          rsyncd.conf.5
-          rrsync.1
-          rrsync
diff --git a/.github/workflows/ubuntu-build.yml b/.github/workflows/ubuntu-build.yml
index 3adab91e6..2eda24033 100644
--- a/.github/workflows/ubuntu-build.yml
+++ b/.github/workflows/ubuntu-build.yml
@@ -11,21 +11,42 @@ on:
       - '.github/workflows/*.yml'
       - '!.github/workflows/ubuntu-build.yml'
   pull_request:
-    types: [opened, synchronize, reopened]
+    branches: [ master ]
     paths-ignore:
       - '.github/workflows/*.yml'
       - '!.github/workflows/ubuntu-build.yml'
   schedule:
-    - cron: '42 8 * * *'
+    - cron: '42 8 * * 1'
+
+permissions:
+  contents: read
 
 jobs:
   test:
-    runs-on: ubuntu-latest
-    name: Test rsync on Ubuntu
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - runner: ubuntu-latest
+            name: Test rsync on Ubuntu latest
+            artifact: ubuntu-bin
+            nonroot: true
+            install_smoke: true
+            profiles: non-asan,root,self-peer,linux
+          - runner: ubuntu-22.04
+            name: Test rsync on Ubuntu 22.04
+            artifact: ubuntu-22.04-bin
+            nonroot: false
+            install_smoke: false
+            profiles: non-asan,root,self-peer,linux,no-zstd-threads
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 45
+    name: ${{ matrix.name }}
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       with:
         fetch-depth: 0
+        persist-credentials: false
     - name: prep
       run: |
         sudo apt-get update
@@ -35,45 +56,61 @@ jobs:
       run: ./configure --with-rrsync
     - name: make
       run: make
+    - name: install/uninstall DESTDIR smoke test
+      if: matrix.install_smoke
+      run: |
+        set -e
+        tmp="$(mktemp -d)"
+        trap 'rm -rf "$tmp"' EXIT
+
+        make install-all DESTDIR="$tmp"
+
+        for path in \
+          /usr/local/bin/rsync \
+          /usr/local/bin/rsync-ssl \
+          /usr/local/bin/rrsync \
+          /usr/local/share/man/man1/rsync.1 \
+          /usr/local/share/man/man1/rsync-ssl.1 \
+          /usr/local/share/man/man1/rrsync.1 \
+          /usr/local/share/man/man5/rsyncd.conf.5 \
+          /etc/stunnel/rsyncd.conf
+        do
+          test -e "$tmp$path"
+        done
+
+        make uninstall-all DESTDIR="$tmp"
+
+        leftover="$(find "$tmp" -type f -print)"
+        if [ -n "$leftover" ]; then
+          printf '%s\n' "$leftover"
+          exit 1
+        fi
     - name: install
       run: sudo make install
     - name: info
       run: rsync --version
     - name: check
-      run: sudo RSYNC_EXPECT_SKIPPED=@testsuite/skiplist/common.txt,@testsuite/skiplist/linux.txt make check
+      run: sudo RSYNC_TEST_PROFILES=pipe,${{ matrix.profiles }} make check
     - name: check30
-      run: sudo RSYNC_EXPECT_SKIPPED=@testsuite/skiplist/common.txt,@testsuite/skiplist/linux.txt,@testsuite/skiplist/proto30.txt make check30
+      run: sudo RSYNC_TEST_PROFILES=pipe,${{ matrix.profiles }},protocol-30 make check30
     - name: check29
-      run: sudo RSYNC_EXPECT_SKIPPED=@testsuite/skiplist/common.txt,@testsuite/skiplist/linux.txt,@testsuite/skiplist/proto29.txt make check29
+      run: sudo RSYNC_TEST_PROFILES=pipe,${{ matrix.profiles }},protocol-29 make check29
     - name: check (TCP daemon transport)
-      # Second run with daemon tests over a real loopback rsyncd. The default
-      # 'make check' above uses the secure stdio-pipe transport (no listening
-      # sockets); this run exercises the real TCP accept/auth path. Skip-set
-      # is env-dependent here (chroot-acl), so leave RSYNC_EXPECT_SKIPPED unset.
-      run: sudo ./runtests.py --rsync-bin="$PWD/rsync" --use-tcp -j 8
+      run: sudo RSYNC_TEST_PROFILES=${{ matrix.profiles }} ./testsuite/runtests.py --rsync-bin="$PWD/rsync" --use-tcp --daemon-tests-only -j 8
     - name: check (non-root, targeted)
-      # Every run above is root (sudo), so privilege-sensitive tests never hit
-      # their non-root path. Run those here as the unprivileged 'runner' user
-      # (NO sudo). Explicit test names make runtests.py full_run False, so
-      # RSYNC_EXPECT_SKIPPED is bypassed -- no per-platform skip list needed.
-      #   daemon-namecvt-empty-response -- REQUIRES non-root (skips as root by
-      #     design); the only test with no other CI coverage (Benjamin #2).
-      #   ownership-depth -- non-root takes the group-only remap path.
-      #   daemon          -- non-root takes the default-config path.
-      # CONVENTION: a new test that requires/meaningfully exercises a non-root
-      # path must be added to the list below (kept in sync with the fleet
-      # harness's nonroot_tests).
+      if: matrix.nonroot
       run: |
-        sudo rm -rf testtmp   # prior root steps left it root-owned
-        ./runtests.py --rsync-bin="$PWD/rsync" \
-          daemon-namecvt-empty-response ownership-depth daemon
+        # Prior matrix steps leave root-owned scratch
+        sudo rm -rf testtmp
+        ./testsuite/runtests.py --rsync-bin="$PWD/rsync" \
+          daemon-namecvt-empty-response ownership-depth daemon-basics
     - name: ssl file list
       run: rsync-ssl --no-motd download.samba.org::rsyncftp/ || true
     - name: save artifact
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       with:
         retention-days: 45
-        name: ubuntu-bin
+        name: ${{ matrix.artifact }}
         path: |
           rsync
           rsync-ssl
diff --git a/.github/workflows/ubuntu-version-mix.yml b/.github/workflows/ubuntu-version-mix.yml
index d16dd09dd..704bd4263 100644
--- a/.github/workflows/ubuntu-version-mix.yml
+++ b/.github/workflows/ubuntu-version-mix.yml
@@ -4,27 +4,6 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
   cancel-in-progress: true
 
-# Runs the CURRENT test suite with two different rsync binaries: the freshly
-# built ./rsync as the client/driver, and a committed OLD static binary
-# (old_versions/rsync_<ver>) as the daemon / remote-shell peer. This exercises
-# real version mixing over the wire -- more convincing than --protocol forcing,
-# which only makes the current binary speak an old protocol.
-#
-# Direction is fixed: the current binary always drives (only it understands the
-# new test scripts); the old binary is only ever the server/daemon side. The
-# reverse (old client driving new scripts) is not possible -- but one test,
-# reverse-daemon-delta, swaps the roles internally (current build as the daemon,
-# old binary as the client) to cover the backward-compat direction: a current
-# daemon serving the installed base of old clients.
-#
-# The per-version manifest testsuite/expect/rsync_<ver>.expect lists exactly
-# which tests run and each one's expected outcome (pass/skip/fail/xfail), so an
-# old peer's known feature gaps are recorded rather than treated as breakage.
-#
-# All peers run in a SINGLE job (looped, not a matrix) so the PR shows one check
-# line rather than one per version. Each peer/transport is a foldable ::group::
-# in the log, and a failure annotates which peer/transport broke.
-
 on:
   push:
     branches: [ master ]
@@ -39,14 +18,19 @@ on:
   schedule:
     - cron: '52 8 * * 1'
 
+permissions:
+  contents: read
+
 jobs:
   version-mix:
     runs-on: ubuntu-latest
+    timeout-minutes: 45
     name: rsync version-mix
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       with:
         fetch-depth: 0
+        persist-credentials: false
     - name: prep
       run: |
         sudo apt-get update
@@ -55,24 +39,26 @@ jobs:
     - name: configure
       run: ./configure --with-rrsync
     - name: make
-      # check-progs builds rsync AND the test helper programs (tls, trimslash,
-      # t_unsafe, ...) that runtests.py requires; plain `make` does not.
       run: make check-progs
     - name: info
       run: ./rsync --version | head -1
+    - name: validate profiles
+      run: ./testsuite/runtests.py profile --rsync-bin="$PWD/rsync"
     - name: version mixing (all peers, pipe + TCP transports)
       run: |
+        mkdir -p test-results/version-mix
         rc=0
         for peer in old_versions/rsync_*; do
           chmod +x "$peer"
           name=$(basename "$peer")
-          expect="testsuite/expect/$name.expect"
+          profile="peer-${name#rsync_}"
           for transport in pipe tcp; do
             tcp=()
-            [ "$transport" = tcp ] && tcp=(--use-tcp)
+            [ "$transport" = tcp ] && tcp=(--use-tcp --daemon-tests-only)
             echo "::group::$name ($transport): $("$peer" --version | head -1)"
-            if ! ./runtests.py --rsync-bin="$PWD/rsync" --rsync-bin2="$PWD/$peer" \
-                  --expect-result "$expect" "${tcp[@]}" -j 8; then
+            if ! ./testsuite/runtests.py --rsync-bin="$PWD/rsync" --rsync-bin2="$PWD/$peer" \
+                  --profiles="linux,pre-3.4.3,$profile" --receipt="test-results/version-mix/$name-$transport.json" \
+                  "${tcp[@]}" -j 8; then
               echo "::error::version-mix failed: $name ($transport)"
               rc=1
             fi
@@ -80,3 +66,9 @@ jobs:
           done
         done
         exit $rc
+    - name: upload receipts
+      if: always()
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+      with:
+        name: version-mix-receipts
+        path: test-results/version-mix
diff --git a/.github/workflows/valgrind.yml b/.github/workflows/valgrind.yml
index 33be5f102..78f6df5f5 100644
--- a/.github/workflows/valgrind.yml
+++ b/.github/workflows/valgrind.yml
@@ -19,20 +19,37 @@ on:
     - cron: '17 4 * * *'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   memcheck:
     runs-on: ubuntu-latest
-    timeout-minutes: 120
+    timeout-minutes: 60
     strategy:
       fail-fast: false
       matrix:
-        privilege: [ user, root ]
-        transport: [ pipe, tcp ]
+        include:
+          - privilege: user
+            transport: pipe
+            profiles: pipe,non-asan,nonroot,self-peer,linux,valgrind
+          - privilege: user
+            transport: tcp
+            profiles: non-asan,nonroot,self-peer,linux,valgrind
+          - privilege: root
+            transport: pipe
+            profiles: pipe,non-asan,root,self-peer,linux,valgrind
+          - privilege: root
+            transport: tcp
+            profiles: non-asan,root,self-peer,linux,valgrind
     name: memcheck (${{ matrix.privilege }}, ${{ matrix.transport }})
+    env:
+      VALGRIND_SCRATCH: /tmp/rsync-valgrind-${{ github.run_id }}-${{ github.run_attempt }}-${{ matrix.privilege }}-${{ matrix.transport }}
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       with:
         fetch-depth: 0
+        persist-credentials: false
     - name: prep
       run: |
         sudo apt-get update
@@ -46,33 +63,36 @@ jobs:
     - name: info
       run: ./rsync --version
 
-    # Run the whole suite under valgrind.  We gate on memory *errors* (uninit
-    # reads, invalid read/write, bad frees, uninit syscall params), not leaks:
-    # rsync deliberately leaves file-list/socket/option memory unfreed at exit
-    # (short-lived process; the OS reclaims), so --leak-check=no avoids a sea of
-    # by-design "definitely lost" reports.  Functional pass/fail is covered by
-    # the other workflows, so the suite is allowed to finish regardless of
-    # per-test results; the scan step below is the gate.  --error-exitcode=0
-    # keeps valgrind from perturbing test exit codes; the bundled
-    # testsuite/valgrind.supp silences known-benign reports.
+    # Gate memory errors rather than intentional process-exit leaks
     - name: run testsuite under valgrind
       run: |
-        SUDO=
-        [ "${{ matrix.privilege }}" = root ] && SUDO="sudo -E"
-        TCP=
-        [ "${{ matrix.transport }}" = tcp ] && TCP="--use-tcp"
-        $SUDO ./runtests.py --valgrind \
+        mkdir -p test-results/valgrind-logs
+        SUDO=()
+        [ "${{ matrix.privilege }}" = root ] && SUDO=(sudo -E)
+        TCP=()
+        [ "${{ matrix.transport }}" = tcp ] && TCP=(--use-tcp --daemon-tests-only)
+        "${SUDO[@]}" env RSYNC_TEST_PROFILES=${{ matrix.profiles }} scratchbase="$VALGRIND_SCRATCH" \
+          ./testsuite/runtests.py --valgrind \
           --valgrind-opts="--leak-check=no --error-exitcode=0" \
-          $TCP -j8 --preserve-scratch || true
+          "${TCP[@]}" -j2 --timeout=600 --preserve-scratch \
+          --receipt=test-results/valgrind-${{ matrix.privilege }}-${{ matrix.transport }}.json
 
     - name: scan for unsuppressed valgrind errors
+      if: always()
       run: |
-        sudo chown -R "$USER" testtmp 2>/dev/null || true
-        mapfile -t logs < <(find testtmp -name 'valgrind.*.log' 2>/dev/null)
+        log_dir="$VALGRIND_SCRATCH/testtmp/valgrind-logs"
+        if [ -d "$log_dir" ]; then
+          sudo chown -R "$USER" "$log_dir"
+        fi
+        shopt -s nullglob
+        logs=("$log_dir"/valgrind.*.log)
         if [ "${#logs[@]}" -eq 0 ]; then
           echo "::error::no valgrind logs were produced -- the suite did not run"
           exit 1
         fi
+        evidence_dir=test-results/valgrind-logs
+        mkdir -p "$evidence_dir"
+        cp -- "${logs[@]}" "$evidence_dir/"
         echo "scanned ${#logs[@]} valgrind log(s)"
         bad=()
         for f in "${logs[@]}"; do
@@ -90,11 +110,13 @@ jobs:
         fi
         echo "valgrind clean: no unsuppressed errors"
 
-    - name: upload valgrind logs on failure
-      if: failure()
-      uses: actions/upload-artifact@v4
+    - name: upload valgrind evidence
+      if: always()
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       with:
         name: valgrind-logs-${{ matrix.privilege }}-${{ matrix.transport }}
-        path: testtmp/**/valgrind.*.log
+        path: |
+          test-results/valgrind-logs/*.log
+          test-results/*.json
         if-no-files-found: ignore
-        retention-days: 7
+        retention-days: 45
diff --git a/.gitignore b/.gitignore
index f73d65f27..babf937b4 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,5 +1,6 @@
 *.[oa]
 *~
+__pycache__/
 dummy
 ID
 Makefile
@@ -63,8 +64,6 @@ aclocal.m4
 /testsuite/chown-fake.test
 /testsuite/devices-fake.test
 /testsuite/xattrs-hlink.test
-/testsuite/fleettest.json
-/fleettest-logs
 /patches
 /patches.gen
 /build
diff --git a/Makefile.in b/Makefile.in
index 716171db1..891f4a8c0 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -62,8 +62,10 @@ CHECK_PROGS = rsync$(EXEEXT) tls$(EXEEXT) getgroups$(EXEEXT) getfsdev$(EXEEXT) \
 	testrun$(EXEEXT) trimslash$(EXEEXT) t_unsafe$(EXEEXT) t_chmod_secure$(EXEEXT) \
 	t_rename_secure$(EXEEXT) t_symlink_secure$(EXEEXT) t_secure_relpath$(EXEEXT) t_acl$(EXEEXT) t_hashtable_overflow$(EXEEXT) t_iwildmatch$(EXEEXT) t_clean_fname$(EXEEXT) t_safe_arg$(EXEEXT) wildtest$(EXEEXT) simdtest$(EXEEXT)
 
-CHECK_SYMLINKS = testsuite/chown-fake_test.py testsuite/devices-fake_test.py \
-	testsuite/xattrs-hlink_test.py testsuite/exclude-lsh_test.py
+CHECK_SYMLINKS = testsuite/tests/metadata/chown-fake.py \
+	testsuite/tests/metadata/devices-fake.py \
+	testsuite/tests/metadata/xattrs-hlink.py \
+	testsuite/tests/transfer/exclude-lsh.py
 
 # Objects for CHECK_PROGS to clean
 CHECK_OBJS=tls.o testrun.o getgroups.o getfsdev.o t_stub.o t_unsafe.o t_chmod_secure.o t_rename_secure.o t_symlink_secure.o t_secure_relpath.o t_acl.o t_hashtable_overflow.o t_iwildmatch.o t_clean_fname.o t_safe_arg.o trimslash.o wildtest.o
@@ -436,22 +438,22 @@ COVERAGE_EXCLUDE = -e '(^|/)zlib/' -e '(^|/)popt/' \
 	-e '(^|/)lib/(md5|snprintf)\.c$$'
 
 # Build everything the test suite needs (rsync + helper programs + symlinks)
-# WITHOUT running it. Used by CI jobs that invoke runtests.py directly with
-# custom options (e.g. the version-mix workflow's --rsync-bin2/--expect-result).
+# WITHOUT running it. Used by CI jobs that invoke testsuite/runtests.py
+# directly with options such as --rsync-bin2 and --profiles.
 .PHONY: check-progs
 check-progs: all $(CHECK_PROGS) $(CHECK_COMPILE_OBJS) $(CHECK_SYMLINKS)
 
 .PHONY: check
 check: all $(CHECK_PROGS) $(CHECK_COMPILE_OBJS) $(CHECK_SYMLINKS)
-	"$(srcdir)/runtests.py" --rsync-bin="`pwd`/rsync$(EXEEXT)" -j $(CHECK_J)
+	"$(srcdir)/testsuite/runtests.py" --rsync-bin="`pwd`/rsync$(EXEEXT)" -j $(CHECK_J)
 
 .PHONY: check29
 check29: all $(CHECK_PROGS) $(CHECK_COMPILE_OBJS) $(CHECK_SYMLINKS)
-	"$(srcdir)/runtests.py" --rsync-bin="`pwd`/rsync$(EXEEXT)" -j $(CHECK_J) --protocol=29
+	"$(srcdir)/testsuite/runtests.py" --rsync-bin="`pwd`/rsync$(EXEEXT)" -j $(CHECK_J) --protocol=29
 
 .PHONY: check30
 check30: all $(CHECK_PROGS) $(CHECK_COMPILE_OBJS) $(CHECK_SYMLINKS)
-	"$(srcdir)/runtests.py" --rsync-bin="`pwd`/rsync$(EXEEXT)" -j $(CHECK_J) --protocol=30
+	"$(srcdir)/testsuite/runtests.py" --rsync-bin="`pwd`/rsync$(EXEEXT)" -j $(CHECK_J) --protocol=30
 
 # Whole-suite gcov coverage report (HTML, with branch + decision coverage).
 # Requires a build configured with --enable-coverage and the `gcovr` tool
@@ -473,13 +475,13 @@ coverage: all $(CHECK_PROGS) $(CHECK_SYMLINKS)
 	@# world-writable so any uid can create the sibling .gcda, and set a
 	@# default ACL of o::rw so the .gcda are world-mergeable regardless of
 	@# the creator's umask (every test process resets umask to 022 via
-	@# rsyncfns.py, so a Makefile-level `umask 0` would not survive).
+	@# harness/rsync.py, so a Makefile-level `umask 0` would not survive).
 	@find . -name '*.gcno' -printf '%h\n' 2>/dev/null | sort -u | \
 	  while read d; do \
 	    chmod a+rwx "$$d"; \
 	    setfacl -m 'd:u::rwx,d:g::rwx,d:o::rwx' "$$d" 2>/dev/null || true; \
 	  done
-	@rc=0; "$(srcdir)/runtests.py" --rsync-bin="`pwd`/rsync$(EXEEXT)" -j $(COVERAGE_J) $(COVERAGE_RUNFLAGS) || rc=$$?; \
+	@rc=0; "$(srcdir)/testsuite/runtests.py" --rsync-bin="`pwd`/rsync$(EXEEXT)" -j $(COVERAGE_J) $(COVERAGE_RUNFLAGS) || rc=$$?; \
 	  rm -rf $(COVERAGE_DIR) && mkdir -p $(COVERAGE_DIR); \
 	  gcovr --root $(srcdir) $(COVERAGE_EXCLUDE) --decisions --print-summary \
 	      --gcov-ignore-parse-errors=negative_hits.warn_once_per_file \
@@ -517,9 +519,9 @@ coverage-all: all $(CHECK_PROGS) $(CHECK_SYMLINKS)
 	    setfacl -m 'd:u::rwx,d:g::rwx,d:o::rwx' "$$d" 2>/dev/null || true; \
 	  done
 	@rc=0; \
-	  for cfg in '' '--protocol=30' '--protocol=29' '--use-tcp'; do \
+	  for cfg in '' '--protocol=30' '--protocol=29' '--use-tcp --daemon-tests-only'; do \
 	    echo "===== coverage-all: runtests.py $$cfg ====="; \
-	    "$(srcdir)/runtests.py" --rsync-bin="`pwd`/rsync$(EXEEXT)" -j $(COVERAGE_J) $$cfg || rc=$$?; \
+	    "$(srcdir)/testsuite/runtests.py" --rsync-bin="`pwd`/rsync$(EXEEXT)" -j $(COVERAGE_J) $$cfg || rc=$$?; \
 	  done; \
 	  rm -rf coverage-all && mkdir -p coverage-all; \
 	  gcovr --root $(srcdir) $(COVERAGE_EXCLUDE) --decisions --print-summary \
@@ -550,17 +552,17 @@ simdtest$(EXEEXT): simd-checksum-x86_64.cpp $(HEADERS)
 	    touch $@; \
 	fi
 
-testsuite/chown-fake_test.py:
-	ln -s chown_test.py $(srcdir)/testsuite/chown-fake_test.py
+testsuite/tests/metadata/chown-fake.py:
+	ln -s chown.py $(srcdir)/testsuite/tests/metadata/chown-fake.py
 
-testsuite/devices-fake_test.py:
-	ln -s devices_test.py $(srcdir)/testsuite/devices-fake_test.py
+testsuite/tests/metadata/devices-fake.py:
+	ln -s devices.py $(srcdir)/testsuite/tests/metadata/devices-fake.py
 
-testsuite/xattrs-hlink_test.py:
-	ln -s xattrs_test.py $(srcdir)/testsuite/xattrs-hlink_test.py
+testsuite/tests/metadata/xattrs-hlink.py:
+	ln -s xattrs.py $(srcdir)/testsuite/tests/metadata/xattrs-hlink.py
 
-testsuite/exclude-lsh_test.py:
-	ln -s exclude_test.py $(srcdir)/testsuite/exclude-lsh_test.py
+testsuite/tests/transfer/exclude-lsh.py:
+	ln -s exclude.py $(srcdir)/testsuite/tests/transfer/exclude-lsh.py
 
 # This does *not* depend on building or installing: you can use it to
 # check a version installed from a binary or some other source tree,
@@ -568,7 +570,7 @@ testsuite/exclude-lsh_test.py:
 
 .PHONY: installcheck
 installcheck: $(CHECK_PROGS) $(CHECK_SYMLINKS)
-	"$(srcdir)/runtests.py" --rsync-bin="$(bindir)/rsync$(EXEEXT)" --srcdir="$(srcdir)" --tooldir="`pwd`" -j $(CHECK_J)
+	"$(srcdir)/testsuite/runtests.py" --rsync-bin="$(bindir)/rsync$(EXEEXT)" --srcdir="$(srcdir)" --tooldir="`pwd`" -j $(CHECK_J)
 
 # TODO: Add 'dist' target; need to know which files will be included
 
diff --git a/NEWS.md b/NEWS.md
index f792911cd..f8ea78e63 100644
--- a/NEWS.md
+++ b/NEWS.md
@@ -45,7 +45,7 @@ test improvements.
 
 ### BUILD AND TESTS:
 - `install-strip` now honours `STRIP` including during cross-compilation.
-- Updated platform tests and fleet-test coverage for the 3.5.0 fixes.
+- Updated platform tests for the 3.5.0 fixes.
 
 ------------------------------------------------------------------------------
 # NEWS for rsync 3.5.0 (13 Aug 2026)
diff --git a/SECURITY.md b/SECURITY.md
index b77e1473c..65e1c7ff6 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -385,8 +385,8 @@ The following are documented as out of scope for this release:
   can still slip past confinement that is anchored at the process CWD (e.g. the
   sender's content open), because the descriptor is not bound to the original
   inode.  The parent-component symlink-race tests are therefore not enforced on
-  Cygwin (see `RSYNC_EXPECT_SKIPPED` in `.github/workflows/cygwin-build.yml` and
-  the Cygwin-only xfail in `symlink-race-source_test.py`).  Cygwin is a
+  Cygwin (see the `cygwin` test profile and the Cygwin-only xfail in
+  `symlink-race-source.py`).  Cygwin is a
   development/interoperability target, not a privilege boundary host, so this is
   accepted for this release.
 
diff --git a/old_versions/README.md b/old_versions/README.md
index a5ce3a5b6..30c19e55e 100644
--- a/old_versions/README.md
+++ b/old_versions/README.md
@@ -1,87 +1,27 @@
-# Old rsync version archive
-
-Static rsync binaries built from historical release tags. Two uses:
-
-1. **Cross-version behaviour checks** — confirming whether a behaviour a user
-   reported on an old release is version-specific or option-driven.
-2. **The version-mixing test suite** — `runtests.py --rsync-bin2=...` runs the
-   current code against one of these as the daemon / remote-shell peer; CI
-   (`.github/workflows/ubuntu-version-mix.yml`) does this for every binary
-   here against the per-version manifests in `testsuite/expect/`.
-
-Binaries are **statically linked** so they run regardless of the host's
-shared libraries, and named `rsync_<version>`:
-
-| Binary         | Version | Protocol | Notes                                   |
-|----------------|---------|----------|-----------------------------------------|
-| `rsync_2.6.0`  | 2.6.0   | 27       | 2004; needs autoconf regen (see below)  |
-| `rsync_3.0.0`  | 3.0.0   | 30       | 2008                                    |
-| `rsync_3.1.0`  | 3.1.0   | 31       | 2013                                    |
-| `rsync_3.1.3`  | 3.1.3   | 31       | Ubuntu 18.04 / Debian buster era (2018) |
-| `rsync_3.2.0`  | 3.2.0   | 31       | 2020 (zstd/lz4/xxhash negotiation added)|
-| `rsync_3.2.7`  | 3.2.7   | 31       | 2022                                    |
-| `rsync_3.3.0`  | 3.3.0   | 31       | 2024                                    |
-| `rsync_3.4.0`  | 3.4.0   | 32       | 2025                                    |
-| `rsync_3.4.1`  | 3.4.1   | 32       | 2025                                    |
-
-These are every `x.y.0` release from 2.6.0 (2004) onward plus a few point
-releases. 2.6.0 is the practical floor: older tags need progressively more
-porting to build on a current toolchain.
-
-All built `--disable-openssl` and with `_FORTIFY_SOURCE` disabled (see below);
-xxhash/zstd/lz4 are compiled in where the version supports them.
-
-## Adding a version
-
-```bash
-./build_static.sh 3.2.7            # uses git tag v3.2.7
-./build_static.sh 3.0.9 v3.0.9     # explicit tag if naming differs
+The script uses a temporary worktree, builds the requested tag, verifies the binary and removes the worktree.
+
+# Old rsync versions
+
+These statically linked binaries support cross-version regression checks and the version-mixing workflow. Peer expectations live in `testsuite/profiles/`
+
+Binary | Version | Protocol
+--- | --- | ---
+rsync_2.6.0 | 2.6.0 | 27
+rsync_3.0.0 | 3.0.0 | 30
+rsync_3.1.0 | 3.1.0 | 31
+rsync_3.1.3 | 3.1.3 | 31
+rsync_3.2.0 | 3.2.0 | 31
+rsync_3.2.7 | 3.2.7 | 31
+rsync_3.3.0 | 3.3.0 | 31
+rsync_3.4.0 | 3.4.0 | 32
+rsync_3.4.1 | 3.4.1 | 32
+
+The archive starts at 2.6.0 because older releases require broader source changes to build with modern toolchains.
+
+## Rebuilding
+```sh
+./build_static.sh 3.2.7
+./build_static.sh 3.0.9 v3.0.9
 ```
 
-The script checks out the tag into a throwaway `git worktree`, applies the
-minimal patches needed to compile old sources on a modern toolchain, links
-statically, verifies the result is static and reports the requested version,
-then installs `rsync_<version>` here and removes the worktree.
-
-Override the source repo with `RSYNC_REPO=/path/to/rsync ./build_static.sh ...`
-(defaults to `../rsync.4`).
-
-## Why the patches?
-
-Modern GCC (>= 14, C23 default) and glibc reject things old rsync relied on.
-`build_static.sh` handles these, each guarded so it's a no-op when not needed:
-
-1. **K&R `lseek64()` redeclaration** in `syscall.c` clashes with glibc's real
-   prototype — removed.
-2. **`gettimeofday()`** — glibc only has the 2-arg form; configure misdetects
-   the 1-arg form, so `HAVE_GETTIMEOFDAY_TZ` is forced on in `config.h`.
-3. **C23 `()` == `(void)`** breaks K&R prototypes called with arguments
-   (`qsort` comparator, `pool->bomb`, etc.) — built with `-std=gnu11`.
-4. Assorted modern `-Werror` promotions (incompatible pointer types, implicit
-   declarations) downgraded to warnings; bundled zlib/popt used to keep the
-   static link self-contained.
-
-5. **OpenSSL (3.2+)** is disabled with `--disable-openssl`: linking
-   `libcrypto.a` statically drags in jitterentropy (`jent_*`) and zlib's
-   `uncompress` (OpenSSL's COMP module), which don't resolve here. OpenSSL only
-   provided optional MD4/MD5, which rsync implements natively, so checksum
-   behaviour is unaffected.
-
-6. **`_FORTIFY_SOURCE` disabled** (`-U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=0`):
-   modern Ubuntu defaults it to `=3`, whose stricter object-size checks turn
-   latent (historically benign) over-reads in OLD rsync into hard
-   `*** buffer overflow detected ***` aborts when the binary runs as a
-   server/daemon — which made e.g. 3.1.3 and 3.2.7 unusable as peers. Disabling
-   it makes the archival binaries behave as the released versions did.
-
-7. **Pre-3.0 tags (e.g. 2.6.0)** ship `configure.in`, not a generated
-   `configure`. The script runs `autoheader`/`autoconf` to generate it, after
-   neutralizing the `AC_CHECK_FUNCS(fn,,AC_LIBOBJ(lib/...))` fallbacks for
-   `inet_ntop`/`inet_pton`/`getaddrinfo`/`getnameinfo` — modern autoconf emits
-   broken shell for those never-taken branches (the funcs exist in glibc). It
-   also generates `proto.h` (no make rule in that era) and stubs the vendored
-   `lib/addrinfo.h` the tag dropped (modern glibc supplies `struct addrinfo`).
-   All guarded so they no-op on 3.x.
-
-Newer versions may need fewer or different tweaks; if a build fails, the
-script prints the first compiler errors from its log.
+Set `RSYNC_REPO` to override the source repository. Compatibility patches cover old configure inputs, K&R prototypes, current libc declarations and compiler diagnostics. OpenSSL and `_FORTIFY_SOURCE` are disabled so the archived binaries retain their release-era checksum and memory behaviour when used as peers.
diff --git a/runtests.py b/runtests.py
deleted file mode 100755
index 4f62c12f6..000000000
--- a/runtests.py
+++ /dev/null
@@ -1,1024 +0,0 @@
-#!/usr/bin/env python3
-
-# Copyright (C) 2001, 2002 by Martin Pool <mbp@samba.org>
-# Copyright (C) 2003-2022 Wayne Davison
-# Copyright (C) 2026 Andrew Tridgell
-#
-# Rewrite of runtests.sh in Python (runtests.sh is now deprecated).
-#
-# This program is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License version
-# 2 as published by the Free Software Foundation.
-
-"""rsync test runner.
-
-Invokes test scripts from testsuite/ and reports results.
-Can be called by 'make check' or directly.
-
-Usage:
-    ./runtests.py [options] [TEST ...]
-
-Each TEST is a test name (e.g. 'delete') or glob pattern (e.g. 'xattr*').
-If no tests are specified, all tests are run.
-"""
-
-import argparse
-import concurrent.futures
-import fnmatch
-import glob
-import math
-import os
-import signal
-import subprocess
-import sys
-import threading
-import time
-
-# Share the test exit-code enum with the test helpers. exitcodes.py lives in
-# testsuite/ (next to this script); it has no import-time side effects.
-sys.path.insert(0, os.path.join(os.path.dirname(os.path.abspath(__file__)), 'testsuite'))
-from exitcodes import Exit
-
-
-def _race_seconds(text):
-    """argparse type for --race-timeout: a finite, strictly positive number.
-
-    A race test loops `while monotonic() < deadline`, so a budget of 0 (or a
-    negative, or a NaN, which fails every comparison) runs the body ZERO times
-    and the test reports PASS without ever exercising its oracle -- a silently
-    disarmed security test, which is worse than a slow one. Infinity would run
-    until the unrelated per-test timeout. The old max(RACE_TIMEOUT, 10.0) floor
-    used to make this unreachable; validating here restores that guarantee."""
-    try:
-        secs = float(text)
-    except ValueError:
-        raise argparse.ArgumentTypeError(f'not a number: {text!r}')
-    if not math.isfinite(secs) or secs <= 0:
-        raise argparse.ArgumentTypeError(
-            f'must be a finite positive number of seconds, got {text!r}; '
-            'a zero/negative/NaN budget would make every race test pass '
-            'without running its race')
-    return secs
-
-
-def parse_args():
-    p = argparse.ArgumentParser(description='Run rsync test suite')
-    p.add_argument('tests', nargs='*', metavar='TEST',
-                   help='Test names or patterns to run (default: all)')
-    p.add_argument('--exclude', default=None, metavar='LIST',
-                   help='Comma-separated test names/globs to skip entirely: '
-                        'they are not run and not reported as skipped. Useful '
-                        'for tests that cannot work in a given build/CI '
-                        'environment (e.g. a restricted buildd chroot). '
-                        'Falls back to the RSYNC_EXCLUDE environment variable.')
-    p.add_argument('-j', '--parallel', type=int, default=1, metavar='N',
-                   help='Run up to N tests in parallel (default: 1)')
-    p.add_argument('--valgrind', action='store_true',
-                   help='Run rsync under valgrind (logs to per-process files)')
-    p.add_argument('--valgrind-opts', default='', metavar='OPTS',
-                   help='Extra valgrind options (e.g. "--leak-check=full")')
-    p.add_argument('--preserve-scratch', action='store_true',
-                   help='Keep scratch directories after tests complete')
-    p.add_argument('--log-level', type=int, default=1, metavar='N',
-                   help='Verbosity level 1-10 (default: 1)')
-    p.add_argument('--always-log', action='store_true',
-                   help='Show test logs even for passing tests')
-    p.add_argument('--stop-on-fail', action='store_true',
-                   help='Stop after first test failure')
-    p.add_argument('--timing', action='store_true',
-                   help='After the run, report each test\'s wall-clock time, '
-                        'slowest first. With -j N the report also shows how '
-                        'much of the run the slowest test alone accounts for.')
-    p.add_argument('--timeout', type=int, default=300, metavar='SECS',
-                   help='Per-test timeout in seconds (default: 300)')
-    p.add_argument('--race-timeout', type=_race_seconds, default=None, metavar='SECS',
-                   help='Budget (seconds) a TOCTOU symlink-race test may spend '
-                        'trying to win its race before concluding. Overrides '
-                        'every such test\'s own default (5-15s, the suite\'s '
-                        'slowest tests: a race test always spends its whole '
-                        'budget). Lowering it speeds the suite up but weakens '
-                        'the oracle. Unset: each test keeps its default.')
-    p.add_argument('--rsync-bin', default=None, metavar='PATH',
-                   help='Path to rsync binary (default: ./rsync)')
-    p.add_argument('--rsync-bin2', default=None, metavar='PATH',
-                   help='Path to a second ("peer") rsync binary used for the '
-                        'daemon side and remote-shell --rsync-path. Lets the '
-                        'suite mix two rsync versions over the wire. Default: '
-                        'same as --rsync-bin (no version mixing).')
-    p.add_argument('--tooldir', default=None, metavar='DIR',
-                   help='Tool/build directory (default: cwd)')
-    p.add_argument('--srcdir', default=None, metavar='DIR',
-                   help='Source directory (default: script directory)')
-    p.add_argument('--protocol', type=int, default=None, metavar='VER',
-                   help='Force protocol version (adds --protocol=VER to rsync)')
-    p.add_argument('--expect-skipped', default=None, metavar='LIST',
-                   help='Comma-separated list of expected-skipped tests. An '
-                        '@FILE entry reads a skip list (one test per line, '
-                        '"#" comments); relative paths resolve against srcdir '
-                        'and several may be composed, e.g. '
-                        '@testsuite/skiplist/linux.txt,@testsuite/skiplist/proto29.txt. '
-                        'A -NAME entry removes a name the rest of the spec '
-                        'added, for a host that can really run a test its '
-                        'platform list expects to skip.')
-    p.add_argument('--expect-result', default=None, metavar='FILE',
-                   help='Path to an expected-outcome manifest (one '
-                        '"<testname> <pass|skip|fail|xfail>" per line). When '
-                        'set, ONLY the tests listed in FILE are run, and each '
-                        "test's actual outcome is compared against its "
-                        'expected one; any mismatch (including an unexpected '
-                        'pass) fails the run. Used for version-mixing CI.')
-    p.add_argument('--daemon-tests-only', action='store_true',
-                   help='Run only the tests that can reach the daemon '
-                        'transport. Intended for a --use-tcp pass that follows '
-                        'a full default-transport run: the tests this drops '
-                        'never call start_test_daemon(), so they cannot observe '
-                        '--use-tcp and would just repeat themselves. Disables '
-                        'the expected-skip oracle (it describes a full run).')
-    p.add_argument('--use-tcp', action='store_true',
-                   help='Run daemon tests against a real rsyncd bound to '
-                        '127.0.0.1 (non-default). The default is the secure '
-                        'stdio-pipe transport, which opens no listening '
-                        'socket; --use-tcp exposes a loopback port for the '
-                        'duration of each daemon test.')
-    return p.parse_args()
-
-
-def find_setfacl_nodef(scratchbase):
-    """Determine the setfacl command to remove default ACLs."""
-    for cmd in [
-        ['setacl', '-k', 'u::7,g::5,o:5', scratchbase],
-        ['setfacl', '-k', scratchbase],
-        ['setfacl', '-s', 'u::7,g::5,o:5', scratchbase],
-    ]:
-        try:
-            subprocess.run(cmd, capture_output=True, timeout=5)
-            return cmd[:2] if cmd[0] == 'setacl' else cmd[:2]
-        except (FileNotFoundError, subprocess.TimeoutExpired):
-            continue
-    try:
-        r = subprocess.run(['setfacl', '--help'], capture_output=True, text=True, timeout=5)
-        if '-k,' in r.stdout or '-k,' in r.stderr:
-            return ['setfacl', '-k']
-    except (FileNotFoundError, subprocess.TimeoutExpired):
-        pass
-    return None
-
-
-def get_tls_args(config_h):
-    """Determine TLS_ARGS from config.h."""
-    args = ''
-    try:
-        with open(config_h) as f:
-            text = f.read()
-        if '#define HAVE_LUTIMES 1' in text:
-            args += ' -l'
-        if '#undef CHOWN_MODIFIES_SYMLINK' in text:
-            args += ' -L'
-    except FileNotFoundError:
-        pass
-    return args.strip()
-
-
-def read_shconfig(path):
-    """Read shell config variables from shconfig."""
-    env = {}
-    try:
-        with open(path) as f:
-            for line in f:
-                line = line.strip()
-                if line.startswith('#') or line.startswith('export') or not line:
-                    continue
-                if '=' in line:
-                    k, _, v = line.partition('=')
-                    env[k.strip()] = v.strip().strip('"')
-    except FileNotFoundError:
-        pass
-    return env
-
-
-def get_testuser():
-    """Determine the current test user."""
-    for cmd in ['/usr/bin/whoami', '/usr/ucb/whoami', '/bin/whoami']:
-        if os.path.isfile(cmd):
-            try:
-                return subprocess.check_output([cmd], text=True).strip()
-            except subprocess.CalledProcessError:
-                pass
-    try:
-        return subprocess.check_output(['id', '-un'], text=True).strip()
-    except (FileNotFoundError, subprocess.CalledProcessError):
-        return os.environ.get('LOGNAME', os.environ.get('USER', 'UNKNOWN'))
-
-
-def _move_aside(path):
-    """Rename an un-removable directory to a unique sibling so its name is free.
-
-    A rename-storm symlink-race test can corrupt a directory on some filesystems
-    (OpenBSD FFS soft-updates can leave an "empty" dir that still reports
-    ENOTEMPTY/EPERM and only fsck clears). `rm -rf` then can't remove it, but
-    renaming the top dir aside succeeds even with a corrupted descendant, freeing
-    the original name for a clean scratchdir."""
-    n = 0
-    while os.path.exists(f"{path}.corrupt.{os.getpid()}.{n}"):
-        n += 1
-    try:
-        os.rename(path, f"{path}.corrupt.{os.getpid()}.{n}")
-    except OSError:
-        pass
-
-
-def prep_scratch(scratchdir, srcdir, tooldir, setfacl_nodef):
-    """Prepare a scratch directory for a test."""
-    if os.path.isdir(scratchdir):
-        subprocess.run(['chmod', '-R', 'u+rwX', scratchdir], capture_output=True)
-        subprocess.run(['rm', '-rf', scratchdir], capture_output=True)
-        if os.path.isdir(scratchdir):
-            _move_aside(scratchdir)   # rm -rf left corrupted debris; don't inherit it
-    os.makedirs(scratchdir, exist_ok=True)
-    if setfacl_nodef:
-        subprocess.run(setfacl_nodef + [scratchdir], capture_output=True)
-    try:
-        os.chmod(scratchdir, os.stat(scratchdir).st_mode & ~0o2000)  # clear setgid
-    except OSError:
-        pass
-    src_link = os.path.join(scratchdir, 'src')
-    if not os.path.exists(src_link):
-        if os.path.isabs(srcdir):
-            os.symlink(srcdir, src_link)
-        else:
-            os.symlink(os.path.join(tooldir, srcdir), src_link)
-
-
-# Python tests are identified by a positive "_test.py" suffix so that
-# helper modules (e.g. rsyncfns.py) sit in testsuite/ without being mistaken
-# for tests.
-_PY_TEST_SUFFIX = '_test.py'
-
-
-def _is_test_path(path):
-    return os.path.basename(path).endswith(_PY_TEST_SUFFIX)
-
-
-def _testbase(path):
-    """Strip the test extension to get the canonical test name."""
-    base = os.path.basename(path)
-    if base.endswith(_PY_TEST_SUFFIX):
-        return base[:-len(_PY_TEST_SUFFIX)]
-    return base
-
-
-def collect_tests(suitedir, patterns):
-    """Collect test scripts (_test.py) matching the given patterns."""
-    if not patterns:
-        candidates = glob.glob(os.path.join(suitedir, '*' + _PY_TEST_SUFFIX))
-        tests = sorted(p for p in candidates if _is_test_path(p))
-    else:
-        seen = set()
-        tests = []
-        for pat in patterns:
-            # Accept either bare name ("mkpath"), explicit extension, or glob.
-            if pat.endswith('.py'):
-                pats = [pat]
-            else:
-                pats = [pat + _PY_TEST_SUFFIX]
-            for p in pats:
-                for m in sorted(glob.glob(os.path.join(suitedir, p))):
-                    if _is_test_path(m) and m not in seen:
-                        seen.add(m)
-                        tests.append(m)
-    return tests
-
-
-# Tokens through which a test can reach the daemon transport. --use-tcp works by
-# setting RSYNC_TEST_USE_TCP, which is read in exactly one place (rsyncfns
-# USE_TCP) and acted on in exactly one function (start_test_daemon): a test whose
-# source mentions none of these never gets there, so it behaves identically with
-# and without --use-tcp and running it a second time under TCP buys no coverage.
-#
-# The list is the closure of every rsyncfns helper that reaches USE_TCP,
-# start_rsyncd or claim_ports, plus the helper modules that open a daemon
-# connection themselves and the bare literals a test might use directly. It is
-# deliberately over-broad: a false positive only costs runtime, while a false
-# negative would silently drop real coverage.
-_DAEMON_API = (
-    'USE_TCP', 'require_tcp', 'start_test_daemon', 'start_rsyncd',
-    'claim_ports', 'claim_free_port', 'setup_chroot_inner',
-    'stdio_daemon', 'rsync_proto', 'DaemonClient',
-    'rsync://', '--daemon', 'rsyncd',
-)
-
-
-def select_daemon_tests(tests):
-    """Split `tests` into (daemon-transport tests, the rest).
-
-    Used by --daemon-tests-only so a TCP pass need not re-run the whole suite.
-    A test we cannot read is kept, not dropped -- the failure mode of this
-    filter must always be "ran too much"."""
-    keep, dropped = [], []
-    for path in tests:
-        try:
-            with open(path, errors='replace') as f:
-                text = f.read()
-        except OSError:
-            keep.append(path)
-            continue
-        (keep if any(tok in text for tok in _DAEMON_API) else dropped).append(path)
-    return keep, dropped
-
-
-_VALID_OUTCOMES = ('pass', 'skip', 'fail', 'xfail')
-
-
-def parse_expect_result(path):
-    """Parse an expected-outcome manifest into {testbase: outcome}.
-
-    One "<testname> <outcome>" entry per line; '#' comments and blank lines
-    are ignored. outcome is one of pass|skip|fail|xfail. The set of listed
-    tests doubles as the run set (see main()). Exits 2 on a malformed file.
-    """
-    expect = {}
-    with open(path) as f:
-        for lineno, raw in enumerate(f, 1):
-            line = raw.split('#', 1)[0].strip()
-            if not line:
-                continue
-            fields = line.split()
-            if len(fields) != 2 or fields[1] not in _VALID_OUTCOMES:
-                sys.stderr.write(
-                    f"{path}:{lineno}: expected '<testname> "
-                    f"<{'|'.join(_VALID_OUTCOMES)}>', got: {raw.rstrip()}\n"
-                )
-                sys.exit(Exit.ERROR)
-            expect[fields[0]] = fields[1]
-    return expect
-
-
-def expand_skip_spec(spec, srcdir, suitedir):
-    """Expand an RSYNC_EXPECT_SKIPPED spec into a normalised csv.
-
-    The spec is a comma-separated list of test names, '@FILE' skip-list
-    references, and '-name' removals.  A skip-list file holds one test name per line ('#' starts a
-    comment; blank lines are ignored), which is what keeps two branches from
-    colliding: adding a test edits one line of one file rather than a shared
-    3 KB csv.  Several may be composed, e.g.
-        RSYNC_EXPECT_SKIPPED=@testsuite/skiplist/linux.txt,@.../proto29.txt
-    Relative paths resolve against srcdir (not the cwd) so out-of-tree builds
-    and `make installcheck` work.  A '-name' entry removes a name the rest of
-    the spec added, for a host that can genuinely run a test its platform list
-    expects to skip; it is applied last, and must actually remove something.
-
-    Entries must name a real test, and each file must be non-empty, sorted and
-    free of duplicates: unsorted files defeat the point (everyone appends to
-    the same last line), and a stale name would otherwise fail as a skip
-    mismatch far from its cause.  Exits 2 on any of those -- nothing malformed
-    may quietly shrink the expected set, which would disarm the oracle.
-    """
-    def die(msg):
-        sys.stderr.write(msg + '\n')
-        sys.exit(Exit.ERROR)
-
-    # An entirely empty spec is the legitimate "expect no skips at all".  An
-    # empty entry *within* a spec is not: it is what an unset shell variable
-    # expands to, and silently dropping it would quietly shrink the expected
-    # set.
-    if not spec.strip():
-        return ''
-
-    names = []
-    drop = []
-    for tok in (t.strip() for t in spec.split(',')):
-        if not tok:
-            die('RSYNC_EXPECT_SKIPPED: empty entry (an unset variable?): '
-                f'{spec!r}')
-        if tok.startswith('-'):
-            # '-name' removes a name a composed list added, for a host that
-            # really can run a test its platform list expects to skip (e.g. a
-            # scratch dir on a second filesystem makes a cross-device copy
-            # work).  Subtraction cannot be done by whoever composes the spec,
-            # because the name lives inside an @FILE that is only expanded
-            # here.  Applied after every addition, so order does not matter.
-            drop.append((tok[1:], tok))
-            continue
-        if not tok.startswith('@'):
-            names.append((tok, 'RSYNC_EXPECT_SKIPPED'))
-            continue
-        path = tok[1:]
-        if not os.path.isabs(path):
-            path = os.path.join(srcdir, path)
-        try:
-            with open(path) as f:
-                lines = f.readlines()
-        except (OSError, UnicodeDecodeError) as e:
-            die(f'{tok}: cannot read skip list: {e}')
-        prev = None
-        found = 0
-        for lineno, raw in enumerate(lines, 1):
-            name = raw.split('#', 1)[0].strip()
-            if not name:
-                continue
-            where = f'{path}:{lineno}'
-            if len(name.split()) != 1:
-                die(f'{where}: expected one test name per line, got: {raw.rstrip()}')
-            if prev is not None and name <= prev:
-                die(f'{where}: skip lists must be sorted and duplicate-free '
-                    f'({name!r} follows {prev!r})')
-            prev = name
-            found += 1
-            names.append((name, where))
-        # A truncated or emptied list must not read as "expect no skips".
-        if not found:
-            die(f'{path}: skip list contains no test names')
-
-    seen = {}
-    for name, where in names:
-        if name in seen:
-            continue
-        seen[name] = where
-        # A plain test name: no path, and no comma (which the expanded csv,
-        # and the summary the fleet parses back, use as the separator).
-        if ',' in name or '/' in name or os.sep in name or name in ('.', '..'):
-            die(f'{where}: not a test name: {name!r}')
-        if not os.path.isfile(os.path.join(suitedir, name + '_test.py')):
-            die(f'{where}: no such test: {name}')
-    for name, tok in drop:
-        # Every removal must remove something.  A name the spec never added is
-        # stale (the list stopped expecting that skip, or it is misspelled), and
-        # a repeated removal is the same no-op written twice.  Shrinking the
-        # expected set is precisely what must not happen quietly, so neither is
-        # allowed to sit in a config unnoticed.
-        if name not in seen:
-            die(f'RSYNC_EXPECT_SKIPPED: {tok!r} removes a name that nothing '
-                f'added: {name}')
-        del seen[name]
-    return ','.join(sorted(seen))
-
-
-def read_backport_exclude(tooldir, suitedir):
-    """Test names from the BUILD tree's testsuite/skiplist/backport.txt.
-
-    A stable-backport branch runs a newer suite than its own code, and this
-    file names the tests that base cannot run.  It lives in the tree being
-    built, not the suite tree, so it cannot be an @FILE in the expect-skipped
-    spec -- those resolve against srcdir.
-    """
-    path = os.path.join(tooldir, 'testsuite', 'skiplist', 'backport.txt')
-    if not os.path.isfile(path):
-        return set()
-    names = set()
-    with open(path) as f:
-        for lineno, raw in enumerate(f, 1):
-            name = raw.split('#', 1)[0].strip()
-            if not name:
-                continue
-            where = f'{path}:{lineno}'
-            if len(name.split()) != 1:
-                sys.stderr.write(f'{where}: expected one test name per line\n')
-                sys.exit(Exit.ERROR)
-            # A stale name here would silently exclude nothing, which is the
-            # failure this file exists to prevent.
-            if not os.path.isfile(os.path.join(suitedir, name + '_test.py')):
-                sys.stderr.write(f'{where}: no such test: {name}\n')
-                sys.exit(Exit.ERROR)
-            names.add(name)
-    return names
-
-
-_TIMING_TOP = 25
-
-
-def print_timing_report(durations, outcomes, run_wall, parallel):
-    """Report per-test wall-clock, slowest first (--timing).
-
-    With -j N the run cannot finish sooner than its slowest single test, so the
-    tail matters as much as the total: a 300s test pins the whole suite to 300s
-    no matter how many workers there are. The footer gives both bounds -- the
-    serial sum (what one worker would take) and that floor -- so it is obvious
-    whether a slow run wants more parallelism or a faster individual test."""
-    if not durations:
-        return
-    ranked = sorted(durations.items(), key=lambda kv: kv[1], reverse=True)
-    total = sum(durations.values())
-    print(f'----- slowest tests (of {len(ranked)}, wall-clock each):')
-    for name, secs in ranked[:_TIMING_TOP]:
-        print(f'      {secs:7.1f}s  {name:<32} {outcomes.get(name, "?")}')
-    print(f'      serial sum {total:.0f}s over {len(ranked)} tests; '
-          f'run took {run_wall:.0f}s with -j{parallel}')
-    slowest, slowest_secs = ranked[0]
-    if parallel > 1:
-        # The floor: even with unlimited workers the suite cannot beat its
-        # longest single test.
-        print(f'      floor {slowest_secs:.0f}s ({slowest}) = '
-              f'{100.0 * slowest_secs / run_wall:.0f}% of this run; '
-              f'ideal at -j{parallel} is {total / parallel:.0f}s')
-
-
-def outcome_of(result):
-    """Map a per-test exit code to an outcome string."""
-    if result == Exit.PASS:
-        return 'pass'
-    if result == Exit.SKIP:
-        return 'skip'
-    if result == Exit.XFAIL:
-        return 'xfail'
-    return 'fail'
-
-
-def build_rsync_cmd(rsync_bin, args, scratchbase):
-    """Build the RSYNC command string for tests."""
-    parts = []
-    if args.valgrind:
-        # Logs go in a world-writable+sticky subdir so that rsync children
-        # which drop privileges (the setpriv cap-drop in partial_nowrite, a
-        # daemon dropping to the module's uid) can still create their log file
-        # even when scratchbase itself is root-owned.
-        vgdir = os.path.join(scratchbase, 'valgrind-logs')
-        os.makedirs(vgdir, exist_ok=True)
-        os.chmod(vgdir, 0o1777)
-        vlog = os.path.join(vgdir, 'valgrind.%p.log')
-        vopts = f'--log-file={vlog}'
-        supp = os.path.join(os.path.dirname(os.path.abspath(__file__)),
-                            'testsuite', 'valgrind.supp')
-        if os.path.exists(supp):
-            vopts += f' --suppressions={supp}'
-        if args.valgrind_opts:
-            vopts += ' ' + args.valgrind_opts
-        parts.append(f'valgrind {vopts}')
-    parts.append(rsync_bin)
-    if args.protocol is not None:
-        parts.append(f'--protocol={args.protocol}')
-    return ' '.join(parts)
-
-
-class TestResult:
-    """Result of a single test execution."""
-    __slots__ = ('testbase', 'result', 'output', 'skipped_reason', 'duration')
-
-    def __init__(self, testbase, result, output='', skipped_reason='',
-                 duration=0.0):
-        self.testbase = testbase
-        self.result = result
-        self.output = output
-        self.skipped_reason = skipped_reason
-        self.duration = duration
-
-
-def run_one_test(testscript, testbase, scratchdir, base_env, timeout,
-                 srcdir, tooldir, setfacl_nodef, always_log):
-    """Run a single test. Returns a TestResult.
-
-    This function is safe to call from multiple threads — it uses only
-    per-test state (unique scratchdir, copy of env).
-    """
-    started = time.monotonic()
-    prep_scratch(scratchdir, srcdir, tooldir, setfacl_nodef)
-
-    env = base_env.copy()
-    env['scratchdir'] = scratchdir
-
-    # Dispatch by extension: shell tests via /bin/sh -e, Python tests via
-    # the same python3 that's running this runner.
-    if testscript.endswith('.py'):
-        cmd = [sys.executable, testscript]
-    else:
-        cmd = ['sh', '-e', testscript]
-
-    logfile = os.path.join(scratchdir, 'test.log')
-    with open(logfile, 'w') as log:
-        # start_new_session: run the test driver as its own session/group leader
-        # so the daemon, clients and flipper it spawns inherit that group. A
-        # timeout then killpg's the whole tree (not just the driver), and the
-        # lock-file sweep can reap a SIGKILLed run's stranded group the same way.
-        proc = subprocess.Popen(
-            cmd,
-            stdout=log, stderr=subprocess.STDOUT,
-            env=env, cwd=env.get('TOOLDIR', '.'),
-            start_new_session=True,
-        )
-        try:
-            result = proc.wait(timeout=timeout)
-        except subprocess.TimeoutExpired:
-            # Reap the whole session group, but only if the driver really is its
-            # own group leader (start_new_session took) and that group isn't ours
-            # -- killpg of our own group would take down the runner.
-            try:
-                pgid = os.getpgid(proc.pid)
-            except OSError:
-                pgid = -1
-            if pgid == proc.pid and pgid != os.getpgrp():
-                try:
-                    os.killpg(pgid, signal.SIGKILL)
-                except OSError:
-                    proc.kill()
-            else:
-                proc.kill()
-            proc.wait()
-            result = 1
-            log.write(f"\nTIMEOUT: test took over {timeout} seconds\n")
-
-    # Build output text
-    output_parts = []
-
-    show_log = always_log or (result not in (Exit.PASS, Exit.SKIP, Exit.XFAIL))
-    if show_log:
-        output_parts.append(f'----- {testbase} log follows')
-        try:
-            with open(logfile) as f:
-                output_parts.append(f.read().rstrip())
-        except FileNotFoundError:
-            pass
-        output_parts.append(f'----- {testbase} log ends')
-        rsyncd_log = os.path.join(scratchdir, 'rsyncd.log')
-        if os.path.isfile(rsyncd_log):
-            output_parts.append(f'----- {testbase} rsyncd.log follows')
-            with open(rsyncd_log) as f:
-                output_parts.append(f.read().rstrip())
-            output_parts.append(f'----- {testbase} rsyncd.log ends')
-
-    skipped_reason = ''
-    if result == Exit.PASS:
-        output_parts.append(f'PASS    {testbase}')
-    elif result == Exit.SKIP:
-        whyfile = os.path.join(scratchdir, 'whyskipped')
-        try:
-            with open(whyfile) as f:
-                skipped_reason = f.read().strip()
-        except FileNotFoundError:
-            pass
-        output_parts.append(f'SKIP    {testbase} ({skipped_reason})')
-    elif result == Exit.XFAIL:
-        output_parts.append(f'XFAIL   {testbase}')
-    else:
-        output_parts.append(f'FAIL    {testbase}')
-
-    return TestResult(testbase, result, '\n'.join(output_parts), skipped_reason,
-                      time.monotonic() - started)
-
-
-# Lock for serializing output in parallel mode
-_print_lock = threading.Lock()
-
-
-def main():
-    args = parse_args()
-
-    # Also accept legacy environment variables
-    if args.preserve_scratch or os.environ.get('preserve_scratch') == 'yes':
-        args.preserve_scratch = True
-    if args.log_level == 1:
-        args.log_level = int(os.environ.get('loglevel', '1'))
-    if args.expect_skipped is None:
-        args.expect_skipped = os.environ.get('RSYNC_EXPECT_SKIPPED', 'IGNORE')
-    if args.exclude is None:
-        args.exclude = os.environ.get('RSYNC_EXCLUDE', '')
-    if os.environ.get('whichtests'):
-        args.tests = [os.environ['whichtests']]
-
-    # Determine directories
-    tooldir = args.tooldir or os.environ.get('TOOLDIR') or os.getcwd()
-    script_path = os.path.dirname(os.path.abspath(__file__))
-    srcdir = args.srcdir or script_path
-    if not srcdir or srcdir == '.':
-        srcdir = tooldir
-    rsync_bin = args.rsync_bin or os.environ.get('rsync_bin') or os.path.join(tooldir, 'rsync')
-    # Absolutize: tests run with subprocess(cwd=TOOLDIR) below, so a relative
-    # argv[0] would re-resolve against TOOLDIR rather than the runner's
-    # invocation cwd, breaking --rsync-bin=../foo/rsync forms.  abspath()
-    # captures os.getcwd() now, which is what the operator intended.
-    if rsync_bin and not os.path.isabs(rsync_bin):
-        rsync_bin = os.path.abspath(rsync_bin)
-
-    # Optional second ("peer") binary for the daemon / remote-shell side, so a
-    # run can mix two rsync versions. Defaults to rsync_bin -> no mixing.
-    rsync_bin2 = args.rsync_bin2 or os.environ.get('rsync_bin2') or rsync_bin
-    if rsync_bin2 and not os.path.isabs(rsync_bin2):
-        rsync_bin2 = os.path.abspath(rsync_bin2)
-
-    suitedir = os.path.join(srcdir, 'testsuite')
-    # A backport tree excludes what its base cannot run.  Those tests never
-    # run, so they must also drop out of the expected-skip set -- otherwise the
-    # oracle demands a skip from a test that was never started.
-    backport_excl = read_backport_exclude(tooldir, suitedir)
-    if backport_excl:
-        args.exclude = ','.join(x for x in (args.exclude,
-                                            ','.join(sorted(backport_excl))) if x)
-    if args.expect_skipped != 'IGNORE':
-        args.expect_skipped = expand_skip_spec(args.expect_skipped, srcdir, suitedir)
-        if backport_excl:
-            args.expect_skipped = ','.join(n for n in args.expect_skipped.split(',')
-                                           if n and n not in backport_excl)
-    scratchbase = os.path.join(os.environ.get('scratchbase', tooldir), 'testtmp')
-    os.makedirs(scratchbase, exist_ok=True)
-
-    shconfig = read_shconfig(os.path.join(tooldir, 'shconfig'))
-    tls_args = get_tls_args(os.path.join(tooldir, 'config.h'))
-    setfacl_nodef = find_setfacl_nodef(scratchbase)
-    rsync_cmd = build_rsync_cmd(rsync_bin, args, scratchbase)
-    rsync_peer_cmd = build_rsync_cmd(rsync_bin2, args, scratchbase)
-
-    if not os.path.isfile(rsync_bin):
-        sys.stderr.write(f"rsync_bin {rsync_bin} is not a file\n")
-        sys.exit(Exit.ERROR)
-    if not os.path.isfile(rsync_bin2):
-        sys.stderr.write(f"rsync_bin2 {rsync_bin2} is not a file\n")
-        sys.exit(Exit.ERROR)
-    if not os.path.isdir(srcdir):
-        sys.stderr.write(f"srcdir {srcdir} is not a directory\n")
-        sys.exit(Exit.ERROR)
-
-    # Helper programs the test scripts invoke directly. Missing any of these
-    # would cause many tests to fail with confusing "not found" errors, so
-    # check up front and point the user at the make target that builds them.
-    required_helpers = ['tls', 'trimslash', 't_unsafe', 't_chmod_secure',
-                        't_secure_relpath',
-                        'wildtest', 'getgroups', 'getfsdev']
-    missing = [h for h in required_helpers
-               if not os.path.isfile(os.path.join(tooldir, h))]
-    if missing:
-        sys.stderr.write(
-            f"runtests.py: missing test helper program(s) in {tooldir}: "
-            f"{', '.join(missing)}\n"
-            f"Build them with: make {' '.join(missing)}\n"
-            f"or run the full test target: make check\n"
-        )
-        sys.exit(Exit.ERROR)
-
-    testuser = get_testuser()
-
-    # Print header
-    print('=' * 60)
-    print(f'{sys.argv[0]} running in {tooldir}')
-    print(f'    rsync_bin={rsync_cmd}')
-    if rsync_peer_cmd != rsync_cmd:
-        print(f'    rsync_peer={rsync_peer_cmd}')
-    print(f'    srcdir={srcdir}')
-    print(f'    TLS_ARGS={tls_args}')
-    print(f'    testuser={testuser}')
-    print(f'    os={subprocess.check_output(["uname", "-a"], text=True).strip()}')
-    print(f'    preserve_scratch={"yes" if args.preserve_scratch else "no"}')
-    if args.valgrind:
-        print(f'    valgrind=enabled (logs in valgrind-logs/valgrind.*.log)')
-    if args.parallel > 1:
-        print(f'    parallel={args.parallel}')
-    print(f'    daemon_transport={"tcp (loopback)" if args.use_tcp else "pipe (secure default)"}')
-    print(f'    scratchbase={scratchbase}')
-
-    # Build base environment for test scripts
-    path = os.environ.get('PATH', '')
-    if os.path.isdir('/usr/xpg4/bin'):
-        path = '/usr/xpg4/bin:' + path
-
-    # Make the testsuite/ directory importable so Python tests can `import rsyncfns`.
-    pythonpath = suitedir
-    if os.environ.get('PYTHONPATH'):
-        pythonpath = suitedir + os.pathsep + os.environ['PYTHONPATH']
-
-    base_env = os.environ.copy()
-    base_env.update({
-        'PATH': path,
-        'POSIXLY_CORRECT': '1',
-        'TOOLDIR': tooldir,
-        'srcdir': srcdir,
-        'RSYNC': rsync_cmd,
-        'RSYNC_PEER': rsync_peer_cmd,
-        'TLS_ARGS': tls_args,
-        'RUNSHFLAGS': '-e',
-        'scratchbase': scratchbase,
-        'suitedir': suitedir,
-        'TESTRUN_TIMEOUT': str(args.timeout),
-        'HOME': scratchbase,
-        'PYTHONPATH': pythonpath,
-    })
-    if args.use_tcp:
-        # Opt-in: daemon tests start a real rsyncd on a claimed loopback port.
-        # Default (unset) keeps the secure stdio-pipe transport.
-        base_env['RSYNC_TEST_USE_TCP'] = '1'
-    if args.race_timeout is not None:
-        # Only exported when the operator actually passed --race-timeout: its
-        # mere presence is what tells a race test to override its own default.
-        base_env['race_timeout'] = str(args.race_timeout)
-    else:
-        # A stale value inherited from the environment would silently override
-        # every test's default; the flag is the only way to set this.
-        base_env.pop('race_timeout', None)
-    for k, v in shconfig.items():
-        if v:
-            base_env[k] = v
-    if setfacl_nodef:
-        base_env['setfacl_nodef'] = ' '.join(setfacl_nodef)
-    else:
-        base_env['setfacl_nodef'] = 'true'
-    if args.log_level > 8:
-        base_env['RUNSHFLAGS'] = '-e -x'
-
-    # Collect tests
-    tests = collect_tests(suitedir, args.tests)
-    full_run = len(args.tests) == 0
-
-    # Drop excluded tests entirely (matched by basename against name/glob).
-    excl = [e.strip() for e in args.exclude.split(',') if e.strip()]
-    if excl:
-        before = len(tests)
-        tests = [t for t in tests
-                 if not any(fnmatch.fnmatch(_testbase(t), pat) for pat in excl)]
-        if before != len(tests):
-            print(f"Excluding {before - len(tests)} test(s) matching: "
-                  f"{', '.join(excl)}")
-
-    # Narrow to the daemon-transport tests. The dropped count is always printed:
-    # a pass that silently ran a third of the suite would read in the report as
-    # if it had run all of it.
-    if args.daemon_tests_only:
-        tests, dropped = select_daemon_tests(tests)
-        print(f"Daemon-transport tests only: running {len(tests)}, skipping "
-              f"{len(dropped)} test(s) that cannot observe the transport")
-        # The expected-skip list describes a full run, so it cannot be enforced
-        # against a subset -- same rule as naming tests explicitly.
-        full_run = False
-
-    # An expected-result manifest defines BOTH the run set (its keys) and the
-    # expected per-test outcome (its values). Used for version-mixing runs.
-    expect = parse_expect_result(args.expect_result) if args.expect_result else None
-    if expect is not None:
-        have = {_testbase(t) for t in tests}
-        unknown = sorted(k for k in expect if k not in have)
-        if unknown:
-            sys.stderr.write(
-                "runtests.py: --expect-result lists test(s) with no matching "
-                f"test file (ignored): {', '.join(unknown)}\n"
-            )
-        tests = [t for t in tests if _testbase(t) in expect]
-        full_run = False
-
-    def _cls(outcome):
-        """Equivalence class for outcome comparison: fail and xfail both just
-        mean 'broke', so a manifest 'fail' matches an actual fail OR xfail."""
-        return 'broken' if outcome in ('fail', 'xfail') else outcome
-
-    def mismatch(testbase, actual):
-        """True if actual outcome disagrees with the manifest expectation."""
-        return expect is not None and _cls(expect[testbase]) != _cls(actual)
-
-    # Record test order for consistent skipped-list output
-    test_order = {_testbase(t): i for i, t in enumerate(tests)}
-
-    passed = 0
-    failed = 0
-    skipped = 0
-    xfailed = 0
-    skipped_list = []
-    outcomes = {}  # testbase -> actual outcome string ('pass'/'skip'/'fail'/'xfail')
-    durations = {}  # testbase -> wall-clock seconds (for --timing)
-
-    def process_result(tr):
-        """Process a TestResult and update counters. Returns True if the test
-        should count as a failure for --stop-on-fail purposes."""
-        nonlocal passed, failed, skipped, xfailed
-        with _print_lock:
-            if tr.output:
-                print(tr.output)
-        scratchdir = os.path.join(scratchbase, tr.testbase)
-        oc = outcome_of(tr.result)
-        outcomes[tr.testbase] = oc
-        durations[tr.testbase] = tr.duration
-        if tr.result == Exit.PASS:
-            passed += 1
-        elif tr.result == Exit.SKIP:
-            skipped_list.append(tr.testbase)
-            skipped += 1
-        elif tr.result == Exit.XFAIL:
-            # XFAIL: an expected failure (a known, documented residual the test
-            # asserts against). Reported distinctly but does NOT fail the suite;
-            # when the underlying issue is fixed the test returns 0 instead.
-            xfailed += 1
-        else:
-            failed += 1
-        if tr.result in (Exit.PASS, Exit.SKIP, Exit.XFAIL) and not args.preserve_scratch \
-                and os.path.isdir(scratchdir):
-            subprocess.run(['rm', '-rf', scratchdir], capture_output=True)
-        # With a manifest, only a mismatch is a "failure" (an expected fail is
-        # fine); without one, any non-pass/non-skip/non-xfail result is a failure.
-        if expect is not None:
-            return mismatch(tr.testbase, oc)
-        return tr.result not in (Exit.PASS, Exit.SKIP, Exit.XFAIL)
-
-    run_started = time.monotonic()
-
-    if args.parallel > 1:
-        # Parallel execution
-        with concurrent.futures.ThreadPoolExecutor(max_workers=args.parallel) as executor:
-            futures = {}
-            for testscript in tests:
-                testbase = _testbase(testscript)
-                scratchdir = os.path.join(scratchbase, testbase)
-                timeout = 600 if ('hardlinks' in testbase or testbase == 'variety') else args.timeout
-                f = executor.submit(
-                    run_one_test, testscript, testbase, scratchdir,
-                    base_env, timeout, srcdir, tooldir, setfacl_nodef,
-                    args.always_log
-                )
-                futures[f] = testbase
-
-            for f in concurrent.futures.as_completed(futures):
-                tr = f.result()
-                is_fail = process_result(tr)
-                if is_fail and args.stop_on_fail:
-                    # Cancel pending futures
-                    for pending in futures:
-                        pending.cancel()
-                    break
-    else:
-        # Sequential execution
-        for testscript in tests:
-            testbase = _testbase(testscript)
-            scratchdir = os.path.join(scratchbase, testbase)
-            timeout = 600 if ('hardlinks' in testbase or testbase == 'variety') else args.timeout
-            tr = run_one_test(
-                testscript, testbase, scratchdir,
-                base_env, timeout, srcdir, tooldir, setfacl_nodef,
-                args.always_log
-            )
-            is_fail = process_result(tr)
-            if is_fail and args.stop_on_fail:
-                break
-
-    run_wall = time.monotonic() - run_started
-
-    # Check valgrind logs for errors
-    vg_errors = 0
-    if args.valgrind:
-        for vlog in sorted(glob.glob(os.path.join(scratchbase, 'valgrind-logs', 'valgrind.*.log'))):
-            try:
-                with open(vlog) as f:
-                    content = f.read()
-                for line in content.splitlines():
-                    if 'ERROR SUMMARY:' in line and 'ERROR SUMMARY: 0 errors' not in line:
-                        vg_errors += 1
-                        print(f'----- valgrind errors in {os.path.basename(vlog)}:')
-                        print(content)
-                        break
-            except FileNotFoundError:
-                pass
-
-    # Summary
-    print('-' * 60)
-    print('----- overall results:')
-    print(f'      {passed} passed')
-    if failed > 0:
-        print(f'      {failed} failed')
-    if xfailed > 0:
-        print(f'      {xfailed} xfailed (expected)')
-    if skipped > 0:
-        print(f'      {skipped} skipped')
-    if vg_errors > 0:
-        print(f'      {vg_errors} valgrind error(s) found (see logs in {os.path.join(scratchbase, "valgrind-logs")})')
-
-    if args.timing:
-        print_timing_report(durations, outcomes, run_wall, args.parallel)
-
-    if expect is not None:
-        # Version-mixing mode: the run is judged purely on whether each test's
-        # actual outcome matched its manifest expectation. An expected 'fail'
-        # is fine; an UNEXPECTED pass (xpass) or any other divergence is not.
-        mismatches = []
-        for tb in sorted(expect, key=lambda x: test_order.get(x, 1 << 30)):
-            actual = outcomes.get(tb, 'notrun')
-            if actual == 'notrun' or mismatch(tb, actual):
-                mismatches.append((tb, expect[tb], actual))
-        if mismatches:
-            print('----- expected-result mismatches:')
-            for tb, want, got in mismatches:
-                tag = ' (xpass)' if _cls(want) == 'broken' and got == 'pass' else ''
-                print(f'      {tb}: expected {want}, got {got}{tag}')
-        print('-' * 60)
-        exit_code = len(mismatches) + vg_errors
-        print(f'overall result is {exit_code}')
-        sys.exit(exit_code)
-
-    skipped_str = ','.join(sorted(skipped_list, key=lambda x: test_order.get(x, 0)))
-    if full_run and args.expect_skipped != 'IGNORE':
-        print('----- skipped results:')
-        print(f'      expected: {args.expect_skipped}')
-        print(f'      got:      {skipped_str}')
-    else:
-        skipped_str = ''
-        args.expect_skipped = ''
-
-    print('-' * 60)
-
-    exit_code = failed + vg_errors
-    if exit_code == 0:
-        # Compare the skipped set order-insensitively: which tests skipped is
-        # what matters, not the order runtests happened to collect them in
-        # (that order is just sorted filenames -- an easy thing to get subtly
-        # wrong when maintaining the per-platform expected lists).
-        got = set(s for s in skipped_str.split(',') if s)
-        want = set(s for s in args.expect_skipped.split(',') if s)
-        if got != want:
-            exit_code = 1
-
-    print(f'overall result is {exit_code}')
-    sys.exit(exit_code)
-
-
-if __name__ == '__main__':
-    main()
diff --git a/support/rrsh.sh b/support/rrsh.sh
index 83025f2f5..fc598cf12 100755
--- a/support/rrsh.sh
+++ b/support/rrsh.sh
@@ -1,12 +1,5 @@
 #!/bin/sh
-# abdiff helper: a "remote shell" that emulates an sshd forced-command of
-# `rrsync DIR`.  rsync invokes a remote shell as:
-#     <shell-words...> [ssh-opts] <host> <rsync --server ...>
-# so when used as  -e "sh rrsh.sh <RRSYNC> <DIR>"  rsync calls us as:
-#     sh rrsh.sh <RRSYNC> <DIR> [opts] lh rsync --server ...
-# We hand the server command to rrsync via SSH_ORIGINAL_COMMAND (exactly as
-# sshd would) and exec the restricted wrapper, so abdiff can A/B the rrsync
-# path itself.  Only the pretend hosts "lh"/"localhost" are accepted.
+# Emulate an sshd forced command for the version comparison's rrsync transport.
 RRSYNC="$1"; DIR="$2"; shift 2
 while [ $# -gt 0 ]; do
     case "$1" in
diff --git a/testsuite/00-hello_test.py b/testsuite/00-hello_test.py
deleted file mode 100644
index cdc153798..000000000
--- a/testsuite/00-hello_test.py
+++ /dev/null
@@ -1,104 +0,0 @@
-#!/usr/bin/env python3
-# Python rewrite of testsuite/00-hello.test.
-#
-# Foundational smoke test: --version / --info=help / --debug=help all
-# work, plus a round-trip transfer of a directory whose name contains
-# shell-special characters via the lsh.sh remote-shell stand-in.
-
-import os
-
-from rsyncfns import (
-    FROMDIR, RSYNC, RSYNC_PEER, SRCDIR, TODIR,
-    checkit, run_rsync, test_fail, rsync_path_arg, rsh_cmd,
-)
-
-
-# Set RSYNC_RSH so rsync picks up lsh.sh for the "lh:" hosts below.
-os.environ['RSYNC_RSH'] = rsh_cmd()
-
-# Basic help dumps must not crash.
-if run_rsync('--version', check=False).returncode != 0:
-    test_fail('--version output failed')
-if run_rsync('--info=help', check=False).returncode != 0:
-    test_fail('--info=help output failed')
-if run_rsync('--debug=help', check=False).returncode != 0:
-    test_fail('--debug=help output failed')
-
-weird_name = "A weird)name"
-
-FROMDIR.mkdir(parents=True, exist_ok=True)
-weird_dir = FROMDIR / weird_name
-weird_dir.mkdir()
-
-
-def append_line(line: str) -> None:
-    print(line)
-    with open(weird_dir / 'file', 'a') as f:
-        f.write(line + '\n')
-
-
-def copy_weird(args: list, src_host: str, dst_host: str) -> None:
-    checkit(
-        [*args, f'--rsync-path={rsync_path_arg()}',
-         f'{src_host}{weird_dir}/',
-         f'{dst_host}{TODIR / weird_name}'],
-        FROMDIR, TODIR,
-    )
-
-
-append_line('test1')
-checkit(['-ai', f'{FROMDIR}/', f'{TODIR}/'], FROMDIR, TODIR)
-
-append_line('test2')
-copy_weird(['-ai'], 'lh:', '')
-
-append_line('test3')
-copy_weird(['-ai'], '', 'lh:')
-
-append_line('test4')
-copy_weird(['-ais'], 'lh:', '')
-
-append_line('test5')
-copy_weird(['-ais'], '', 'lh:')
-
-# test6: --old-args lets two whitespace-separated names go through as a
-# single "one two" remote argument to be re-split by the remote shell.
-print('test6')
-(FROMDIR / 'one').touch()
-(FROMDIR / 'two').touch()
-
-saved = os.getcwd()
-os.chdir(FROMDIR)
-try:
-    run_rsync('-ai', '--old-args', f'--rsync-path={rsync_path_arg()}',
-              'lh:one two', f'{TODIR}/')
-finally:
-    os.chdir(saved)
-
-if not (TODIR / 'one').is_file() or not (TODIR / 'two').is_file():
-    test_fail("old-args copy of 'one two' failed")
-
-# test7: the RSYNC_OLD_ARGS=1 env var should be equivalent to --old-args.
-print('test7')
-(TODIR / 'one').unlink()
-(TODIR / 'two').unlink()
-
-env = os.environ.copy()
-env['RSYNC_OLD_ARGS'] = '1'
-import subprocess
-from rsyncfns import rsync_argv
-
-os.chdir(FROMDIR)
-try:
-    subprocess.run(
-        rsync_argv('-ai', f'--rsync-path={rsync_path_arg()}',
-                   'lh:one two', f'{TODIR}/'),
-        env=env, check=True,
-    )
-finally:
-    os.chdir(saved)
-
-# check=True only proves a zero exit; confirm the env-var path actually copied
-# both files (as the explicit --old-args case above does).
-if not (TODIR / 'one').is_file() or not (TODIR / 'two').is_file():
-    test_fail("RSYNC_OLD_ARGS=1 copy of 'one two' failed")
diff --git a/testsuite/COVERAGE.md b/testsuite/COVERAGE.md
index 470d87a09..4f9165764 100644
--- a/testsuite/COVERAGE.md
+++ b/testsuite/COVERAGE.md
@@ -1,204 +1,199 @@
-# rsync option / daemon-parameter test coverage matrix
-
-Living checklist for the test-coverage effort that precedes the path-handling
-restructure of rsync's path resolution. The restructure rewrites parent-directory
-resolution for essentially every option, so the goal here is a regression net
-that exercises each option **at directory depth** (≥3 levels) and, where the
-option spans trees, **across directory boundaries**, asserting the *specific
-property* the option controls — not just `dest == src`.
-
-How to read the columns:
-
-* **test(s)** — the `testsuite/*_test.py` that exercise the option. Tests added
-  by this effort are marked `*new*`.
-* **depth** — Y = asserted on entries ≥3 levels deep; `~` = exercised only at/near
-  the tree root; `n/a` = not a path-resolution option.
-* **x-dir** — Y = exercised with the relevant aux tree (temp/backup/dest/partial)
-  **outside** the main tree; `—` = not a cross-directory option.
-* **gap** — what is still missing.
-
-Status legend: ✓ property asserted · `~` shallow / by an existing ported test ·
-✗ no coverage.
-
----
-
-## Command-line options
-
-### Recursion / structure
-| option | test(s) | depth | x-dir | notes / gap |
-|---|---|---|---|---|
-| -a, --archive | (all) | Y | — | ✓ ubiquitous |
-| -r, --recursive | hands, delete-deep*new* | Y | — | ✓ |
-| -R, --relative | relative, relative-implied*new* | Y | — | ✓ implied-dir attrs at depth |
-| --no-implied-dirs | relative-implied*new* | Y | — | ✓ (proto 30+; proto 29 rejects multi-component path) |
-| --inc-recursive / --no-inc-recursive | hardlinks | Y | — | `~` exercised, not isolated |
-| -d, --dirs | dirs*new* | Y | — | ✓ no-recurse top layer |
-| --old-dirs / --old-d | — | — | — | ✗ |
-| -m, --prune-empty-dirs | prune-empty-dirs*new* | Y | — | ✓ incl. filter-emptied chains |
-
-### Links
-| option | test(s) | depth | x-dir | notes / gap |
-|---|---|---|---|---|
-| -l, --links | links*new*, symlink-ignore | Y | — | ✓ |
-| -L, --copy-links | links*new* | Y | — | ✓ deref file+dir |
-| -k, --copy-dirlinks | links*new* | Y | — | ✓ follow dir-symlink |
-| -K, --keep-dirlinks | symlink-dirlink-basis | Y | — | ✓ #715; skips on no-RESOLVE_BENEATH / --disable-openat2 |
-| -H, --hard-links | hardlinks, hardlinks-deep*new* | Y | Y | ✓ cross-directory hardlink |
-| --copy-unsafe-links | unsafe-links | `~` | — | `~` |
-| --safe-links | safe-links | `~` | — | `~` |
-| --munge-links | (daemon-munge*new* covers the daemon param) | — | — | `~` client option not isolated; local mode is a near no-op |
-
-### Metadata / permissions / ownership
-| option | test(s) | depth | x-dir | notes / gap |
-|---|---|---|---|---|
-| -p, --perms | metadata-depth*new* | Y | — | ✓ exact modes per entry |
-| -E, --executability | executability | `~` | — | `~` |
-| --chmod | metadata-depth*new*, chmod-option | Y | — | ✓ |
-| -A, --acls | acls, acls-depth*new* | Y | — | ✓ |
-| -X, --xattrs | xattrs, xattrs-depth*new* | Y | — | ✓ |
-| -t, --times | metadata-depth*new* | Y | — | ✓ |
-| -U, --atimes | atimes | `~` | — | `~` (same set path as -t, covered deep) |
-| --open-noatime | open-noatime | `~` | — | `~` |
-| -N, --crtimes | crtimes | `~` | — | `~` (skips without crtimes support) |
-| -O, --omit-dir-times | omit-times*new* | Y | — | ✓ |
-| -J, --omit-link-times | omit-times*new* | Y | — | ✓ |
-| -o, --owner | chown, ownership-depth*new* | Y | — | ✓ uid map root-gated |
-| -g, --group | chgrp, ownership-depth*new* | Y | — | ✓ group remap non-root |
-| --super / --fake-super | chown, chown-fake | `~` | — | `~` |
-| --numeric-ids | — | — | — | ✗ client; daemon `numeric ids` also ✗ |
-| --usermap / --groupmap | ownership-depth*new* | Y | — | ✓ groupmap non-root; usermap root-gated |
-| --chown | ownership-depth*new* | Y | — | ✓ group half |
-| -D / --devices / --specials | devices, devices-fake | `~` | — | `~` root/device-gated |
-| --copy-devices / --write-devices | — | — | — | ✗ device-gated |
-| -S, --sparse | sparse*new* | Y | — | ✓ hole preserved at depth |
-
-### Delta / temp / backup / dest (highest restructure risk)
-| option | test(s) | depth | x-dir | notes / gap |
-|---|---|---|---|---|
-| -T, --temp-dir | temp-dir*new*, chmod-temp-dir | Y | Y | ✓ cross-dir rename |
-| --partial | partial*new* | Y | — | ✓ partial kept in dest file |
-| --partial-dir | partial*new*, symlink-dirlink-basis | Y | Y | ✓ relative (in-tree) + absolute (outside), incl. delta resume from an absolute outside-tree partial |
-| --delay-updates | delay-updates, delay-updates-deep*new* | Y | — | ✓ per-dir staging |
-| --inplace | inplace*new*, alt-dest | Y | — | ✓ inode preserved |
-| --append / --append-verify | append*new* | Y | — | ✓ verify split is proto 30+ |
-| -b, --backup / --backup-dir / --suffix | backup, backup-deep*new* | Y | Y | ✓ |
-| --compare-dest / --copy-dest / --link-dest | alt-dest, alt-dest-deep*new* | Y | Y | ✓ link=hardlink, copy=copy, compare=skip |
-| -y, --fuzzy | fuzzy | `~` | — | `~` |
-| -u, --update | update*new* | Y | — | ✓ keeps newer dest, updates older |
-| -W, --whole-file | (used widely; --no-whole-file ubiquitous) | n/a | — | `~` |
-| --mkpath | mkpath | `~` | — | `~` |
-| -x, --one-file-system | — | — | — | ✗ (needs a mount boundary) |
-| --preallocate / --fsync | — | — | — | ✗ |
-| -B, --block-size | — | — | — | ✗ |
-| --max-alloc | max-alloc-zero | — | — | ✓ zero resolves to each peer's supported ceiling; values above the limit are rejected |
-
-### Filtering
-| option | test(s) | depth | x-dir | notes / gap |
-|---|---|---|---|---|
-| -f, --filter / -F | filter-depth*new*, merge | Y | — | ✓ deep per-dir merge |
-| --exclude / --include | filter-depth*new*, exclude, exclude-lsh | Y | — | ✓ |
-| --exclude-from / --include-from | files-from-depth*new* | Y | — | ✓ |
-| -C, --cvs-exclude | cvs-exclude*new* | Y | — | ✓ incl. deep .cvsignore |
-| --files-from | files-from-depth*new* | Y | — | ✓ |
-| -0, --from0 | files-from-depth*new* | Y | — | ✓ |
-| --max-size / --min-size | size-filter*new* | Y | — | ✓ |
-| --existing / --ignore-existing | delete-deep*new* | Y | — | ✓ |
-| --ignore-missing-args / --delete-missing-args | — | — | — | ✗ |
-
-### Deletion
-| option | test(s) | depth | x-dir | notes / gap |
-|---|---|---|---|---|
-| --delete / --del | delete, delete-deep*new* | Y | — | ✓ deep subtree |
-| --delete-before/during/delay/after | delete-deep*new* | Y | — | ✓ all four agree |
-| --delete-excluded | delete | `~` | — | `~` |
-| --max-delete | delete-deep*new* | Y | — | ✓ caps deletions |
-| --remove-source-files | delete | `~` | — | `~` |
-| --force | update*new* | Y | — | ✓ replaces a non-empty dir with a file |
-| --ignore-errors | — | — | — | ✗ (client; daemon `ignore errors` also ✗) |
-
-### Comparison / checksum / compression
-| option | test(s) | depth | x-dir | notes / gap |
-|---|---|---|---|---|
-| -c, --checksum | compare*new* | Y | — | ✓ catches stealth change |
-| -I, --ignore-times | compare*new* | Y | — | ✓ |
-| --size-only | compare*new* | Y | — | ✓ |
-| -@, --modify-window | compare*new* | Y | — | ✓ |
-| --checksum-choice / --checksum-seed | compress-options*new* | Y | — | ✓ every advertised algo |
-| -z, --compress | daemon-gzip-{up,down}load, daemon-refuse-compress | `~` | — | `~` |
-| --compress-choice / --compress-level / --skip-compress | compress-options*new* | Y | — | ✓ |
-
-### Output / reporting (path-irrelevant — checked for output shape)
-| option | test(s) | notes / gap |
-|---|---|---|
-| -i, --itemize-changes | output-options*new*, itemize | ✓ |
-| -n, --dry-run | output-options*new* | ✓ |
-| --stats | output-options*new* | ✓ |
-| --out-format | output-options*new* | ✓ |
-| --list-only | output-options*new* | ✓ |
-| -q, --quiet | output-options*new* | ✓ |
-| --progress / -P | output-options*new* | ✓ (--progress) |
-| -h, --human-readable / -8, --8-bit-output | output-options*new* | ✓ smoke |
-| --version / --help | output-options*new* | ✓ |
-| --info / --debug / --stderr / --no-motd / --outbuf | — | ✗ |
-| -M, --remote-option / --log-file / --log-file-format | — | ✗ (daemon `log file` covered) |
-
-### Batch / connection / misc
-| option | test(s) | notes / gap |
-|---|---|---|
-| --write-batch / --only-write-batch / --read-batch | batch-mode | `~` |
-| -e, --rsh / --rsync-path | ssh-basic, many | `~` |
-| --protocol | check29 / check30 (whole suite) | ✓ |
-| --address / --port | daemon tests under --use-tcp | `~` |
-| --password-file | daemon-auth*new* | ✓ |
-| --early-input / daemon `early exec` | — | ✗ |
-| --sockopts / --blocking-io / --timeout / --contimeout | — | ✗ |
-| -4/-6, --ipv4/--ipv6 | — | ✗ |
-| --stop-after / --stop-at | — | ✗ |
-| --bwlimit | partial*new* (used, not asserted) | `~` |
-| --copy-as | — | ✗ root-gated |
-| --iconv | — | ✗ |
-| -s/--secluded-args, --old-args, --trust-sender | (default arg-protection exercised) | `~` |
-
----
-
-## Daemon (rsyncd.conf) parameters
-
-| parameter | test(s) | notes / gap |
-|---|---|---|
-| path | daemon-access*new*, all daemon tests | ✓ incl. deep sub-path |
-| read only | daemon-access*new*, daemon | ✓ |
-| write only | daemon-access*new* | ✓ |
-| list | daemon-access*new*, daemon | ✓ hidden-but-usable |
-| use chroot | sender-flist-symlink-leak, daemon-chroot-acl | `~` (no=most tests; yes needs root) |
-| munge symlinks | daemon-munge*new* | ✓ /rsyncd-munged/ add+strip |
-| exclude / include | daemon-filter*new*, daemon | ✓ exclude |
-| filter / exclude from / include from | — | ✗ (exclude covers the mechanism) |
-| incoming chmod | daemon-filter*new*, chmod-option | ✓ |
-| outgoing chmod | daemon-filter*new* | ✓ |
-| auth users / secrets file | daemon-auth*new* | ✓ accept/reject/unauth |
-| strict modes | daemon-auth*new* | ✓ rejects world-readable secrets |
-| refuse options | daemon-refuse*new*, daemon-refuse-compress | ✓ named/wildcard/allow-list |
-| pre-xfer exec / post-xfer exec | daemon-exec*new* | ✓ env + abort |
-| early exec | — | ✗ (needs --early-input) |
-| hosts allow / hosts deny | daemon (allow), daemon-chroot-acl (deny) | `~` (needs --use-tcp for real peer) |
-| reverse lookup / forward lookup | daemon-chroot-acl | `~` reverse only |
-| log file / transfer logging / log format | daemon | `~` set, not asserted |
-| max verbosity | daemon | `~` |
-| comment | daemon, daemon-access*new* | ✓ |
-| numeric ids | — | ✗ (hard to observe non-root) |
-| fake super | chown-fake (client side) | ✗ as daemon param |
-| timeout / max connections / lock file | — | ✗ (need --use-tcp + concurrency) |
-| temp dir / open noatime / ignore errors / ignore nonreadable | — | ✗ |
-| charset / name converter / dont compress | — | ✗ |
-| uid / gid / daemon uid / daemon gid / daemon chroot | build_rsyncd_conf (uid/gid when root), daemon-chroot-acl | `~` root-gated |
-| motd file / pid file / port / address / socket options / listen backlog / proxy protocol / syslog facility / syslog tag | — | ✗ (server-startup/connection params) |
-
----
-
-## Known gaps worth a future pass
-* Connection/timeout params (`--timeout`, `--contimeout`, daemon `timeout`,
-  `max connections`) need a real socket + concurrency (run under `--use-tcp`).
-* Root-only behaviours (`-o`/`--usermap` uid remap, real devices, `use chroot
-  = yes`, daemon uid/gid) skip as non-root; run the suite as root to cover.
-* `--ignore-errors`, `-x/--one-file-system`, `--numeric-ids` have no dedicated
-  test yet (lower restructure risk).
+Covered means a test directly checks the behaviour. Partial means the option is exercised without covering its whole contract. Missing identifies work still to do.
+
+Path depth is deep, shallow, untested or N/A. Auxiliary tree is outside, inside only, untested or N/A depending on where the relevant backup, basis, partial or temporary tree is exercised.
+
+## Recursion and structure
+
+Option | Tests | Path depth | Auxiliary tree | Coverage
+--- | --- | --- | --- | ---
+-a, --archive | many | deep | N/A | Covered throughout the suite
+-r, --recursive | basic-transfer, delete-deep | deep | N/A | Covered
+-R, --relative | relative-paths, relative-implied | deep | N/A | Covered with implied-directory attributes
+--no-implied-dirs | relative-implied | deep | N/A | Covered for protocol 30 and later; protocol 29 rejects the multi-component case
+--inc-recursive, --no-inc-recursive, --no-i-r | hardlinks | deep | N/A | Partial: exercised but not isolated
+-d, --dirs | nonrecursive-directories | deep | N/A | Covered without recursion
+--old-dirs, --old-d | old-dirs | shallow | N/A | Covered in both mixed-version remote directions
+-m, --prune-empty-dirs | prune-empty-dirs | deep | N/A | Covered with filter-emptied chains
+
+## Links
+
+Option | Tests | Path depth | Auxiliary tree | Coverage
+--- | --- | --- | --- | ---
+-l, --links | links, symlink-ignore | deep | N/A | Covered
+-L, --copy-links | links | deep | N/A | Covered for file and directory links
+-k, --copy-dirlinks | links | deep | N/A | Covered
+-K, --keep-dirlinks | symlink-dirlink-basis | deep | N/A | Covered for issue 715; unavailable without the secure path resolver
+-H, --hard-links | hardlinks, hardlinks-deep | deep | outside | Covered across directories
+--copy-unsafe-links | safe-links | shallow | N/A | Partial
+--safe-links | safe-links | shallow | N/A | Partial
+--insecure-links | operator-path tests, insecure-links-admin-optout | deep | N/A | Covered for the local opt-out and daemon refusal
+--confine-root | filter-file-confinement, relative-source-ancestor, rrsync-merge-file-confine | deep | N/A | Covered for direct arguments, files-from and restricted shells
+--munge-links | daemon-munge | N/A | N/A | Partial: daemon behaviour is covered but the client option is not isolated
+
+## Metadata, permissions and ownership
+
+Option | Tests | Path depth | Auxiliary tree | Coverage
+--- | --- | --- | --- | ---
+-p, --perms | metadata-depth | deep | N/A | Covered with exact per-entry modes
+-E, --executability | executability | shallow | N/A | Partial
+--chmod | metadata-depth, chmod-option | deep | N/A | Covered
+-A, --acls | acls, acls-depth | deep | N/A | Covered when ACL support is available
+-X, --xattrs | xattrs, xattrs-depth | deep | N/A | Covered when extended attributes are available
+-t, --times | metadata-depth | deep | N/A | Covered
+-U, --atimes | atimes | shallow | N/A | Partial
+--open-noatime | open-noatime | shallow | N/A | Partial
+-N, --crtimes | crtimes | shallow | N/A | Partial and platform-dependent
+-O, --omit-dir-times | omit-times | deep | N/A | Covered
+-J, --omit-link-times | omit-times | deep | N/A | Covered
+-o, --owner | chown, ownership-depth | deep | N/A | Covered with root-gated UID mapping
+-g, --group | chgrp, ownership-depth | deep | N/A | Covered with non-root group remapping
+--super, --fake-super | chown, chown-fake | shallow | N/A | Partial
+--numeric-ids | ownership-depth | deep | N/A | Covered for client UID and GID mapping
+--usermap, --groupmap | ownership-depth | deep | N/A | Covered; user mapping needs root
+--chown | ownership-depth | deep | N/A | Partial: group handling is covered
+-D, --devices, --specials | devices, devices-fake | shallow | N/A | Partial and privilege-dependent
+--drop-D | rrsync-specials-denied | N/A | N/A | Covered for restricted receivers
+--copy-devices, --write-devices | none | untested | N/A | Missing
+-S, --sparse | sparse | deep | N/A | Covered with a hole at depth
+
+## Delta, temporary, backup and basis paths
+
+Option | Tests | Path depth | Auxiliary tree | Coverage
+--- | --- | --- | --- | ---
+-T, --temp-dir | temp-dir, chmod-temp-dir | deep | outside | Covered across filesystems
+--partial | partial | deep | inside only | Covered with a retained destination partial
+--partial-dir | partial, symlink-dirlink-basis | deep | outside | Covered for relative and absolute partial directories with delta resume
+--delay-updates | delay-updates, delay-updates-deep | deep | inside only | Covered for per-directory staging
+--inplace | inplace, alt-dest | deep | inside only | Covered with inode preservation
+--append, --append-verify | append | deep | inside only | Covered; the verification split needs protocol 30 or later
+-b, --backup, --backup-dir, --suffix | backup, backup-deep | deep | outside | Covered
+--compare-dest, --copy-dest, --link-dest | alt-dest, alt-dest-deep, alt-dest-module-escape, operator-path-alt-dest | deep | outside | Covered for skip, copy, hard-link and confinement behaviour
+-y, --fuzzy | fuzzy | shallow | N/A | Partial
+-u, --update | update | deep | N/A | Covered for newer and older destinations
+-W, --whole-file, --no-whole-file | many | N/A | N/A | Partial: widely exercised but not isolated
+--mkpath | mkpath | shallow | N/A | Partial
+-x, --one-file-system | none | untested | untested | Missing; needs a mount boundary
+--preallocate | preallocate | deep | N/A | Covered for allocation and delta updates
+--fsync | none | untested | N/A | Missing
+-B, --block-size | hashsearch-chain, compress-zlib-insert, preallocate | deep | N/A | Covered
+--max-alloc | max-alloc-zero | N/A | N/A | Covered for zero and values above the peer limit
+
+## Filtering
+
+Option | Tests | Path depth | Auxiliary tree | Coverage
+--- | --- | --- | --- | ---
+-f, --filter, -F | filter-depth, multiple-sources | deep | N/A | Covered for deep per-directory merges
+--exclude, --include | filter-depth, exclude, exclude-lsh | deep | N/A | Covered
+--exclude-from, --include-from | files-from-depth | deep | N/A | Covered
+-C, --cvs-exclude | cvs-exclude | deep | N/A | Covered with nested .cvsignore
+--files-from | files-from-depth | deep | N/A | Covered
+-0, --from0 | files-from-depth | deep | N/A | Covered
+--max-size, --min-size | size-filter | deep | N/A | Covered
+--existing, --ignore-non-existing, --ignore-existing | delete-deep | deep | N/A | Covered
+--ignore-missing-args | ignore-missing-args | deep | N/A | Covered for direct, remote-shell and files-from inputs
+--delete-missing-args | delete-missing-args-files-from | shallow | N/A | Covered with files-from
+
+## Deletion
+
+Option | Tests | Path depth | Auxiliary tree | Coverage
+--- | --- | --- | --- | ---
+--delete, --del | delete, delete-deep | deep | N/A | Covered for deep subtrees
+--delete-before, --delete-during, --delete-delay, --delete-after | delete-deep | deep | N/A | Covered
+--delete-excluded | delete | shallow | N/A | Partial
+--max-delete | delete-deep | deep | N/A | Covered
+--remove-source-files | delete | shallow | N/A | Partial
+--force | update | deep | N/A | Covered when replacing a non-empty directory with a file
+--ignore-errors | iconv | N/A | N/A | Covered for deletion after sender input failure
+
+## Comparison, checksum and compression
+
+Option | Tests | Path depth | Auxiliary tree | Coverage
+--- | --- | --- | --- | ---
+-c, --checksum | comparison-options | deep | N/A | Covered for same-metadata content changes
+-I, --ignore-times | comparison-options | deep | N/A | Covered
+--size-only | comparison-options | deep | N/A | Covered
+-@, --modify-window | comparison-options | deep | N/A | Covered
+--checksum-choice, --checksum-seed | compress-options | deep | N/A | Covered for advertised algorithms
+-z, --compress | daemon-gzip, daemon-refuse-compress | shallow | N/A | Partial
+--compress-choice, --compress-level, --skip-compress | compress-options | deep | N/A | Covered
+--compress-threads | daemon-refuse-compress-threads-alias, daemon-zstd-thread-exhaustion | N/A | N/A | Partial: refusal and the daemon worker limit are covered
+
+## Output and reporting
+
+Option | Tests | Coverage
+--- | --- | ---
+-v, --verbose | many | Partial: used widely but verbosity levels are not isolated
+-i, --itemize-changes | output-options, itemize | Covered
+-n, --dry-run | output-options | Covered
+--stats | output-options | Covered
+--out-format | output-options | Covered
+--list-only | output-options | Covered
+-q, --quiet | output-options | Covered
+--progress, -P | output-options | Covered for progress output
+-h, --human-readable, -8, --8-bit-output | output-options | Covered with format assertions
+--version, --help | output-options | Covered
+--info, --debug, --stderr, --no-motd, --outbuf | output-options, daemon-module-options | Covered for selection, routing, MOTD suppression and line buffering
+-M, --remote-option, --log-file, --log-file-format | remote-logging | Covered for client and remote-shell sender or receiver logs
+
+## Batch, connection and miscellaneous options
+
+Option | Tests | Coverage
+--- | --- | ---
+--write-batch, --only-write-batch, --read-batch | batch-mode | Partial
+-e, --rsh, --rsync-path | ssh-basic and many others | Partial
+--protocol | check29 and check30 | Covered across the selected suite
+--daemon, --config, --detach, --no-detach | daemon-standalone-detach, daemon-stdin tests | Covered for detached, foreground and inherited-socket startup
+--dparam | none | Missing
+--address, --port | daemon-address-family, daemon-standalone-detach | Covered for IPv4, IPv6 and configured binding
+--password-file | daemon-auth | Covered
+--early-input | daemon-early-exec-nameconv, early-input-symlink | Covered for data delivery and confined input paths
+--sockopts | daemon-module-options | Covered for client and daemon configuration
+--blocking-io | none | Missing
+--timeout, --contimeout | daemon-handshake-timeout, msg-io-timeout-zero, msg-io-timeout-overflow, contimeout-rsh | Covered for precedence, bounds and remote-shell daemon paths
+-4, -6, --ipv4, --ipv6 | daemon-address-family | Covered for daemon binding and client connection
+--stop-after, --stop-at | stop-time | Covered for future, past and duration parsing
+--bwlimit | partial | Partial: used but not asserted directly
+--copy-as | none | Missing and root-gated
+--iconv | iconv | Covered for names, arguments, file lists, protocol 30 link targets and invalid input; the raw-byte fixture is unavailable on macOS
+-s, --secluded-args, --old-args, --trust-sender | iconv, smoke | Partial: secluded and legacy argument handling are asserted; trust-sender is not isolated
+
+## Daemon parameters
+
+Parameter | Tests | Coverage
+--- | --- | ---
+path | daemon-access and daemon-basics | Covered with nested paths
+read only | daemon-access, daemon-basics | Covered
+write only | daemon-access | Covered
+list | daemon-access, daemon-basics | Covered for hidden but usable modules
+use chroot | sender-flist-symlink-leak, daemon-chroot-acl | Partial: the enabled case needs root
+insecure links | insecure-links-admin-optout, daemon-symlink-escape-matrix | Covered for the administrative opt-out
+munge symlinks | daemon-munge | Covered for prefix addition and removal
+exclude, include | daemon-filter, daemon-basics | Covered for exclusion
+filter, exclude from, include from | none | Missing as daemon parameters
+incoming chmod | daemon-filter, chmod-option | Covered
+outgoing chmod | daemon-filter | Covered
+auth users, secrets file | daemon-auth | Covered for acceptance and rejection
+auth digest | daemon-auth-digest-floor | Covered for minimum strength, old peers and invalid configuration
+strict modes | daemon-auth | Covered for unsafe secrets-file modes
+refuse options | daemon-refuse, daemon-refuse-compress | Covered for names, wildcards and allow lists
+pre-xfer exec, post-xfer exec | daemon-exec | Covered for environment and abort behaviour
+early exec | daemon-early-exec-nameconv | Covered for environment and early input
+hosts allow, hosts deny | daemon-basics, daemon-chroot-acl | Partial: a real TCP peer is required
+reverse lookup, forward lookup | daemon-chroot-acl | Partial: reverse lookup only
+log file, transfer logging, log format | daemon-basics | Partial: configured but not asserted
+max verbosity | daemon-basics | Partial
+comment | daemon-basics, daemon-access | Covered
+numeric ids | daemon-early-exec-nameconv, daemon-namecvt tests | Covered for numeric ids = no
+fake super | chown-fake, daemon-namecvt-empty-response | Covered
+timeout | daemon-handshake-timeout | Covered with zero and precedence
+max connections, lock file | daemon-connection-limits | Covered for refusal and slot reuse
+temp dir, open noatime, ignore errors, ignore nonreadable | iconv | Partial: ignore errors is asserted
+charset | iconv | Covered for module override of the remote charset
+name converter | daemon-early-exec-nameconv, daemon-namecvt tests | Covered for success, empty and malformed responses
+dont compress | daemon-module-options | Partial: configured but compression choice is not asserted
+uid, gid, daemon uid, daemon gid, daemon chroot | build_rsyncd_conf, daemon-chroot-acl | Partial and root-gated
+motd file | daemon-module-options | Covered for banner content
+socket options | daemon-module-options | Partial: the live socket path runs but kernel effects are not inspected
+pid file, port, address | daemon-standalone-detach, daemon-address-family | Covered for configuration and CLI paths
+proxy protocol, proxy protocol hosts | daemon-proxy-protocol, proxy-protocol-trusted-peer | Covered for enabled, disabled and trusted-peer policy
+listen backlog, syslog facility, syslog tag | none | Missing
diff --git a/testsuite/README.md b/testsuite/README.md
index 3536a3660..ad51147ef 100644
--- a/testsuite/README.md
+++ b/testsuite/README.md
@@ -1,304 +1,91 @@
 # rsync testsuite
 
-This directory holds rsync's automated regression tests. Ideally every code
-change or bug fix comes with a test that would have caught the problem.
+Rsync's automated tests live here. Bug fixes **should** include a regression test when practical.
 
-The tests are Python scripts named `testsuite/*_test.py`, driven by the
-`runtests.py` harness at the top of the tree (the old shell-based `runtests.sh`
-is gone). Shared helpers live in `testsuite/rsyncfns.py`. A handful of C helper
-programs (`tls`, `getgroups`, `trimslash`, …) are built alongside `rsync` and
-used by some tests. Coverage notes are in [COVERAGE.md](COVERAGE.md).
+## Layout
+- `testsuite/tests/` groups test scripts by the subsystem they exercise
+- `testsuite/runtests.py` is the test runner entry point
+- `testsuite/harness/` contains the runner plus shared fixtures, assertions and protocol support
+- `testsuite/profiles/` records platform capabilities and peer deviations
+- `testsuite/tools/` contains standalone fixture and comparison tools
+- [COVERAGE.md](COVERAGE.md) records option and daemon-parameter coverage
 
-## Writing tests
-
-Favour readability — a test is also documentation of the behaviour it pins, so
-prefer clarity over cleverness:
-
-* When a test writes an `rsyncd.conf`, write it as a triple-quoted f-string so
-  the actual config is readable top-to-bottom, with module parameters indented
-  with plain spaces. Don't build it from adjacent string literals full of `\n`
-  (and `\t`) escapes. The daemon's parser accepts space-indented parameters.
-* Better still, use the structured helpers in `rsyncfns.py` when a stock config
-  will do: `write_daemon_conf(modules, globals)` (per-test modules/params) or
-  `build_rsyncd_conf()` (the four standard modules). They also handle the
-  root-only `uid`/`gid` lines for you (needed so a `use chroot = no` daemon run
-  as root can read a root-owned module).
-* For config that varies (e.g. those root-only `uid`/`gid` lines), interpolate a
-  single optional block that expands when needed and is an empty string
-  otherwise, rather than splicing pieces together:
-
-  ```python
-  root = get_testuid() == get_rootuid()
-  ids = f"uid = {get_rootuid()}\ngid = {get_rootgid()}" if root else ""
-  conf.write_text(f"""\
-  pid file = {base}/rsyncd.pid
-  use chroot = no
-  {ids}
-  log file = {base}/rsyncd.log
+Some tests also use C helpers built with rsync.
 
-  [m]
-      path = {mod}
-      read only = yes
-  """)
-  ```
+The test groups are build, daemon, harness, metadata, path, protocol, rrsync and transfer. The group does not form part of a test name. Selectors, profiles and receipts use the filename without a `.py` file ending. Security, compatibility and cost remain test metadata because they apply across those groups.
 
-## Running the tests
-
-### Via make
+## Writing tests
 
-Run from the build directory:
+A regression test should assert the behaviour being fixed. A final source and destination comparison can miss the actual bug.
 
-- **`make check`** — build the helper programs and run the whole suite in
-  parallel (`CHECK_J`, default 8) against the just-built `./rsync`. You do **not**
-  need `make install` first; indeed you generally should not install before
-  testing. Use `make check CHECK_J=1` to run serially.
-- **`make check29`** / **`make check30`** — the same, forcing protocol version 29
-  or 30.
-- **`make installcheck`** — run the suite against the *installed* binary (e.g.
-  `/usr/local/bin/rsync`). Per the GNU standards this does not search `$PATH`.
-  Handy for testing a distribution build.
-- **`make check-progs`** — (re)build just the C helper programs the tests need,
-  without running anything.
-- **`make coverage`** / **`coverage-tcp`** / **`coverage-all`** — generate an HTML
-  coverage report (needs `./configure --enable-coverage` and `gcovr`);
-  `coverage-all` merges runs across protocol versions and the tcp transport.
+Function-based tests use one `@requires(...)` decorator. Module tests use one top-level `metadata(...)` call. Declare any capability passed to `test_skipped()` and use `require_tcp()` or `require_asan()` for those checks.
 
-### Via runtests.py directly
+Use `TestContext` or the paths in `harness.rsync` for scratch data. Do not write into the source tree or use sleeps for synchronisation and timestamp changes. Tests run in parallel by default and must clean up their processes, sockets and temporary files. Use `write_daemon_conf()` or `build_rsyncd_conf()` for ordinary daemon configurations.
 
-`make check` just drives `runtests.py`; run it directly for finer control. It
-defaults `--rsync-bin` to `./rsync`, so run it from the build directory (or pass
-`--rsync-bin` / `--tooldir`):
+## Running tests
 
+Run the standard suite from a configured build directory:
 ```sh
-./runtests.py                 # all tests
-./runtests.py chmod-temp-dir  # a single test by name
-./runtests.py 'xattr*'        # a glob of test names
+make check
 ```
 
-Useful options:
-
-- `-j N`, `--parallel N` — run up to N tests at once
-- `--use-tcp` — run daemon tests against a real `rsyncd` on `127.0.0.1` (the
-  default runs them over a stdio pipe). **Read the security warning below before
-  using this on a shared machine.**
-- `--protocol VER` — force a protocol version
-- `--preserve-scratch` — keep each test's scratch dir afterwards
-- `--log-level N`, `--always-log` — more verbose output / show logs for passing tests too
-- `--stop-on-fail` — stop after the first failure
-- `--timeout SECS` — per-test timeout (default 300)
-- `--timing` — after the run, list the tests by wall-clock, slowest first, with
-  the serial sum and the floor set by the single longest test
-- `--race-timeout SECS` — budget a TOCTOU race test may spend trying to win its
-  race. These are the suite's slowest tests: a race test is a negative oracle,
-  so it passes by spending its *whole* budget (5–15s each by default). Lowering
-  this speeds the suite up and weakens the oracle in equal measure.
-- `--valgrind`, `--valgrind-opts OPTS` — run rsync under valgrind
-- `--rsync-bin PATH`, `--tooldir DIR`, `--srcdir DIR` — locate the binary / build / source dirs
-- `--expect-skipped LIST` — see skip enforcement below
-
-### Security warning: `--use-tcp`
-
-> **⚠️ Do not use `--use-tcp` on a machine with untrusted local users.**
->
-> `--use-tcp` starts a real `rsync` daemon listening on a loopback TCP port
-> (`127.0.0.1` / `::1`) and **deliberately configures insecure test scenarios**
-> (daemon modules without authentication, unsafe options enabled, etc.). Loopback
-> addresses are reachable by *every* local user, so for as long as the tests run,
-> any other user on the machine can connect to that daemon and exploit those
-> deliberately-insecure modules — potentially reading or writing files with the
-> privileges of the user running the tests (which is **root** if you run the suite
-> as root).
->
-> Only run `--use-tcp` where there are **no possible local users who might try to
-> exploit it** — a single-user workstation or a dedicated, isolated CI machine.
-> The default stdio-pipe transport carries no such risk: it talks to the daemon
-> over a private pipe with nothing listening on the network, so prefer it on any
-> shared or multi-user host.
-
-### Results and exit codes
-
-Each test prints one result line — `PASS`, `FAIL`, `ERROR`, `SKIP` (with a
-reason), or `XFAIL` (an expected failure) — and the run ends with a
-`passed / failed / skipped` summary. Per-test exit-code convention:
-
-| code | meaning |
-|------|---------|
-| 0    | pass    |
-| 1    | fail    |
-| 2    | error   |
-| 77   | skip    |
-| 78   | xfail   |
-
-`runtests.py` exits non-zero if any test fails. Some tests need root or another
-precondition and otherwise `SKIP` — read the individual test scripts for details.
-
-**Skip enforcement:** on a full run, set `RSYNC_EXPECT_SKIPPED=a,b,c` (or
-`--expect-skipped a,b,c`) and the run fails if the set of skipped tests does not
-match. This is how the CI workflows pin each platform's expected skip set. An
-`@FILE` entry reads a skip list (one test per line) instead, and several may be
-composed: the workflows use
-`@testsuite/skiplist/common.txt,@testsuite/skiplist/linux.txt`. Keeping the
-lists one-name-per-line is what stops two branches that each add a skipping test
-from conflicting -- see `testsuite/skiplist/README.md`.
-
-### Scratch dirs and debugging
-
-Each test runs in `testtmp/<name>/`. On failure the scratch directory is left in
-place (also `--preserve-scratch`); including its logs in a bug report is helpful.
-
-### Preconditions
-
-You need `python3`, `/bin/sh`, and the normal build toolchain. The ACL/xattr
-tests need the `acl` and `attr` tools (`getfacl`/`setfacl`,
-`getfattr`/`setfattr`) and skip if they are absent. Some tests need root.
-
-These tests also run in CI via GitHub Actions (see `.github/workflows/`).
-
-## Fleet testing (fleettest.py)
-
-`testsuite/fleettest.py` builds the committed HEAD of an rsync checkout on a
-fleet of remote machines over ssh and runs the suite under both transports
-(stdio-pipe and `--use-tcp`) in parallel, reporting only the *unexpected*
-results. It is a fast local pre-flight for the GitHub CI matrix: each target
-mirrors a `.github/workflows/*.yml` job — its configure flags, and the
-`RSYNC_EXPECT_SKIPPED` list parsed straight from the workflow.
-
-Because every run includes a `--use-tcp` pass, the fleet stands up the insecure
-loopback test daemon on each target — so only point it at machines with **no
-untrusted local users** (see the [security warning](#security-warning---use-tcp)
-above).
-
-The fleet — which machines, and how to reach and build on each — is described in
-a JSON file. Copy the bundled example (it is git-ignored) and edit it for your
-hosts:
-
+Other make targets:
 ```sh
-cp testsuite/fleettest.json.example testsuite/fleettest.json   # then edit
-# (or symlink it, or point elsewhere with --fleet PATH)
+make check CHECK_J=1
+make check29
+make check30
+make check-progs
+make installcheck
+make coverage-all
 ```
 
-The config is looked up in order: `~/.fleettest.json` first, then
-`testsuite/fleettest.json`, unless overridden with `--fleet PATH`.
-
-Each entry names an ssh host (`null` to run locally), the workflow it mirrors,
-and its configure flags, plus optional per-target settings (`make`, `privilege`,
-`env_prefix`, …). See the comments in `fleettest.json.example`.
+The runner accepts names and shell patterns:
+```sh
+./testsuite/runtests.py
+./testsuite/runtests.py chmod-temp-dir
+./testsuite/runtests.py 'xattr*'
+```
 
-A target with `"nonroot": true` does an extra pass, after the main (root) run,
-that reruns the privilege-sensitive tests as the unprivileged ssh user. Which
-tests those are is **not** listed in the fleet config — a test opts in by
-setting a module-level `fleet_nonroot = True`, so the set is maintained in the
-test files and new privilege-sensitive tests join automatically with no
-fleet-config change.
+The main controls are `-j`, `--rsync-bin`, `--rsync-bin2`, `--protocol`, `--profiles`, `--use-tcp`, `--daemon-tests-only`, `--race-timeout`, `--receipt`, `--describe-tests` and `--valgrind`. Run `./testsuite/runtests.py --help` for the full list.
 
-A target with `"protocols": [30, 29]` runs one extra stdio-pipe pass per listed
-version, each forcing that older wire version with `runtests --protocol=N` — the
-fleet analogue of a workflow's `check30`/`check29` steps. Each pass takes the
-`RSYNC_EXPECT_SKIPPED` spec from the workflow's own `check30`/`check29` step, so
-a lane with extra protocol-gated skips (`check29` adds
-`@testsuite/skiplist/proto29.txt`) is enforced correctly. They show up as
-`protoNN` columns in the report (and `--timing` breakdown); targets that don't
-set `protocols` show `-` there.
+## TCP daemon mode
 
-Run it from inside a checkout (it builds the current directory's HEAD; use
-`--repo PATH` for another tree):
+`--use-tcp` starts unauthenticated test daemons on loopback addresses and some fixtures enable unsafe daemon options. Other local users can reach those listeners, so use the default pipe transport on shared hosts.
 
-```sh
-python3 testsuite/fleettest.py                       # whole fleet, both transports
-python3 testsuite/fleettest.py --list                # list configured targets
-python3 testsuite/fleettest.py --targets NAME[,NAME]
-python3 testsuite/fleettest.py --fleet other.json --transport pipe
-python3 testsuite/fleettest.py --timing              # per-target wall-clock breakdown
-python3 testsuite/fleettest.py --keep-on-fail        # keep logs + tree where it broke
-python3 testsuite/fleettest.py --full-tcp            # whole suite in the tcp pass too
-```
+`--daemon-tests-only` is for a TCP pass that follows a full pipe pass. It omits tests that cannot observe the transport choice.
 
-`--timing` adds a per-target breakdown after the report — total wall-clock plus
-the push / build / pipe / tcp / protoNN / nonroot phases, sorted slowest-first. Targets
-run in parallel, so the whole run is gated by the slowest one; the phase columns
-show whether that target's hold-up is the push, the build, or a test pass. It
-also passes `--timing` down to each target's `runtests.py`, so the captured
-output attributes a slow pass to individual tests.
+## Results and profiles
 
-The `tcp` pass runs **only the tests that can reach the daemon transport**, since
-it follows a full pipe pass over the very same build. `--use-tcp` is observable
-through exactly one path — `RSYNC_TEST_USE_TCP` is read once in `rsyncfns`
-(`USE_TCP`) and acted on once, in `start_test_daemon()` — so a test that never
-gets there produces an identical result twice. That drops 186 of the 340 tests
-and roughly a third of the pass's work; the count skipped is always printed.
-Pass `--full-tcp` to sweep the whole suite there anyway. The narrowing applies
-only when both transports run: under `--transport tcp` that pass is the only
-one, so it runs the whole suite regardless.
+Result | Meaning
+--- | ---
+PASS | The assertion passed
+FAIL | The assertion failed
+ERROR | The test environment or harness failed
+SKIP | The test did not run
+UNSUPPORTED | A declared capability was unavailable
+XFAIL | A known defect reproduced
+XPASS | A known defect no longer reproduced
+PROFILE_ERROR | The result disagreed with the active profile
 
-`--keep-on-fail [DIR]` makes a failure inspectable without repeating the run.
-For every target that came back with anything unexpected it writes the full
-build and per-transport output to `DIR/<run_id>/<target>/` (default
-`./fleettest-logs`) and keeps that target's remote run dir, with the scratch
-trees its failing tests left behind. Targets that came back clean are swept as
-usual. This matters most for the race tests, which may not fail the same way
-twice — and because a re-run costs a full configure + build on every machine.
+Exit codes are 0 for pass, 1 for fail, 2 for error, 77 for skip and 78 for expected failure.
 
-Each run gets its own randomly-named build dir on every target
-(`<builddir>-<run_id>`), so two or three runs can share the same fleet without
-interfering. The dir is removed when the run ends — on success or failure, and
-best-effort on Ctrl-C/kill; pass `--keep` to retain it for inspection. A hard
-kill (`SIGKILL`), or a signal arriving mid-push, can leave a stray
-`<builddir>-<id>` behind; sweep leftovers with
-`python3 testsuite/fleettest.py --cleanup` (scope it with `--targets`, and only
-run it when no other fleet runs are active, since it removes *all* matching run
-dirs on the selected targets).
+Profiles compose by name. For example `--profiles=linux,peer-3.4.1` combines the Linux capabilities with the known deviations for that peer. Tests tagged `version-mix` are selected from metadata.
 
-Each target must be provisioned with the build toolchain its workflow installs
-(autoconf, automake, a C compiler, perl, a python3 markdown module such as
-cmarkgfm or commonmark unless the flags pass `--disable-md2man`, and the dev
-libraries its configure flags enable). A missing piece shows up as `BUILD-FAIL`.
+An unsupported result is accepted only when the test declares the capability and the active profile permits its absence. A generic skip is a profile error. Receipts retain the raw outcome and the profile verdict.
 
-## Differential regression hunting (abdiff.py)
+## Scratch data and requirements
 
-`testsuite/abdiff.py` is a developer tool — **not** a `*_test.py`, so `runtests.py`
-ignores it. It hunts *regressions* by running the **same benign transfer** with
-two rsync binaries (`A` = the build under test, `B` = a baseline) and comparing
-the OUTCOME. The oracle is: for a benign input, a correctness/behaviour change
-between the builds must be **invisible**, so A and B must produce an identical
-result. Any divergence is a regression candidate to investigate and, if real,
-minimize into a `*_test.py`.
+Tests use `testtmp/<name>/`; failed scratch directories remain for inspection. The suite needs Python 3, `/bin/sh` and the normal build toolchain. ACL and extended-attribute tests also need the platform ACL and attr tools.
 
-It compares exit code, stderr (error markers + normalised text), `--stats`
-"Literal data", the destination tree (content + full metadata: mode/uid/gid/
-mtime/size/symlink target/xattrs/ACLs/hardlink grouping), the `--itemize` list,
-and — with `--cost` — peak process-group RSS (a resource-regression oracle that
-functional comparison misses). A **stability gate** runs each binary several
-times and escalates on a candidate diff; nondeterministic scenarios are
-quarantined `FLAKY`, never reported as regressions.
+## Differential testing
 
-Run it from the build directory (so `./rsync` and `old_versions/` resolve):
+The version comparison tool runs the same transfer with two rsync binaries and compares the result, diagnostics, file data, metadata and optional peak memory.
 
+Examples:
 ```sh
-testsuite/abdiff.py                       # default: ./rsync vs old_versions/rsync_3.4.1
-testsuite/abdiff.py --sweep all -j5       # broad single pass, 5-way parallel
-testsuite/abdiff.py --loop --timelimit 3600 --cost   # hunt for an hour, resource oracle on
-testsuite/abdiff.py --list --sweep all    # list scenarios without running
+python3 -m testsuite.tools.compare_versions
+python3 -m testsuite.tools.compare_versions --sweep all -j5
+python3 -m testsuite.tools.compare_versions --loop --timelimit 3600 --cost
 ```
 
-Each finding is classed `DIFF` (regression candidate), `ALLOW` (an intentional,
-documented behaviour change listed in the tool's allowlist), `BETTER` (A succeeds
-where B fails), `FLAKY`, or `TIMEOUT`. Findings are printed and appended to a
-per-run `abdiff-log_<TIME>.txt` (and the curated `--findings` log).
-
-Key options: `-j N` parallelism; `--sweep NAME|all`; `--loop` (endless
-random + systematic-combo stream) bounded by `--timelimit SECS`; `--cost`
-(+`--scale N` for the large-tree fixtures); `--repeat N` (stability samples);
-`--rsync-a`/`--rsync-b` the two binaries. Run **as root** to fold in the
-owner/device/specials/fake-super and chroot-daemon sweeps automatically.
-
-Transport lanes (a feature broken only over the wire is invisible to a local
-copy): local, an ssh split (`support/lsh.sh`), a stdio-pipe daemon, a **real TCP
-daemon** (bound port + greeting/handshake, and an auth challenge-response
-variant), and the restricted **rrsync** wrapper (`support/rrsh.sh`). rrsync's
-behaviour ships in the *script*, so pair each binary with its own version's
-rrsync via `--rrsync-a`/`--rrsync-b` (give B's rrsync, e.g. one extracted from
-that release's `support/rrsync`).
-
-Cross-version baselines are the static binaries already in `old_versions/`;
-`old_versions/build_static.sh` builds more from a git tag (and you can grab a
-matching `support/rrsync` from the same tag for the rrsync lane).
+The available transports are local copy, `support/lsh.sh`, a pipe daemon, a TCP daemon and rrsync. Pair each binary with the matching rrsync script when testing that transport. Historical binaries live in `old_versions/`. Investigate differences and confirm the intended behaviour before adding a focused test under the relevant `testsuite/tests/` group.
diff --git a/testsuite/acl-symlink-race_test.py b/testsuite/acl-symlink-race_test.py
deleted file mode 100644
index 039888cba..000000000
--- a/testsuite/acl-symlink-race_test.py
+++ /dev/null
@@ -1,169 +0,0 @@
-#!/usr/bin/env python3
-# Symlink-race (TOCTOU) LPE in the receiver's ACL-apply path.
-#
-# rsync applies a received ACL with the path-based sys_acl_set_file() ->
-# acl_set_file(), which follows symlinks at the final component (POSIX has no
-# AT_SYMLINK_NOFOLLOW for ACLs) and -- unlike do_chmod_at()/do_lchown_at() --
-# has no fd-held/secure wrapper. In a "use chroot = no" daemon there is a
-# window between do_mknod_at() creating a FIFO and set_acl() applying its ACL.
-# A local attacker who flips the leaf fifo <-> symlink->privileged-file in that
-# window gets the source FIFO's ACL written to the symlink target: an LPE, since
-# the attacker chooses the ACL (e.g. grant themselves rwx on a root-owned file).
-#
-# The source FIFO carries a marker entry user:MARKER_UID:rwx; the test asserts
-# the outside privileged sentinel never gains that entry no matter how the race
-# lands. RED on the unhardened tree; GREEN once the ACL set goes through a held
-# fd that can't be redirected by a symlink.
-
-import os
-import platform
-import shutil
-import subprocess
-import time
-
-from rsyncfns import (
-    SCRATCHDIR, race_budget,
-    forced_protocol, get_rootgid, get_rootuid, get_testuid,
-    rmtree, run_rsync, rsync_argv, start_path_flipper, stop_flipper,
-    start_test_daemon, test_fail, test_skipped,
-)
-
-DAEMON_PORT = 12896
-MARKER_UID = 60001          # distinctive; must not appear in the baseline ACL
-
-
-# ---- gates -----------------------------------------------------------------
-if platform.system() != 'Linux':
-    test_skipped("POSIX ACL race test is Linux-only (setfacl/getfacl semantics)")
-if not shutil.which('setfacl') or not shutil.which('getfacl'):
-    test_skipped("setfacl/getfacl not available")
-# Protocol gate FIRST: this test transfers an ACL over the wire, which requires
-# protocol 30+ regardless of the host's ACL capability.  It MUST precede the
-# ACL_at check below: on a no-xattrat box that check short-circuits to a PASS,
-# so if it ran first a proto-29 run would PASS where an xattrat box SKIPs --
-# diverging from the kernel-independent RSYNC_EXPECT_SKIPPED check29 list and
-# failing CI on the no-xattrat Ubuntu runners.
-proto = forced_protocol()
-if proto is not None and proto < 30:
-    test_skipped(f"ACL transfer requires protocol 30+ (negotiated {proto})")
-vv = run_rsync('-VV', check=True, capture_output=True)
-if '"ACLs": true' not in vv.stdout:
-    test_skipped("rsync built without ACL support")
-if '"ACL_at": true' not in vv.stdout:
-    # No race-safe ACL primitive on this kernel (no *xattrat, pre-6.13 / BSD):
-    # by project policy a received ACL is then applied via the path so --acls
-    # keeps working, which re-opens this race.  The race is an accepted residual
-    # on platforms that cannot offer the secure primitive, so there is nothing
-    # to assert here.  We PASS (rather than skip) so the proto-30+ skip set stays
-    # kernel-independent (a no-xattrat and an xattrat box behave the same here).
-    print("acl-symlink-race: no race-safe ACL primitive on this platform; "
-          "--acls is functional-but-racy here by policy (race not asserted)")
-    raise SystemExit(0)
-
-
-def setfacl(spec, path):
-    if subprocess.run(['setfacl', '-m', spec, str(path)]).returncode != 0:
-        test_skipped("filesystem has ACLs disabled (setfacl failed)")
-
-
-def getfacl(path) -> str:
-    # Plain getfacl only: the suite runs with POSIXLY_CORRECT=1, under which
-    # getfacl rejects -c/-E and accepts just the file argument.
-    return subprocess.run(['getfacl', str(path)],
-                          capture_output=True, text=True).stdout
-
-
-def facl_has_marker(path) -> bool:
-    return f'user:{MARKER_UID}:' in getfacl(path)
-
-
-# ---- layout ----------------------------------------------------------------
-mod = SCRATCHDIR / 'module'
-outside = SCRATCHDIR / 'outside'
-src = SCRATCHDIR / 'src_files'
-conf = SCRATCHDIR / 'test-rsyncd.conf'
-
-for d in (mod, outside, src):
-    rmtree(d)
-    d.mkdir(parents=True)
-
-# The privileged file the attacker wants to grant themselves access to.
-priv = outside / 'privileged'
-priv.write_text("ROOT_OWNED_SECRET\n")
-os.chmod(priv, 0o600)
-if facl_has_marker(priv):
-    test_fail("baseline outside file already carries the marker ACL")
-
-# Source FIFO carrying the attacker-chosen marker ACL.
-victim_src = src / 'victim'
-os.mkfifo(victim_src, 0o600)
-setfacl(f'user:{MARKER_UID}:rwx', victim_src)
-
-# Attacker's symlink inside the module, pointing at the privileged file.
-os.symlink(str(priv), mod / '.evil')
-
-my_uid = get_testuid()
-root_uid = get_rootuid()
-root_gid = get_rootgid()
-uid_line = f"uid = {root_uid}"
-gid_line = f"gid = {root_gid}"
-if my_uid != root_uid:
-    uid_line = '#' + uid_line
-    gid_line = '#' + gid_line
-
-conf.write_text(f"""\
-use chroot = no
-{uid_line}
-{gid_line}
-log file = {SCRATCHDIR}/rsyncd.log
-[upload]
-    path = {mod}
-    use chroot = no
-    read only = no
-""")
-
-url = start_test_daemon(conf, DAEMON_PORT)
-
-
-def push():
-    subprocess.run(
-        rsync_argv('-rtpA', '--specials', f'{src}/', f'{url}upload/'),
-        stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL,
-    )
-
-
-# ---- positive control: a normal push carries the FIFO's ACL into the module,
-# so the race below isn't vacuous (ACLs really are being applied). ------------
-push()
-landed = mod / 'victim'
-if not facl_has_marker(landed):
-    test_fail("positive control: a normal push did not apply the FIFO's ACL in "
-              "the module -- the daemon isn't preserving special-file ACLs, so "
-              "the race scenario would be vacuous")
-# Clean the control artifact so the flipper starts from a known state.  It is a
-# FIFO: use unlink, not rmtree -- shutil.rmtree on a pre-3.11 Python does
-# os.open(path, O_RDONLY) on the target, which blocks forever on a writerless
-# FIFO (the daemon-side hang seen on Ubuntu 22.04's Python 3.10).
-landed.unlink()
-
-
-# ---- the race --------------------------------------------------------------
-# Flip the destination leaf between the FIFO rsync creates and the symlink to
-# the privileged file. If set_acl() resolves the leaf while it is the symlink,
-# the marker ACL lands on the privileged file.
-flip = start_path_flipper(mod / 'victim', mod / '.evil')
-deadline = time.monotonic() + race_budget(10.0)
-try:
-    while time.monotonic() < deadline:
-        push()
-        if facl_has_marker(priv):
-            test_fail(
-                f"ACL-set symlink race: the FIFO's user:{MARKER_UID}:rwx ACL was "
-                "applied to the outside privileged file -- the receiver's "
-                "set_acl() followed the leaf symlink (LPE). "
-                f"getfacl {priv}:\n" + getfacl(priv)
-            )
-finally:
-    stop_flipper(flip)
-
-# No escape within the race budget.
diff --git a/testsuite/acls-unpinnable_test.py b/testsuite/acls-unpinnable_test.py
deleted file mode 100644
index 65e4145b6..000000000
--- a/testsuite/acls-unpinnable_test.py
+++ /dev/null
@@ -1,86 +0,0 @@
-#!/usr/bin/env python3
-# --acls must update a destination ACL even when the destination entry cannot be
-# pinned with O_RDONLY|O_NOFOLLOW -- e.g. a pre-existing no-owner-read (0300)
-# directory, whose held_fd open fails for a non-root receiver.
-#
-# The receiver's hardened ACL path applies via a held fd, or via the *xattrat
-# syscalls (dirfd+leaf, AT_SYMLINK_NOFOLLOW) on Linux 6.13+.  Where neither is
-# available -- no held fd (un-pinnable entry) AND no *xattrat (pre-6.13 / BSD) --
-# rsync falls back to the path-based sys_acl_set_file() so --acls stays
-# functional (project policy: prefer functionality where the OS cannot offer the
-# race-safe primitive; the parent-symlink race is an accepted residual there,
-# and a current kernel takes the secure xattrat path).
-#
-# An earlier revision skipped that fallback with a warning + success, silently
-# leaving the destination ACL STALE -- so a revoked/changed source ACL did not
-# propagate while rsync reported success.  This asserts the new ACL lands and the
-# stale entry is gone.  It exercises the path-based fallback when run non-root on
-# a no-*xattrat kernel; elsewhere it goes through the held-fd / xattrat path and
-# still asserts the same functional outcome.
-
-import os
-import platform
-import shutil
-import subprocess
-
-from rsyncfns import (
-    SCRATCHDIR, forced_protocol, rmtree, run_rsync, test_fail, test_skipped,
-)
-
-NEW_UID = 60002          # the source ACL grant that must propagate
-STALE_UID = 60009        # a different grant pre-seeded on the dest; must be gone
-
-if platform.system() != 'Linux':
-    test_skipped("POSIX ACL test is Linux-only (setfacl/getfacl semantics)")
-if not shutil.which('setfacl') or not shutil.which('getfacl'):
-    test_skipped("setfacl/getfacl not available")
-if '"ACLs": true' not in run_rsync('-VV', check=True, capture_output=True).stdout:
-    test_skipped("rsync built without ACL support")
-proto = forced_protocol()
-if proto is not None and proto < 30:
-    test_skipped(f"ACL transfer requires protocol 30+ (negotiated {proto})")
-
-
-def setfacl(spec, path):
-    if subprocess.run(['setfacl', '-m', spec, str(path)]).returncode != 0:
-        test_skipped("filesystem has ACLs disabled (setfacl failed)")
-
-
-def getfacl(path) -> str:
-    # POSIXLY_CORRECT in the suite: plain getfacl only (no -c/-E).
-    return subprocess.run(['getfacl', str(path)],
-                          capture_output=True, text=True).stdout
-
-
-base = SCRATCHDIR / 'acls-unpinnable'
-src = base / 'src'
-dest = base / 'dest'
-rmtree(base)
-(src / 'dropbox').mkdir(parents=True)
-(src / 'top.txt').write_text('top\n')
-(dest / 'dropbox').mkdir(parents=True)
-
-# Source: the grant that must propagate.  Dest: a pre-existing 0300 directory
-# carrying a *different* (stale) grant, so the sync must change its ACL -- and
-# the dir is un-pinnable (no owner read) for a non-root receiver at apply time.
-setfacl(f'user:{NEW_UID}:rwx', src / 'dropbox')
-os.chmod(src / 'dropbox', 0o300)
-setfacl(f'user:{STALE_UID}:rwx', dest / 'dropbox')
-os.chmod(dest / 'dropbox', 0o300)
-
-# The 0300 dirs are unreadable, so listing them errors (exit 23); the directory
-# entry + its ACL still transfer, which is what we assert.  Accept 0 or 23.
-proc = run_rsync('-aA', f'{src}/', f'{dest}/', check=False, capture_output=True)
-if proc.returncode not in (0, 23):
-    test_fail(f"rsync exited {proc.returncode}:\n{proc.stderr}")
-
-acl = getfacl(dest / 'dropbox')
-if f'user:{NEW_UID}:' not in acl:
-    test_fail("--acls did not apply the source ACL to the un-pinnable (0300) "
-              f"destination directory (stale/missing ACL); getfacl:\n{acl}")
-if f'user:{STALE_UID}:' in acl:
-    test_fail("--acls left the stale destination ACL entry in place on the "
-              f"un-pinnable (0300) directory -- a revocation did not propagate; "
-              f"getfacl:\n{acl}")
-
-print("acls-unpinnable: --acls updates the ACL of a no-owner-read (0300) dir")
diff --git a/testsuite/alt-dest-deep_test.py b/testsuite/alt-dest-deep_test.py
deleted file mode 100644
index 1054948e8..000000000
--- a/testsuite/alt-dest-deep_test.py
+++ /dev/null
@@ -1,85 +0,0 @@
-#!/usr/bin/env python3
-"""Property-level coverage of --link-dest / --copy-dest / --compare-dest at
-depth and across directory boundaries.
-
-The existing alt-dest_test.py is a faithful port that checks tree equality;
-this companion asserts the *distinguishing* property of each option, at every
-level of a >=3-deep tree, with the alternate-destination tree placed OUTSIDE
-both the source and destination trees (a sibling, not a parent/child):
-
-  --link-dest    unchanged files are HARD-LINKED to the reference (same inode);
-                 a changed file is transferred fresh (not linked).
-  --copy-dest    unchanged files are COPIED from the reference (never linked);
-                 dest is complete and byte-identical to the source.
-  --compare-dest unchanged files are NEITHER transferred NOR created in dest;
-                 only a changed/new file lands in dest.
-
-These options drive the two-dirfd / outside-tree path handling the resolver
-restructure rewrites, so they must be guarded at depth.
-"""
-
-import os
-
-from rsyncfns import (
-    FROMDIR, SCRATCHDIR, TODIR,
-    assert_exists, assert_hardlinked, assert_not_exists, assert_not_hardlinked,
-    assert_same, make_tree, rmtree, run_rsync, walk_files,
-)
-
-src = FROMDIR
-ref = SCRATCHDIR / 'altref'   # sibling of from/ and to/ -- outside both trees
-
-rmtree(src)
-rmtree(ref)
-rmtree(TODIR)
-
-# A >=3-deep source: f0 at the root, then d1/f1, d1/d2/f2, d1/d2/d3/f3.
-make_tree(src, depth=3, data=True)
-
-# Reference tree == an exact copy of the source, so every file is "identical"
-# for the alt-dest comparison.
-run_rsync('-a', f'{src}/', f'{ref}/')
-
-# Now make the deepest file differ so it must be transferred in every mode.
-changed = os.path.join('d1', 'd2', 'd3', 'f3')
-with open(src / changed, 'ab') as f:
-    f.write(b'a changed deep tail\n')
-
-rels = [p.relative_to(src) for p in walk_files(src)]
-assert os.path.join('d1', 'd2', 'd3', 'f3') in [str(r) for r in rels]
-
-
-def run_to(opt):
-    rmtree(TODIR)
-    run_rsync('-a', f'--{opt}={ref}', f'{src}/', f'{TODIR}/')
-
-
-# --- --link-dest: unchanged -> hardlink to ref; changed -> fresh copy -------
-run_to('link-dest')
-for rel in rels:
-    d, r = TODIR / rel, ref / rel
-    if str(rel) == changed:
-        assert_not_hardlinked(d, r, label=f'link-dest changed {rel}')
-        assert_same(d, src / rel, label=f'link-dest changed {rel}')
-    else:
-        assert_hardlinked(d, r, label=f'link-dest unchanged {rel}')
-
-# --- --copy-dest: every file copied (never linked), dest complete -----------
-run_to('copy-dest')
-for rel in rels:
-    d, r = TODIR / rel, ref / rel
-    assert_exists(d, label=f'copy-dest {rel}')
-    assert_same(d, src / rel, label=f'copy-dest {rel}')
-    assert_not_hardlinked(d, r, label=f'copy-dest {rel}')
-
-# --- --compare-dest: unchanged absent from dest; only the changed file lands -
-run_to('compare-dest')
-for rel in rels:
-    d = TODIR / rel
-    if str(rel) == changed:
-        assert_exists(d, label=f'compare-dest changed {rel}')
-        assert_same(d, src / rel, label=f'compare-dest changed {rel}')
-    else:
-        assert_not_exists(d, label=f'compare-dest unchanged {rel}')
-
-print("alt-dest-deep: link-dest/copy-dest/compare-dest verified at depth")
diff --git a/testsuite/alt-dest-symlink-race_test.py b/testsuite/alt-dest-symlink-race_test.py
deleted file mode 100644
index fc83c5762..000000000
--- a/testsuite/alt-dest-symlink-race_test.py
+++ /dev/null
@@ -1,98 +0,0 @@
-#!/usr/bin/env python3
-# Python rewrite of testsuite/alt-dest-symlink-race.test.
-#
-# Regression test for the basedir-confinement gap in
-# secure_relative_open(): a parent symlink ON basedir is followed
-# unrestrictedly, then RESOLVE_BENEATH is applied only to relpath,
-# anchored at the wrong directory.  In daemon mode this lets a local
-# attacker who can write into a module plant module/cd -> /outside and
-# then use --link-dest=cd / --copy-dest=cd / --compare-dest=cd to make
-# the receiver's basis-file lookup resolve into /outside, leaking
-# daemon-readable content via the rsync delta-rolling read-disclosure
-# primitive.
-#
-# Detection: with --link-dest, when basis matches source exactly the
-# destination is hard-linked to the basis. On a successful escape the
-# destination shares an inode with /outside/target.txt; on a fix it
-# doesn't.
-
-import os
-import subprocess
-
-from rsyncfns import (
-    SCRATCHDIR,
-    rsync_argv, get_testuid, get_rootuid, get_rootgid,
-    rmtree, start_test_daemon, test_fail,
-)
-
-
-DAEMON_PORT = 12882
-
-
-mod = SCRATCHDIR / 'module'
-outside = SCRATCHDIR / 'outside'
-src_dir = SCRATCHDIR / 'src_files'
-conf = SCRATCHDIR / 'test-rsyncd.conf'
-
-for d in (mod, outside, src_dir):
-    rmtree(d)
-    d.mkdir(parents=True)
-
-# The outside file an attacker wants the daemon to treat as a basis.
-(outside / 'target.txt').write_text("OUTSIDE_SECRET_DATA\n")
-os.chmod(outside / 'target.txt', 0o644)
-
-# Attacker-planted module symlink.
-os.symlink(str(outside), mod / 'cd')
-
-# Source: same content + mtime + mode as outside, so --link-dest hard-
-# links the destination to the basis iff basedir lookup escapes.
-(src_dir / 'target.txt').write_text("OUTSIDE_SECRET_DATA\n")
-ref = (outside / 'target.txt').stat()
-os.utime(src_dir / 'target.txt', (ref.st_atime, ref.st_mtime))
-os.chmod(src_dir / 'target.txt', 0o644)
-
-my_uid = get_testuid()
-root_uid = get_rootuid()
-root_gid = get_rootgid()
-uid_line = f"uid = {root_uid}"
-gid_line = f"gid = {root_gid}"
-if my_uid != root_uid:
-    uid_line = '#' + uid_line
-    gid_line = '#' + gid_line
-
-conf.write_text(f"""\
-use chroot = no
-{uid_line}
-{gid_line}
-log file = {SCRATCHDIR}/rsyncd.log
-[upload]
-    path = {mod}
-    use chroot = no
-    read only = no
-""")
-
-url = start_test_daemon(conf, DAEMON_PORT)
-
-# Push directly into the module root: pushing into a destination subdir
-# would make the receiver chdir into it before resolving --link-dest,
-# making "cd" resolve in the wrong CWD and masking the bug.
-subprocess.run(
-    rsync_argv('-rtp', '--link-dest=cd',
-               f'{src_dir}/', f'{url}upload/'),
-    stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL,
-)
-
-target = mod / 'target.txt'
-if not target.is_file():
-    test_fail(
-        "destination file was not created -- daemon transfer failed "
-        "before the test could observe the basedir behaviour"
-    )
-
-if target.stat().st_ino == (outside / 'target.txt').stat().st_ino:
-    test_fail(
-        f"basedir-escape: --link-dest hard-linked module/target.txt to "
-        f"outside/target.txt (inode {target.stat().st_ino}); daemon's "
-        "basis-file lookup followed the parent symlink on the basedir"
-    )
diff --git a/testsuite/append-shortsum_test.py b/testsuite/append-shortsum_test.py
deleted file mode 100644
index 6fa3bddcb..000000000
--- a/testsuite/append-shortsum_test.py
+++ /dev/null
@@ -1,52 +0,0 @@
-#!/usr/bin/env python3
-"""Regression: a short transfer checksum must not over-state the block s2length.
-
-A full-checksum (--append-verify redo) pass computes the strong block sum length
-(s2length).  The generator used to cap it at SUM_LENGTH (16), the legacy MD4/MD5
-digest size, regardless of the negotiated algorithm.  Since the sum2 array holds
-xfer_sum_len-byte elements and the sender rejects an s2length larger than
-xfer_sum_len, a sub-16-byte transfer checksum -- xxh64 (8 bytes), which is what
-rsync negotiates when the build's libxxhash lacks xxh128/xxh3 (e.g. Ubuntu
-20.04) -- made the sender die with "Invalid checksum length 16 [sender]"
-(protocol incompatibility, code 2).
-
-Forcing --checksum-choice=xxh64 reproduces it on any build that has xxhash, so
-this guards the fix without needing an old-libxxhash host.  Skipped where xxh64
-is unavailable (a build without xxhash).
-"""
-
-import json
-
-from rsyncfns import (
-    FROMDIR, TODIR, assert_same, make_data_file, rmtree, run_rsync,
-    test_skipped,
-)
-
-vv = json.loads(run_rsync('-VV', check=True, capture_output=True).stdout)
-if 'xxh64' not in vv.get('checksum_list', []):
-    test_skipped("xxh64 not in this build's checksum list (no xxhash)")
-
-src, dst = FROMDIR, TODIR
-rmtree(src)
-rmtree(dst)
-src.mkdir(parents=True)
-dst.mkdir(parents=True)
-
-# Source longer than the destination so --append has bytes to add; the dest is a
-# *corrupted* prefix so --append-verify's whole-file check fails and the file is
-# redone with a full checksum -- the csum_length == SUM_LENGTH path that emitted
-# the over-long s2length.
-make_data_file(src / 'f', 40000)
-full = (src / 'f').read_bytes()
-prefix = bytearray(full[:20000])
-prefix[0:64] = b'\x00' * 64
-(dst / 'f').write_bytes(bytes(prefix))
-
-# --no-whole-file forces the delta/checksum path regardless of local-vs-remote.
-# run_rsync(check=True) fails the test on the non-zero exit the bug produced.
-run_rsync('-a', '--append-verify', '--checksum-choice=xxh64', '--no-whole-file',
-          f'{src}/', f'{dst}/')
-assert_same(dst / 'f', src / 'f', label='append-verify xxh64 redo')
-
-print("append-shortsum: --append-verify with an 8-byte (xxh64) checksum no "
-      "longer overflows the block s2length")
diff --git a/testsuite/atimes_test.py b/testsuite/atimes_test.py
deleted file mode 100644
index bb8d3268b..000000000
--- a/testsuite/atimes_test.py
+++ /dev/null
@@ -1,33 +0,0 @@
-#!/usr/bin/env python3
-# Python rewrite of testsuite/atimes.test.
-#
-# Test that rsync preserves source atimes when the binary was built with
-# atimes support. We pin the source file's atime to a known historical
-# value then sync with -U; the listing (with --atimes in tls) must match
-# between source and destination.
-
-import os
-
-import rsyncfns
-from rsyncfns import FROMDIR, TODIR, checkit, run_rsync, test_skipped
-
-
-vv = run_rsync('-VV', check=True, capture_output=True)
-if '"atimes": true' not in vv.stdout:
-    test_skipped("Rsync is configured without atimes support")
-
-FROMDIR.mkdir(parents=True, exist_ok=True)
-foo = FROMDIR / 'foo'
-foo.touch()
-
-# `touch -a -t 200102031717.42` -> set atime to 2001-02-03 17:17:42, mtime unchanged.
-import datetime
-atime = datetime.datetime(2001, 2, 3, 17, 17, 42).timestamp()
-mtime = foo.stat().st_mtime
-os.utime(foo, (atime, mtime))
-
-# Make the listing include atimes so checkit's tls compare picks up the
-# transferred atime.
-rsyncfns.TLS_ARGS = '--atimes'
-
-checkit(['-rtUgvvv', f'{FROMDIR}/', f'{TODIR}/'], FROMDIR, TODIR)
diff --git a/testsuite/backup-acl-xattr-cache_test.py b/testsuite/backup-acl-xattr-cache_test.py
deleted file mode 100644
index eacd4e6ef..000000000
--- a/testsuite/backup-acl-xattr-cache_test.py
+++ /dev/null
@@ -1,77 +0,0 @@
-#!/usr/bin/env python3
-"""Coverage: cache_tmp_acl/cache_tmp_xattr (and cache_rsync_acl/uncache_duo_acls)
-in backup.c make_backup_dir_tree().
-
-When --backup --backup-dir=<dir> backs up a file at a nested path, rsync
-recreates the intermediate directories under the backup dir and copies
-each one's ACL/xattrs from the corresponding live directory.  That copy
-goes through cache_tmp_acl()/cache_tmp_xattr() (backup.c:~127/134), which
-no other test reaches: backup_test.py doesn't pass -A/-X, and the
-make_backup() per-file path normally short-circuits via link_or_rename()
-on a same-fs backup dir, never reaching its own cache_tmp_* block.
-
-Skips when the scratch fs lacks ACL or xattr support.
-"""
-
-import os
-
-from rsyncfns import (
-    SCRATCHDIR,
-    acls_supported, xattrs_supported, acl_set, xattr_set,
-    makepath, rmtree, rsync_argv, test_fail, test_skipped,
-)
-import subprocess
-
-if not acls_supported():
-    test_skipped("ACLs not supported on this filesystem")
-if not xattrs_supported():
-    test_skipped("xattrs not supported on this filesystem")
-
-src = SCRATCHDIR / 'bak-src'
-dest = SCRATCHDIR / 'bak-dest'
-bak = SCRATCHDIR / 'bak-dir'
-rmtree(src); rmtree(dest); rmtree(bak)
-makepath(src / 'd1' / 'd2', dest / 'd1' / 'd2', bak)
-
-# Stage: dest has an OLDER d1/d2/file than src, so the next push backs it up.
-(src / 'd1' / 'd2' / 'file').write_bytes(b'NEW')
-(dest / 'd1' / 'd2' / 'file').write_bytes(b'OLD')
-os.utime(dest / 'd1' / 'd2' / 'file', (1_600_000_000, 1_600_000_000))
-
-# Decorate the LIVE dest dirs with an ACL and an xattr -- these are what
-# make_backup_dir_tree() reads via get_acl()/get_xattr() and passes through
-# cache_tmp_acl()/cache_tmp_xattr() when it mkdirs bak/d1 and bak/d2.
-for d in (dest / 'd1', dest / 'd1' / 'd2'):
-    if not acl_set('u:0:rwx', d):
-        test_skipped(f"setfacl failed on {d}")
-    xattr_set('user.bak-cache', 'v', d)
-
-r = subprocess.run(
-    rsync_argv('-aAX', '--backup', f'--backup-dir={bak}', f'{src}/', f'{dest}/'),
-    capture_output=True, text=True,
-)
-if r.returncode != 0:
-    test_fail(f"-aAX --backup --backup-dir push -> rc={r.returncode}\n{r.stderr}")
-
-# Backed-up file present, and the intermediate backup dirs were created.
-bf = bak / 'd1' / 'd2' / 'file'
-if not bf.is_file() or bf.read_bytes() != b'OLD':
-    test_fail(f"backup file missing or wrong content: {bf}")
-for d in (bak / 'd1', bak / 'd1' / 'd2'):
-    if not d.is_dir():
-        test_fail(f"backup intermediate dir not created: {d}")
-
-# Coverage goal: cache_tmp_acl/cache_tmp_xattr were *entered* (which the
-# structural checks above plus -A -X on a nested backup path guarantee --
-# verified via gcov: backup.c:127/134 each fire 2x for d1 and d2).  Whether
-# set_file_attrs() then propagates the cached ACL/xattr onto the freshly-
-# mkdired backup dir is a separate behavioural question we deliberately do
-# NOT assert here, since it depends on set_file_attrs's compare-against-dest
-# path and the answer is the same with or without this test.
-
-# And dest/d1/d2/file is the new content.
-if (dest / 'd1' / 'd2' / 'file').read_bytes() != b'NEW':
-    test_fail("dest/d1/d2/file not updated to NEW")
-
-print("backup-acl-xattr-cache: make_backup_dir_tree cache_tmp_acl/xattr -> "
-      "bak/d1, bak/d2 created with propagated ACL+xattr")
diff --git a/testsuite/backup-dir-symlink-race_test.py b/testsuite/backup-dir-symlink-race_test.py
deleted file mode 100644
index 1d67e3e74..000000000
--- a/testsuite/backup-dir-symlink-race_test.py
+++ /dev/null
@@ -1,127 +0,0 @@
-#!/usr/bin/env python3
-# Non-daemon (local) --backup-dir parent-component symlink-race confinement.
-#
-# Companion to nondaemon-symlink-race (which pins the DETERMINISTIC leaf case:
-# the whole --backup-dir is a pre-planted escaping symlink).  Here the escaping
-# symlink is a PARENT component of the backup path that an attacker flips
-# dir<->symlink UNDER A RACE:
-#
-#     rsync -a -b --chmod=777 --backup-dir=backup src/ dest/
-#
-# Differing files in dest/sub/ are backed up to backup/sub/.  A concurrent
-# flipper swaps backup/sub between a real directory and a symlink -> outside.
-# If the receiver resolves the backup path while "sub" is the symlink and
-# renames the old dest file through it, the (0777) backup lands in outside/,
-# clobbering a sentinel there -- an escape.  The static parent-component case
-# does NOT reproduce (a pre-existing symlink-to-dir is handled without escape);
-# only the race window exposes it, so this case needs the flipper.
-#
-# The operator-path policy follows a symlink owned by uid 0 or the euid (the
-# operator's OWN backup dir) and refuses a foreign-owned one, so the boundary is
-# an ATTACKER-owned backup symlink with rsync run as root.  The held-dirfd /
-# ownership-walk resolver must refuse it on every flip, not just statically.
-#
-# RED on stock rsync (the pre-resolver code follows the parent symlink under the
-# race); GREEN once make_backup resolves through the operator-path resolver.
-# --insecure-links is the documented opt-out and is exercised by the matrix
-# tests, not here.
-
-import os
-import stat
-import subprocess
-import time
-
-from rsyncfns import (
-    SCRATCHDIR, race_budget, find_attacker_uid,
-    rmtree, rsync_argv, start_c_flipper, stop_flipper, test_fail, test_skipped,
-)
-
-# Cross-uid plant needs root: only root can own a symlink by a foreign uid and
-# thereby make it "not the operator's own".  At any other uid the boundary
-# cannot be built, so the race would be vacuous.
-if os.geteuid() != 0:
-    test_skipped("requires root to plant a backup-dir symlink owned by a non-self uid")
-ATT_UID = find_attacker_uid()
-if ATT_UID is None:
-    test_skipped("no untrusted-uid user available for cross-uid plant")
-
-NFILES = 95
-
-base = SCRATCHDIR / 'bdir-race'
-src = base / 'src'
-dest = base / 'dest'
-backup = base / 'backup'
-outside = base / 'outside'
-sub = backup / 'sub'            # the parent the attacker flips dir<->symlink
-sublink = backup / '.sublink'   # symlink -> outside, swapped in for `sub`
-
-
-def build():
-    rmtree(base)
-    for d in (src / 'sub', dest / 'sub', backup, outside):
-        d.mkdir(parents=True)
-    for i in range(NFILES):
-        (src / 'sub' / f'f{i}').write_text('payload\n')
-        os.chmod(src / 'sub' / f'f{i}', 0o777)
-        (dest / 'sub' / f'f{i}').write_text('different\n')
-        os.chmod(dest / 'sub' / f'f{i}', 0o777)
-        # Out-of-tree sentinels at a distinctive 0600: a 0777 here means a
-        # backed-up dest file escaped through the flipped symlink.
-        (outside / f'f{i}').write_text('do-not-touch\n')
-        os.chmod(outside / f'f{i}', 0o600)
-    sub.mkdir()
-    os.symlink(str(outside), sublink)
-    os.lchown(sublink, ATT_UID, ATT_UID)   # foreign-owned: must be refused
-
-
-def push():
-    subprocess.run(
-        rsync_argv('-a', '-b', '--chmod=777', f'--backup-dir={backup}',
-                   f'{src}/', f'{dest}/'),
-        stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL,
-    )
-
-
-def escaped() -> bool:
-    # Any out-of-tree sentinel turned 0777 == a backup escaped through the symlink.
-    with os.scandir(outside) as it:
-        for e in it:
-            if e.is_file() and stat.S_IMODE(e.stat().st_mode) == 0o777:
-                return True
-    return False
-
-
-# ---- positive control: with `sub` a plain dir, a normal push really does back
-# up into backup/sub/, so the race below isn't vacuous. ----------------------
-build()
-push()
-if not (sub / 'f0').is_file():
-    test_fail("positive control: a normal push did not create backup/sub/f0 -- "
-              "backups are not happening, so the race scenario would be vacuous")
-if escaped():
-    test_fail("positive control: a sentinel was already 0777 before the race")
-
-
-# ---- the race --------------------------------------------------------------
-# Flip backup/sub between the real dir and the attacker-owned symlink->outside.
-# The swap is name-only renames, so the symlink keeps its foreign owner; the
-# resolver must refuse it on every flip it happens to observe.  The compiled
-# flipper (renameat2 EXCHANGE) flips fast enough to win the window reliably even
-# on a slow journaled fs; it degrades to the Python flipper where no compiler is.
-flip = start_c_flipper(sub, sublink)
-try:
-    deadline = time.monotonic() + race_budget(10.0)
-    while time.monotonic() < deadline:
-        # Re-dirty the dest files so every push triggers fresh backups.
-        for i in range(80):
-            (dest / 'sub' / f'f{i}').write_text('changed\n')
-        push()
-        if escaped():
-            test_fail(
-                "backup-dir parent symlink race: a 0777 dest file was backed up "
-                f"into {outside} through the flipped backup/sub symlink -- "
-                "make_backup followed a foreign-owned parent component (escape).")
-finally:
-    stop_flipper(flip)
-
-# No escape within the race budget.
diff --git a/testsuite/basis-xname-traversal_test.py b/testsuite/basis-xname-traversal_test.py
deleted file mode 100644
index 1ab28c4b5..000000000
--- a/testsuite/basis-xname-traversal_test.py
+++ /dev/null
@@ -1,146 +0,0 @@
-#!/usr/bin/env python3
-# Server-controlled alternate-basis xname must stay confined to the operator
-# basedir on the client.  Reported by z3r0s (github z3r0s6), 2026-07.
-#
-# When the client pulls with an alt-dest flag (--link-dest / --copy-dest /
-# --compare-dest, or --fuzzy), the sender sends an fnamecmp_type + xname naming
-# which alternate basis the receiver should reconstruct against.  The receiver
-# joins the wire-supplied xname to the operator's basedir (basis_dir[]) and
-# opens it as the delta basis.  read_ndx_and_attrs() sanitized xname only when
-# sanitize_paths was set (daemon side); a *client* receiver has
-# sanitize_paths == 0, so a malicious server could send xname="../../etc/shadow"
-# and make the client open an out-of-tree file (client-side arbitrary-read /
-# file-existence-oracle / FIFO-hang).  secure_basis_open()'s ownership walk does
-# not stop this: it deliberately follows a plain ".." to a regular file (the
-# legitimate --link-dest=../01 sibling, #915) and only refuses foreign-owned
-# *symlink* components.  The fix sanitizes the wire xname itself (for basis
-# types only, leaving the hard-link "=> target" xname alone).
-#
-# Test: build an instrumented rsync (env-gated sender.c edit that, when
-# RSYNC_MAL_XNAME is set, injects ITEM_XNAME_FOLLOWS|ITEM_BASIS_TYPE_FOLLOWS +
-# fnamecmp_type=FNAMECMP_FUZZY+1 (== basis_dir[0]) + xname onto each transfer).
-# An env-gated receiver.c edit records the exact basedir and relpath passed to
-# secure_basis_open().  This observes the security decision directly without
-# relying on timing-sensitive FIFO rendezvous behaviour across operating systems.
-
-import os
-import shlex
-import subprocess
-
-from rsyncfns import (
-    SCRATCHDIR, build_patched_rsync, forced_protocol, makepath, rmtree,
-    rsync_argv, test_fail, test_skipped, write_daemon_conf,
-)
-
-# Gates ----------------------------------------------------------------------
-# xname only exists in the protocol >= 29 item stream; below that
-# write_ndx_and_attrs() returns before any flags/xname, so the injection can't
-# cross the wire and the test would be vacuous.  (The fix is a no-op there.)
-_proto = forced_protocol()
-if _proto is not None and _proto < 29:
-    test_skipped("basis-xname-traversal: xname/item flags need protocol >= 29")
-# -- Build the instrumented peer (shared helper: Cygwin skip, CCACHE_DISABLE,
-#    forced rebuild of the patched unit) -------------------------------------
-PATCH_OLD = ("\t\twrite_ndx_and_attrs(f_out, ndx, iflags, fname, file, fnamecmp_type, xname, xlen);\n"
-             "\t\twrite_sum_head(f_xfer, s);")
-PATCH_NEW = ("\t\tif (getenv(\"RSYNC_MAL_XNAME\")) { /* basis-xname-traversal PoC */\n"
-             "\t\t\tiflags |= ITEM_XNAME_FOLLOWS | ITEM_BASIS_TYPE_FOLLOWS;\n"
-             "\t\t\tfnamecmp_type = FNAMECMP_FUZZY + 1;\n"
-             "\t\t\txlen = strlcpy(xname, getenv(\"RSYNC_MAL_XNAME\"), MAXPATHLEN);\n"
-             "\t\t}\n"
-             "\t\twrite_ndx_and_attrs(f_out, ndx, iflags, fname, file, fnamecmp_type, xname, xlen);\n"
-             "\t\twrite_sum_head(f_xfer, s);")
-TRACE_OLD = ("static int secure_basis_open(const char *basedir, const char *relpath, int flags, mode_t mode)\n"
-             "{\n"
-             "\textern int am_daemon, am_chrooted;")
-TRACE_NEW = ("static int secure_basis_open(const char *basedir, const char *relpath, int flags, mode_t mode)\n"
-             "{\n"
-             "\tconst char *trace_path = getenv(\"RSYNC_BASIS_TRACE\");\n"
-             "\tif (trace_path) {\n"
-             "\t\tFILE *trace = fopen(trace_path, \"a\");\n"
-             "\t\tif (trace) {\n"
-             "\t\t\tfprintf(trace, \"%s\\t%s\\n\", basedir ? basedir : \"\", relpath);\n"
-             "\t\t\tfclose(trace);\n"
-             "\t\t}\n"
-             "\t}\n"
-             "\textern int am_daemon, am_chrooted;")
-mal_rsync = build_patched_rsync(
-    'mal-xname-rsync',
-    [('sender.c', PATCH_OLD, PATCH_NEW),
-     ('receiver.c', TRACE_OLD, TRACE_NEW)],
-)
-
-
-# -- Workspace ----------------------------------------------------------------
-#   base/serversrc/file    the file the instrumented daemon offers
-#   base/linkdest/         the client's --link-dest (basis_dir[0])
-#   base/linkdest/secret   where a sanitized "secret" resolves
-#   base/secret            where an unsanitized "../secret" resolves
-#   base/dest/             the client's destination
-base = SCRATCHDIR / 'xname-race'
-rmtree(base)
-serversrc = base / 'serversrc'
-linkdest = base / 'linkdest'
-dest = base / 'dest'
-escape = base / 'secret'                 # linkdest/../secret
-decoy = linkdest / 'secret'              # linkdest/secret
-trace_file = base / 'basis.trace'
-makepath(serversrc)
-makepath(linkdest)
-makepath(dest)
-(serversrc / 'file').write_text("from the server\n")
-escape.write_text("escaped basis\n")
-decoy.write_text("confined basis\n")
-
-conf = write_daemon_conf(
-    [('m', {'path': str(serversrc), 'read only': 'yes', 'use chroot': 'no'})],
-    name='mal-xname-rsyncd.conf')
-os.environ['RSYNC_CONNECT_PROG'] = f'{shlex.quote(str(mal_rsync))} --config={shlex.quote(str(conf))} --daemon'
-os.environ['RSYNC_MAL_XNAME'] = '../secret'  # from basis_dir[0] == linkdest
-os.environ['RSYNC_BASIS_TRACE'] = str(trace_file)
-try:
-    argv = rsync_argv('-a', f'--link-dest={linkdest}',
-                      'rsync://localhost/m/file', str(dest) + '/')
-    argv[0] = str(mal_rsync)
-    proc = subprocess.run(
-        argv,
-        stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True, timeout=120)
-finally:
-    os.environ.pop('RSYNC_BASIS_TRACE', None)
-    os.environ.pop('RSYNC_MAL_XNAME', None)
-    os.environ.pop('RSYNC_CONNECT_PROG', None)
-
-
-# -- Oracle -------------------------------------------------------------------
-out_tail = '\n'.join(proc.stdout.splitlines()[-20:])
-trace = trace_file.read_text().splitlines() if trace_file.is_file() else []
-escaped = f'{linkdest}\t../secret'
-confined = f'{linkdest}\tsecret'
-
-if escaped in trace:
-    test_fail(
-        "malicious server traversed the client's filesystem via the alt-dest "
-        f"xname: the receiver attempted {escape} (one level above the --link-dest "
-        "dir) as the delta basis.  A server-supplied xname of '../secret' was "
-        "not sanitized on the client (sanitize_paths==0 off-daemon).  Fix: "
-        "sanitize a basis-type xname in read_ndx_and_attrs().  Receiver output "
-        f"tail:\n{out_tail}")
-
-# The trace proves the crafted xname reached the receiver and was confined to
-# the basedir (sanitized "../secret" -> "secret" -> linkdest/secret).  Its
-# absence means the injection never took effect (e.g. a stale patched build).
-if confined not in trace:
-    test_fail(
-        "the crafted xname never reached the receiver's confined basis open; "
-        "the instrumented injection did not take effect, so this run is "
-        f"vacuous. Trace={trace!r}. Receiver rc={proc.returncode}. "
-        f"Output tail:\n{out_tail}")
-
-if proc.returncode != 0:
-    test_fail(
-        f"xname confined to the basedir, but the pull failed (rc={proc.returncode}).  "
-        f"Output tail:\n{out_tail}")
-
-print("basis-xname-traversal: receiver confined the server-supplied alt-dest "
-      "xname to the --link-dest dir; '../secret' resolved to linkdest/secret, "
-      "not the out-of-tree sibling.")
diff --git a/testsuite/batch-file-symlink_test.py b/testsuite/batch-file-symlink_test.py
deleted file mode 100644
index d169152d3..000000000
--- a/testsuite/batch-file-symlink_test.py
+++ /dev/null
@@ -1,219 +0,0 @@
-#!/usr/bin/env python3
-# --write-batch / --read-batch must not follow planted symlinks at
-# attacker-controlled path components.
-#
-# Threat: batch.c:232,238,242 call
-# do_open() (plain open() under the hood) without O_NOFOLLOW. Two attacks:
-#
-#   --write-batch: planted leaf symlink → root truncate+overwrite of an
-#                  arbitrary file. Planted parent symlink → batch created
-#                  inside an attacker-chosen dir.
-#
-#   --read-batch:  planted leaf symlink → rsync interprets attacker-chosen
-#                  bytes as protocol data. Planted parent → same. Also: a
-#                  planted FIFO/device at the read-batch path lets the
-#                  attacker stream protocol bytes (the audit added a
-#                  S_ISREG check on the opened fd as defense in depth).
-#
-# This test exercises both --write-batch variants (leaf and parent) where
-# the leak signal is clear and direct: with the leak the victim file is
-# truncated/overwritten or a new file appears under the planted parent;
-# with the fix neither happens. --read-batch is covered by the same path-
-# walk helper (the test for it would need a self-consistent batch payload
-# to drive the receiver, which is excess machinery here).
-#
-# Requires root for the cross-uid plant; skips otherwise.
-
-import os
-import pwd
-import subprocess
-
-from rsyncfns import SCRATCHDIR, rmtree, rsync_argv, test_fail, test_skipped
-
-
-if os.geteuid() != 0:
-    test_skipped("requires root to plant a symlink owned by a non-self uid "
-                 "(the attacker simulation)")
-
-NOBODY_UID = None
-for name in ('nobody', 'nfsnobody', 'daemon'):
-    try:
-        u = pwd.getpwnam(name).pw_uid
-        if u != 0 and u != os.geteuid():
-            NOBODY_UID = u
-            break
-    except KeyError:
-        continue
-if NOBODY_UID is None:
-    test_skipped("no untrusted-uid user available for cross-uid plant")
-
-
-base = SCRATCHDIR / 'batch'
-src = base / 'src'
-dest = base / 'dest'
-plants = base / 'plants'
-
-rmtree(base)
-src.mkdir(parents=True)
-(src / 'f').write_text("payload\n")
-dest.mkdir(parents=True)
-plants.mkdir(parents=True)
-
-
-def run_write_batch(batch_plant_path):
-    """Run rsync with --write-batch=batch_plant_path. The actual transfer
-    succeeds; we only care whether the batch open follows the planted symlink."""
-    # rsync writes both <name> and <name>.sh. Clean dest each run.
-    rmtree(dest); dest.mkdir(parents=True)
-    return subprocess.run(
-        rsync_argv('-a', '--write-batch=' + str(batch_plant_path),
-                   f'{src}/', f'{dest}/'),
-        stdout=subprocess.DEVNULL, stderr=subprocess.PIPE, text=True)
-
-
-# ---------------------------------------------------------------------------
-# LEAF plant — --write-batch path is a symlink to a victim file. Without the
-# fix, the O_TRUNC|O_WRONLY|O_CREAT open truncates the victim and writes the
-# batch data into it.
-# ---------------------------------------------------------------------------
-victim = plants / 'sentinel_leaf'
-INITIAL_BYTES = b"VICTIM_INITIAL_CONTENTS\n"
-victim.write_bytes(INITIAL_BYTES)
-os.chmod(victim, 0o600)
-
-leaf_plant = plants / 'write_batch_leaf'
-os.symlink(victim, leaf_plant)
-os.lchown(leaf_plant, NOBODY_UID, NOBODY_UID)
-
-run_write_batch(leaf_plant)
-
-# Read as bytes — rsync's batch data is binary protocol, not text.
-leaf_after = victim.read_bytes()
-if leaf_after != INITIAL_BYTES:
-    test_fail(
-        f"--write-batch followed a planted LEAF symlink (owned by uid "
-        f"{NOBODY_UID}): victim {victim} was truncated/overwritten by the "
-        f"O_TRUNC open. {len(INITIAL_BYTES)} initial bytes replaced by "
-        f"{len(leaf_after)} bytes of attacker-influenceable batch data. "
-        f"Fix: refuse planted symlinks at --write-batch.")
-
-
-# ---------------------------------------------------------------------------
-# PARENT-component plant — --write-batch=plant/batchname where plant is a
-# symlink to a victim dir. The kernel resolves the parent (symlink), creates
-# the batch INSIDE the victim dir. Plain O_NOFOLLOW on the leaf does NOT
-# defend this; only the path-walk's parent-symlink ownership check does.
-# ---------------------------------------------------------------------------
-real_target = plants / 'parent_real_target'
-real_target.mkdir()
-
-parent_plant = plants / 'parent_link'
-os.symlink(real_target, parent_plant)
-os.lchown(parent_plant, NOBODY_UID, NOBODY_UID)
-
-run_write_batch(parent_plant / 'batchfile')
-
-# Did rsync create the batch (and/or its .sh wrapper) inside the planted dir?
-created = sorted(p.name for p in real_target.iterdir())
-if created:
-    test_fail(
-        f"--write-batch followed a planted PARENT-component symlink (owned "
-        f"by uid {NOBODY_UID}): {parent_plant} -> {real_target} was "
-        f"traversed and rsync wrote batch artefact(s) into the victim dir: "
-        f"{created}. /tmp/somedir/-class parent-flip; plain O_NOFOLLOW does "
-        "NOT defend. Fix: per-component path walk with parent-symlink "
-        "ownership check.")
-
-
-# ---------------------------------------------------------------------------
-# --read-batch LEAF plant — the higher-power side of finding 1.6.  Read-batch
-# content drives the receiver's protocol parser, so a planted symlink lets the
-# attacker stream arbitrary protocol bytes into the receiver and have it
-# create / modify files anywhere the receiver can write.  The leak signal in
-# this test is direct: we first run a legitimate --write-batch to capture a
-# real batch that creates a single canary file in the dest, then plant the
-# read-batch path as a symlink to that legitimate batch.  Without the fix,
-# the planted symlink is followed, rsync replays the legitimate batch from
-# the planted target, and the canary appears in the destination.  With the
-# fix, the planted symlink is refused (ELOOP via the owned-by-trusted-uid
-# walk) and no canary appears.
-# ---------------------------------------------------------------------------
-legit_src = base / 'rb_src'
-legit_src.mkdir()
-(legit_src / 'rb_canary').write_bytes(b'AUDIT_READ_BATCH_LEAK_PAYLOAD')
-
-# Capture a real batch by running write-batch normally (no symlinks in path).
-legit_batch_dir = base / 'rb_legit_batch'
-legit_batch_dir.mkdir()
-legit_batch = legit_batch_dir / 'batch'
-subprocess.run(
-    rsync_argv('-a', f'--write-batch={legit_batch}',
-               f'{legit_src}/', f'{dest}/rb_setup_unused/'),
-    stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
-
-# Now plant a symlink at the read-batch path, pointing at the legit batch.
-rb_dest = base / 'rb_dest'
-rmtree(rb_dest); rb_dest.mkdir()
-rb_leaf_plant = plants / 'read_batch_leaf'
-os.symlink(legit_batch, rb_leaf_plant)
-os.lchown(rb_leaf_plant, NOBODY_UID, NOBODY_UID)
-
-subprocess.run(
-    rsync_argv('-a', f'--read-batch={rb_leaf_plant}', str(rb_dest) + '/'),
-    stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
-
-if (rb_dest / 'rb_canary').exists():
-    test_fail(
-        f"--read-batch followed a planted LEAF symlink (owned by uid "
-        f"{NOBODY_UID}): rsync read the symlink's target as protocol data "
-        f"and replayed the legitimate batch from it, creating "
-        f"{rb_dest}/rb_canary in the destination.  The leaked batch could "
-        "have written anywhere the receiver can write (higher-power "
-        "primitive than --write-batch).  Fix: refuse planted symlinks at "
-        "--read-batch.")
-
-
-# ---------------------------------------------------------------------------
-# --read-batch S_ISREG defense-in-depth — even when no symlink is involved,
-# a planted FIFO / device / socket at the read-batch path lets an attacker
-# stream protocol bytes into the receiver.  The audit's agreed defense is
-# an fstat() S_ISREG check on the opened fd in addition to the path walk.
-# We test it via a char-device node (a /dev/null clone) at the read-batch
-# path: without the check rsync reads 0 bytes from the device and errors with
-# a generic protocol message; with the check rsync errors with the specific
-# "Batch file ... is not a regular file" message in stderr.
-# ---------------------------------------------------------------------------
-import stat as _stat
-
-rb_dev = plants / 'read_batch_dev'
-try:
-    # Recreate /dev/null with its REAL device number so the node is openable
-    # on every platform. A hardcoded makedev(1, 3) is only Linux's /dev/null;
-    # on BSD/Solaris that major/minor is an unconfigured device, so rsync would
-    # fail at open() (ENXIO) BEFORE reaching the S_ISREG check and the test
-    # would mis-report a defended path as a failure.
-    os.mknod(rb_dev, 0o600 | _stat.S_IFCHR, os.stat('/dev/null').st_rdev)
-except OSError as e:
-    test_skipped(
-        f"cannot mknod a char device for S_ISREG sub-test ({e}); "
-        "likely no CAP_MKNOD or the filesystem disallows devnodes")
-
-rb_dev_dest = base / 'rb_dev_dest'
-rmtree(rb_dev_dest); rb_dev_dest.mkdir()
-proc = subprocess.run(
-    rsync_argv('-a', f'--read-batch={rb_dev}', str(rb_dev_dest) + '/'),
-    stdout=subprocess.DEVNULL, stderr=subprocess.PIPE, text=True)
-
-# The device must be refused.  The S_ISREG check yields the specific "is not a
-# regular file" message; on some platforms (e.g. OpenBSD) opening the device
-# node fails first with ENXIO, which is an equally valid refusal at the open.
-# A clean (returncode 0) run would be the real failure -- rsync accepting the
-# device as a batch file.
-refused = ('is neither a regular file nor a FIFO' in proc.stderr
-           or ('open error' in proc.stderr and proc.returncode != 0))
-if not refused:
-    test_fail(
-        f"--read-batch did not refuse a non-regular batch path (char device at "
-        f"{rb_dev}). rsync returncode {proc.returncode}, stderr: "
-        f"{proc.stderr!r}. Fix: after the safe open, fstat() the fd and "
-        "refuse !S_ISREG.")
diff --git a/testsuite/chmod-symlink-race_test.py b/testsuite/chmod-symlink-race_test.py
deleted file mode 100644
index 430442d28..000000000
--- a/testsuite/chmod-symlink-race_test.py
+++ /dev/null
@@ -1,57 +0,0 @@
-#!/usr/bin/env python3
-# Python rewrite of testsuite/chmod-symlink-race.test.
-#
-# Regression test for the symlink-TOCTOU class of bug applied to chmod()
-# on the receiver side. The CVE-2026-29518 fix used
-# secure_relative_open() for the basis-file open, but every other
-# path-based syscall the receiver runs on sender-controllable paths is
-# vulnerable to the same primitive: a local attacker swaps a symlink
-# into one of the parent directory components between the receiver's
-# check and its act, and the syscall escapes the module.
-#
-# The helper t_chmod_secure exercises the new do_chmod_at() wrapper
-# across four scenarios; see the shell version for the full enumeration.
-# After the helper runs we sanity-check the outside sentinel's mode
-# from Python too, in case the helper's internal stat() ever drifts.
-
-import os
-import subprocess
-
-from rsyncfns import SCRATCHDIR, TOOLDIR, rmtree, test_fail
-
-
-mod = SCRATCHDIR / 'module'
-trap_outside = SCRATCHDIR / 'trap'
-rmtree(mod)
-rmtree(trap_outside)
-mod.mkdir(parents=True)
-(mod / 'realdir').mkdir(parents=True)
-trap_outside.mkdir(parents=True)
-
-# File-system objects the helper expects.
-(mod / 'realdir' / 'sentinel').write_text("bystander\n")
-os.chmod(mod / 'realdir' / 'sentinel', 0o600)
-(trap_outside / 'sentinel').write_text("target\n")
-os.chmod(trap_outside / 'sentinel', 0o600)
-os.symlink('realdir', mod / 'inside_link')
-os.symlink('../trap', mod / 'escape_link')
-(mod / 'topfile').write_text("top\n")
-os.chmod(mod / 'topfile', 0o600)
-# A LEAF symlink (final path component) escaping the tree, for the leaf-flip
-# scenario: do_chmod_at('realdir/leaflink') has a legitimate real parent but an
-# escaping symlink leaf, so it isolates the O_NOFOLLOW leaf guard from the
-# parent-confinement scenarios. Target is the same outside sentinel (relative to
-# realdir/, the outside trap is ../../trap).
-os.symlink('../../trap/sentinel', mod / 'realdir' / 'leaflink')
-
-proc = subprocess.run([str(TOOLDIR / 't_chmod_secure'), str(mod)])
-if proc.returncode != 0:
-    test_fail("t_chmod_secure reported failures (see stderr above)")
-
-# Second-look sanity check from Python.
-sentinel_mode = (trap_outside / 'sentinel').stat().st_mode & 0o777
-if sentinel_mode != 0o600:
-    test_fail(
-        f"outside sentinel mode changed from 600 to {oct(sentinel_mode)[2:]} "
-        "-- chmod escaped the module"
-    )
diff --git a/testsuite/chmod-temp-dir_test.py b/testsuite/chmod-temp-dir_test.py
deleted file mode 100644
index 30d9fe20a..000000000
--- a/testsuite/chmod-temp-dir_test.py
+++ /dev/null
@@ -1,65 +0,0 @@
-#!/usr/bin/env python3
-# Python rewrite of testsuite/chmod-temp-dir.test.
-#
-# Like chmod_test.py, but uses --temp-dir pointing at a different
-# filesystem so rsync must rename(2) across filesystems (i.e. fall back
-# to copy+unlink) instead of the in-place rename it does when temp and
-# destination are on the same fs. We probe candidate tmp paths to find
-# one whose filesystem differs from the scratch dir.
-
-import os
-import subprocess
-
-from rsyncfns import FROMDIR, SCRATCHDIR, TODIR, TOOLDIR, checkit, hands_setup, test_skipped
-
-
-def _fsdev(path: str) -> str:
-    return subprocess.check_output(
-        [str(TOOLDIR / 'getfsdev'), path], text=True,
-    ).strip()
-
-
-hands_setup()
-
-scratch_dev = _fsdev(str(SCRATCHDIR))
-tmpdir2 = None
-candidates = [
-    os.environ.get('RSYNC_TEST_TMP', '/override-tmp-not-specified'),
-    '/run/shm', '/var/tmp', '/tmp',
-]
-for cand in candidates:
-    if not (os.path.isdir(cand) and os.access(cand, os.W_OK)):
-        continue
-    if _fsdev(cand) != scratch_dev:
-        tmpdir2 = cand
-        break
-
-if tmpdir2 is None:
-    test_skipped("Can't find a tmp dir on a different file system")
-
-
-# Mirror chmod_test.py: set up a varied permission tree on the source.
-def _try_chmods(path, modes):
-    for m in modes:
-        try:
-            os.chmod(path, m)
-            return
-        except PermissionError:
-            continue
-    os.chmod(path, modes[-1])
-
-
-os.chmod(FROMDIR / 'text', 0o440)
-os.chmod(FROMDIR / 'dir' / 'text', 0o500)
-_try_chmods(FROMDIR / 'dir' / 'subdir' / 'foobar.baz',
-            [0o6450, 0o2450, 0o1450, 0o450])
-_try_chmods(FROMDIR / 'dir' / 'subdir' / 'subsubdir' / 'etc-ltr-list',
-            [0o2670, 0o1670, 0o670])
-
-# First a normal copy (whole-file) but through a cross-fs --temp-dir.
-checkit(['-avv', f'--temp-dir={tmpdir2}', f'{FROMDIR}/', str(TODIR)],
-        FROMDIR, TODIR)
-
-# Then an update through delta, still routing partial transfers across fs.
-checkit(['-avvI', '--no-whole-file', f'--temp-dir={tmpdir2}',
-         f'{FROMDIR}/', str(TODIR)], FROMDIR, TODIR)
diff --git a/testsuite/chmod_test.py b/testsuite/chmod_test.py
deleted file mode 100644
index ea6934b58..000000000
--- a/testsuite/chmod_test.py
+++ /dev/null
@@ -1,40 +0,0 @@
-#!/usr/bin/env python3
-# Python rewrite of testsuite/chmod.test.
-#
-# Test that varied read-only and set[ug]id permissions transfer correctly
-# both on first copy (whole-file) and on subsequent updates (delta).
-
-import os
-
-from rsyncfns import FROMDIR, TODIR, checkit, hands_setup
-
-
-hands_setup()
-
-# Three of these chmod modes use the sticky/setuid/setgid bits which some
-# platforms refuse for non-root. The shell test tries them in descending
-# order, falling back to plain mode on rejection.
-def _try_chmods(path, modes):
-    for m in modes:
-        try:
-            os.chmod(path, m)
-            return
-        except PermissionError:
-            continue
-    # Final mode in the list is the no-special-bits fallback.
-    os.chmod(path, modes[-1])
-
-
-os.chmod(FROMDIR / 'text', 0o440)
-os.chmod(FROMDIR / 'dir' / 'text', 0o500)
-_try_chmods(FROMDIR / 'dir' / 'subdir' / 'foobar.baz',
-            [0o6450, 0o2450, 0o1450, 0o450])
-_try_chmods(FROMDIR / 'dir' / 'subdir' / 'subsubdir' / 'etc-ltr-list',
-            [0o2670, 0o1670, 0o670])
-
-# First a normal whole-file copy.
-checkit(['-avv', f'{FROMDIR}/', str(TODIR)], FROMDIR, TODIR)
-
-# Then update through delta with -I (ignore times) so every file is
-# touched again.
-checkit(['-avvI', '--no-whole-file', f'{FROMDIR}/', str(TODIR)], FROMDIR, TODIR)
diff --git a/testsuite/chown-fake_test.py b/testsuite/chown-fake_test.py
deleted file mode 120000
index e1b09becb..000000000
--- a/testsuite/chown-fake_test.py
+++ /dev/null
@@ -1 +0,0 @@
-chown_test.py
\ No newline at end of file
diff --git a/testsuite/chown_test.py b/testsuite/chown_test.py
deleted file mode 100644
index 116b97ef0..000000000
--- a/testsuite/chown_test.py
+++ /dev/null
@@ -1,73 +0,0 @@
-#!/usr/bin/env python3
-# Python rewrite of testsuite/chown.test (and, via a symlink installed by
-# the Makefile as chown-fake_test.py, of testsuite/chown-fake.test).
-#
-# Verifies that rsync -a + ownership-preservation sets the destination
-# uid/gid to match the source. The "real" variant needs root to chown(2);
-# the "fake" variant emulates ownership in the user.rsync.%stat xattr and
-# tests --fake-super.
-
-import os
-import sys
-
-import rsyncfns
-from rsyncfns import (
-    FROMDIR, RSYNC_PREFIX, TODIR,
-    checkit, test_skipped, xattr_set, xattrs_supported,
-)
-
-
-# Detect fake variant by the script name we were invoked under. The
-# Makefile creates chown-fake_test.py as a symlink to this file.
-script_name = os.path.basename(sys.argv[0] if sys.argv[0] else __file__)
-fake_variant = 'fake' in script_name
-
-if fake_variant:
-    # --fake-super needs xattrs support (and a way to set them here).
-    if not xattrs_supported():
-        test_skipped("Rsync needs xattrs for fake device tests")
-    # Augment the RSYNC command and TLS_ARGS so checkit's listing path
-    # treats the xattr-encoded ownership as the file's real ownership.
-    rsyncfns.RSYNC = rsyncfns.RSYNC + ' --fake-super'
-    rsyncfns.TLS_ARGS = (rsyncfns.TLS_ARGS + ' --fake-super').strip()
-
-    def chown_or_fake(path, uid, gid):
-        # Store ownership in rsync's fake-super "%stat" xattr -- the name
-        # (RSYNC_PREFIX) and namespace vary by OS; xattr_set handles that.
-        # %stat format: "MODE DEV_MAJOR,DEV_MINOR UID:GID"
-        mode = os.stat(path).st_mode
-        xattr_set(f'{RSYNC_PREFIX}.%stat', f"{mode:o} 0,0 {uid}:{gid}", path)
-        return True
-else:
-    rsyncfns.RSYNC = rsyncfns.RSYNC + ' --super'
-
-    my_uid = os.getuid()
-    if my_uid != 0:
-        # If a fakeroot binary is in the environment, re-exec ourselves
-        # under it -- same trick the shell test used.
-        fakeroot_path = os.environ.get('FAKEROOT_PATH')
-        if fakeroot_path and os.access(fakeroot_path, os.X_OK):
-            print("Let's try re-running the script under fakeroot...")
-            os.execv(fakeroot_path, [fakeroot_path, sys.executable, __file__])
-
-    def chown_or_fake(path, uid, gid):
-        try:
-            os.chown(path, uid, gid)
-            return True
-        except (PermissionError, OSError):
-            return False
-
-
-FROMDIR.mkdir(parents=True, exist_ok=True)
-name1 = FROMDIR / 'name1'
-name2 = FROMDIR / 'name2'
-name1.write_text("This is the file\n")
-name2.write_text("This is the other file\n")
-
-if not chown_or_fake(name1, 5000, 5002):
-    test_skipped("Can't chown (probably need root)")
-if not chown_or_fake(name2, 5001, 5003):
-    test_skipped("Can't chown (probably need root)")
-
-os.chdir(FROMDIR.parent)
-checkit(['-aHvv', 'from/', 'to/'], FROMDIR, TODIR)
diff --git a/testsuite/chroot-alt-dest-inner-module_test.py b/testsuite/chroot-alt-dest-inner-module_test.py
deleted file mode 100644
index 35990b87d..000000000
--- a/testsuite/chroot-alt-dest-inner-module_test.py
+++ /dev/null
@@ -1,14 +0,0 @@
-#!/usr/bin/env python3
-import shutil
-
-from rsyncfns import run_checked, setup_chroot_inner
-from rsyncfns import makepath, rsync_argv, test_fail
-
-base, inner, outside, src, url = setup_chroot_inner('chroot-comparedest-inner')
-makepath(inner / 'dest')
-(src / 'f').write_text('same\n')
-shutil.copy2(src / 'f', outside / 'f')
-proc, out = run_checked(rsync_argv('-a', '--compare-dest=../linkparent', f'{src}/', f'{url}mod/dest/'))
-if not (inner / 'dest' / 'f').exists():
-    test_fail(f"compare-dest used outside-inner-module metadata to suppress the transfer:\n{out}")
-print("chroot-alt-dest-inner-module: outside compare-dest did not suppress destination creation")
diff --git a/testsuite/chroot-basis-forge-inner-module_test.py b/testsuite/chroot-basis-forge-inner-module_test.py
deleted file mode 100644
index 7cad48852..000000000
--- a/testsuite/chroot-basis-forge-inner-module_test.py
+++ /dev/null
@@ -1,100 +0,0 @@
-#!/usr/bin/env python3
-# Finding (codex review of [16-19]): the generator-side alt-dest basis stat is
-# confined for a /./ inner-module chroot, but the RECEIVER's delta-basis open
-# (secure_basis_open) bypassed confinement for any am_chrooted daemon. The
-# receiver trusts the peer-supplied fnamecmp_type (read from the inbound stream),
-# so a malicious push client can force an alternate-basis index whose basis_dir
-# escapes the inner module through a symlinked parent (--compare-dest=../linkparent
-# -> outside). The receiver then opens an outside-inner-module file as the delta
-# basis and copies its matched blocks into the in-module destination -- an
-# out-of-module read materialized into a file the client can later pull.
-#
-# This drives the attack with the pure-Python sender (rsync_proto) instead of a
-# recompiled malicious binary: push file "f" and, in the transfer phase, forge
-# fnamecmp_type = FNAMECMP_FUZZY + 1 (alt-dest index 0) with xname "f" and a
-# delta that matches block 0 of that forged basis. The pre-existing dest matches
-# the source's first block (so a block-0 match is legitimate); with the forged
-# index the receiver applies that match against the OUTSIDE basis, and the wrong
-# whole-file checksum then trips "failed verification" -- but only AFTER the
-# receiver opened and read the out-of-module file, which is the confinement
-# violation. So the tell is in the daemon log: "failed verification" means the
-# escaping basis was opened (RED on the unconfined receiver); once
-# secure_basis_open confines the inner-module case the open is refused (the
-# forged match has no basis file) and no out-of-module read occurs.
-#
-# Needs root (the /./ chroot) and a real TCP daemon (the Python sender).
-
-import os
-import time
-
-from rsyncfns import (
-    SCRATCHDIR, claim_ports, get_rootuid, get_testuid, makepath, require_tcp,
-    rmtree, start_test_daemon, test_fail, test_skipped, write_daemon_conf,
-)
-import rsync_proto as rp
-
-PORT = 12973
-require_tcp("the pure-Python sender needs a real TCP daemon; run with --use-tcp")
-if get_testuid() != get_rootuid():
-    test_skipped("the /./ inner-module chroot regression requires root")
-claim_ports(PORT)
-
-base = SCRATCHDIR / 'chroot-basis-forge'
-outer = base / 'outer'
-inner = outer / 'inner'
-outside = outer / 'outside'
-src = base / 'src'
-rmtree(base)
-makepath(inner, outside, src)
-os.symlink('../outside', inner / 'linkparent')
-
-BLK = 700
-SECRET = b'S' * BLK + b'Y'        # outside basis: first block is the secret
-PUBLIC = b'A' * BLK               # pre-existing dest == generator's FNAME basis
-SOURCE = b'A' * BLK + b'X'        # block 0 matches dest, so a block-0 match is sent
-
-(outside / 'f').write_bytes(SECRET)
-(outside / 'dest').mkdir()        # cover both file->dirname resolutions
-(outside / 'dest' / 'f').write_bytes(SECRET)
-(src / 'f').write_bytes(SOURCE)
-(inner / 'dest').mkdir()
-(inner / 'dest' / 'f').write_bytes(PUBLIC)
-
-conf = write_daemon_conf([
-    ('mod', {'path': str(outer) + '/./inner', 'read only': 'no',
-             'use chroot': 'yes', 'munge symlinks': 'no'}),
-], name='chroot-basis-forge.conf')
-log = SCRATCHDIR / 'rsyncd.log'
-before = log.read_text(errors='replace') if log.exists() else ''
-start_test_daemon(conf, PORT)
-
-s = rp.DaemonSender('127.0.0.1', PORT)
-s.handshake('mod', ['--server', '-le.LsfxCIu', '--no-whole-file',
-                    '--compare-dest=../linkparent', '.', 'dest/'],
-            greeting_version=30)
-# Push file "f"; its content is delivered in the transfer phase, not the flist.
-s.send_flat_flist([rp.FileEntry('f', mode=rp.S_IFREG | 0o644, length=len(SOURCE))])
-# Forge alt-dest basis index 0 (FNAMECMP_FUZZY+1) with basename "f"; match block 0
-# of that basis then send the literal 'X' tail.
-s.run_forged_transfer(rp.FNAMECMP_FUZZY + 1, b'f', literal_tail=b'X')
-s.drain(timeout=3.0)
-s.close()
-
-leaked = False
-for _ in range(50):
-    new = log.read_text(errors='replace')[len(before):]
-    if 'failed verification' in new:
-        leaked = True
-        break
-    time.sleep(0.1)
-
-if leaked:
-    new = log.read_text(errors='replace')[len(before):]
-    test_fail("receiver opened and read an outside-inner-module file as the delta "
-              "basis via a forged fnamecmp_type (the reconstruction failed the "
-              "whole-file checksum -- but the out-of-module read already "
-              "happened); secure_basis_open did not confine the /./ chroot.\n"
-              + new)
-
-print("chroot-basis-forge-inner-module: a forged alt-dest basis index cannot "
-      "open a file outside the inner module")
diff --git a/testsuite/chroot-copy-dest-inner-module_test.py b/testsuite/chroot-copy-dest-inner-module_test.py
deleted file mode 100644
index 3d822a74e..000000000
--- a/testsuite/chroot-copy-dest-inner-module_test.py
+++ /dev/null
@@ -1,37 +0,0 @@
-#!/usr/bin/env python3
-# A /./ inner-module chroot daemon must not use an out-of-inner-module file as a
-# --copy-dest basis (here reached via inner/linkparent -> ../outside).
-#
-# Detection is CONTENT-based, not atime-based: poison outside/f with distinct
-# content but an identical size+mtime, so the --copy-dest size+mtime quick-check
-# would still accept it if confinement were bypassed -- and copy_file() would then
-# copy the poison bytes into dest.  If the confinement holds, the basis is refused
-# and dest is transferred from src.  (The previous atime oracle false-positived on
-# macOS: Spotlight, mds/mdworker_shared, indexes the freshly-created scratch files
-# and reads outside/f, advancing its atime independently of rsync.  Any external
-# reader -- indexer, AV, backup -- defeats an atime signal; content does not.)
-
-import os
-import shutil
-
-from rsyncfns import run_checked, setup_chroot_inner
-from rsyncfns import makepath, rsync_argv, test_fail
-
-base, inner, outside, src, url = setup_chroot_inner('chroot-copydest-inner')
-makepath(inner / 'dest')
-(src / 'f').write_text('same\n')                 # 5 bytes
-shutil.copy2(src / 'f', outside / 'f')           # same size + mtime as src/f
-(outside / 'f').write_text('PWND\n')             # distinct content, same 5 bytes
-src_mtime = (src / 'f').stat().st_mtime
-os.utime(outside / 'f', (src_mtime, src_mtime))  # restore mtime for the quick-check
-
-proc, out = run_checked(rsync_argv('-a', '--copy-dest=../linkparent', f'{src}/', f'{url}mod/dest/'))
-dest = inner / 'dest' / 'f'
-if not dest.exists():
-    test_fail(f"copy-dest transfer did not create destination file:\n{out}")
-# A real escape copies the out-of-module basis content into dest; a confined
-# daemon transfers from src instead.
-if dest.read_text() != (src / 'f').read_text():
-    test_fail("copy-dest read an outside-inner-module basis file: dest got the "
-              f"out-of-module content {dest.read_text()!r}:\n{out}")
-print("chroot-copy-dest-inner-module: outside copy-dest basis was not read")
diff --git a/testsuite/chroot-link-dest-inner-module_test.py b/testsuite/chroot-link-dest-inner-module_test.py
deleted file mode 100644
index ae03b701c..000000000
--- a/testsuite/chroot-link-dest-inner-module_test.py
+++ /dev/null
@@ -1,18 +0,0 @@
-#!/usr/bin/env python3
-import os
-import shutil
-
-from rsyncfns import run_checked, setup_chroot_inner
-from rsyncfns import makepath, rsync_argv, test_fail
-
-base, inner, outside, src, url = setup_chroot_inner('chroot-linkdest-inner')
-makepath(inner / 'dest')
-(src / 'f').write_text('same\n')
-shutil.copy2(src / 'f', outside / 'f')
-proc, out = run_checked(rsync_argv('-a', '--link-dest=../linkparent', f'{src}/', f'{url}mod/dest/'))
-dest = inner / 'dest' / 'f'
-if not dest.exists():
-    test_fail(f"link-dest transfer did not create destination file:\n{out}")
-if (dest.stat().st_dev, dest.stat().st_ino) == ((outside / 'f').stat().st_dev, (outside / 'f').stat().st_ino):
-    test_fail(f"link-dest hardlinked an outside-inner-module file:\n{out}")
-print("chroot-link-dest-inner-module: outside basis was not hardlinked into inner module")
diff --git a/testsuite/clean-fname-underflow_test.py b/testsuite/clean-fname-underflow_test.py
deleted file mode 100644
index 505938abd..000000000
--- a/testsuite/clean-fname-underflow_test.py
+++ /dev/null
@@ -1,38 +0,0 @@
-#!/usr/bin/env python3
-# Python rewrite of testsuite/clean-fname-underflow.test.
-#
-# Ensure clean_fname() does not read-before-buffer when collapsing "..".
-# Exercises the --server path where a crafted merge filename hits
-# clean_fname(); the test fails if rsync dies from a signal (status >= 128)
-# AND if rsync exits 0 -- the bogus input must be rejected (clean_fname
-# collapses "a/../test" to "test", whose merge file does not exist, so rsync
-# errors out non-zero). Accepting it would mean the name was mis-collapsed.
-
-import os
-import shlex
-import subprocess
-
-from rsyncfns import RSYNC, TMPDIR, test_fail, split_rsync_cmd
-
-
-workdir = TMPDIR / 'workdir'
-(workdir / 'mod').mkdir(parents=True, exist_ok=True)
-os.chdir(workdir)
-
-# RSYNC may be a multi-word command (e.g. valgrind + rsync); take just the
-# binary path, matching the shell test's `echo $RSYNC | sed 's/ .*//'`.
-rsync_bin = split_rsync_cmd(RSYNC)[0]
-
-proc = subprocess.run(
-    [rsync_bin, '--server', '--sender', '-vlr',
-     '--filter=merge a/../test', '.', 'mod/'],
-    stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL,
-)
-
-if proc.returncode >= 128:
-    test_fail(f"rsync exited due to a signal (status={proc.returncode})")
-if proc.returncode == 0:
-    test_fail("rsync accepted the bogus 'a/../test' merge filter (expected a "
-              "non-zero rejection); clean_fname() may have mis-collapsed it")
-
-print("OK: clean_fname() handled 'a/../test' without crashing, and rejected it")
diff --git a/testsuite/compress-zlib-insert_test.py b/testsuite/compress-zlib-insert_test.py
deleted file mode 100644
index a7be60d99..000000000
--- a/testsuite/compress-zlib-insert_test.py
+++ /dev/null
@@ -1,72 +0,0 @@
-#!/usr/bin/env python3
-# Regression test for issue #951.
-#
-# When rsync is built against a system zlib (no bundled Z_INSERT_ONLY
-# extension), send_deflated_token() falls back to Z_SYNC_FLUSH to add a
-# matched block to the compressor history -- but Z_SYNC_FLUSH emits a flush
-# block into a fixed-size obuf.  A large incompressible matched block
-# overflowed obuf and aborted the transfer with
-#     "deflate on token returned 0 (N bytes left)"  at token.c
-# The fix loops, discarding the (never-sent) output, until the input is
-# consumed.  A bundled-zlib build emits no output here, so this test passes
-# on either build; it is RED only on a pre-fix system-zlib build.
-#
-# The matched-block insert path needs all of: --compress-choice=zlib (the
-# only method that feeds matched blocks into the deflate history), a large
-# --block-size so a single matched token exceeds obuf, incompressible
-# (random) data, and a delta over a real connection (compression is skipped
-# for purely local transfers).  We assert the upload SUCCEEDS *and* the
-# result matches the source, so the fix is verified correct, not merely
-# non-crashing.
-
-import filecmp
-import shutil
-import subprocess
-
-from rsyncfns import (
-    SCRATCHDIR, make_data_file, makepath, rmtree, rsync_argv,
-    start_test_daemon, test_fail, write_daemon_conf,
-)
-
-DAEMON_PORT = 12922
-SIZE = 8 * 1024 * 1024     # enough blocks to exercise many inserts
-# 65535 (0xffff) is a single insert fragment larger than the deflate output
-# buffer (AVAIL_OUT_SIZE(CHUNK_SIZE) ~= 32816).  It exercises both failure
-# modes of the pre-fix code: the obuf overflow abort, and -- once that is
-# loop-drained -- pending insert output left in the stream that leaks into
-# the next send.  A block that splits into chunks ending in a tiny fragment
-# (e.g. 131072 = 65535+65535+2) would hide the pending case.
-BLOCK = 65535
-
-moddir = SCRATCHDIR / 'zmod'
-srcdir = SCRATCHDIR / 'zsrc'
-rmtree(moddir)
-rmtree(srcdir)
-makepath(moddir)
-makepath(srcdir)
-
-# Source is incompressible.  The basis (already in the module) is the same
-# data with a few bytes changed in one block, so every other 128KB block
-# matches exactly and is sent as a token -> the deflate insert path.
-make_data_file(srcdir / 'big.dat', SIZE)
-shutil.copy(srcdir / 'big.dat', moddir / 'big.dat')
-with open(srcdir / 'big.dat', 'r+b') as f:
-    f.seek(SIZE // 2 + 1000)
-    f.write(b'\x00' * 32)
-
-conf = write_daemon_conf([('zmod', {'path': str(moddir), 'read only': 'no'})])
-url = start_test_daemon(conf, DAEMON_PORT) + 'zmod/'
-
-# -I forces the delta even though the basis has the same size (otherwise the
-# quick check skips the file and the matched-block insert path never runs).
-proc = subprocess.run(
-    rsync_argv('-zI', '--compress-choice=zlib', '--no-whole-file',
-               f'--block-size={BLOCK}', str(srcdir / 'big.dat'), url),
-    stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True)
-if proc.returncode != 0:
-    print(proc.stdout)
-    test_fail(f"zlib delta upload failed (rc={proc.returncode}); "
-              "regression of #951 deflate-token overflow")
-
-if not filecmp.cmp(srcdir / 'big.dat', moddir / 'big.dat', shallow=False):
-    test_fail("uploaded file differs from source -- zlib delta corruption")
diff --git a/testsuite/copy-dest-source-symlink_test.py b/testsuite/copy-dest-source-symlink_test.py
deleted file mode 100644
index d1f445423..000000000
--- a/testsuite/copy-dest-source-symlink_test.py
+++ /dev/null
@@ -1,95 +0,0 @@
-#!/usr/bin/env python3
-# Python rewrite of testsuite/copy-dest-source-symlink.test.
-#
-# Regression test for codex audit Finding 3a: copy_file()'s source open
-# in copy_altdest_file() is via do_open_nofollow(), which only refuses
-# a final-component symlink. A daemon-module attacker who plants a
-# parent symlink (module/cd -> /outside) then runs --copy-dest=cd
-# against a source matching the size+mtime of /outside/target.txt
-# drives the receiver to read /outside/target.txt under the daemon's
-# authority and copy it into the module.
-#
-# Detection: source and outside have identical metadata (size, mtime,
-# mode) but distinct content. After the transfer, module/target.txt
-# must contain source's content, not outside's.
-
-import filecmp
-import os
-import subprocess
-
-from rsyncfns import (
-    SCRATCHDIR,
-    rsync_argv, get_testuid, get_rootuid, get_rootgid,
-    rmtree, start_test_daemon, test_fail,
-)
-
-
-DAEMON_PORT = 12883
-
-
-mod = SCRATCHDIR / 'module'
-outside = SCRATCHDIR / 'outside'
-src_dir = SCRATCHDIR / 'src_files'
-conf = SCRATCHDIR / 'test-rsyncd.conf'
-
-for d in (mod, outside, src_dir):
-    rmtree(d)
-    d.mkdir(parents=True)
-
-(outside / 'target.txt').write_text("OUTSIDE_LEAKED_DATA!\n")
-os.chmod(outside / 'target.txt', 0o644)
-
-os.symlink(str(outside), mod / 'cd')
-
-# Source: same size + mtime + mode as outside, different content.
-(src_dir / 'target.txt').write_text("ATTACKER_KNOWN_DATA!\n")
-ref = (outside / 'target.txt').stat()
-os.utime(src_dir / 'target.txt', (ref.st_atime, ref.st_mtime))
-os.chmod(src_dir / 'target.txt', 0o644)
-
-my_uid = get_testuid()
-root_uid = get_rootuid()
-root_gid = get_rootgid()
-uid_line = f"uid = {root_uid}"
-gid_line = f"gid = {root_gid}"
-if my_uid != root_uid:
-    uid_line = '#' + uid_line
-    gid_line = '#' + gid_line
-
-conf.write_text(f"""\
-use chroot = no
-{uid_line}
-{gid_line}
-log file = {SCRATCHDIR}/rsyncd.log
-[upload]
-    path = {mod}
-    use chroot = no
-    read only = no
-""")
-
-url = start_test_daemon(conf, DAEMON_PORT)
-
-subprocess.run(
-    rsync_argv('-rtp', '--copy-dest=cd',
-               f'{src_dir}/', f'{url}upload/'),
-    stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL,
-)
-
-target = mod / 'target.txt'
-if not target.is_file():
-    test_fail(
-        "destination file was not created -- daemon transfer failed "
-        "before the test could observe the basedir behaviour"
-    )
-
-if filecmp.cmp(target, outside / 'target.txt', shallow=False):
-    test_fail(
-        "basedir-escape via copy_file source: module/target.txt now "
-        "contains the contents of outside/target.txt -- daemon read "
-        "/outside via the cd symlink and copied it into the module"
-    )
-if not filecmp.cmp(target, src_dir / 'target.txt', shallow=False):
-    test_fail(
-        "destination doesn't match source content (and isn't outside "
-        "content either): unexpected state"
-    )
diff --git a/testsuite/copy-xattrs-symlink-race_test.py b/testsuite/copy-xattrs-symlink-race_test.py
deleted file mode 100644
index b902a86c5..000000000
--- a/testsuite/copy-xattrs-symlink-race_test.py
+++ /dev/null
@@ -1,160 +0,0 @@
-#!/usr/bin/env python3
-# Symlink-race (TOCTOU) in a confined receiver's metadata xattr write.
-#
-# With -X and --copy-dest, when a basis file matches the source the generator
-# copies it into place and then runs set_file_attrs(), which sets the xattrs/ACLs
-# through a held O_NOFOLLOW fd (fsetxattr).  When that held fd is unavailable --
-# the held-dirfd cache misses, e.g. for a path deeper than the cache -- the
-# unfixed code fell through to a path-based sys_lsetxattr(dest, ...).  lsetxattr
-# does not follow a *leaf* symlink, but the kernel's path walk follows symlinks
-# in PARENT components, so a parent flipped to a symlink->outside in the window
-# between the confined create and the setxattr redirected the attacker-chosen
-# xattr onto a file OUTSIDE the destination tree (the attacker controls the
-# bytes -- e.g. security.capabilities as root).
-#
-# RED before the fix (the marker xattr lands on an outside sentinel); GREEN once
-# set_file_attrs() re-pins via the secure resolver (or refuses) so the write
-# always uses fsetxattr on a confined fd, which a parent flip cannot redirect.
-# The dest path is buried below the held-dirfd cache depth so the fd-less path is
-# taken on EVERY push (see DEEP), making the flip the only race; a separate-
-# process flipper wins it.  No rsync instrumentation is needed.
-
-import os
-import platform
-import subprocess
-import time
-
-from rsyncfns import (
-    race_budget, SCRATCHDIR, rmtree, rsync_argv, test_fail, test_skipped,
-    xattr_set, xattrs_supported,
-)
-
-MARKER = 'user.marker'   # on-disk name we look for on the outside sentinels
-N = 120
-
-if platform.system() != 'Linux':
-    test_skipped("parent-flip xattr race is checked on Linux (os.*xattr)")
-if not xattrs_supported():
-    test_skipped("rsync built without xattr support (or no xattr tooling)")
-
-base = SCRATCHDIR / 'copy-xattrs-race'
-src = base / 'src'
-cdbasis = base / 'cdbasis'      # absolute --copy-dest basis
-dest = base / 'dest'
-outside = base / 'outside'
-# Bury the flipped dir below the receiver's held-dirfd cache depth (>64) so
-# held_dfd_for()/vfs_cached_dirfd() returns -1 for EVERY file deterministically
-# (not just on a cache-miss race): set_file_attrs() then takes the fd-less
-# metadata path on every push, so the only remaining race is the flip landing
-# during the lsetxattr -- a far stronger RED oracle, especially under -j load.
-DEEP = '/'.join(['d'] * 70)
-
-rmtree(base)
-(src / DEEP / 'sub').mkdir(parents=True)
-(cdbasis / DEEP / 'sub').mkdir(parents=True)
-(dest / DEEP).mkdir(parents=True)
-outside.mkdir()
-
-# Source + matching copy-dest basis (same content/mtime/mode so the generator
-# copies from the basis rather than transferring), both carrying the attacker-
-# chosen marker xattr.  A large payload widens the copy_file open->setxattr
-# window so the separate-process flipper can land inside it.
-payload = ('x' * 4096 + '\n') * 16  # ~64 KB: widens the per-file create->lsetxattr window
-try:
-    for i in range(N):
-        s = src / DEEP / 'sub' / f'f{i}'
-        b = cdbasis / DEEP / 'sub' / f'f{i}'
-        s.write_text(payload)
-        b.write_text(payload)
-        os.chmod(s, 0o644)
-        os.chmod(b, 0o644)
-        st = s.stat()
-        os.utime(b, (st.st_atime, st.st_mtime))
-        xattr_set('marker', 'PWNED', s, b)
-        # Pre-create the outside sentinel the escaped lsetxattr would land on
-        # (lsetxattr on a missing path is a no-op ENOENT, not an escape).
-        (outside / f'f{i}').write_text('')
-except OSError as e:
-    test_skipped(f"filesystem does not support user xattrs ({e})")
-
-sub = dest / DEEP / 'sub'           # the parent component the attacker flips
-link = dest / DEEP / '.sublink'     # symlink -> outside, swapped in for `sub`
-link.symlink_to(outside)
-
-
-def push():
-    subprocess.run(
-        rsync_argv('-rtpX', '--inplace', f'--copy-dest={cdbasis}',
-                   f'{src}/', f'{dest}/'),
-        stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL,
-    )
-
-
-def outside_marked():
-    return sorted(p.name for p in outside.iterdir()
-                  if p.is_file() and not p.is_symlink()
-                  and MARKER in os.listxattr(str(p)))
-
-
-# Positive control: a normal push copies the basis xattr into dest/sub, so the
-# copy_xattrs path is genuinely exercised and the race below isn't vacuous.
-rmtree(sub)
-sub.mkdir()
-push()
-if MARKER not in os.listxattr(str(sub / 'f0')):
-    test_fail("positive control: a normal --copy-dest -X push did not copy the "
-              "basis marker xattr into dest/sub/f0, so the copy_xattrs race "
-              "window would be vacuous")
-# Clear any marker the control might have left on the sentinels.
-for i in range(N):
-    try:
-        os.removexattr(str(outside / f'f{i}'), MARKER)
-    except OSError:
-        pass
-
-# Separate-process flipper: flip dest/sub between a real directory and the
-# symlink->outside (atomic 3-rename swap), fast enough to win the window
-# between the confined create and set_file_attrs' fd-less metadata setxattr.  It self-
-# terminates when the test process goes away (getppid changes) and after a
-# hard deadline, so a killed test can't leak an orphan (see start_path_flipper).
-flip_code = (
-    "import os, sys, time\n"
-    "sub, link = sys.argv[1], sys.argv[2]\n"
-    "scratch = sub + '.flip'\n"
-    "parent = os.getppid()\n"
-    "deadline = time.time() + 120\n"
-    "while time.time() < deadline and os.getppid() == parent:\n"
-    "    try:\n"
-    "        os.makedirs(sub, exist_ok=True)\n"
-    "        os.rename(sub, scratch); os.rename(link, sub); os.rename(scratch, link)\n"
-    "        os.rename(sub, scratch); os.rename(link, sub); os.rename(scratch, link)\n"
-    "    except OSError:\n"
-    "        pass\n"
-)
-flip = subprocess.Popen(['python3', '-c', flip_code, str(sub), str(link)])
-try:
-    deadline = time.monotonic() + race_budget(10.0)
-    while time.monotonic() < deadline:
-        # Start each round from a real (absent->mkdir'd) dest/sub so the copy
-        # opens a real directory; the flip then happens during the copy.
-        rmtree(sub)
-        try:
-            sub.unlink()
-        except OSError:
-            pass
-        push()
-        marked = outside_marked()
-        if marked:
-            test_fail(
-                "metadata xattr parent-symlink race: the attacker-chosen marker "
-                f"xattr was written onto files OUTSIDE the destination tree "
-                f"({marked}) -- a confined receiver's set_file_attrs() fell back to "
-                "a path-based lsetxattr and followed a flipped dest/sub symlink.")
-finally:
-    flip.terminate()
-    try:
-        flip.wait(timeout=5)
-    except subprocess.TimeoutExpired:
-        flip.kill()
-
-# No escape within the race budget.
diff --git a/testsuite/crtimes_test.py b/testsuite/crtimes_test.py
deleted file mode 100644
index 7142b5ea4..000000000
--- a/testsuite/crtimes_test.py
+++ /dev/null
@@ -1,38 +0,0 @@
-#!/usr/bin/env python3
-# Python rewrite of testsuite/crtimes.test.
-#
-# Test that rsync preserves source create times when the binary was built
-# with crtimes support. Touch tricks: setting an older time via touch sets
-# the create time to the mtime; setting a newer time affects only mtime.
-
-import datetime
-import os
-
-import rsyncfns
-from rsyncfns import FROMDIR, TODIR, checkit, run_rsync, test_skipped
-
-
-vv = run_rsync('-VV', check=True, capture_output=True)
-if '"crtimes": true' not in vv.stdout:
-    test_skipped("Rsync is configured without crtimes support")
-
-FROMDIR.mkdir(parents=True, exist_ok=True)
-(FROMDIR / 'foo').write_text("hiho\n")
-
-
-def _utime(path, when: 'datetime.datetime') -> None:
-    ts = when.timestamp()
-    os.utime(path, (ts, ts))
-
-
-# Touch fromdir to an old time then to a newer time -- in shells with the
-# right kernel support this leaves the create time pinned to the older.
-_utime(FROMDIR, datetime.datetime(2001, 1, 1, 11, 11, 11))
-_utime(FROMDIR, datetime.datetime(2002, 2, 2, 22, 22, 22))
-
-_utime(FROMDIR / 'foo', datetime.datetime(2001, 11, 11, 11, 11, 11))
-_utime(FROMDIR / 'foo', datetime.datetime(2002, 12, 12, 22, 22, 22))
-
-rsyncfns.TLS_ARGS = '--crtimes'
-
-checkit(['-rtgvvv', '--crtimes', f'{FROMDIR}/', f'{TODIR}/'], FROMDIR, TODIR)
diff --git a/testsuite/daemon-auth-users-comma-only_test.py b/testsuite/daemon-auth-users-comma-only_test.py
deleted file mode 100644
index 479da5364..000000000
--- a/testsuite/daemon-auth-users-comma-only_test.py
+++ /dev/null
@@ -1,180 +0,0 @@
-#!/usr/bin/env python3
-"""A leading comma in "auth users" must make splitting comma-only.
-
-rsyncd.conf(5) documents that when the auth users value starts with a comma,
-splitting is done on commas ALONE, so an entry may contain spaces -- which is
-how an NSS group name with a space is written:
-
-    auth users = ,@Group Name:deny, alice:rw
-
-auth_server() ignored that and always tokenised on commas AND whitespace
-(strtok(users, " ,\\t")), so "@Group Name:deny" was torn into "@Group" and
-"Name:deny": the group rule the administrator wrote never matched anything, and
-a username rule they never wrote appeared out of its tail.
-
-The reported impact is an authorization BYPASS: a member of a denied group
-evades the deny and matches a later :rw entry.  Both directions are covered.
-
-"grpdeny" drives the reported one without needing an NSS group whose name
-contains a space, which a test cannot create: "@[! []*" is a wildmatch class
-holding a space that matches any ordinary group name -- one with no "/" in it,
-which wildmatch treats as a path separator -- whose first character is neither
-a space nor a "[".  So the entry contains a space and still matches a real
-group.  The "[" is excluded so that the tail left by a whitespace split,
-"[]*", is an unterminated class that can match no name at all: with the
-simpler "[! ]*" the tail is "]*", which would match (and deny) any user whose
-name began with "]", letting the buggy parser produce the right refusal for
-the wrong reason.
-
-"spaced" drives the identical defect in the direction that needs no groups:
-
-    auth users = ,@nosuchgroup alice:deny, alice:rw
-
-  * parsed as documented -- one entry "@nosuchgroup alice:deny" naming a group
-    that does not exist, so no match, then "alice:rw" grants access.
-  * parsed by splitting on whitespace -- "@nosuchgroup", then "alice:deny",
-    which matches the username and refuses the transfer that should succeed.
-
-Either way the rule enforced is not the rule written.  Each direction has its
-own control module proving the credential and the transfer itself are fine, and
-the deny is checked against the daemon log rather than the client's output,
-because a client is told only "auth failed" for every server-side reason alike.
-"""
-
-import os
-import subprocess
-
-from rsyncfns import (
-    SCRATCHDIR, makepath, rmtree, rsync_argv, start_test_daemon, test_fail,
-    write_daemon_conf,
-)
-
-PORT = 12949
-USER = 'authuser'
-PASSWORD = 'known-password'
-DATA = 'AUTH-USERS-PARSE\n'
-
-base = SCRATCHDIR / 'auth-users-comma-only'
-rmtree(base)
-src = base / 'src'
-mod = base / 'mod'
-ctrl = base / 'ctrl'
-grp = base / 'grp'
-grpc = base / 'grpc'
-makepath(src, mod, ctrl, grp, grpc)
-(src / 'f1').write_text(DATA)
-
-# The group half needs an auth name the daemon can resolve to a real uid, or
-# getallgroups() finds nothing and no group rule can ever match.
-import pwd
-REALUSER = pwd.getpwuid(os.geteuid()).pw_name
-
-secrets = base / 'auth-users.secrets'
-secrets.write_text(f'{USER}:{PASSWORD}\n{REALUSER}:{PASSWORD}\n')
-secrets.chmod(0o600)
-pwfile = base / 'auth-users.password'
-pwfile.write_text(PASSWORD + '\n')
-pwfile.chmod(0o600)
-
-common = {
-    'read only': 'no',
-    'use chroot': 'no',
-    'secrets file': str(secrets),
-}
-
-conf = write_daemon_conf([
-    # The documented comma-only form.  The first entry names a group that does
-    # not exist, so only the second entry may decide the outcome.
-    ('spaced', dict(common, path=str(mod),
-                    **{'auth users': f',@nosuchgroup {USER}:deny, {USER}:rw'})),
-    # Control: same credential, same transfer, no space in any entry.
-    ('plain', dict(common, path=str(ctrl),
-                   **{'auth users': f'{USER}:rw'})),
-    # The reported direction: a group rule containing a space must DENY a member.
-    # "[! []*" is a wildmatch class holding a space that matches any ordinary
-    # group name whose first character is neither a space nor a "[" -- i.e. a
-    # real group of REALUSER -- so the space is exercised without needing an
-    # NSS group named with one.  (Ordinary: wildmatch reads "/" as a path
-    # separator, so a group name containing one would not match either.)
-    #   documented parse: one entry "@[! []*:deny" -> the deny fires
-    #   whitespace parse: "@[!" (an unterminated class, so no group) plus
-    #                     "[]*:deny" (likewise, so no user), and with neither
-    #                     matching the later ":rw" lets them in.
-    # Positive control for the group half: "@*" matches any group, so this
-    # only succeeds if the daemon resolved REALUSER to a uid, enumerated its
-    # groups, accepted its secret and could store the file.  Without it a
-    # grpdeny refusal could be any of those failing instead of the deny.
-    ('grpctl', dict(common, path=str(grpc),
-                    **{'auth users': f'@*:rw'})),
-    ('grpdeny', dict(common, path=str(grp),
-                     **{'auth users': f',@[! []*:deny, {REALUSER}:rw'})),
-], name='auth-users-comma-only.conf')
-url = start_test_daemon(conf, PORT)
-
-os.environ['RSYNC_PASSWORD'] = 'wrong-environment-fallback'
-
-
-def push(module, dest_dir, as_user=USER):
-    proc = subprocess.run(
-        rsync_argv('-r', f'--password-file={pwfile}', f'{src}/',
-                   url.replace('rsync://', f'rsync://{as_user}@', 1) + module + '/'),
-        stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True)
-    landed = dest_dir / 'f1'
-    return proc, landed
-
-
-# Control first: if this fails, nothing below means anything.
-proc, landed = push('plain', ctrl)
-if proc.returncode != 0 or not landed.is_file() or landed.read_text() != DATA:
-    test_fail('positive control failed: the credential could not push to a '
-              f'module with a plain "auth users" (rc={proc.returncode}, '
-              f'output={proc.stdout.strip()[:300]!r})')
-
-proc, landed = push('spaced', mod)
-ctx = f'rc={proc.returncode}, output={proc.stdout.strip()[:300]!r}'
-if not landed.is_file():
-    test_fail('"auth users" starting with a comma was split on whitespace: the '
-              f'entry "@nosuchgroup {USER}:deny" names a group that does not '
-              f'exist and must not match, but its tail was read as a separate '
-              f'"{USER}:deny" rule and the transfer was refused ({ctx})')
-if landed.read_text() != DATA:
-    test_fail(f'transfer was allowed but delivered the wrong content ({ctx})')
-if proc.returncode != 0:
-    test_fail(f'transfer was allowed but failed ({ctx})')
-
-# Group control: everything the group half depends on must work first.
-proc, landed = push('grpctl', grpc, as_user=REALUSER)
-ctx = f'rc={proc.returncode}, output={proc.stdout.strip()[:300]!r}'
-if proc.returncode != 0 or not landed.is_file():
-    test_fail(f'group positive control failed: "@*:rw" should admit {REALUSER} '
-              'via any of its groups.  Either the daemon could not resolve that '
-              'name to a uid, could not enumerate its groups, rejected its '
-              f'secret, or could not store the file ({ctx})')
-
-# The reported direction: the spaced group rule must actually DENY.
-proc, landed = push('grpdeny', grp, as_user=REALUSER)
-ctx = f'rc={proc.returncode}, output={proc.stdout.strip()[:300]!r}'
-if landed.is_file() or proc.returncode == 0:
-    test_fail('a group deny rule containing a space did not fire: '
-              f'"@[! []*:deny" must match a real group of {REALUSER} and '
-              'refuse the transfer, but the whitespace split turned it into '
-              f'"@[!" and "[]*:deny", neither of which matches, so the later '
-              f'"{REALUSER}:rw" granted access ({ctx})')
-# ...and it must be refused BY THE DENY.  A client is told only "auth failed"
-# whatever the server decided: "denied by rule", "no matching rule" and
-# "password mismatch" all reach it identically, so a parse yielding no rules at
-# all would satisfy a check on the client output while the deny never matched
-# anything.  Only the daemon log names the reason.
-logfile = SCRATCHDIR / 'rsyncd.log'
-log = logfile.read_text(errors='replace') if logfile.is_file() else ''
-if not [ln for ln in log.splitlines()
-        if 'auth failed on module grpdeny' in ln
-        and f'for {REALUSER}: denied by rule' in ln]:
-    test_fail('the transfer was refused, but not by the deny rule: the daemon '
-              f'log has no "auth failed on module grpdeny ... for {REALUSER}: '
-              'denied by rule".  A refusal for any other reason -- above all '
-              '"no matching rule", which is what a parse yielding no rules at '
-              'all produces -- would make this case pass without the deny ever '
-              f'matching ({ctx}, log={log.strip()[-500:]!r})')
-
-print('a leading comma in "auth users" splits on commas alone')
diff --git a/testsuite/daemon-config-symlink_test.py b/testsuite/daemon-config-symlink_test.py
deleted file mode 100644
index 9b7376c79..000000000
--- a/testsuite/daemon-config-symlink_test.py
+++ /dev/null
@@ -1,126 +0,0 @@
-#!/usr/bin/env python3
-# Daemon ancillary opens (motd / early-input / lock / --config rsyncd.conf)
-# must not follow planted symlinks at attacker-controlled path components.
-#
-# Threat: admin-configured paths in
-# rsyncd.conf or on the daemon's command line are operator-supplied, but the
-# /tmp-class trust model applies (admin reasonably picks /tmp or another
-# shared-parent path for one-off use; the attacker plants in that parent).
-# Each of these opens is plain fopen()/open() without O_NOFOLLOW or path
-# walk:
-#   clientserver.c:160   fopen(motd, "r")
-#   clientserver.c:269   fopen(early_input_file, "rb")
-#   connection.c:33      open(lock_file, O_RDWR|O_CREAT, 0600)
-#   params.c:583         fopen(rsyncd.conf, "r")
-#
-# This test exercises the MOTD case as the representative -- the leak signal
-# is direct: when the planted symlink is followed, its target's bytes are
-# read and sent to the connecting client as the message of the day. With the
-# fix the open is refused; the daemon either sends no motd or errors, but
-# the leaked content does not reach the client. The other three call sites
-# (early-input, lock, --config) are covered by the SAME path-walk helper
-# applied uniformly; their behaviour is not separately exercised here.
-#
-# Requires root for the cross-uid plant; skips otherwise.
-
-import os
-import pwd
-import subprocess
-
-from rsyncfns import (
-    FROMDIR, SCRATCHDIR, make_tree, rmtree, rsync_argv, start_test_daemon,
-    test_fail, test_skipped, write_daemon_conf,
-)
-
-DAEMON_PORT = 12901
-MARKER = "AUDIT_MOTD_LEAK_MARKER_DO_NOT_DISCLOSE"
-
-
-if os.geteuid() != 0:
-    test_skipped("requires root to plant a symlink owned by a non-self uid "
-                 "(the attacker simulation)")
-
-NOBODY_UID = None
-for name in ('nobody', 'nfsnobody', 'daemon'):
-    try:
-        u = pwd.getpwnam(name).pw_uid
-        if u != 0 and u != os.geteuid():
-            NOBODY_UID = u
-            break
-    except KeyError:
-        continue
-if NOBODY_UID is None:
-    test_skipped("no untrusted-uid user available for cross-uid plant")
-
-
-# Daemon setup
-src = FROMDIR
-rmtree(src)
-make_tree(src, depth=1)
-
-base = SCRATCHDIR / 'daemoncfg'
-rmtree(base)
-base.mkdir()
-plants = base / 'plants'
-plants.mkdir()
-modpath = base / 'mod'
-modpath.mkdir()
-
-# The victim file. The attacker plants a symlink at the motd path pointing
-# here; the file's content is the unique marker. If the marker reaches the
-# connecting client, the leak fired.
-victim = plants / 'motd_victim'
-victim.write_text(MARKER + "\n")
-os.chmod(victim, 0o600)
-
-motd_plant = plants / 'motd_plant'
-os.symlink(victim, motd_plant)
-os.lchown(motd_plant, NOBODY_UID, NOBODY_UID)
-
-# Lock-file plant.  The daemon uses 'lock file =' for max-connections gating
-# (connection.c:33: open(fname, O_RDWR|O_CREAT, 0600)) -- only when
-# max_connections > 0, so we set max_connections=5 below to force the open.
-# A planted symlink at the lock-file path redirects the daemon's
-# O_CREAT-open to an attacker-chosen path.  We plant a symlink pointing at
-# a victim-directory entry inside our scratch tree; if the daemon followed
-# it, the file gets created at the planted target on first client connect.
-lock_victim_dir = base / 'lock_victim'
-lock_victim_dir.mkdir()
-lock_plant = plants / 'lock_plant'
-os.symlink(lock_victim_dir / 'leaked_lockfile', lock_plant)
-os.lchown(lock_plant, NOBODY_UID, NOBODY_UID)
-
-conf = write_daemon_conf(
-    [('mod', {'path': modpath, 'read only': 'yes',
-              'max connections': '5'})],
-    globals={'motd file': str(motd_plant),
-             'lock file': str(lock_plant)},
-)
-url = start_test_daemon(conf, DAEMON_PORT)
-
-# Connect with the rsync client; the daemon will (or won't) send the motd
-# content to the client during connection setup. Listing the module triggers
-# motd, and -- since max_connections > 0 on `mod` -- ALSO triggers the lock-
-# file open via claim_connection().
-proc = subprocess.run(
-    rsync_argv(url + 'mod/'),
-    stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True)
-
-if MARKER in proc.stdout or MARKER in proc.stderr:
-    test_fail(
-        f"daemon followed a planted motd symlink (owned by uid {NOBODY_UID}): "
-        f"the marker {MARKER!r} from {victim} was read via the symlink and "
-        "sent to the connecting client as the message of the day. Fix: refuse "
-        "planted symlinks at the daemon motd open (and analogously for "
-        "early-input / lock / --config).")
-
-# Did the daemon's claim_connection() follow the planted lock-file symlink
-# and create a file at the attacker-chosen location?
-leaked_lockfile = lock_victim_dir / 'leaked_lockfile'
-if leaked_lockfile.exists():
-    test_fail(
-        f"daemon followed a planted lock-file symlink (owned by uid "
-        f"{NOBODY_UID}): {lock_plant} -> {leaked_lockfile} was traversed by "
-        f"claim_connection()'s open(O_CREAT) at connection.c:33, creating a "
-        f"root-owned file at the attacker-chosen path. Fix: refuse planted "
-        "symlinks at the daemon lock-file open.")
diff --git a/testsuite/daemon-config_test.py b/testsuite/daemon-config_test.py
deleted file mode 100644
index b680c73ce..000000000
--- a/testsuite/daemon-config_test.py
+++ /dev/null
@@ -1,52 +0,0 @@
-#!/usr/bin/env python3
-"""Daemon coverage: the &include config directive (params.c include_config /
-parse_directives) and a module whose path doesn't exist (clientserver.c
-path_failure).
-
-Uses a hand-written rsyncd.conf because &include is a directive line, not a
-`name = value` parameter.
-"""
-
-import subprocess
-
-from rsyncfns import (
-    FROMDIR, SCRATCHDIR,
-    make_tree, rmtree, rsync_argv, start_test_daemon, test_fail,
-)
-
-DAEMON_PORT = 12893
-
-src = FROMDIR
-rmtree(src)
-make_tree(src, depth=2)
-
-inc = SCRATCHDIR / 'included.conf'
-inc.write_text(f"[inc-mod]\n\tpath = {src}\n\tread only = yes\n\tcomment = via-include\n")
-
-conf = SCRATCHDIR / 'daemon-config.conf'
-conf.write_text(
-    f"pid file = {SCRATCHDIR}/rsyncd.pid\n"
-    "use chroot = no\n"
-    "hosts allow = localhost 127.0.0.0/8\n"
-    f"log file = {SCRATCHDIR}/rsyncd.log\n"
-    f"&include {inc}\n"
-    f"\n[badpath]\n\tpath = {SCRATCHDIR}/no-such-dir\n\tread only = yes\n"
-)
-url = start_test_daemon(conf, DAEMON_PORT)
-
-# &include pulled in inc-mod: it must be listable and present in the module list.
-proc = subprocess.run(rsync_argv('-r', f'{url}inc-mod/'),
-                      stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True)
-if proc.returncode != 0:
-    test_fail(f"&include-defined module not reachable: {proc.stderr}")
-proc = subprocess.run(rsync_argv(url), capture_output=True, text=True)
-if 'inc-mod' not in proc.stdout:
-    test_fail(f"&include-defined module absent from the listing:\n{proc.stdout}")
-
-# A module whose path does not exist must fail the connection (path_failure).
-proc = subprocess.run(rsync_argv('-r', f'{url}badpath/'),
-                      stdout=subprocess.DEVNULL, stderr=subprocess.PIPE, text=True)
-if proc.returncode == 0:
-    test_fail("a module with a non-existent path unexpectedly served a connection")
-
-print("daemon-config: &include directive + bad-path failure verified")
diff --git a/testsuite/daemon-copy-links-symlink_test.py b/testsuite/daemon-copy-links-symlink_test.py
deleted file mode 100644
index a79fa445f..000000000
--- a/testsuite/daemon-copy-links-symlink_test.py
+++ /dev/null
@@ -1,65 +0,0 @@
-#!/usr/bin/env python3
-# A daemon must follow an IN-TREE symlink in its served module when the client
-# asks to dereference it (-L copy-links / -k copy-dirlinks) -- the symlink is
-# inside the operator's own served tree, which 3.4.x follows.
-#
-# A/B + fuzzer-discovered 3.5 regression (abdiff --fuzz: 16 candidates, one root
-# cause): an early per-component O_NOFOLLOW resolver made the daemon SENDER refuse
-# to follow the in-tree dir-symlink that -L/-k must dereference (exit 23, files
-# lost; the -L pull case could even exit 0 while SILENTLY dropping the symlinked
-# content).  The secure resolver now follows in-tree directory symlinks on every
-# platform, so -L/-k over the daemon transport works uniformly; 3.4.x is unaffected.
-#
-# Same root cause as the local -K (keep-dirlinks-symlinked-dest) and -aR
-# (relative-symlinked-parent) regressions, but a BROADER surface: it adds -L and
-# -k, over the DAEMON transport (the local -L/-k paths are unaffected).  No root;
-# uses the standard test-daemon seam (no real TCP in the default mode).
-
-import os
-
-from rsyncfns import (SCRATCHDIR, assert_same, get_rootgid, get_rootuid,
-                      get_testuid, makepath, rmtree, run_rsync,
-                      start_test_daemon, test_fail)
-
-DAEMON_PORT = 12898
-base = SCRATCHDIR / 'daemon_copylinks'
-rmtree(base)
-mod = base / 'mod'
-makepath(mod / 'dir' / 'sub', base / 'dest')
-(mod / 'dir' / 'a.txt').write_text('payload a\n')
-(mod / 'dir' / 'sub' / 'b.txt').write_text('payload b\n')
-os.symlink('dir', mod / 'dir_link')          # in-tree dir-symlink within the module
-
-# When the suite runs as root (e.g. the CI fleet's sudo pass) a use-chroot=no
-# daemon otherwise drops to nobody and can't read the root-owned module, so the
-# sender fails with EACCES on every file -- nothing to do with the symlink.
-# Pin uid/gid to root in that case, as build_rsyncd_conf() does.  Non-root
-# cannot set uid/gid (and doesn't need to: it owns the module).
-root = get_testuid() == get_rootuid()
-ids = f"uid = {get_rootuid()}\ngid = {get_rootgid()}" if root else ""
-
-conf = base / 'copylinks.conf'
-conf.write_text(f"""\
-pid file = {base}/rsyncd.pid
-use chroot = no
-{ids}
-log file = {base}/rsyncd.log
-
-[m]
-    path = {mod}
-    read only = yes
-    hosts allow = 127.0.0.1
-""")
-url = start_test_daemon(conf, DAEMON_PORT)
-
-# -L (copy-links): dir_link must arrive as a real directory with its content.
-# check=False: the fallback regression manifests either as exit 23 or as a
-# silent exit-0 partial copy -- assert on the resulting tree either way.
-run_rsync('-aL', f'{url}m/', f'{base}/dest/', check=False)
-
-for rel in ('dir_link/a.txt', 'dir_link/sub/b.txt'):
-    if not (base / 'dest' / rel).is_file():
-        test_fail(f"daemon pull -aL dropped in-tree symlinked content: dest/{rel} missing")
-assert_same(mod / 'dir' / 'a.txt', base / 'dest' / 'dir_link' / 'a.txt', label='content')
-
-print("daemon-copy-links-symlink: daemon -aL follows an in-tree dir-symlink in the module")
diff --git a/testsuite/daemon-copylinks-intree_test.py b/testsuite/daemon-copylinks-intree_test.py
deleted file mode 100755
index 80592b45e..000000000
--- a/testsuite/daemon-copylinks-intree_test.py
+++ /dev/null
@@ -1,49 +0,0 @@
-#!/usr/bin/env python3
-"""A daemon sender must follow an in-tree symlink for -L/--copy-links.
-
-A read-only daemon module that contains a benign in-tree symlink (`lnk` ->
-a sibling regular file inside the module) must, when pulled with `-aL`, transfer
-the symlink's target as a regular file -- exactly as a plain local `-aL` does.
-
-Regression: the daemon sender was observed to refuse the in-tree symlink with
-"failed to open ... Too many levels of symbolic links" (ELOOP), exit 23, leaving
-the file untransferred -- while a local `-aL` of the same tree, and an older
-rsync over the daemon, both follow it. The leaf-symlink refusal that protects the
-content open must not defeat an operator's explicit --copy-links request for an
-in-tree (non-escaping) symlink.
-"""
-
-import os
-
-from rsyncfns import (
-    SCRATCHDIR, assert_same, makepath, rmtree, run_rsync, start_test_daemon,
-    test_fail, write_daemon_conf,
-)
-
-DAEMON_PORT = 12935
-
-served = SCRATCHDIR / 'cli_mod'
-dest = SCRATCHDIR / 'cli_dest'
-rmtree(served)
-rmtree(dest)
-makepath(served)
-(served / 'real').write_text("symlink target content\n")
-os.symlink('real', served / 'lnk')          # in-tree symlink to a sibling file
-(served / 'anchor').write_text("anchor\n")
-
-conf = write_daemon_conf([('m', {'path': str(served), 'read only': 'yes'})])
-url = start_test_daemon(conf, DAEMON_PORT)
-
-# Pull with -L: the daemon sender must follow the in-tree symlink and send its
-# target as a regular file (codes 0 ok; 23 = the very failure we are guarding).
-run_rsync('-aL', f'{url}m/', f'{dest}/', check=False)
-
-if not (dest / 'lnk').exists():
-    test_fail("daemon -aL did not transfer the in-tree symlink 'lnk' "
-              "(the sender refused to follow it)")
-if os.path.islink(dest / 'lnk'):
-    test_fail("daemon -aL left 'lnk' as a symlink instead of following it")
-assert_same(dest / 'lnk', served / 'real',
-            label="daemon -aL followed the in-tree symlink to its target")
-
-print("daemon-copylinks-intree: daemon -aL follows an in-tree symlink")
diff --git a/testsuite/daemon-deny-dns-failopen_test.py b/testsuite/daemon-deny-dns-failopen_test.py
deleted file mode 100644
index 55ae8a16a..000000000
--- a/testsuite/daemon-deny-dns-failopen_test.py
+++ /dev/null
@@ -1,70 +0,0 @@
-#!/usr/bin/env python3
-"""Daemon: a `hosts deny` hostname token that cannot be resolved must fail CLOSED.
-
-KI-43 / sibling of CVE-2026-43617 (access.c).  match_hostname() does a forward
-DNS lookup of a config-specified hostname token (gethostbyname) and, on failure,
-returned "no match" -- indistinguishable from a real non-match -- so allow_access
-fell through to ALLOW.  A daemon with `hosts deny = <hostname>` therefore silently
-admitted the very host it meant to block whenever the token could not resolve (a
-resolver-less chroot -- a recommended hardening -- or a transient DNS failure),
-with no attacker DNS control required.
-
-The fix makes an unresolvable token on a DENY list fail closed (treated as a
-match, i.e. deny) while leaving allow-list behaviour unchanged.
-
-This needs --use-tcp: match_hostname only runs for a real TCP peer (127.0.0.1).
-"""
-
-import subprocess
-
-from rsyncfns import (
-    FROMDIR, SCRATCHDIR, RSYNC,
-    make_tree, require_tcp, rmtree, rsync_argv, start_test_daemon, test_fail,
-)
-
-DAEMON_PORT = 12894
-require_tcp("hosts deny DNS-failure matching needs a real TCP peer")
-
-src = FROMDIR
-rmtree(src)
-make_tree(src, depth=2)
-
-# `.invalid` is reserved (RFC 6761) to never resolve, so gethostbyname() on the
-# deny token fails deterministically -- exactly the fail-open trigger.
-conf = SCRATCHDIR / 'deny-dns.conf'
-conf.write_text(
-    f"pid file = {SCRATCHDIR}/rsyncd.pid\n"
-    "use chroot = no\n"
-    f"log file = {SCRATCHDIR}/rsyncd.log\n"
-    f"\n[plain]\n\tpath = {src}\n\tread only = yes\n"
-    f"\n[deny-match]\n\tpath = {src}\n\tread only = yes\n\thosts deny = 127.0.0.0/8\n"
-    f"\n[deny-nomatch]\n\tpath = {src}\n\tread only = yes\n\thosts deny = 10.0.0.0/8\n"
-    f"\n[deny-unresolvable]\n\tpath = {src}\n\tread only = yes\n\thosts deny = nope.nonexistent.invalid\n"
-)
-# The access check is daemon-side, so the daemon must be the binary under test
-# (matters under --rsync-bin2, where RSYNC_PEER could be a different/old binary).
-url = start_test_daemon(conf, DAEMON_PORT, rsync_cmd=RSYNC)
-
-
-def connect(mod):
-    """Return rsync's exit code for listing the module over the daemon."""
-    return subprocess.run(rsync_argv('-r', f'{url}{mod}/'),
-                          stdout=subprocess.DEVNULL, stderr=subprocess.PIPE,
-                          text=True).returncode
-
-
-# Controls (non-vacuity): the daemon answers, the deny mechanism works, and a
-# non-matching deny still admits.
-if connect('plain') != 0:
-    test_fail("control: connection to [plain] (no deny) should be ALLOWED but was refused")
-if connect('deny-match') == 0:
-    test_fail("control: [deny-match] (hosts deny = 127.0.0.0/8) should be DENIED but succeeded")
-if connect('deny-nomatch') != 0:
-    test_fail("control: [deny-nomatch] (hosts deny = 10.0.0.0/8, non-matching) should be ALLOWED but was refused")
-
-# The fix: an unresolvable deny-list hostname token must fail CLOSED.
-if connect('deny-unresolvable') == 0:
-    test_fail("[deny-unresolvable] (hosts deny = nope.nonexistent.invalid) was ALLOWED: "
-              "an unresolvable deny token failed OPEN (KI-43)")
-
-print("daemon-deny-dns-failopen: unresolvable hosts-deny token fails closed")
diff --git a/testsuite/daemon-filter-merge-bypass_test.py b/testsuite/daemon-filter-merge-bypass_test.py
deleted file mode 100644
index 5e06cbdd6..000000000
--- a/testsuite/daemon-filter-merge-bypass_test.py
+++ /dev/null
@@ -1,132 +0,0 @@
-#!/usr/bin/env python3
-# Daemon-side --filter merge-file bypasses the module's daemon_filter_list.
-#
-# Threat (Mitchell Benjamin report, May 2026):
-#   A daemon module has `filter = - /secret/***` to hide its /secret/
-#   subtree from clients.  A client that connects to that module with
-#       -M --filter=._/secret/rules
-#   (i.e. --remote-option=--filter=._<path>) makes the daemon's option
-#   parser run parse_filter_str() on the server side.  That goes through
-#   parse_merge_name() (exclude.c:599), which under sanitize_paths=True
-#   prepends `module_dir` to absolute merge-file paths, then calls
-#   parse_filter_file().
-#
-#   parse_filter_file() (exclude.c:1457) *does* check daemon_filter_list
-#   before fopen(), but against the post-merge-name absolute path
-#   (e.g. /srv/rsync/MOD/secret/rules) — the daemon's anchored rule
-#   `- /secret/***` only matches the module-relative form `/secret/...`,
-#   so the check passes and fopen() succeeds.
-#
-#   Compare options.c:1522-1544 (OPT_EXCLUDE_FROM / OPT_INCLUDE_FROM)
-#   which strips `module_dirlen` from the front BEFORE check_filter():
-#       dir = cp + (*cp == '/' ? module_dirlen : 0);
-#       clean_fname(dir, CFN_COLLAPSE_DOT_DOT_DIRS);
-#       rej = check_filter(&daemon_filter_list, FLOG, dir, 0) < 0;
-#   The merge-file path lacks this strip.  That asymmetry is the bug.
-#
-# Oracle: make /secret/rules contain `- *` (exclude everything).  When the
-#   daemon's sender parses it, the rule joins filter_list and excludes
-#   public.txt too.  So:
-#     * baseline pull (no --filter)        -> public.txt arrives.
-#     * attack pull (--filter=._/secret/rules):
-#         - if vulnerable: public.txt is EXCLUDED (rules file was parsed
-#                          and its rule applied).
-#         - if fixed:      public.txt still arrives (rules file refused
-#                          before fopen()).
-#
-#   Negative control: --remote-option=--exclude-from=/secret/rules is
-#   already rejected by the daemon (the working code path).  We don't
-#   require it as a hard assertion (the daemon may reject early before we
-#   can introspect), but it is documented behaviour.
-#
-# Suggested fix: in parse_filter_file() (exclude.c:1457), strip
-# module_dirlen the same way OPT_EXCLUDE_FROM does, OR have
-# parse_merge_name() expose the module-relative form for the daemon-filter
-# check and use the absolute form only for fopen().
-
-import os
-import subprocess
-
-from rsyncfns import (
-    SCRATCHDIR, makepath, rmtree, rsync_argv, start_test_daemon,
-    test_fail, write_daemon_conf,
-)
-
-DAEMON_PORT = 12921
-
-# Module root and the two files: a public one (the baseline transfer
-# witness) and the daemon-hidden rules file (the attack target).
-mod = SCRATCHDIR / 'srvmod'
-rmtree(mod)
-makepath(mod / 'secret')
-(mod / 'public.txt').write_text("PUBLIC\n")
-# A valid rsync filter rule that, if parsed, will exclude everything ---
-# including public.txt.  The point of the test is that the daemon should
-# never open this file at all.
-(mod / 'secret' / 'rules').write_text("- *\n")
-
-conf = write_daemon_conf([
-    ('mod', {'path': str(mod),
-             'read only': 'yes',
-             # Anchored module-relative rule: matches /secret/anything but
-             # NOT the absolute /<module-path>/secret/anything form that
-             # parse_merge_name() produces.  This is exactly the rule
-             # shape Mitchell's report uses.
-             'filter': '- /secret/***'}),
-])
-url = start_test_daemon(conf, DAEMON_PORT)
-
-
-def pull(args, dest):
-    rmtree(dest)
-    makepath(dest)
-    return subprocess.run(rsync_argv('-a', *args, f'{url}mod/', f'{dest}/'),
-                          stdout=subprocess.DEVNULL,
-                          stderr=subprocess.PIPE, text=True)
-
-
-# -- baseline: public.txt is delivered without any client filter -----------
-base_dest = SCRATCHDIR / 'base'
-rc = pull([], base_dest)
-if rc.returncode not in (0, 23):
-    test_fail(f"baseline pull failed (rc={rc.returncode}): {rc.stderr!r}")
-if not (base_dest / 'public.txt').is_file():
-    test_fail("baseline: public.txt did not transfer; the module is "
-              "mis-configured (daemon filter is hiding it) and the test "
-              "would be vacuous.")
-if (base_dest / 'secret' / 'rules').exists():
-    test_fail("baseline: /secret/rules WAS delivered -- the module's "
-              "daemon filter is not active and the oracle would be "
-              "meaningless.")
-
-
-# -- attack: --filter=._/secret/rules pushed to the daemon side via -M -----
-# The daemon sender re-parses this option, runs parse_filter_str ->
-# parse_merge_name -> parse_filter_file on "/secret/rules", and (when
-# vulnerable) fopen()s it despite the anchored module-filter.
-atk_dest = SCRATCHDIR / 'atk'
-rc = pull(['-M', '--filter=._/secret/rules'], atk_dest)
-# rc may legitimately be 0 (everything excluded) or 23 (partial); both
-# are accepted -- the security signal is what landed in atk_dest.
-if (atk_dest / 'secret' / 'rules').exists():
-    test_fail("daemon delivered /secret/rules itself -- this should never "
-              "happen given the daemon filter.  Test setup error?")
-
-if not (atk_dest / 'public.txt').is_file():
-    # public.txt is missing -> the hidden rule "- *" reached the daemon
-    # filter list, which means parse_filter_file() did open /secret/rules.
-    # That is exactly the leak we're testing for.
-    test_fail(
-        "daemon parsed the hidden merge-file at /secret/rules: public.txt "
-        "was excluded by the rule inside that file even though the "
-        "module's daemon filter (- /secret/***) should have refused the "
-        "fopen().  parse_filter_file()'s daemon_filter_list check uses "
-        "the post-merge-name absolute path; module_dirlen is not stripped, "
-        "so an anchored module-relative rule never matches.  Fix: strip "
-        "module_dirlen in exclude.c:1457 like options.c:1522 does for "
-        "--exclude-from.")
-
-# Daemon-filter-bypass not triggered: public.txt is intact.  Either the
-# fix is in place, or the daemon found another way to refuse the file.
-print("daemon-filter-merge-bypass: --filter merge-file refused by "
-      "daemon_filter_list (public.txt survived the attack pull).")
diff --git a/testsuite/daemon-gzip-download_test.py b/testsuite/daemon-gzip-download_test.py
deleted file mode 100644
index 4550863aa..000000000
--- a/testsuite/daemon-gzip-download_test.py
+++ /dev/null
@@ -1,29 +0,0 @@
-#!/usr/bin/env python3
-# Python rewrite of testsuite/daemon-gzip-download.test.
-#
-# Download a file tree over a compressed connection from a test daemon.
-# Exercises (exorcises?) a bug in 2.5.3 that mis-handled doubly-compressed
-# transfers. Uses the secure stdio-pipe transport by default; --use-tcp
-# runs it against a real loopback rsyncd.
-
-from rsyncfns import (
-    CHKDIR, FROMDIR, TODIR,
-    build_rsyncd_conf, checkit, hands_setup, run_rsync, start_test_daemon,
-)
-
-
-DAEMON_PORT = 12879
-
-conf = build_rsyncd_conf()
-hands_setup()
-
-# chkdir: vanilla copy minus the daemon's global "foobar.baz" exclude.
-run_rsync('-av', '--exclude=foobar.baz', f'{FROMDIR}/', f'{CHKDIR}/')
-
-url = start_test_daemon(conf, DAEMON_PORT)
-
-checkit(
-    ['-avvvvzz', f'{url}test-from/', f'{TODIR}/'],
-    CHKDIR, TODIR,
-    allowed_codes=(0, 23),
-)
diff --git a/testsuite/daemon-gzip-upload_test.py b/testsuite/daemon-gzip-upload_test.py
deleted file mode 100644
index 64922a143..000000000
--- a/testsuite/daemon-gzip-upload_test.py
+++ /dev/null
@@ -1,29 +0,0 @@
-#!/usr/bin/env python3
-# Python rewrite of testsuite/daemon-gzip-upload.test.
-#
-# Upload a file tree over a compressed connection to a test daemon.
-# Exercises (exorcises?) a bug in 2.5.3 that mis-handled doubly-compressed
-# transfers. Uses the secure stdio-pipe transport by default; --use-tcp
-# runs it against a real loopback rsyncd.
-
-from rsyncfns import (
-    CHKDIR, FROMDIR, TODIR,
-    build_rsyncd_conf, checkit, hands_setup, run_rsync, start_test_daemon,
-)
-
-
-DAEMON_PORT = 12880
-
-conf = build_rsyncd_conf()
-hands_setup()
-
-# chkdir: vanilla copy minus the daemon's global "foobar.baz" exclude.
-run_rsync('-av', '--exclude=foobar.baz', f'{FROMDIR}/', f'{CHKDIR}/')
-
-url = start_test_daemon(conf, DAEMON_PORT)
-
-checkit(
-    ['-avvvvzz', f'{FROMDIR}/', f'{url}test-to/'],
-    CHKDIR, TODIR,
-    allowed_codes=(0, 23),
-)
diff --git a/testsuite/daemon-include-maxconn_test.py b/testsuite/daemon-include-maxconn_test.py
deleted file mode 100644
index a6fca2deb..000000000
--- a/testsuite/daemon-include-maxconn_test.py
+++ /dev/null
@@ -1,118 +0,0 @@
-#!/usr/bin/env python3
-"""Daemon coverage: rsyncd.conf `&include`/`&merge` directives + `max connections`.
-
-Covers:
-  - params.c include_config(): both the file form (`&merge = file.inc`) and
-    the directory form (`&include = dir/` -> readdir + glob *.conf + qsort
-    via name_cmp() when count>1) -> the ]push/]reset/]pop section-stack path
-    in loadparm.c.
-  - connection.c claim_connection() / util1.c lock_range(): a module with
-    `max connections = N` + `lock file = path` opens the lock file via
-    open_no_attacker_symlinks() and lock_range()s a 4-byte slot.
-"""
-
-import subprocess
-
-from rsyncfns import (
-    SCRATCHDIR, FROMDIR,
-    claim_ports, get_rootgid, get_rootuid, get_testuid,
-    make_tree, makepath, rmtree, rsync_argv,
-    start_test_daemon, test_fail, write_daemon_conf,
-)
-
-# `&include` (manage_globals=1) ]push/]pop's the global section stack, so the
-# parent conf's root-aware `uid = 0`/`gid = 0` does NOT propagate into the
-# fragments -- the included modules would default to `nobody` and fail to
-# write into root-owned dest dirs.  Mirror write_daemon_conf()'s handling.
-if get_testuid() == get_rootuid():
-    UIDGID = f'\tuid = {get_rootuid()}\n\tgid = {get_rootgid()}\n'
-else:
-    UIDGID = ''
-
-PORT = 12895
-claim_ports(PORT)
-
-src = FROMDIR
-rmtree(src)
-make_tree(src, depth=1)
-
-# A directory of *.conf fragments for `&include = <dir>` (needs >=2 entries
-# to hit name_cmp() via qsort, and a non-matching file to exercise the
-# wildmatch("*.conf", ...) skip).
-conf_d = SCRATCHDIR / 'rsyncd.conf.d'
-makepath(conf_d)
-
-dest_a = SCRATCHDIR / 'dest-incA'
-dest_b = SCRATCHDIR / 'dest-incB'
-dest_m = SCRATCHDIR / 'dest-merge'
-makepath(dest_a, dest_b, dest_m)
-
-lockfile = SCRATCHDIR / 'rsyncd.lock'
-
-(conf_d / '20-b.conf').write_text(
-    f'[incB]\n\tpath = {dest_b}\n\tread only = no\n{UIDGID}'
-)
-(conf_d / '10-a.conf').write_text(
-    '# fragment loaded via &include directory glob\n'
-    f'[incA]\n'
-    f'\tpath = {dest_a}\n'
-    f'\tread only = no\n'
-    f'\tmax connections = 2\n'
-    f'\tlock file = {lockfile}\n'
-    f'{UIDGID}'
-)
-(conf_d / 'README').write_text('not matched by *.conf glob\n')
-
-# A single file for `&merge = <file>` (the manage_globals=0 / *.inc branch).
-merge_inc = SCRATCHDIR / 'extra.inc'
-merge_inc.write_text(
-    f'[merged]\n\tpath = {dest_m}\n\tread only = no\n'
-)
-
-# Main conf: globals carry both directives. write_daemon_conf() emits
-# `globals` as `key = value`, which is exactly the &include/&merge syntax.
-conf = write_daemon_conf(
-    [],
-    globals={
-        '&include': str(conf_d),
-        '&merge': str(merge_inc),
-    },
-    name='include-maxconn.conf',
-)
-url = start_test_daemon(conf, PORT)
-
-
-def push(module):
-    return subprocess.run(
-        rsync_argv('-r', f'{src}/', f'{url}{module}/'),
-        capture_output=True, text=True,
-    )
-
-
-# --- &include directory: both fragment-defined modules must resolve --------
-for mod, dest in (('incA', dest_a), ('incB', dest_b)):
-    r = push(mod)
-    if r.returncode != 0:
-        test_fail(f"&include dir: module [{mod}] should exist "
-                  f"(rc={r.returncode}):\n{r.stderr}")
-    if not any(dest.iterdir()):
-        test_fail(f"&include dir: push to [{mod}] wrote nothing into {dest}")
-
-# --- &merge file: the [merged] module must resolve -------------------------
-r = push('merged')
-if r.returncode != 0:
-    test_fail(f"&merge file: module [merged] should exist "
-              f"(rc={r.returncode}):\n{r.stderr}")
-
-# --- max connections: lock file was created and the slot taken+released ----
-if not lockfile.exists():
-    test_fail(f"max connections=2 should have created lock file {lockfile}")
-# Second sequential push to [incA] reuses (or re-acquires) a slot; this
-# exercises claim_connection() twice on the same lock file.
-r = push('incA')
-if r.returncode != 0:
-    test_fail(f"second push to [incA] (max connections=2) failed "
-              f"(rc={r.returncode}):\n{r.stderr}")
-
-print(f"daemon-include-maxconn: &include={conf_d.name}/ (2 *.conf, qsort), "
-      f"&merge={merge_inc.name}, max connections=2 lock file ok")
diff --git a/testsuite/daemon-link-dest-escape_test.py b/testsuite/daemon-link-dest-escape_test.py
deleted file mode 100644
index 98f9d4d40..000000000
--- a/testsuite/daemon-link-dest-escape_test.py
+++ /dev/null
@@ -1,73 +0,0 @@
-#!/usr/bin/env python3
-"""A daemon must confine a client's --link-dest/--compare-dest/--copy-dest basis
-dir to the served module (Leonid Bugaev May-2026 re-audit, KI-48 / CVE-53795
-surface; defense-in-depth guard).
-
-basis_link_stat() joins the peer-supplied basis dir with each fname and stats it.
-A client sending --link-dest=../<sibling> (or an absolute path) must NOT make the
-daemon stat files outside the module -- that would be an existence/size/mode
-oracle for out-of-tree paths, even though CVE-53795 already refuses the
-cross-boundary hardlink itself.
-
-The daemon already clamps such a path to the module root (longstanding sanitize
-behavior, preserved through this branch's d33e599c path-confinement rework -- the
-audit's "runtime-confirmed" KI-48 was a *local* receiver, where --link-dest=..
-is the operator's own intended choice, not a boundary crossing).  This test locks
-that confinement in: it pushes with --link-dest=../<sibling> where <sibling> is a
-real dir next to the module root; the daemon reports "link-dest arg does not
-exist" (to the client, via -v) only when it could NOT reach the dir, so reaching
-the real out-of-tree dir (no warning) would be a regression/leak.
-"""
-
-import os
-import subprocess
-
-from rsyncfns import (
-    SCRATCHDIR, makepath, rmtree, rsync_argv, start_test_daemon, test_fail,
-    write_daemon_conf,
-)
-
-DAEMON_PORT = 12894
-
-# Layout:  base/mod/        <- the served module (read only=no, push target)
-#          base/sibling/    <- OUTSIDE the module; the client must not reach it
-base = SCRATCHDIR / 'kid48'
-rmtree(base)
-mod = base / 'mod'
-sibling = base / 'sibling'
-makepath(mod)
-makepath(sibling)
-(sibling / 'probe').write_text('out-of-tree basis content\n')
-
-# Client source to push.
-src = base / 'src'
-makepath(src)
-(src / 'probe').write_text('client content\n')
-
-conf = write_daemon_conf([
-    ('mod', {'path': str(mod), 'read only': 'no'}),
-])
-url = start_test_daemon(conf, DAEMON_PORT)
-
-# Push with --link-dest=../sibling (a real dir just outside the module root).
-proc = subprocess.run(
-    rsync_argv('-rv', '--link-dest=../sibling', f'{src}/', f'{url}mod/'),
-    stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True)
-out = proc.stdout or ''
-
-# The daemon (receiver) runs check_alt_basis_dirs() / basis_link_stat() against
-# the basis dir relative to the module root.  Confined: "../sibling" is clamped
-# to "sibling" inside the module, which does not exist -> a "does not exist"
-# warning.  Leaked: the daemon stats base/sibling (the real out-of-tree dir),
-# so there is NO such warning.
-reached_outside = 'does not exist' not in out and 'is not a dir' not in out
-
-if reached_outside:
-    test_fail(
-        "daemon reached outside the module via --link-dest=../sibling: the "
-        "out-of-tree directory was stat'd (no 'arg does not exist' warning), "
-        "leaking the existence of paths outside the module.\n--- client saw ---\n"
-        + out)
-
-print("daemon-link-dest-escape: --link-dest=../sibling was confined to the "
-      "module (out-of-tree basis dir not reachable)")
diff --git a/testsuite/daemon-module-chdir-symlink_test.py b/testsuite/daemon-module-chdir-symlink_test.py
deleted file mode 100644
index 66b2663e5..000000000
--- a/testsuite/daemon-module-chdir-symlink_test.py
+++ /dev/null
@@ -1,99 +0,0 @@
-#!/usr/bin/env python3
-# Daemon module-root chdir under `use chroot = no` must not follow planted
-# symlinks at attacker-controlled path components.
-#
-# Threat: when a daemon is
-# configured with `use chroot = no`, it calls change_dir(module_chdir)
-# where module_chdir is the absolute path from rsyncd.conf `path =`.
-# change_dir's absolute-path branch (util1.c:1193) is plain chdir() with
-# NO symlink confinement. If the admin's configured path includes a
-# component the attacker controls (e.g. `path = /home/$user/share`, or any
-# /srv-style path under a non-root-owned parent), an attacker-planted
-# symlink redirects the daemon's CWD out of the configured module before
-# any transfer begins.
-#
-# This is the daemon-side analog of the symlink-race-dest XFAIL (the
-# non-daemon receiver chdir); the daemon path has a clear fix here without
-# the chdir-of-named-dest scope concern.
-#
-# Leak signal: configure the daemon with `path = $plant` where $plant is
-# a planted symlink to an "escape" directory containing a unique-named
-# canary file that the legitimate module doesn't have. List the module
-# from a client; if the canary appears in the listing, the daemon's chdir
-# followed the planted symlink and is serving files from the escape
-# target. With the fix the chdir is refused and the daemon errors on
-# connection.
-#
-# Requires root for the cross-uid plant; skips otherwise.
-
-import os
-import pwd
-import subprocess
-
-from rsyncfns import (
-    SCRATCHDIR, rmtree, rsync_argv, start_test_daemon, test_fail,
-    test_skipped, write_daemon_conf,
-)
-
-DAEMON_PORT = 12900
-CANARY = "audit_escape_canary"
-
-
-if os.geteuid() != 0:
-    test_skipped("requires root to plant a symlink owned by a non-self uid "
-                 "(the attacker simulation)")
-
-NOBODY_UID = None
-for name in ('nobody', 'nfsnobody', 'daemon'):
-    try:
-        u = pwd.getpwnam(name).pw_uid
-        if u != 0 and u != os.geteuid():
-            NOBODY_UID = u
-            break
-    except KeyError:
-        continue
-if NOBODY_UID is None:
-    test_skipped("no untrusted-uid user available for cross-uid plant")
-
-
-base = SCRATCHDIR / 'modchdir'
-rmtree(base)
-base.mkdir()
-
-# The "escape" directory the attacker wants the daemon to serve from.
-# Owned by us, with a canary file the legitimate module doesn't have.
-escape_target = base / 'escape_target'
-escape_target.mkdir()
-(escape_target / CANARY).write_text("you-should-not-see-this\n")
-
-# The planted symlink: appears at the daemon-configured 'path =' and
-# redirects to the escape target. The symlink itself is owned by NOBODY_UID
-# (the attacker), so the fix's owned-by-trusted-uid path walk refuses it.
-plant = base / 'plant'
-os.symlink(escape_target, plant)
-os.lchown(plant, NOBODY_UID, NOBODY_UID)
-
-# Daemon config: `path = $plant`. With `use chroot = no` (the default in
-# write_daemon_conf) the daemon will chdir into the resolved path before
-# serving the module.
-conf = write_daemon_conf(
-    [('mod', {'path': plant, 'read only': 'yes'})],
-)
-url = start_test_daemon(conf, DAEMON_PORT)
-
-# Client lists the module's contents (rsync $url/mod/). Without the fix the
-# daemon's chdir followed the planted symlink and is serving from
-# escape_target -> canary appears in the listing.
-proc = subprocess.run(
-    rsync_argv(f'{url}mod/'),
-    stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True)
-
-if CANARY in proc.stdout:
-    test_fail(
-        f"daemon module-root chdir followed a planted parent-component "
-        f"symlink (owned by uid {NOBODY_UID}): {plant} -> {escape_target} "
-        f"was traversed by the plain chdir() in change_dir(), and the daemon "
-        f"is now serving files from the escape target (canary "
-        f"{CANARY!r} appeared in the module listing). Fix: per-component "
-        "owned-by-trusted-uid path walk in change_dir's absolute-path branch "
-        "under am_daemon && !am_chrooted.")
diff --git a/testsuite/daemon-module-private-parent_test.py b/testsuite/daemon-module-private-parent_test.py
deleted file mode 100644
index 599d37d49..000000000
--- a/testsuite/daemon-module-private-parent_test.py
+++ /dev/null
@@ -1,103 +0,0 @@
-#!/usr/bin/env python3
-# A daemon must serve a module whose path lies under a directory the SERVED
-# (dropped-privilege) uid cannot traverse.
-#
-# The daemon chdir's into the module root while still root, then drops to the
-# module uid; both the directory scan AND the file-content open must resolve
-# relative to that pinned root, NOT re-walk the absolute module path -- which
-# re-traverses the module's ancestors as the unprivileged uid and EACCESes.  The
-# common real-world shape is a module under a 0700 home (path = /home/backup/data);
-# here we plant an explicit 0700 parent so the test is deterministic and
-# independent of where the suite is built.
-#
-# RED before the privilege-drop-safe anchoring (the daemon's directory scan, or
-# send_files' content open, fails with "Permission denied"); GREEN after.
-# Requires root (a 0700 parent the served uid cannot traverse, and a daemon that
-# drops to an unprivileged uid).
-
-import os
-import pwd
-import subprocess
-
-from rsyncfns import (
-    SCRATCHDIR, makepath, rmtree, rsync_argv, start_test_daemon,
-    test_fail, test_skipped, write_daemon_conf,
-)
-
-DAEMON_PORT = 12951
-CONTENT = "served-from-under-a-private-parent\n"
-
-
-if os.geteuid() != 0:
-    test_skipped("requires root (a 0700 parent the served uid cannot traverse, "
-                 "and a daemon that drops to an unprivileged uid)")
-
-UNPRIV = None
-for name in ('nobody', 'nfsnobody', 'daemon'):
-    try:
-        u = pwd.getpwnam(name)
-        if u.pw_uid != 0 and u.pw_uid != os.geteuid():
-            UNPRIV = u
-            break
-    except KeyError:
-        continue
-if UNPRIV is None:
-    test_skipped("no unprivileged uid available to drop the daemon to")
-
-base = SCRATCHDIR / 'priv-parent'
-rmtree(base)
-# A 0700 root-owned parent the served uid cannot search.  The module lives under
-# it; its own contents are world-readable so serving works once the daemon is
-# inside (it chdir'd in while still root).
-private = base / 'private'
-modpath = private / 'mod'
-sub = modpath / 'sub'
-makepath(sub)
-(sub / 'file').write_text(CONTENT)
-os.chmod(modpath, 0o755)
-os.chmod(sub, 0o755)
-os.chmod(sub / 'file', 0o644)
-os.chmod(private, 0o700)          # <-- the barrier: unsearchable to UNPRIV
-
-dest = base / 'dest'
-makepath(dest)
-
-# Numeric uid/gid so we don't depend on a group named like the user (e.g.
-# "nobody" is a user but the group is "nogroup" on Debian/Ubuntu).
-conf = write_daemon_conf([
-    ('m', {'path': modpath, 'read only': 'yes',
-           'uid': str(UNPRIV.pw_uid), 'gid': str(UNPRIV.pw_gid)}),
-])
-url = start_test_daemon(conf, DAEMON_PORT)
-
-def pull(*opts):
-    """Pull the module to a fresh dest with the given options; assert it serves
-    sub/file (the content open under the 0700 parent must not EACCES)."""
-    rmtree(dest)
-    makepath(dest)
-    proc = subprocess.run(
-        rsync_argv(*opts, f'{url}m/', f'{dest}/'),
-        stdout=subprocess.DEVNULL, stderr=subprocess.PIPE, text=True)
-    if proc.returncode != 0:
-        test_fail(
-            f"daemon failed to serve a module under a 0700 parent as uid "
-            f"{UNPRIV.pw_name} ({' '.join(opts)}): {proc.stderr.strip()!r}.  The "
-            "scan and the content open must resolve relative to the module root "
-            "the daemon pinned while privileged, not re-walk the absolute module "
-            "path (which EACCESes on the 0700 ancestor under the dropped uid).")
-    got = dest / 'sub' / 'file'
-    if not got.is_file() or got.read_text() != CONTENT:
-        test_fail(f"the under-0700-parent module did not serve its file with "
-                  f"'{' '.join(opts)}' (dest/sub/file missing/wrong)")
-
-
-# Default mode: content open via sender_open_confined() -> held_dir_path_fd()
-# (the dpc base open).
-pull('-r')
-# Symlink-following mode: content open via sender_open_copylinks_confined() ->
-# secure_relative_open(module_dir, ...) -- the other re-walk site (covers the
-# absolute-basedir branch of the resolver).
-pull('-rL')
-
-print("daemon-module-private-parent: served a module under a 0700 parent as "
-      f"uid {UNPRIV.pw_name} (default + --copy-links content opens)")
diff --git a/testsuite/daemon-namecvt-empty-response_test.py b/testsuite/daemon-namecvt-empty-response_test.py
deleted file mode 100644
index 2967afba9..000000000
--- a/testsuite/daemon-namecvt-empty-response_test.py
+++ /dev/null
@@ -1,191 +0,0 @@
-#!/usr/bin/env python3
-# Daemon-side `name converter` empty-line response is treated as success
-# with id=0, mapping unknown sender names to uid/gid 0.
-#
-# Threat (Mitchell Benjamin report, May 2026):
-#   The documented helper contract (support/nameconvert:14) is
-#       "An unknown ID_NUM or NAME results in an empty return value."
-#   But namecvt_call() in clientserver.c:1227 does:
-#       if (!read_line_old(namecvt_fd_ans, buf, sizeof buf, 0))
-#           return False;
-#       if (*name_p)
-#           *id_p = (id_t)atol(buf);              <-- atol("") == 0
-#       else
-#           *name_p = strdup(buf);
-#       return True;
-#   So an empty response is read successfully and atol("") = 0 is treated
-#   as a valid mapping.  user_to_uid()/group_to_gid() then return success
-#   with *uid_p = 0 / *gid_p = 0.  Receiver recv_add_id() (uidlist.c:273)
-#   uses that as the local id, and with `fake super = yes` the file's
-#   xattr ends up with "MODE 0,0 0:0" — root-owned setuid metadata that
-#   a fake-super restore/list view honours as a real root-owned file.
-#
-# Test design:
-#   * A stub name-converter that always prints an empty line, no matter
-#     what the daemon asks.  This simulates the "every sender name is
-#     unknown to the daemon" case (the report did the same thing via an
-#     NSS shim; the stub is equivalent and far easier).
-#   * Daemon module: read only=no, fake super=yes, name converter=stub,
-#     numeric ids=no, so the receiver looks up the sender's user/group
-#     names through the stub.
-#   * Client uploads a regular file under the current user's identity
-#     (a non-root uid/gid).
-#   * After upload, read user.rsync.%stat xattr on the stored file.
-#     Format is "MODE 0,0 UID:GID".  If UID is 0 (and sender's uid was
-#     non-zero), the bug is present.
-#
-# Fix direction:
-#   In namecvt_call(), for the name-to-id branch, treat empty/non-numeric
-#   buf as lookup failure (return False).  recv_add_id then falls back
-#   to the sender's numeric id (uidlist.c:276), so unknown names stay
-#   non-root.
-
-import os
-import re
-import subprocess
-
-from rsyncfns import (
-    RSYNC_PREFIX, SCRATCHDIR, _xattr_full, makepath, rmtree, rsync_argv,
-    start_test_daemon, test_fail, test_skipped, write_daemon_conf,
-    xattrs_supported,
-)
-
-# Skips as root (see the my_uid==0 guard below), so the fleet harness reruns it
-# in its non-root pass to get real coverage (testsuite/fleettest.py).
-fleet_nonroot = True
-
-DAEMON_PORT = 12904
-
-if not xattrs_supported():
-    test_skipped("namecvt-empty-response test requires xattr support to "
-                 "read fake-super metadata")
-
-if not hasattr(os, 'getxattr'):
-    # CPython exposes os.getxattr only on Linux; the OS (e.g. Cygwin) may have
-    # xattrs yet no Python binding to read the fake-super %stat metadata.
-    test_skipped("this Python build lacks os.getxattr to read fake-super metadata")
-
-my_uid = os.getuid()
-my_gid = os.getgid()
-if my_uid == 0:
-    # Running as root would defeat the test: any namecvt mapping that
-    # ends in id=0 is indistinguishable from "the sender was already
-    # root."  We need a non-zero sender id so the bug-vs-fix branches
-    # produce different xattr UIDs.
-    # NOTE: because every Linux CI job runs the suite as root, this test only
-    # gets coverage from the dedicated non-root run -- the "check (non-root,
-    # targeted)" step in .github/workflows/ubuntu-build.yml. Any new non-root-
-    # only test must be added to that step (and declare `fleet_nonroot = True`
-    # for the fleet harness's non-root pass) or it will silently never run in CI.
-    test_skipped("namecvt-empty-response test must run as a non-root user "
-                 "(sender uid/gid must differ from 0 to expose the bug)")
-
-
-# -- stub name-converter that always returns empty -------------------------
-stub = SCRATCHDIR / 'stub_nameconvert'
-stub.write_text(
-    "#!/usr/bin/env python3\n"
-    "# Always-empty stub: every usr/grp/uid/gid lookup answers ''.\n"
-    "# The bundled support/nameconvert helper does this only when the\n"
-    "# lookup fails (KeyError); the namecvt_call() bug treats the empty\n"
-    "# line as a valid numeric 0.\n"
-    "import sys\n"
-    "for _ in sys.stdin:\n"
-    "    print('', flush=True)\n"
-)
-stub.chmod(0o755)
-
-
-mod = SCRATCHDIR / 'recvmod'
-src = SCRATCHDIR / 'srcdir'   # NOT 'src' -- runtests.py:155 plants
-                              # a <scratch>/src symlink to SRCDIR for
-                              # every test, so writing files under it
-                              # would land in the repo working tree.
-rmtree(mod)
-rmtree(src)
-makepath(mod)
-makepath(src)
-(src / 'f').write_text("DATA\n")
-
-
-conf = write_daemon_conf([
-    ('recv', {'path':           str(mod),
-              'read only':      'no',
-              'fake super':     'yes',
-              'numeric ids':    'no',
-              'name converter': str(stub)}),
-])
-url = start_test_daemon(conf, DAEMON_PORT)
-
-
-# -- positive control: upload a file -------------------------------------
-# `-a` includes owner+group preservation, and the receiver (daemon w/
-# fake-super) writes the metadata into user.rsync.%stat.
-proc = subprocess.run(rsync_argv('-a', f'{src}/', f'{url}recv/'),
-                      stdout=subprocess.DEVNULL,
-                      stderr=subprocess.PIPE, text=True)
-if proc.returncode not in (0, 23):
-    test_fail(f"upload to recv module failed (rc={proc.returncode}): "
-              f"{proc.stderr!r}")
-
-stored = mod / 'f'
-if not stored.is_file():
-    test_fail(f"upload did not deliver the file ({stored})")
-
-
-# -- read the fake-super xattr ------------------------------------------
-# Fake-super only stores an xattr when the metadata to remember DIFFERS
-# from the filesystem reality (rsync.c:526:
-#   change_uid = am_root && uid_ndx && sxp->st.st_uid != F_OWNER(file)).
-# With the FIX:
-#   * namecvt empty -> user_to_uid returns 0 (failure)
-#   * recv_add_id() falls back to the sender's numeric id
-#   * F_OWNER == filesystem-creation uid (both are `my_uid`)
-#   * no xattr is written.
-# With the BUG:
-#   * namecvt empty -> user_to_uid returns success with id=0
-#   * F_OWNER becomes 0, filesystem uid is `my_uid`, they differ
-#   * xattr is written carrying "0:0" -- that is the leak we detect.
-#
-# So we check: if an xattr IS present, parse it and confirm it does not
-# encode 0:0.  If no xattr is present we infer the namecvt path did not
-# fabricate a phantom id=0 -- the metadata simply matches reality.
-xkey = _xattr_full(RSYNC_PREFIX + '.%stat')   # 'user.rsync.%stat' on Linux
-try:
-    raw = os.getxattr(str(stored), xkey)
-    xval = raw.decode('utf-8', 'surrogateescape')
-except OSError:
-    xval = None
-
-if xval is None:
-    # No fake-super xattr stored: metadata matched the filesystem, which
-    # is what the fix produces because F_OWNER == my_uid == filesystem
-    # uid.  That is the GREEN signal.
-    print(f"daemon-namecvt-empty-response: no fake-super xattr written -- "
-          f"namecvt empty response was correctly treated as a lookup "
-          f"failure, so recv_add_id() kept sender uid={my_uid} and the "
-          f"receiver had nothing to remember separately from the "
-          f"filesystem.")
-else:
-    # An xattr is present.  user.rsync.%stat format:
-    #   "MODE DEV_MAJOR,DEV_MINOR UID:GID"
-    # The leak case is UID:GID == 0:0 .
-    m = re.match(r'\S+\s+\S+\s+(\d+):(\d+)\s*$', xval)
-    if not m:
-        test_fail(f"unrecognised fake-super xattr format: {xval!r}")
-    stored_uid, stored_gid = int(m.group(1)), int(m.group(2))
-
-    if stored_uid == 0 and stored_gid == 0:
-        test_fail(
-            f"namecvt empty response was treated as a valid id=0 "
-            f"mapping: file uploaded by uid={my_uid}/gid={my_gid} is "
-            f"stored with fake-super metadata {xval!r} (uid:gid = 0:0). "
-            f" This means a daemon-unknown sender name silently becomes "
-            f"root-owned in preserved metadata.  Fix: namecvt_call() "
-            f"must treat an empty buf as lookup failure (return False) "
-            f"so recv_add_id() falls back to the sender's numeric id "
-            f"(clientserver.c:1227, uidlist.c:273-282).")
-
-    print(f"daemon-namecvt-empty-response: xattr {xval!r} present but "
-          f"non-zero uid/gid -- empty namecvt response did not produce "
-          f"a phantom root-owned mapping.")
diff --git a/testsuite/daemon-path-root-read_test.py b/testsuite/daemon-path-root-read_test.py
deleted file mode 100644
index da1b09d6d..000000000
--- a/testsuite/daemon-path-root-read_test.py
+++ /dev/null
@@ -1,79 +0,0 @@
-#!/usr/bin/env python3
-# Functional regression: a daemon module with `path = /` (use chroot = no)
-# cannot send ANY file in 3.4.3 -- every read fails with "Invalid argument (22)".
-#
-# Reported as #897 ("Regression in 3.4.3, Invalid argument (22) on all file
-# reads when using native protocol").  Works in 3.4.2, works over a remote
-# shell; only the native (daemon) protocol with an absolute module path breaks.
-#
-# Root cause: the 3.4.3 symlink-race hardening routes the sender's file open
-# through secure_relative_open(module_dir, secure_path, ...) (sender.c), where
-#   secure_path = F_PATHNAME + "/" + f_name.
-# With `path = /` the module-relative F_PATHNAME is itself ABSOLUTE, so
-# secure_path starts with '/'.  secure_relative_open()'s front door rejects any
-# absolute relpath with EINVAL *before* it ever calls openat2 (matching the
-# reporter's strace: the file is stat'd and access()'d but never opened).  The
-# generator then reports "send_files failed to open ...: Invalid argument (22)"
-# and the whole transfer ends in code 23.
-#
-# This is a pure functional regression (no attacker, no symlink): XFAIL until
-# the sender open is made to tolerate an absolute module-root path (the
-# accompanying sender.c fix).  Runs at any uid.
-
-import subprocess
-
-from rsyncfns import (
-    SCRATCHDIR, makepath, rmtree, rsync_argv, start_test_daemon, test_fail,
-    write_daemon_conf,
-)
-
-DAEMON_PORT = 12897
-
-# A small source tree under the scratch dir: a file at the served-subdir root
-# and one nested deeper (the bug fails on EVERY file, regardless of depth).
-served = SCRATCHDIR / 'served'
-dst = SCRATCHDIR / 'pulldst'
-rmtree(served)
-rmtree(dst)
-makepath(served / 'sub')
-makepath(dst)
-(served / 'README').write_text("readme-contents\n")
-(served / 'sub' / 'deep.txt').write_text("deep-contents\n")
-
-# Module rooted at the filesystem root, exactly like the report (path = /,
-# use chroot = no).  We then request the served subtree by its absolute path
-# with the leading '/' stripped, so the daemon serves $served from "/".
-conf = write_daemon_conf([
-    ('root', {'path': '/', 'read only': 'yes'}),
-])
-url = start_test_daemon(conf, DAEMON_PORT)
-
-served_rel = str(served).lstrip('/')          # e.g. tmp/.../served
-proc = subprocess.run(
-    rsync_argv('-a', f'{url}root/{served_rel}/', f'{dst}/'),
-    stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True,
-)
-out = proc.stdout or ''
-print(out)
-
-# Bug present: the sender refuses to open the files with EINVAL(22).
-if 'Invalid argument (22)' in out or ('failed to open' in out and proc.returncode != 0):
-    from rsyncfns import test_xfail
-    test_xfail(
-        "#897: daemon module `path = /` (use chroot = no) cannot send files -- "
-        "`send_files failed to open ...: Invalid argument (22)`.  The sender's "
-        "secure_relative_open(module_dir, secure_path) gets an ABSOLUTE "
-        "secure_path (F_PATHNAME is absolute when path=/) and the front door "
-        "rejects absolute relpaths with EINVAL before any openat2.  To be closed "
-        "by letting the sender open succeed for an absolute module-root path.")
-
-# Bug fixed (or never present): the files transfer intact.
-if proc.returncode != 0:
-    test_fail(f"daemon pull failed unexpectedly (rc={proc.returncode}); "
-              f"not the #897 EINVAL symptom:\n{out}")
-for rel in ('README', 'sub/deep.txt'):
-    got = dst / rel
-    if not got.is_file():
-        test_fail(f"daemon pull did not deliver {rel} (dst={dst})")
-    if got.read_text() != (served / rel).read_text():
-        test_fail(f"delivered {rel} content differs from source")
diff --git a/testsuite/daemon-scan-cwd-desync_test.py b/testsuite/daemon-scan-cwd-desync_test.py
deleted file mode 100644
index adc15c4a5..000000000
--- a/testsuite/daemon-scan-cwd-desync_test.py
+++ /dev/null
@@ -1,76 +0,0 @@
-#!/usr/bin/env python3
-# A daemon directory scan must anchor confinement at the module root by IDENTITY,
-# not by climbing ".." up from the cwd by the lexical curr_dir depth.
-#
-# rsync tracks the path it descended (curr_dir) lexically, but the daemon's
-# change_dir follows in-tree directory symlinks.  So when the requested path is an
-# in-module directory symlink whose target nets SHALLOWER -- e.g. x/jump -> ../y,
-# which from module/x lands at module/y -- the real kernel cwd ends up at module/y
-# (depth 1) while curr_dir records module/x/jump (depth 2).  A confinement that
-# reaches the module root by climbing ".." up by the lexical depth then climbs too
-# far (to module/y's grandparent, ABOVE the module) and resolves the scan there:
-# in-module content goes missing, and were a matching path to exist above the
-# module it could be enumerated out of the module.  Anchoring at a module-root fd
-# pinned by identity resolves the same logical path correctly and stays confined.
-#
-# Layout (module path = area/mod):
-#   mod/y/real.txt          (the in-module content that must be served)
-#   mod/x/jump -> ../y       (in-module symlink: mod/x/jump resolves to mod/y)
-# Pull mod/x/jump/ with --copy-dirlinks: the daemon change_dir's through jump,
-# desyncing curr_dir (mod/x/jump) from the real cwd (mod/y).  A correct, identity-
-# anchored scan serves mod/y/real.txt; the buggy lexical climb mis-anchors above
-# the module and the file goes missing.
-#
-# Deterministic (static symlinks).  Requires root for the daemon uid/gid lines;
-# runs unprivileged too.
-
-import os
-
-from rsyncfns import (
-    SCRATCHDIR, get_rootgid, get_rootuid, get_testuid, makepath, rmtree,
-    run_rsync, start_test_daemon, test_fail,
-)
-
-DAEMON_PORT = 12950
-CONTENT = "served-through-a-cwd-desyncing-symlink\n"
-
-base = SCRATCHDIR / 'scan-desync'
-rmtree(base)
-area = base / 'area'
-mod = area / 'mod'
-dest = base / 'dest'
-makepath(mod / 'y', mod / 'x', dest)
-(mod / 'y' / 'real.txt').write_text(CONTENT)
-# In-module symlink whose target nets shallower: mod/x/jump -> ../y == mod/y.
-os.symlink('../y', mod / 'x' / 'jump')
-
-root = get_testuid() == get_rootuid()
-ids = f"uid = {get_rootuid()}\ngid = {get_rootgid()}" if root else ""
-
-conf = base / 'd.conf'
-conf.write_text(f"""\
-pid file = {base}/rsyncd.pid
-use chroot = no
-{ids}
-log file = {base}/rsyncd.log
-
-[m]
-    path = {mod}
-    read only = yes
-    hosts allow = 127.0.0.1
-""")
-url = start_test_daemon(conf, DAEMON_PORT)
-
-# Pull the in-module net-shallower symlinked path; the daemon descends through it.
-run_rsync('-a', '--copy-dirlinks', f'{url}m/x/jump/', f'{dest}/', check=False)
-
-got = dest / 'real.txt'
-if not got.is_file() or got.read_text() != CONTENT:
-    test_fail(
-        "daemon scan failed to serve in-module content reached through a "
-        "cwd-desyncing in-module symlink (mod/x/jump -> ../y): dest/real.txt "
-        "missing/wrong.  The scan must anchor at the module root by identity "
-        "(module_dirfd), not by climbing the lexical curr_dir depth -- the latter "
-        "over-climbs above the module when an in-module symlink nets shallower.")
-print("daemon-scan-cwd-desync-escape: in-module content served correctly through "
-      "a cwd-desyncing symlink (scan stayed anchored at the module root)")
diff --git a/testsuite/daemon-scan-dir-escape_test.py b/testsuite/daemon-scan-dir-escape_test.py
deleted file mode 100644
index dccd17e80..000000000
--- a/testsuite/daemon-scan-dir-escape_test.py
+++ /dev/null
@@ -1,99 +0,0 @@
-#!/usr/bin/env python3
-# A daemon sender must not let a symlink-following mode (-L / --copy-dirlinks /
-# --copy-unsafe-links) escape the served MODULE during the directory scan.
-#
-# The content open is confined beneath module_dir even in these modes
-# (sender_open_copylinks_confined), but the directory ENUMERATION (opendir(fbuf)
-# in flist.c send_directory) was only confined in the default no-follow mode.
-# So a daemon module containing an in-module symlinked directory that points
-# OUTSIDE the module, pulled with --copy-dirlinks, made the sender follow it and
-# enumerate the out-of-module directory, leaking its entry names, metadata and
-# (preserved) symlink targets to the client -- even though the content open
-# refuses the out-of-module file data.
-#
-# Deterministic: a STATIC in-module symlink, no race.  --copy-dirlinks descends
-# the symlinked directory (the escape vector) but preserves file symlinks under
-# it, so an out-of-module symlink whose target is a unique marker proves the
-# enumeration -- not the content open -- escaped the module.  FAILS before the
-# daemon-follow-mode confinement; PASSES once the enumeration is confined beneath
-# module_dir in following modes too (still following in-module symlinks, refusing
-# module escapes).
-
-import os
-
-from rsyncfns import (
-    SCRATCHDIR, get_rootgid, get_rootuid, get_testuid, makepath, rmtree,
-    run_rsync, start_test_daemon, test_fail,
-)
-
-DAEMON_PORT = 12947
-MARKER = "XFIL-OUTSIDE-MODULE-SYMLINK-TARGET"
-
-base = SCRATCHDIR / 'daemon-scan-escape'
-rmtree(base)
-mod = base / 'mod'              # the served module
-outside = base / 'outside'      # OUTSIDE the module (a sibling of mod/)
-dest = base / 'dest'
-makepath(mod / 'real', outside, dest)
-
-# Legitimate in-module content (sanity: the transfer runs and --copy-dirlinks
-# is active).
-(mod / 'real' / 'in.txt').write_text("in-module\n")
-
-# The escape vector: an in-module symlink to a DIRECTORY outside the module.
-# --copy-dirlinks treats it as a directory and descends it.
-os.symlink('../outside', mod / 'escape')
-
-# Out-of-module sentinels.  xfil_link is a FILE symlink (not dereferenced by
-# --copy-dirlinks), so its marker target is transferred verbatim via readlinkat
-# during the scan -- a pure enumeration signal.  The dir/file names are
-# secondary signals.
-os.symlink(MARKER, outside / 'xfil_link')
-(outside / 'xfil_dir').mkdir()
-(outside / 'xfil_dir' / 'inner').write_text("x\n")
-(outside / 'xfil_file').write_text("x\n")
-
-# A use-chroot=no daemon drops to nobody under a root test run and can't read a
-# root-owned module, so as root we pin it to root (as build_rsyncd_conf does);
-# off-root it runs as us and must not set uid/gid, so those lines simply vanish.
-root = get_testuid() == get_rootuid()
-ids = f"uid = {get_rootuid()}\ngid = {get_rootgid()}" if root else ""
-
-conf = base / 'daemon-scan.conf'
-conf.write_text(f"""\
-pid file = {base}/rsyncd.pid
-use chroot = no
-{ids}
-log file = {base}/rsyncd.log
-
-[m]
-    path = {mod}
-    read only = yes
-    hosts allow = 127.0.0.1
-""")
-url = start_test_daemon(conf, DAEMON_PORT)
-
-# --copy-dirlinks makes the daemon sender descend the symlinked 'escape' dir.
-# check=False: with the fix the escape is refused, which may surface as a
-# per-entry error; assert on the resulting tree either way.
-run_rsync('-a', '--copy-dirlinks', f'{url}m/', f'{dest}/', check=False)
-
-esc = dest / 'escape'
-leak = None
-link = esc / 'xfil_link'
-if link.is_symlink() and os.readlink(link) == MARKER:
-    leak = f"symlink target leaked: dest/escape/xfil_link -> {MARKER}"
-else:
-    for name in ('xfil_dir', 'xfil_file', 'xfil_link'):
-        if (esc / name).exists() or (esc / name).is_symlink():
-            leak = f"out-of-module name leaked: dest/escape/{name}"
-            break
-
-if leak is not None:
-    test_fail(
-        "daemon directory-enumeration escaped the module in a symlink-following "
-        f"mode: the sender followed an in-module symlink out of the module and "
-        f"copied an out-of-module entry to the client ({leak}).  send_directory's "
-        "enumeration must stay confined beneath module_dir in following modes "
-        "too, like the content open.")
-print("daemon-scan-dir-escape: --copy-dirlinks enumeration stayed within the module")
diff --git a/testsuite/daemon-secrets-file-symlink_test.py b/testsuite/daemon-secrets-file-symlink_test.py
deleted file mode 100644
index 1a2a2c614..000000000
--- a/testsuite/daemon-secrets-file-symlink_test.py
+++ /dev/null
@@ -1,157 +0,0 @@
-#!/usr/bin/env python3
-# Daemon 'secrets file = PATH' must not follow planted symlinks at attacker-
-# controlled path components.
-#
-# Companion to password-file-symlink (which covers the CLIENT --password-file);
-# this covers the DAEMON-side 'secrets file' open in authenticate.c. Same path-
-# walk helper (open_no_attacker_symlinks), exercised directly here because
-# the daemon secrets read is a distinct call site with its own leak signal.
-#
-# Threat: the daemon opens 'secrets file' to authenticate a client. A symlink
-# planted at that path (or a parent component) by another uid redirects the read
-# to an attacker-chosen file. The strict-modes fstat() runs on the *target*
-# inode, so a symlink to e.g. /etc/shadow (root-owned, not other-readable) would
-# pass the owner/mode check and the daemon would auth against the target's
-# contents.
-#
-# Leak signal: the planted symlink points at a victim secrets file (root:0600)
-# whose contents ARE a known user:password. If the daemon follows it, a client
-# authenticating with that password SUCCEEDS -> leak observed. With the fix the
-# planted symlink is refused ("no secrets file"), so auth fails.
-#
-# Both leaf and parent-component variants are exercised (the parent case is the
-# /tmp/somedir/ class that a leaf-only O_NOFOLLOW does not defend).
-#
-# Requires root (to lchown the planted symlink to a non-self uid -- the attacker
-# simulation); skips otherwise.
-
-import os
-import pwd
-import subprocess
-
-from rsyncfns import (
-    FROMDIR, SCRATCHDIR, make_tree, makepath, rmtree, rsync_argv,
-    start_test_daemon, test_fail, test_skipped, write_daemon_conf,
-)
-
-DAEMON_PORT = 12903
-USER = 'tuser'
-CORRECT_PASSWORD = 'correctpass'
-
-
-if os.geteuid() != 0:
-    test_skipped("requires root to plant a symlink owned by a non-self uid "
-                 "(the attacker simulation)")
-
-NOBODY_UID = None
-for name in ('nobody', 'nfsnobody', 'daemon'):
-    try:
-        u = pwd.getpwnam(name).pw_uid
-        if u != 0 and u != os.geteuid():
-            NOBODY_UID = u
-            break
-    except KeyError:
-        continue
-if NOBODY_UID is None:
-    test_skipped("no untrusted-uid user available for cross-uid plant")
-
-# Prevent rsync's interactive getpass() fallback if no password is read.
-os.environ['RSYNC_PASSWORD'] = 'env-fallback-wrong'
-
-src = FROMDIR
-rmtree(src)
-make_tree(src, depth=1)
-
-base = SCRATCHDIR / 'secretsplant'
-rmtree(base)
-base.mkdir()
-
-# The victim secrets file: root-owned, 0600, contents == a valid credential.
-# A daemon that follows a planted symlink to this file authenticates the client.
-victim = base / 'victim_secrets'
-victim.write_text(f'{USER}:{CORRECT_PASSWORD}\n')
-os.chmod(victim, 0o600)
-os.chown(victim, 0, 0)
-
-# Leaf plant: a symlink AT the secrets-file path, owned by the attacker uid.
-leaf_plant = base / 'secrets_leaf'
-os.symlink(victim, leaf_plant)
-os.lchown(leaf_plant, NOBODY_UID, NOBODY_UID)
-
-# Parent-component plant: secrets file = <parent_link>/victim_in_target, where
-# parent_link is an attacker-owned symlink to a real directory holding the
-# victim secrets. A leaf-only O_NOFOLLOW does not defend this; only the per-
-# component owner-checked walk does.
-parent_real = base / 'parent_real'
-parent_real.mkdir()
-victim_in_target = parent_real / 'victim_in_target'
-victim_in_target.write_text(f'{USER}:{CORRECT_PASSWORD}\n')
-os.chmod(victim_in_target, 0o600)
-os.chown(victim_in_target, 0, 0)
-parent_plant = base / 'parent_link'
-os.symlink(parent_real, parent_plant)
-os.lchown(parent_plant, NOBODY_UID, NOBODY_UID)
-
-authreal = base / 'authreal'
-authleaf = base / 'authleaf'
-authparent = base / 'authparent'
-makepath(authreal, authleaf, authparent)
-
-conf = write_daemon_conf([
-    # Sanity module: a real (non-symlinked) root:0600 secrets file authenticates.
-    ('authreal', {'path': authreal, 'read only': 'no',
-                  'auth users': USER, 'secrets file': victim}),
-    # Leak modules: the secrets file is reached through an attacker-owned symlink.
-    ('authleaf', {'path': authleaf, 'read only': 'no',
-                  'auth users': USER, 'secrets file': leaf_plant}),
-    ('authparent', {'path': authparent, 'read only': 'no',
-                    'auth users': USER,
-                    'secrets file': parent_plant / 'victim_in_target'}),
-])
-url = start_test_daemon(conf, DAEMON_PORT)
-userurl = url.replace('rsync://', f'rsync://{USER}@', 1)
-
-pwfile = SCRATCHDIR / 'pw.ok'
-pwfile.write_text(CORRECT_PASSWORD + '\n')
-pwfile.chmod(0o600)
-
-
-def push(module, dest):
-    rmtree(dest)
-    makepath(dest)
-    return subprocess.run(
-        rsync_argv('-a', f'--password-file={pwfile}',
-                   f'{src}/', f'{userurl}{module}/'),
-        stdout=subprocess.DEVNULL, stderr=subprocess.PIPE, text=True)
-
-
-# Sanity: the real secrets file authenticates (demonstrates the machinery;
-# success against a planted symlink is then the leak signal).
-sanity = push('authreal', authreal)
-if sanity.returncode != 0:
-    test_fail(
-        "sanity check failed: a non-symlinked root:0600 secrets file with the "
-        f"correct credential could not authenticate. stderr: {sanity.stderr!r}")
-
-# Leaf plant: success means the daemon followed the attacker-owned symlink.
-leaf = push('authleaf', authleaf)
-if leaf.returncode == 0:
-    test_fail(
-        f"daemon 'secrets file' followed a planted LEAF symlink (owned by uid "
-        f"{NOBODY_UID}): {leaf_plant} -> {victim} was read as the secrets DB and "
-        f"the client authenticated -> transfer succeeded. Fix: refuse planted "
-        f"symlinks at the daemon secrets-file open.")
-
-# Parent-component plant: success means the daemon traversed the attacker-owned
-# parent symlink.
-parent = push('authparent', authparent)
-if parent.returncode == 0:
-    test_fail(
-        f"daemon 'secrets file' followed a planted PARENT-component symlink "
-        f"(owned by uid {NOBODY_UID}): {parent_plant} -> {parent_real} was "
-        f"traversed and victim_in_target read as the secrets DB; the client "
-        f"authenticated -> transfer succeeded. This is the /tmp/somedir/-class "
-        f"parent-flip case. Fix: per-component path walk refusing parent "
-        f"symlinks owned by untrusted uids.")
-
-print("daemon-secrets-file-symlink: leaf + parent plants refused")
diff --git a/testsuite/daemon-size-arg-overflow_test.py b/testsuite/daemon-size-arg-overflow_test.py
deleted file mode 100644
index a0ba91400..000000000
--- a/testsuite/daemon-size-arg-overflow_test.py
+++ /dev/null
@@ -1,76 +0,0 @@
-#!/usr/bin/env python3
-# Regression test for an out-of-bounds write in options.c parse_size_arg().
-#
-# C99 snprintf() returns the number of bytes it *would* have written, so when
-# a daemon client supplies an oversized --max-size / --min-size / --bwlimit /
-# --block-size / --max-alloc value (each daemon arg may be up to
-# BIGPATHBUFLEN-1 = 5119 bytes via read_args), the `len` at the failure: label
-# can far exceed sizeof err_buf (200). The trailing
-#     err_buf[len] = '\n'; err_buf[len+1] = '\0';
-# then writes 0x0A,0x00 at an attacker-chosen offset thousands of bytes past
-# err_buf into adjacent .bss. Reachable from an unauthenticated client against
-# any daemon module before chroot/privilege-drop.
-#
-# The client itself parses --max-size locally and would reject the oversized
-# value before connecting, so we forward it to the *daemon's* option parser
-# with -M (--remote-option), which the client passes through unparsed.
-#
-# Oracle:
-#   * fixed:   parse_size_arg() clamps `len` to sizeof err_buf - 2 before the
-#              trailing writes; the daemon rejects the value with a clean
-#              "--max-size=... is invalid" error and stays alive.
-#   * pre-fix: the OOB .bss write corrupts adjacent globals. On a normal build
-#              this may not fault deterministically, but under ASAN it is a
-#              hard global-buffer-overflow abort of the daemon child. This test
-#              therefore asserts the GREEN behaviour (clean reject, no crash)
-#              on every build and is a true RED detector under the ASAN matrix.
-
-import re
-import subprocess
-
-from rsyncfns import (
-    SCRATCHDIR, makepath, rmtree, rsync_argv, start_test_daemon,
-    test_fail, write_daemon_conf,
-)
-
-DAEMON_PORT = 12939
-
-mod = SCRATCHDIR / 'sizemod'
-rmtree(mod)
-makepath(mod)
-(mod / 'f.txt').write_text("data\n")
-
-conf = write_daemon_conf([
-    ('mod', {'path': str(mod), 'read only': 'yes'}),
-])
-url = start_test_daemon(conf, DAEMON_PORT)
-
-dst = SCRATCHDIR / 'sizeout'
-rmtree(dst)
-makepath(dst)
-
-big = '9' * 5000  # >> sizeof err_buf (200); ~4.9 KB past err_buf if unclamped
-
-proc = subprocess.run(
-    rsync_argv('-a', f'-M--max-size={big}', f'{url}mod/', f'{dst}/'),
-    stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True)
-
-# parse_size_arg() builds the "--max-size=<value> is invalid" message in
-# err_buf and only THEN does the (pre-fix) out-of-bounds err_buf[len] write,
-# before returning -1 to the option-error reporter that forwards err_buf to
-# the client. So the daemon echoing the rejected --max-size value back is
-# proof it ran parse_size_arg to completion without faulting on the trailing
-# write. (On a normal build the OOB write lands silently in .bss, so pre- and
-# post-fix look identical here and the test passes either way; under the ASAN
-# matrix the pre-fix write is a hard global-buffer-overflow abort that happens
-# BEFORE err_buf is reported, so the value never comes back and this assert
-# fires -- that is the RED signal.)
-out = proc.stdout
-if not re.search(r'--max-size=9{100,}', out):
-    test_fail(
-        "daemon did not echo back the rejected oversized --max-size value "
-        f"(rc={proc.returncode}); parse_size_arg likely aborted on the "
-        f"unclamped err_buf[len] out-of-bounds write.\noutput:\n{out}")
-
-print("daemon-size-arg-overflow: oversized --max-size rejected by the daemon "
-      "after parse_size_arg ran to completion (err_buf length is clamped).")
diff --git a/testsuite/daemon-subdir-climb-symlink_test.py b/testsuite/daemon-subdir-climb-symlink_test.py
deleted file mode 100644
index 1019f9320..000000000
--- a/testsuite/daemon-subdir-climb-symlink_test.py
+++ /dev/null
@@ -1,63 +0,0 @@
-#!/usr/bin/env python3
-# Regression: a daemon subdir pull in a symlink-following mode must still follow
-# an IN-MODULE symlink whose relative target climbs with ".." to a sibling that
-# stays inside the module.
-#
-# The directory-enumeration confinement must use the same module-root anchor as
-# the content open (sender_open_copylinks_confined anchors at module_dir).  A
-# daemon chdir's into the requested subdir (do_server_sender, main.c), so
-# anchoring the scan at the cwd instead of module_dir would wrongly refuse
-# "sub/climb -> ../sibling" -- which resolves to module/sibling, still inside the
-# module -- a regression vs the legacy opendir that followed it (while a target
-# escaping the module is still refused).  This pulls module subdir "sub/" with
-# --copy-dirlinks over an in-module ..-climbing dir symlink and asserts its
-# content arrives.
-
-import os
-
-from rsyncfns import (
-    SCRATCHDIR, get_rootgid, get_rootuid, get_testuid, makepath, rmtree,
-    run_rsync, start_test_daemon, test_fail,
-)
-
-DAEMON_PORT = 12948
-CONTENT = "in-module sibling\n"
-
-base = SCRATCHDIR / 'daemon-subdir-climb'
-rmtree(base)
-mod = base / 'mod'
-dest = base / 'dest'
-makepath(mod / 'sub', mod / 'sibling', dest)
-(mod / 'sibling' / 's.txt').write_text(CONTENT)
-# In-module dir symlink in the subdir, climbing ".." to a sibling still inside
-# the module.  --copy-dirlinks descends it; it must be followed.
-os.symlink('../sibling', mod / 'sub' / 'climb')
-
-root = get_testuid() == get_rootuid()
-ids = f"uid = {get_rootuid()}\ngid = {get_rootgid()}" if root else ""
-
-conf = base / 'd.conf'
-conf.write_text(f"""\
-pid file = {base}/rsyncd.pid
-use chroot = no
-{ids}
-log file = {base}/rsyncd.log
-
-[m]
-    path = {mod}
-    read only = yes
-    hosts allow = 127.0.0.1
-""")
-url = start_test_daemon(conf, DAEMON_PORT)
-
-# Pull the SUBDIR (so the daemon chdir's into mod/sub) with --copy-dirlinks.
-run_rsync('-a', '--copy-dirlinks', f'{url}m/sub/', f'{dest}/', check=False)
-
-got = dest / 'climb' / 's.txt'
-if not got.is_file() or got.read_text() != CONTENT:
-    test_fail(
-        "daemon subdir pull with --copy-dirlinks failed to follow an in-module "
-        "symlink that climbs '..' to a sibling inside the module "
-        "(dest/climb/s.txt missing/wrong): the enumeration must anchor at "
-        "module_dir, not the scan cwd.")
-print("daemon-subdir-climb-symlink: in-module ..-climbing symlink followed under --copy-dirlinks")
diff --git a/testsuite/deep-path_test.py b/testsuite/deep-path_test.py
deleted file mode 100644
index 817524d15..000000000
--- a/testsuite/deep-path_test.py
+++ /dev/null
@@ -1,59 +0,0 @@
-#!/usr/bin/env python3
-# Exercise the DPC_MAXDEPTH (64) boundary of the held ancestor-dirfd cache.
-#
-# The receiver/generator (get_dir_fd) and the sender (held_dir_path_fd) resolve
-# a path against a persistent ancestor-dirfd stack capped at DPC_MAXDEPTH=64
-# path components (syscall.c).  A directory deeper than that is declined by the
-# cache (dpc_dir_fd returns -1) and must fall back to the un-cached
-# secure_relative_open() walk -- which handles arbitrary depth -- and still
-# produce a byte-identical result with no overflow/crash at the array bound.
-#
-# We build a single chain with a file at EVERY level past the cap, so dir-depths
-# both within the cache (<=64 components, fast path) and beyond it (>64, the
-# fallback) are transferred in one run, exercising the fast-path -> fallback
-# handoff on the sender AND the receiver (whose caches are independent).
-# Plain local transfer + a no-chroot daemon push; no root required.
-
-import os
-
-from rsyncfns import (
-    SCRATCHDIR, checkit, make_tree, rmtree, start_test_daemon, test_fail,
-    test_skipped, walk_files, write_daemon_conf,
-)
-
-DEPTH = 70            # > DPC_MAXDEPTH (64): the deepest files use the fallback
-DAEMON_PORT = 12905
-
-base = SCRATCHDIR / 'deep-path'
-src = base / 'src'
-rmtree(base)
-
-# One deep chain, a file at each level: src/f0, src/d1/f1, ..., src/d1/.../d70/f70.
-try:
-    make_tree(src, depth=DEPTH, data=True)
-except OSError as e:
-    test_skipped(f"cannot build a {DEPTH}-deep tree ({e})")
-
-# Sanity: the deepest file's parent really has more components than the cache
-# cap, so the fallback is genuinely exercised (not just the fast path).
-deepest = max(walk_files(src), key=lambda p: len(p.relative_to(src).parts))
-parent_components = len(deepest.relative_to(src).parts) - 1   # drop the filename
-if parent_components <= 64:
-    test_fail(f"deep tree only {parent_components} components deep -- "
-              "does not cross DPC_MAXDEPTH (64); test is ineffective")
-
-# --- local transfer: sender AND receiver caches both cross the boundary -----
-dest = base / 'dest'
-checkit(['-a', f'{src}/', str(dest)], src, dest)
-
-# --- daemon push: the daemon receiver uses the confined resolver ------------
-mod = base / 'module'
-mod.mkdir(parents=True, exist_ok=True)
-conf = write_daemon_conf([
-    ('deep', {'path': str(mod), 'use chroot': 'no', 'read only': 'no'}),
-])
-daemon_url = start_test_daemon(conf, DAEMON_PORT).rstrip('/')
-checkit(['-a', f'{src}/', f'{daemon_url}/deep/'], src, mod, allowed_codes=(0, 23))
-
-print(f"deep-path: {DEPTH}-deep tree round-trips past the dir-fd cache cap "
-      "(local + daemon)")
diff --git a/testsuite/delay-updates_test.py b/testsuite/delay-updates_test.py
deleted file mode 100644
index f6721919f..000000000
--- a/testsuite/delay-updates_test.py
+++ /dev/null
@@ -1,31 +0,0 @@
-#!/usr/bin/env python3
-# Python rewrite of testsuite/delay-updates.test.
-#
-# Exercise --delay-updates: pre-seed the destination's staging directory
-# with a stale file then re-sync; the final destination must match the
-# source regardless of what the staging dir already contained.
-
-import os
-
-from rsyncfns import FROMDIR, TODIR, checkit
-
-
-FROMDIR.mkdir(parents=True, exist_ok=True)
-(FROMDIR / 'foo').write_text("1\n")
-
-checkit(['-aiv', '--delay-updates', f'{FROMDIR}/', f'{TODIR}/'], FROMDIR, TODIR)
-
-# Plant a stale "in-progress" update in the staging dir and a mismatched
-# destination file, then re-sync. --delay-updates should overwrite cleanly.
-(TODIR / '.~tmp~').mkdir(exist_ok=True)
-(TODIR / '.~tmp~' / 'foo').write_text("2\n")
-# Touch both to a fixed time in the past so they look stale and the source's
-# fresh "3" clearly post-dates them.  (A real timestamp, not os.stat('..') --
-# whose shared parent dir is bumped by concurrent -j tests to ~now -- avoids a
-# same-second quick-check collision that would skip the update.)
-stale = 1_000_000_000  # 2001-09-09, well in the past
-os.utime(TODIR / '.~tmp~' / 'foo', (stale, stale))
-os.utime(TODIR / 'foo', (stale, stale))
-(FROMDIR / 'foo').write_text("3\n")
-
-checkit(['-aiv', '--delay-updates', f'{FROMDIR}/', f'{TODIR}/'], FROMDIR, TODIR)
diff --git a/testsuite/delete-missing-args-files-from_test.py b/testsuite/delete-missing-args-files-from_test.py
deleted file mode 100644
index 356be8d51..000000000
--- a/testsuite/delete-missing-args-files-from_test.py
+++ /dev/null
@@ -1,80 +0,0 @@
-#!/usr/bin/env python3
-# Functional regression: --delete-missing-args with --files-from aborts the
-# transfer with "invalid file mode 00 ... protocol incompatibility (code 2)"
-# instead of deleting the entries that are missing on the sender.
-#
-# Reported as #910 ("Security fix in flist.c breaks --delete-missing-args with
-# --files-from").
-#
-# Root cause: for a --files-from entry that does not exist on the sender,
-# --delete-missing-args==2 deliberately sends a "missing" file entry with
-# mode == 0 (the generator's signal to delete it on the receiver).  The 3.4.x
-# security mode-validation added to recv_file_entry() (flist.c) rejects mode 0
-# as an invalid file type BEFORE the generator can act on it, so the receiver
-# bails out with a protocol error and nothing is deleted.  Works in 3.4.1.
-#
-# Two scenarios, since a missing FILE and a missing DIRECTORY are sent as
-# distinct mode-0 entries:
-#   * a regular file present on the receiver but absent on the sender, and
-#   * a directory present on the receiver but absent on the sender,
-# both named in --files-from.  Both must be deleted on the receiver.
-#
-# XFAIL until recv_file_entry() accepts the missing-args mode-0 entry again
-# (the accompanying flist.c fix).  Runs at any uid.
-
-import subprocess
-
-from rsyncfns import (
-    SCRATCHDIR, makepath, rmtree, rsync_argv, start_test_daemon, test_fail,
-    test_xfail, write_daemon_conf,
-)
-
-DAEMON_PORT = 12910
-
-mod = SCRATCHDIR / 'recvmod910'    # daemon receive module
-src = SCRATCHDIR / 'src910'
-rmtree(mod)
-rmtree(src)
-makepath(mod / 'ghostdir', src)
-(src / 'keep.txt').write_text("keep-me\n")            # present on sender
-(mod / 'keep.txt').write_text("stale\n")              # will be updated
-(mod / 'ghost.txt').write_text("delete-me-file\n")    # absent on sender -> delete
-(mod / 'ghostdir' / 'inner').write_text("delete-me-dir\n")  # absent on sender -> delete
-
-# --files-from lists one present file plus the two entries that are missing on
-# the sender (a file and a directory) -- those become mode-0 "missing" entries.
-flist = SCRATCHDIR / 'files910.lst'
-flist.write_text("keep.txt\nghost.txt\nghostdir\n")
-
-conf = write_daemon_conf([
-    ('recv', {'path': str(mod), 'read only': 'no'}),
-])
-url = start_test_daemon(conf, DAEMON_PORT)
-
-proc = subprocess.run(
-    rsync_argv('-a', '--delete', '--delete-missing-args',
-               f'--files-from={flist}', f'{src}/', f'{url}recv/'),
-    stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True)
-out = proc.stdout or ''
-print(out)
-
-# Bug present: the receiver rejects the mode-0 missing-args entry.
-if 'invalid file mode' in out or (proc.returncode == 2 and (mod / 'ghost.txt').exists()):
-    test_xfail(
-        "#910: --delete-missing-args with --files-from aborts with "
-        "`invalid file mode 00 ... protocol incompatibility (code 2)`.  The "
-        "sender sends mode-0 entries for the missing args (the delete signal), "
-        "but recv_file_entry()'s 3.4.x mode-validation rejects mode 0 before the "
-        "generator can delete them.  To be closed by accepting the "
-        "missing-args mode-0 entry in recv_file_entry().")
-
-# Bug fixed (or absent): both missing args were deleted, the present file kept.
-if proc.returncode != 0:
-    test_fail(f"transfer failed unexpectedly (rc={proc.returncode}); "
-              f"not the #910 mode-00 symptom:\n{out}")
-if (mod / 'ghost.txt').exists():
-    test_fail("missing-arg file ghost.txt was not deleted on the receiver")
-if (mod / 'ghostdir').exists():
-    test_fail("missing-arg directory ghostdir was not deleted on the receiver")
-if not (mod / 'keep.txt').is_file() or (mod / 'keep.txt').read_text() != "keep-me\n":
-    test_fail("present file keep.txt was not delivered/updated correctly")
diff --git a/testsuite/dest-symlinked-dir_test.py b/testsuite/dest-symlinked-dir_test.py
deleted file mode 100644
index ae6ed0d7c..000000000
--- a/testsuite/dest-symlinked-dir_test.py
+++ /dev/null
@@ -1,40 +0,0 @@
-#!/usr/bin/env python3
-# Regression: a non-daemon receiver must FOLLOW an absolute symlinked
-# destination directory -- the common `/backup -> /mnt/disk`, `/var/www ->
-# /srv/www` admin pattern that scripts/cron use with absolute paths.
-#
-# The dest-symlink hardening opened the operator-named absolute dest with
-# O_NOFOLLOW and *refused* a symlink ("refusing to chdir into symlinked
-# destination ... use --insecure-links"), exiting 3.  A relative symlinked dest
-# always followed (plain chdir), so the behaviour was inconsistent too.  Now a
-# real directory is still opened O_NOFOLLOW (never reached via a raced leaf
-# symlink), but an operator-named symlinked dest is followed; the per-entry
-# transfer stays confined beneath the resolved root.
-
-import os
-
-from rsyncfns import SCRATCHDIR, assert_same, rmtree, run_rsync, test_fail
-
-base = SCRATCHDIR / 'dest-symlinked'
-src = base / 'src'
-real = base / 'realdest'
-link = base / 'backup'           # absolute symlink -> realdest
-rmtree(base)
-src.mkdir(parents=True)
-real.mkdir(parents=True)
-(src / 'f.txt').write_text('content\n')
-(src / 'sub').mkdir()
-(src / 'sub' / 'g.txt').write_text('deep\n')
-os.symlink(str(real), str(link))     # ABSOLUTE symlinked destination
-
-# Absolute dest path through the symlink -- this exited 3 on the unfixed branch.
-run_rsync('-a', f'{src}/', f'{link}/')   # check=True: must succeed (exit 0)
-
-for rel in ('f.txt', 'sub/g.txt'):
-    got = real / rel
-    if not got.is_file():
-        test_fail("transfer through an absolute symlinked dest did not land in "
-                  f"the real directory: {got} missing")
-    assert_same(src / rel, got, label=rel)
-
-print("dest-symlinked-dir: a non-daemon receiver follows an absolute symlinked dest")
diff --git a/testsuite/devices-fake_test.py b/testsuite/devices-fake_test.py
deleted file mode 120000
index d29085df6..000000000
--- a/testsuite/devices-fake_test.py
+++ /dev/null
@@ -1 +0,0 @@
-devices_test.py
\ No newline at end of file
diff --git a/testsuite/dirs_test.py b/testsuite/dirs_test.py
deleted file mode 100644
index 3772734a3..000000000
--- a/testsuite/dirs_test.py
+++ /dev/null
@@ -1,33 +0,0 @@
-#!/usr/bin/env python3
-"""Coverage of -d / --dirs: transfer directories without recursing into them.
-
--d copies the entries directly named (or directly inside a trailing-slash
-source): regular files at the top level are copied, and a top-level directory
-is created as an empty directory -- its contents are NOT transferred. Verify
-that on a tree that is several levels deep, only the top layer materialises.
-"""
-
-from rsyncfns import (
-    FROMDIR, TODIR,
-    assert_same, make_tree, rmtree, run_rsync, test_fail,
-)
-
-src = FROMDIR
-rmtree(src)
-rmtree(TODIR)
-make_tree(src, depth=3)   # f0 at root; d1/{f1, d2/{f2, d3/f3}}
-
-run_rsync('-d', f'{src}/', f'{TODIR}/')
-
-# The top-level file is copied.
-assert_same(TODIR / 'f0', src / 'f0', label='-d top-level file')
-# The top-level directory is created...
-if not (TODIR / 'd1').is_dir():
-    test_fail("-d did not create the top-level directory")
-# ...but NOT recursed into.
-if (TODIR / 'd1' / 'f1').exists():
-    test_fail("-d recursed into a directory (f1 should not exist)")
-if list((TODIR / 'd1').iterdir()):
-    test_fail("-d populated the directory; it should be empty")
-
-print("dirs: -d copies the top layer without recursing")
diff --git a/testsuite/exclude-lsh_test.py b/testsuite/exclude-lsh_test.py
deleted file mode 120000
index deb8639b6..000000000
--- a/testsuite/exclude-lsh_test.py
+++ /dev/null
@@ -1 +0,0 @@
-exclude_test.py
\ No newline at end of file
diff --git a/testsuite/excludefrom-symlink_test.py b/testsuite/excludefrom-symlink_test.py
deleted file mode 100644
index 00bb95dd4..000000000
--- a/testsuite/excludefrom-symlink_test.py
+++ /dev/null
@@ -1,120 +0,0 @@
-#!/usr/bin/env python3
-# --exclude-from / --include-from / --files-from / --filter=. file must not
-# follow planted symlinks at attacker-controlled path components.
-#
-# Threat:
-# privileged rsync reads from a planted symlink → file contents become
-# filter rules / file list → silent transfer shaping, content leak via
-# -v / -i / --debug output.
-#
-# Signal in this test (--exclude-from variant): the planted file's content
-# is the basename of a "canary" file we placed in src. With the leak, rsync
-# parses the planted content as an exclude rule and drops the canary from
-# the transfer. With the fix, rsync errors on the planted symlink open
-# (XFLG_FATAL_ERRORS at options.c:1543 + exclude.c:1477).
-#
-# Failure condition: returncode == 0 AND canary missing from dest. The only
-# way that combination arises is if rsync read the planted symlink's target
-# as filter rules. With the fix, rsync exits non-zero; with no leak at all,
-# the canary transfers.
-#
-# 1.5 (-C $HOME/.cvsignore) is covered by the same fix code path
-# (parse_filter_file callee shared with 1.1's per-dir merge); we don't
-# duplicate that test here. The XFLG flag differs (1.5 is silent-skip,
-# 1.4 is FATAL) but the open primitive is the same.
-#
-# Requires root for the cross-uid plant; skips otherwise.
-
-import os
-import pwd
-import subprocess
-
-from rsyncfns import SCRATCHDIR, rmtree, rsync_argv, test_fail, test_skipped
-
-
-if os.geteuid() != 0:
-    test_skipped("requires root to plant a symlink owned by a non-self uid "
-                 "(the attacker simulation)")
-
-NOBODY_UID = None
-for name in ('nobody', 'nfsnobody', 'daemon'):
-    try:
-        u = pwd.getpwnam(name).pw_uid
-        if u != 0 and u != os.geteuid():
-            NOBODY_UID = u
-            break
-    except KeyError:
-        continue
-if NOBODY_UID is None:
-    test_skipped("no untrusted-uid user available for cross-uid plant")
-
-
-base = SCRATCHDIR / 'excludefrom'
-src = base / 'src'
-dest = base / 'dest'
-outside = base / 'outside'
-
-rmtree(base)
-src.mkdir(parents=True)
-(src / 'canary_file').write_text("would-be-transferred\n")
-(src / 'other_file').write_text("noise\n")
-dest.mkdir(parents=True)
-outside.mkdir(parents=True)
-
-# Outside attacker-readable content: a CVS-style pattern that matches
-# src/canary_file. If rsync follows the planted symlink and parses this as
-# filter rules, it adds an exclude rule that drops canary_file.
-(outside / 'exclude_list').write_text("canary_file\n")
-
-
-def run_excludefrom(plant_path):
-    rmtree(dest)
-    dest.mkdir(parents=True)
-    return subprocess.run(
-        rsync_argv('-a', '--exclude-from=' + str(plant_path),
-                   f'{src}/', f'{dest}/'),
-        stdout=subprocess.DEVNULL, stderr=subprocess.PIPE, text=True)
-
-
-plants = base / 'plants'
-plants.mkdir()
-
-
-# ---------------------------------------------------------------------------
-# LEAF plant
-# ---------------------------------------------------------------------------
-leaf_plant = plants / 'exclude_leaf'
-os.symlink(outside / 'exclude_list', leaf_plant)
-os.lchown(leaf_plant, NOBODY_UID, NOBODY_UID)
-
-leaf = run_excludefrom(leaf_plant)
-canary = dest / 'canary_file'
-if leaf.returncode == 0 and not canary.exists():
-    test_fail(
-        f"--exclude-from followed a planted LEAF symlink (owned by uid "
-        f"{NOBODY_UID}): rsync read the symlink's target as filter rules and "
-        f"applied the leaked pattern, dropping src/canary_file from the "
-        f"transfer. Fix: refuse planted symlinks at --exclude-from.")
-
-
-# ---------------------------------------------------------------------------
-# PARENT-component plant
-# ---------------------------------------------------------------------------
-real_target = plants / 'parent_real_target'
-real_target.mkdir()
-(real_target / 'exclude_list').write_text("canary_file\n")
-
-parent_plant = plants / 'parent_link'
-os.symlink(real_target, parent_plant)
-os.lchown(parent_plant, NOBODY_UID, NOBODY_UID)
-
-parent = run_excludefrom(parent_plant / 'exclude_list')
-canary = dest / 'canary_file'
-if parent.returncode == 0 and not canary.exists():
-    test_fail(
-        f"--exclude-from followed a planted PARENT-component symlink (owned "
-        f"by uid {NOBODY_UID}): {parent_plant} -> {real_target} was "
-        f"traversed and the leaked exclude_list was applied, dropping "
-        f"canary_file from the transfer. /tmp/somedir/-class parent-flip "
-        "that plain O_NOFOLLOW does NOT defend. Fix: per-component path walk "
-        "with parent-symlink ownership check.")
diff --git a/testsuite/exitcodes.py b/testsuite/exitcodes.py
deleted file mode 100644
index faf3efcb5..000000000
--- a/testsuite/exitcodes.py
+++ /dev/null
@@ -1,17 +0,0 @@
-"""Exit codes a test reports to runtests.py (autotools test convention).
-
-Shared by runtests.py (the harness, which reads these from each test) and
-rsyncfns.py (the helpers, which exit with them) so the 0/1/2/77/78 values are
-named in exactly one place.  This module has no import-time side effects, so
-runtests.py can import it without pulling in rsyncfns's environment checks.
-"""
-
-import enum
-
-
-class Exit(enum.IntEnum):
-    PASS = 0
-    FAIL = 1
-    ERROR = 2     # the test could not run (e.g. missing environment)
-    SKIP = 77
-    XFAIL = 78    # expected failure: a known, documented residual
diff --git a/testsuite/expect/rsync_2.6.0.expect b/testsuite/expect/rsync_2.6.0.expect
deleted file mode 100644
index d4df2c946..000000000
--- a/testsuite/expect/rsync_2.6.0.expect
+++ /dev/null
@@ -1,35 +0,0 @@
-# Expected outcomes for current rsync <-> rsync 2.6.0 peer (protocol 27).
-# See rsync_3.1.3.expect for format/semantics; listed tests are the run set.
-# 2.6.0 predates much of the suite; many daemon/feature tests are expected
-# to fail (xfail) -- a documented old-peer gap, not a current-side bug.
-# The four *-symlink-race / sender-flist-symlink-leak xfails show the peer
-# is vulnerable to the May-2026 findings that current master fixes.
-
-00-hello                     xfail   # feature/negotiation absent in 2.6.0 (proto 27)
-alt-dest                     xfail   # peer vulnerable to May-2026 finding (fixed in current)
-alt-dest-symlink-race        xfail   # peer vulnerable to May-2026 finding (fixed in current)
-bare-do-open-symlink-race    pass
-batch-mode                   xfail   # feature/negotiation absent in 2.6.0 (proto 27)
-chdir-symlink-race           xfail   # peer vulnerable to May-2026 finding (fixed in current)
-chmod-option                 xfail   # feature/negotiation absent in 2.6.0 (proto 27)
-copy-dest-source-symlink     xfail   # peer vulnerable to May-2026 finding (fixed in current)
-daemon                       xfail   # feature/negotiation absent in 2.6.0 (proto 27)
-daemon-access                xfail   # feature/negotiation absent in 2.6.0 (proto 27)
-daemon-auth                  pass
-daemon-config                xfail   # feature/negotiation absent in 2.6.0 (proto 27)
-daemon-exec                  xfail   # feature/negotiation absent in 2.6.0 (proto 27)
-daemon-filter                xfail   # feature/negotiation absent in 2.6.0 (proto 27)
-daemon-gzip-download         xfail   # feature/negotiation absent in 2.6.0 (proto 27)
-daemon-gzip-upload           xfail   # feature/negotiation absent in 2.6.0 (proto 27)
-daemon-munge                 xfail   # feature/negotiation absent in 2.6.0 (proto 27)
-daemon-refuse                xfail   # feature/negotiation absent in 2.6.0 (proto 27)
-daemon-refuse-compress       xfail   # feature/negotiation absent in 2.6.0 (proto 27)
-exclude                      pass
-files-from                   xfail   # feature/negotiation absent in 2.6.0 (proto 27)
-hardlinks                    pass
-reverse-daemon-delta         pass
-sender-flist-symlink-leak    xfail   # peer vulnerable to May-2026 finding (fixed in current)
-ssh-basic                    pass
-variety                      xfail   # specials/devices split & keep-dirlinks absent in 2.6.0 (proto 27)
-variety-symlink-traversal    xfail   # keep-dirlinks absent in 2.6.0 (proto 27)
-symlink-dirlink-basis        xfail   # feature/negotiation absent in 2.6.0 (proto 27)
diff --git a/testsuite/expect/rsync_3.0.0.expect b/testsuite/expect/rsync_3.0.0.expect
deleted file mode 100644
index 8a4333e5c..000000000
--- a/testsuite/expect/rsync_3.0.0.expect
+++ /dev/null
@@ -1,35 +0,0 @@
-# Expected outcomes for current rsync <-> rsync 3.0.0 peer (protocol 30).
-# See rsync_3.1.3.expect for format/semantics; listed tests are the run set.
-# 3.0.0 predates much of the suite; many daemon/feature tests are expected
-# to fail (xfail) -- a documented old-peer gap, not a current-side bug.
-# The four *-symlink-race / sender-flist-symlink-leak xfails show the peer
-# is vulnerable to the May-2026 findings that current master fixes.
-
-00-hello                     pass
-alt-dest                     pass
-alt-dest-symlink-race        xfail   # peer vulnerable to May-2026 finding (fixed in current)
-bare-do-open-symlink-race    pass
-batch-mode                   xfail   # feature/negotiation absent in 3.0.0 (proto 30)
-chdir-symlink-race           xfail   # peer vulnerable to May-2026 finding (fixed in current)
-chmod-option                 xfail   # feature/negotiation absent in 3.0.0 (proto 30)
-copy-dest-source-symlink     xfail   # peer vulnerable to May-2026 finding (fixed in current)
-daemon                       xfail   # feature/negotiation absent in 3.0.0 (proto 30)
-daemon-access                pass
-daemon-auth                  pass
-daemon-config                xfail   # feature/negotiation absent in 3.0.0 (proto 30)
-daemon-exec                  pass
-daemon-filter                xfail   # feature/negotiation absent in 3.0.0 (proto 30)
-daemon-gzip-download         xfail   # feature/negotiation absent in 3.0.0 (proto 30)
-daemon-gzip-upload           xfail   # feature/negotiation absent in 3.0.0 (proto 30)
-daemon-munge                 pass
-daemon-refuse                xfail   # feature/negotiation absent in 3.0.0 (proto 30)
-daemon-refuse-compress       pass
-exclude                      pass
-files-from                   pass
-hardlinks                    pass
-reverse-daemon-delta         pass
-sender-flist-symlink-leak    xfail   # peer vulnerable to May-2026 finding (fixed in current)
-ssh-basic                    pass
-variety                      pass
-variety-symlink-traversal    pass
-symlink-dirlink-basis        pass
diff --git a/testsuite/expect/rsync_3.1.0.expect b/testsuite/expect/rsync_3.1.0.expect
deleted file mode 100644
index 9a4438dc0..000000000
--- a/testsuite/expect/rsync_3.1.0.expect
+++ /dev/null
@@ -1,35 +0,0 @@
-# Expected outcomes for current rsync <-> rsync 3.1.0 peer (protocol 31).
-# See rsync_3.1.3.expect for format/semantics; listed tests are the run set.
-# 3.1.0 predates much of the suite; many daemon/feature tests are expected
-# to fail (xfail) -- a documented old-peer gap, not a current-side bug.
-# The four *-symlink-race / sender-flist-symlink-leak xfails show the peer
-# is vulnerable to the May-2026 findings that current master fixes.
-
-00-hello                     pass
-alt-dest                     pass
-alt-dest-symlink-race        xfail   # peer vulnerable to May-2026 finding (fixed in current)
-bare-do-open-symlink-race    pass
-batch-mode                   pass
-chdir-symlink-race           xfail   # peer vulnerable to May-2026 finding (fixed in current)
-chmod-option                 pass
-copy-dest-source-symlink     xfail   # peer vulnerable to May-2026 finding (fixed in current)
-daemon                       xfail   # feature/negotiation absent in 3.1.0 (proto 31)
-daemon-access                pass
-daemon-auth                  pass
-daemon-config                pass
-daemon-exec                  pass
-daemon-filter                pass
-daemon-gzip-download         xfail   # feature/negotiation absent in 3.1.0 (proto 31)
-daemon-gzip-upload           xfail   # feature/negotiation absent in 3.1.0 (proto 31)
-daemon-munge                 pass
-daemon-refuse                xfail   # feature/negotiation absent in 3.1.0 (proto 31)
-daemon-refuse-compress       xfail   # feature/negotiation absent in 3.1.0 (proto 31)
-exclude                      pass
-files-from                   pass
-hardlinks                    pass
-reverse-daemon-delta         pass
-sender-flist-symlink-leak    xfail   # peer vulnerable to May-2026 finding (fixed in current)
-ssh-basic                    pass
-variety                      pass
-variety-symlink-traversal    pass
-symlink-dirlink-basis        pass
diff --git a/testsuite/expect/rsync_3.1.3.expect b/testsuite/expect/rsync_3.1.3.expect
deleted file mode 100644
index 0ba653441..000000000
--- a/testsuite/expect/rsync_3.1.3.expect
+++ /dev/null
@@ -1,51 +0,0 @@
-# Expected outcomes for current rsync (client/driver) <-> rsync 3.1.3 peer
-# (daemon / remote-shell server), used by runtests.py --expect-result.
-#
-# Format: "<testname> <pass|skip|fail|xfail>", '#' comments ignored. The listed
-# tests ARE the run set. outcome meanings:
-#   pass  - must succeed
-#   skip  - must skip (exit 77)
-#   xfail - expected to fail: a known, benign old-peer limitation or an
-#           unpatched-old-peer vulnerability (documented per line below)
-#   fail  - expected to fail, flagged for investigation (not understood / may
-#           be a current-side bug)
-# fail and xfail are equivalent for pass/fail accounting; the label documents
-# why. An UNEXPECTED pass (xpass) of an xfail/fail line fails the run, which is
-# the signal to revisit this manifest (e.g. an old-peer gap got closed).
-#
-# daemon-access-ip and daemon-chroot-acl are intentionally omitted: they need a
-# real TCP peer and would skip/run differently by transport.
-
-# --- two-sided tests that pass against a 3.1.3 peer ---
-00-hello                    pass
-reverse-daemon-delta        pass    # old client -> current daemon (backward-compat: delta+compress, both directions)
-alt-dest                    pass
-bare-do-open-symlink-race   pass
-batch-mode                  pass
-chmod-option                pass
-daemon-access               pass
-daemon-auth                 pass
-daemon-config               pass
-daemon-exec                 pass
-daemon-filter               pass
-daemon-gzip-download        pass
-daemon-gzip-upload          pass
-daemon-munge                pass
-exclude                     pass
-files-from                  pass
-hardlinks                   pass
-ssh-basic                   pass
-variety                     pass
-variety-symlink-traversal   pass
-symlink-dirlink-basis       pass
-
-# --- version feature/option gaps in 3.1.3 ---
-daemon                      xfail   # exercises -U/--atimes etc. unknown to 3.1.3 (server errors)
-daemon-refuse               xfail   # daemon refuse/option semantics differ (connection reset)
-daemon-refuse-compress      xfail   # pre-zstd compress negotiation; no --compress refuse error
-
-# --- May-2026 security fixes absent in 3.1.3 (peer is vulnerable) ---
-alt-dest-symlink-race       xfail   # --link-dest basis lookup follows basedir symlink (escape)
-chdir-symlink-race          xfail   # chmod escape via cd symlink during chdir
-copy-dest-source-symlink    xfail   # copy_file source reads /outside via cd symlink (poison)
-sender-flist-symlink-leak   xfail   # sender flist follows cd symlink, leaks outside paths
diff --git a/testsuite/expect/rsync_3.2.0.expect b/testsuite/expect/rsync_3.2.0.expect
deleted file mode 100644
index 36f4282dc..000000000
--- a/testsuite/expect/rsync_3.2.0.expect
+++ /dev/null
@@ -1,36 +0,0 @@
-# Expected outcomes for current rsync <-> rsync 3.2.0 peer (see
-# rsync_3.1.3.expect for the format/semantics; listed tests are the run set;
-# fail/xfail both keep CI green, an unexpected pass fails the run).
-
-00-hello                    pass
-reverse-daemon-delta        pass    # old client -> current daemon (backward-compat: delta+compress, both directions)
-alt-dest                    pass
-bare-do-open-symlink-race   pass
-batch-mode                  pass
-daemon-access               pass
-daemon-auth                 pass
-daemon-config               pass
-daemon-exec                 pass
-daemon-filter               pass
-daemon-gzip-download        pass
-daemon-gzip-upload          pass
-daemon-munge                pass
-daemon-refuse               pass
-exclude                     pass
-files-from                  pass
-hardlinks                   pass
-ssh-basic                   pass
-variety                     pass
-variety-symlink-traversal   pass
-symlink-dirlink-basis       pass
-
-# --- version feature/option gaps in 3.2.0 ---
-chmod-option                xfail   # client-server protocol start error (code 5)
-daemon                      xfail   # daemon listing/option path errors (code 5)
-daemon-refuse-compress      xfail   # --compress refuse semantics differ from current
-
-# --- May-2026 security fixes absent in 3.2.0 (peer is vulnerable) ---
-alt-dest-symlink-race       xfail   # --link-dest basis lookup follows basedir symlink (escape)
-chdir-symlink-race          xfail   # chmod escape via cd symlink during chdir
-copy-dest-source-symlink    xfail   # copy_file source reads /outside via cd symlink (poison)
-sender-flist-symlink-leak   xfail   # sender flist follows cd symlink, leaks outside paths
diff --git a/testsuite/expect/rsync_3.2.7.expect b/testsuite/expect/rsync_3.2.7.expect
deleted file mode 100644
index 455873edb..000000000
--- a/testsuite/expect/rsync_3.2.7.expect
+++ /dev/null
@@ -1,33 +0,0 @@
-# Expected outcomes for current rsync <-> rsync 3.2.7 peer (see
-# rsync_3.1.3.expect for the format/semantics; listed tests are the run set).
-
-00-hello                    pass
-reverse-daemon-delta        pass    # old client -> current daemon (backward-compat: delta+compress, both directions)
-alt-dest                    pass
-bare-do-open-symlink-race   pass
-batch-mode                  pass
-chmod-option                pass
-daemon                      pass
-daemon-access               pass
-daemon-auth                 pass
-daemon-config               pass
-daemon-exec                 pass
-daemon-filter               pass
-daemon-gzip-download        pass
-daemon-gzip-upload          pass
-daemon-munge                pass
-daemon-refuse               pass
-daemon-refuse-compress      pass
-exclude                     pass
-files-from                  pass
-hardlinks                   pass
-ssh-basic                   pass
-symlink-dirlink-basis       pass
-variety                     pass
-variety-symlink-traversal   pass
-
-# --- May-2026 security fixes absent in 3.2.7 (peer is vulnerable) ---
-alt-dest-symlink-race       xfail   # --link-dest basis lookup follows basedir symlink (escape)
-chdir-symlink-race          xfail   # chmod escape via cd symlink during chdir
-copy-dest-source-symlink    xfail   # copy_file source reads /outside via cd symlink (poison)
-sender-flist-symlink-leak   xfail   # sender flist follows cd symlink, leaks outside paths
diff --git a/testsuite/expect/rsync_3.3.0.expect b/testsuite/expect/rsync_3.3.0.expect
deleted file mode 100644
index 85b274201..000000000
--- a/testsuite/expect/rsync_3.3.0.expect
+++ /dev/null
@@ -1,33 +0,0 @@
-# Expected outcomes for current rsync <-> rsync 3.3.0 peer (see
-# rsync_3.1.3.expect for the format/semantics; listed tests are the run set).
-
-00-hello                    pass
-reverse-daemon-delta        pass    # old client -> current daemon (backward-compat: delta+compress, both directions)
-alt-dest                    pass
-bare-do-open-symlink-race   pass
-batch-mode                  pass
-chmod-option                pass
-daemon                      pass
-daemon-access               pass
-daemon-auth                 pass
-daemon-config               pass
-daemon-exec                 pass
-daemon-filter               pass
-daemon-gzip-download        pass
-daemon-gzip-upload          pass
-daemon-munge                pass
-daemon-refuse               pass
-daemon-refuse-compress      pass
-exclude                     pass
-files-from                  pass
-hardlinks                   pass
-ssh-basic                   pass
-variety                     pass
-variety-symlink-traversal   pass
-symlink-dirlink-basis       pass
-
-# --- May-2026 security fixes absent in 3.3.0 (peer is vulnerable) ---
-alt-dest-symlink-race       xfail   # --link-dest basis lookup follows basedir symlink (escape)
-chdir-symlink-race          xfail   # chmod escape via cd symlink during chdir
-copy-dest-source-symlink    xfail   # copy_file source reads /outside via cd symlink (poison)
-sender-flist-symlink-leak   xfail   # sender flist follows cd symlink, leaks outside paths
diff --git a/testsuite/expect/rsync_3.4.0.expect b/testsuite/expect/rsync_3.4.0.expect
deleted file mode 100644
index 085e50f6f..000000000
--- a/testsuite/expect/rsync_3.4.0.expect
+++ /dev/null
@@ -1,42 +0,0 @@
-# Expected outcomes for current rsync <-> rsync 3.4.0 peer (see
-# rsync_3.1.3.expect for the format/semantics; listed tests are the run set).
-
-00-hello                    pass
-reverse-daemon-delta        pass    # old client -> current daemon (backward-compat: delta+compress, both directions)
-alt-dest                    pass
-bare-do-open-symlink-race   pass
-batch-mode                  pass
-chmod-option                pass
-daemon                      pass
-daemon-access               pass
-daemon-auth                 pass
-daemon-config               pass
-daemon-exec                 pass
-daemon-filter               pass
-daemon-gzip-download        pass
-daemon-gzip-upload          pass
-daemon-munge                pass
-daemon-refuse               pass
-daemon-refuse-compress      pass
-exclude                     pass
-files-from                  pass
-hardlinks                   pass
-ssh-basic                   pass
-variety                     pass
-variety-symlink-traversal   pass
-
-# issue #715, present in 3.4.0: updating a file through a -K (--copy-dirlinks)
-# directory symlink fails on the receiver because its secure_relative_open()
-# O_NOFOLLOW-confines every path component, including the basedir reached via
-# the symlink, so the basis open is rejected and the update is discarded
-# ("failed verification"). Current master fixes this with secure_basis_open()
-# (receiver.c), which splits the path so the basedir may follow symlinks while
-# only the leaf is O_NOFOLLOW'd. Verified peer-version-, not protocol-, driven
-# (forcing this peer to --protocol=31 still fails; 3.3.0 at proto 31 passes).
-symlink-dirlink-basis       xfail
-
-# --- May-2026 security fixes absent in 3.4.0 (peer is vulnerable) ---
-alt-dest-symlink-race       xfail   # --link-dest basis lookup follows basedir symlink (escape)
-chdir-symlink-race          xfail   # chmod escape via cd symlink during chdir
-copy-dest-source-symlink    xfail   # copy_file source reads /outside via cd symlink (poison)
-sender-flist-symlink-leak   xfail   # sender flist follows cd symlink, leaks outside paths
diff --git a/testsuite/expect/rsync_3.4.1.expect b/testsuite/expect/rsync_3.4.1.expect
deleted file mode 100644
index 4dbacbd15..000000000
--- a/testsuite/expect/rsync_3.4.1.expect
+++ /dev/null
@@ -1,42 +0,0 @@
-# Expected outcomes for current rsync <-> rsync 3.4.1 peer (see
-# rsync_3.1.3.expect for the format/semantics; listed tests are the run set).
-
-00-hello                    pass
-reverse-daemon-delta        pass    # old client -> current daemon (backward-compat: delta+compress, both directions)
-alt-dest                    pass
-bare-do-open-symlink-race   pass
-batch-mode                  pass
-chmod-option                pass
-daemon                      pass
-daemon-access               pass
-daemon-auth                 pass
-daemon-config               pass
-daemon-exec                 pass
-daemon-filter               pass
-daemon-gzip-download        pass
-daemon-gzip-upload          pass
-daemon-munge                pass
-daemon-refuse               pass
-daemon-refuse-compress      pass
-exclude                     pass
-files-from                  pass
-hardlinks                   pass
-ssh-basic                   pass
-variety                     pass
-variety-symlink-traversal   pass
-
-# issue #715, present in 3.4.1: updating a file through a -K (--copy-dirlinks)
-# directory symlink fails on the receiver because its secure_relative_open()
-# O_NOFOLLOW-confines every path component, including the basedir reached via
-# the symlink, so the basis open is rejected and the update is discarded
-# ("failed verification"). Current master fixes this with secure_basis_open()
-# (receiver.c), which splits the path so the basedir may follow symlinks while
-# only the leaf is O_NOFOLLOW'd. Verified peer-version-, not protocol-, driven
-# (forcing this peer to --protocol=31 still fails; 3.3.0 at proto 31 passes).
-symlink-dirlink-basis       xfail
-
-# --- May-2026 security fixes absent in 3.4.1 (peer is vulnerable) ---
-alt-dest-symlink-race       xfail   # --link-dest basis lookup follows basedir symlink (escape)
-chdir-symlink-race          xfail   # chmod escape via cd symlink during chdir
-copy-dest-source-symlink    xfail   # copy_file source reads /outside via cd symlink (poison)
-sender-flist-symlink-leak   xfail   # sender flist follows cd symlink, leaks outside paths
diff --git a/testsuite/fake-super-acl-xattr_test.py b/testsuite/fake-super-acl-xattr_test.py
deleted file mode 100644
index 097323670..000000000
--- a/testsuite/fake-super-acl-xattr_test.py
+++ /dev/null
@@ -1,112 +0,0 @@
-#!/usr/bin/env python3
-"""Coverage: --fake-super -A stores/loads ACLs via the user.rsync.%aacl /
-%dacl xattrs (xattrs.c get_xattr_acl/set_xattr_acl/del_def_xattr_acl and the
-acls.c am_root<0 IVAL/SIVAL pack/unpack paths).
-
-Three legs, all with -A --fake-super on the *receiving* side:
-
-  1. real-ACL src  -> fake-super dst    (acls.c set_xattr_acl path: SIVAL pack
-                                         + xattrs.c set_xattr_acl)
-  2. fake-super dst -> fake-super dst2  (acls.c get_xattr_acl path: IVAL
-                                         unpack on the SENDER side via -M
-                                         --fake-super, then set_xattr_acl
-                                         again on the receiver)
-  3. drop the source dir's default ACL and re-sync dst -> del_def_xattr_acl
-     removes the stale %dacl xattr.
-
-Structural assertions only (xattr presence/absence): the per-field ACL
-round-trip is acls_test.py's job; this test exists to cover the xattr-
-encoding branch that the regular -A tests (am_root>=0) never reach.
-"""
-
-import os
-import platform
-import subprocess
-
-from rsyncfns import (
-    SCRATCHDIR, FROMDIR,
-    acls_supported, makepath, rmtree, rsync_argv,
-    test_fail, test_skipped, xattrs_supported,
-)
-
-# The fake-super ACL encoding stores ACLs under the Linux-only `user.rsync.`
-# xattr namespace (xattrs.c USERNAME_PREFIX under HAVE_LINUX_XATTRS); elsewhere
-# the prefix is `rsync.` and the access path uses setfacl/os.getxattr that don't
-# exist or differ (macOS, the BSDs, Cygwin).  This test targets that Linux path.
-if platform.system() != 'Linux':
-    test_skipped("fake-super ACL xattrs use the Linux user.rsync.* namespace")
-
-if not acls_supported():
-    test_skipped("ACLs not supported on this filesystem")
-if not xattrs_supported():
-    test_skipped("xattrs not supported on this filesystem")
-
-src = FROMDIR
-dst = SCRATCHDIR / 'fakesuper-dst'
-dst2 = SCRATCHDIR / 'fakesuper-dst2'
-for d in (src, dst, dst2):
-    rmtree(d)
-makepath(src)
-
-# Source: a file with a named-user access ACL entry, and a directory with
-# a default ACL (so both %aacl and %dacl encodings are exercised, and the
-# id_access cnt>0 branch in acls.c pack/unpack fires).
-(src / 'f').write_text('hello\n')
-sd = src / 'd'
-sd.mkdir()
-(sd / 'g').write_text('world\n')
-
-r = subprocess.run(['setfacl', '-m', f'u:{os.getuid()}:rwx', str(src / 'f')],
-                   capture_output=True, text=True)
-if r.returncode != 0:
-    test_skipped(f"setfacl on file failed: {r.stderr!r}")
-r = subprocess.run(['setfacl', '-d', '-m', f'u:{os.getuid()}:rwx', str(sd)],
-                   capture_output=True, text=True)
-if r.returncode != 0:
-    test_skipped(f"setfacl -d on dir failed: {r.stderr!r}")
-
-
-def has_xattr(path, name):
-    try:
-        os.getxattr(str(path), name, follow_symlinks=False)
-        return True
-    except OSError:
-        return False
-
-
-def sync(args, frm, to):
-    r = subprocess.run(rsync_argv(*args, f'{frm}/', f'{to}/'),
-                       capture_output=True, text=True)
-    if r.returncode != 0:
-        test_fail(f"rsync {' '.join(args)} {frm} -> {to} "
-                  f"(rc={r.returncode}):\n{r.stderr}")
-    return r
-
-
-# --- leg 1: real-ACL src -> fake-super dst (set_xattr_acl + SIVAL pack) ----
-# In a local copy the client is the SENDER and the forked "server" is the
-# RECEIVER, so --fake-super on the receiving side is `-M--fake-super`.
-sync(['-rA', '-M--fake-super'], src, dst)
-if not has_xattr(dst / 'f', 'user.rsync.%aacl'):
-    test_fail("--fake-super -A should have stored user.rsync.%aacl on dst/f")
-if not has_xattr(dst / 'd', 'user.rsync.%dacl'):
-    test_fail("--fake-super -A should have stored user.rsync.%dacl on dst/d")
-
-# --- leg 2: fake-super dst -> fake-super dst2 (get_xattr_acl + IVAL unpack)
-# Both sides in fake-super mode: sender (client) READS ACLs from the
-# %aacl/%dacl xattrs (get_xattr_acl + IVAL unpack), receiver (-M side)
-# WRITES them back (set_xattr_acl).
-sync(['-rA', '--fake-super', '-M--fake-super'], dst, dst2)
-if not has_xattr(dst2 / 'f', 'user.rsync.%aacl'):
-    test_fail("fake-super -> fake-super -A round-trip lost %aacl on dst2/f")
-if not has_xattr(dst2 / 'd', 'user.rsync.%dacl'):
-    test_fail("fake-super -> fake-super -A round-trip lost %dacl on dst2/d")
-
-# --- leg 3: drop the source dir's default ACL, re-sync -> del_def_xattr_acl
-subprocess.run(['setfacl', '-k', str(sd)], check=True)
-sync(['-rA', '-M--fake-super'], src, dst)
-if has_xattr(dst / 'd', 'user.rsync.%dacl'):
-    test_fail("re-sync after `setfacl -k` should have removed %dacl from dst/d "
-              "(del_def_xattr_acl)")
-
-print("fake-super-acl-xattr: %aacl/%dacl set+get round-trip + del_def ok")
diff --git a/testsuite/files-from-leak_test.py b/testsuite/files-from-leak_test.py
deleted file mode 100644
index b310860e4..000000000
--- a/testsuite/files-from-leak_test.py
+++ /dev/null
@@ -1,207 +0,0 @@
-import os
-import subprocess
-import time
-
-from rsyncfns import (
-    SCRATCHDIR, race_budget, find_attacker_uid, rmtree, rsync_argv,
-    start_c_flipper, stop_flipper, test_fail, test_skipped, start_test_daemon,
-    write_daemon_conf,
-)
-
-# A daemon serving a writable, non-chrooted module creates --backup-dir backups
-# with its own (root) ownership.  A parent-swap race can leave a root-owned
-# backup symlink whose target escapes the module.  Because open_no_attacker_symlinks()
-# follows a symlink owned by uid 0 / the euid, a later --files-from=:LIST that names
-# that backup symlink would read an out-of-module file's content as the file list --
-# unless the files-from open is module-root confined.  RED before that confinement,
-# GREEN after.
-
-PORT = 13333
-
-if os.geteuid() != 0:
-    test_skipped("requires root to plant a backup-dir symlink owned by a non-self uid")
-
-ATT_UID = find_attacker_uid()
-if ATT_UID is None:
-    test_skipped("no untrusted-uid user available for cross-uid plant")
-
-SECRET = "NO_ONE_SHOULD_README\n"
-NFILES = 80
-root = SCRATCHDIR / 'files-from'
-root.mkdir()
-base = root / 'base'
-outside = base / 'outside'
-src = base / 'src'
-dest = base / 'dest'
-backup = base / 'backup'
-sub = backup / 'sub'
-sublink = backup / '.sublink'
-files_from = ""
-
-secret = root / 'secret'
-secret.write_text(SECRET)
-
-
-def build():
-    """Reset the workspace.  Call only while the flipper is stopped."""
-    rmtree(base)
-    for d in (src / 'sub', dest / 'sub', backup, outside):
-        d.mkdir(parents=True, exist_ok=True)
-
-    # Distinct source and destination symlink values so each transfer overwrites
-    # the destination symlink and thus triggers a backup of the old one.
-    for i in range(NFILES):
-        (src / 'sub' / f'f{i}').symlink_to('test')
-        (dest / 'sub' / f'f{i}').symlink_to(f'{secret}')
-        os.lchown(src / 'sub' / f'f{i}', ATT_UID, ATT_UID)
-        os.lchown(dest / 'sub' / f'f{i}', ATT_UID, ATT_UID)
-
-    # The attacker-owned parent-swap target: a symlink to the outside directory.
-    os.symlink(str(outside), sublink)
-    os.lchown(sublink, ATT_UID, ATT_UID)
-    sub.mkdir(parents=True, exist_ok=True)
-
-
-def push():
-    """Blocking rsync push that backs up the old destination symlinks."""
-    return subprocess.run(
-        rsync_argv('-a', '-b', '--backup-dir=/backup/',
-                   f'{src}/', f'rsync://127.0.0.1:{PORT}/m/dest/'),
-        stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL,
-    )
-
-
-def leak():
-    """Attempt to read a secret via files-from through the root-owned symlink."""
-    proc = subprocess.run(
-        rsync_argv('-a', f'--files-from=:backup/sub/{files_from}',
-                   f'rsync://127.0.0.1:{PORT}/m/', f'{dest}/'),
-        stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True,
-    )
-    if "NO_ONE_SHOULD" in proc.stdout:
-        test_fail(f"{secret.name} is leaked!\n\nOutput: {proc.stdout}")
-
-
-def normalize_sub():
-    """If the flipper stopped with `sub` as the attacker symlink while the real
-    backup directory sits at `.sublink`, put the real dir back at `sub` so the
-    daemon path backup/sub/<name> (and our scandir) see the real backups.
-
-    Best-effort only: the non-atomic (non-Linux) flipper swaps via a `sub.flip`
-    scratch name and can be killed mid-rename, leaving `sub` absent or the real
-    dir parked at `.flip`.  Any state we can't cleanly settle is left as-is and
-    treated by the caller as 'no win this round'."""
-    try:
-        if sub.is_symlink() and sublink.is_dir() and not sublink.is_symlink():
-            sub.unlink()
-            sublink.rename(sub)
-    except OSError:
-        pass
-
-
-def root_owned_backup_symlink():
-    """Return the name of a root-owned backup symlink directly in `sub`, or "".
-
-    Never raises: a swap killed mid-rename can leave `sub` absent or a symlink,
-    which just means no usable win this round -- the caller rebuilds and retries."""
-    normalize_sub()
-    try:
-        if sub.is_symlink() or not sub.is_dir():
-            return ""
-        with os.scandir(sub) as it:
-            for entry in it:
-                if entry.is_symlink() and entry.stat(follow_symlinks=False).st_uid == 0:
-                    return entry.name
-    except (FileNotFoundError, NotADirectoryError):
-        return ""
-    return ""
-
-
-# Positive control: a clean run (no flipper) must back the old destination
-# symlink into the backup tree, proving this transfer shape exercises the backup
-# symlink path.  A broken fixture or an rsync that errors early fails here loudly
-# instead of passing the race vacuously.
-conf = write_daemon_conf(
-    [('m', {'path': str(base), 'read only': 'no', 'use chroot': 'no'})],
-    name='files-from-rsyncd.conf',
-)
-start_test_daemon(conf, PORT)
-
-build()
-proc = push()
-if proc.returncode != 0:
-    test_fail(f"positive control: clean --backup-dir run failed (rc={proc.returncode})")
-if not (sub / 'f0').is_symlink() or os.readlink(sub / 'f0') != f'{secret}':
-    test_fail(
-        "positive control: the old destination symlink was not backed up into "
-        f"{sub}; the backup symlink path was not exercised"
-    )
-
-
-# ---- THE LIVE RACE ---------------------------------------------------------
-# Repeatedly push under the parent-swap flipper until a root-owned backup symlink
-# lands in `sub`.  Reset the workspace only while the flipper is quiet so build()'s
-# rmtree/mkdir can't race the swapper.
-
-deadline = time.monotonic() + race_budget(10.0)
-flip = None
-try:
-    while time.monotonic() < deadline:
-        if flip is not None:
-            stop_flipper(flip)
-            flip = None
-
-        files_from = root_owned_backup_symlink()
-        if files_from:
-            break
-
-        build()
-        flip = start_c_flipper(sub, sublink)
-        push()
-finally:
-    if flip is not None:
-        stop_flipper(flip)
-
-if not files_from:
-    # The leak needs a root-owned backup symlink, which only appears when the
-    # parent-swap race makes make_backup() fall back to creating the symlink
-    # itself.  Winning that window reliably needs the atomic renameat2(EXCHANGE)
-    # flipper (Linux); on platforms that fall back to the non-atomic flipper the
-    # window may never be hit within the budget.  Can't mount the attack here, so
-    # there's nothing to assert -- skip rather than fail.
-    test_skipped("race did not produce a root-owned backup symlink (no atomic flipper?)")
-
-# Non-vacuous GREEN precondition: the symlink we exploit must genuinely target a
-# secret OUTSIDE the module, so marker-absence proves module-root confinement
-# refused it -- not that the attack was never mounted.
-tgt = os.readlink(sub / files_from)
-if os.path.realpath(tgt) != os.path.realpath(str(secret)):
-    test_fail(f"setup failed: backup symlink {files_from} -> {tgt}, not the out-of-module secret")
-
-leak()
-
-# ---- LOCAL COMMAND CONFINEMENT EDGE CASE -----------------------------------
-# A local operator invoking --confine-root should still be able to specify a
-# --files-from file that resides outside the confined boundary. The file is
-# opened locally by the operator, not as an operator-path via a daemon, so
-# it should not trip the path-walker ELOOP block.
-
-local_files_from = root / 'local_files_from.txt'
-local_file = src / 'sub' / 'files-from-local'
-local_file.write_text('local files-from content\n')
-local_files_from.write_text('sub/files-from-local\n')
-
-local_proc = subprocess.run(
-    rsync_argv('-a', f'--confine-root={base}', f'--files-from={local_files_from}',
-               f'{src}/', f'{dest}/'),
-    stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True,
-)
-
-copied = dest / 'sub' / 'files-from-local'
-if (local_proc.returncode != 0 or not copied.is_file()
-        or copied.read_text() != 'local files-from content\n'):
-    test_fail(
-        "Local --files-from transfer did not copy the listed file while the "
-        "list was outside --confine-root.\n"
-        f"Output: {local_proc.stdout}"
-    )
diff --git a/testsuite/files-from-path-clamp_test.py b/testsuite/files-from-path-clamp_test.py
deleted file mode 100644
index b94225bbb..000000000
--- a/testsuite/files-from-path-clamp_test.py
+++ /dev/null
@@ -1,65 +0,0 @@
-"""Pin how `--files-from` treats a leading slash and ".." components.
-
-The rsync(1) `--files-from` entry states the goal but not the mechanism: "any
-leading slashes are removed and no '..' references are allowed to go higher than
-the source dir."  "are removed" / "are not allowed" don't say what actually
-happens to such an entry.  Measured behaviour:
-
-  - a leading "/" is stripped and the entry is taken relative to the source dir;
-  - a ".." component is CLAMPED (trimmed) so the path cannot rise above the
-    source dir -- "../keep" resolves to "<source>/keep", NOT the parent's "keep".
-
-So an entry that tries to escape silently resolves back inside the source; it
-does not error out by virtue of the "..", and it never reaches a sibling of the
-source.  Pure local client behaviour: no daemon/root/tcp.  Cross-version:
-expected identical against --rsync-bin=old_versions/rsync_3.2.7.
-"""
-
-import subprocess
-
-from rsyncfns import SCRATCHDIR, rmtree, rsync_argv, test_fail
-
-base = SCRATCHDIR / 'files-from-clamp'
-rmtree(base)
-base.mkdir(parents=True)
-
-src = base / 'src'
-src.mkdir()
-(src / 'file').write_text('INSRC-FILE\n')
-(src / 'keep').write_text('INSRC-KEEP\n')          # what "../keep" must clamp to
-# A sibling of the source with the SAME basename: a real escape would grab this.
-(base / 'keep').write_text('OUTSIDE-KEEP-MUST-NOT-APPEAR\n')
-
-listf = base / 'list'
-# leading-slash entry, a normal entry, and an escaping "../keep".
-listf.write_text('/file\nkeep\n../keep\n')
-
-dst = base / 'dst'
-rmtree(dst)
-dst.mkdir()
-proc = subprocess.run(
-    rsync_argv('-a', f'--files-from={listf}', f'{src}/', f'{dst}/'),
-    stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
-
-# leading "/" stripped -> taken relative to the source.
-f = dst / 'file'
-if not f.is_file() or f.read_text() != 'INSRC-FILE\n':
-    test_fail("--files-from: leading-slash '/file' was not transferred relative "
-              "to the source dir")
-
-# "keep" and the clamped "../keep" both resolve to <source>/keep, never the
-# parent's keep -> the escape was prevented.
-k = dst / 'keep'
-if not k.is_file():
-    test_fail("--files-from: 'keep' did not transfer")
-if k.read_text() != 'INSRC-KEEP\n':
-    test_fail(f"--files-from: '../keep' escaped the source dir -- dst/keep is "
-              f"{k.read_text()!r}, expected the in-source 'INSRC-KEEP'")
-
-# No file should have landed outside dst (no sibling-of-dst named 'keep' created).
-if (base / 'keep').read_text() != 'OUTSIDE-KEEP-MUST-NOT-APPEAR\n':
-    test_fail("--files-from: the outside 'keep' was modified")
-
-print("files-from-path-clamp: leading '/' stripped (entry taken relative to the "
-      "source); '..' is clamped within the source dir so '../keep' resolves to "
-      "<source>/keep and cannot reach a sibling of the source")
diff --git a/testsuite/files-from_test.py b/testsuite/files-from_test.py
deleted file mode 100644
index faab43b9a..000000000
--- a/testsuite/files-from_test.py
+++ /dev/null
@@ -1,51 +0,0 @@
-#!/usr/bin/env python3
-# Python rewrite of testsuite/files-from.test.
-#
-# Verify that --files-from=LIST drives rsync correctly both for a plain
-# local sync and across the lsh.sh "remote shell" with each of the four
-# files-host / src-host / dest-host placement combinations.
-
-from rsyncfns import (
-    CHKDIR, FROMDIR, RSYNC, RSYNC_PEER, SCRATCHDIR, SRCDIR, TODIR,
-    checkit, hands_setup, rmtree, run_rsync, rsync_path_arg, rsh_cmd,
-)
-
-
-SSH = rsh_cmd()
-
-hands_setup()
-
-# Files-from list: skip the contents of subsubdir but include subsubdir2/
-# in full (the trailing slash on subsubdir2/ is what flips it).
-filelist = SCRATCHDIR / 'filelist'
-filelist.write_text(
-    "from/./\n"
-    "from/./dir/subdir\n"
-    "from/./dir/subdir/subsubdir\n"
-    "from/./dir/subdir/subsubdir2/\n"
-    "from/./dir/subdir/foobar.baz\n"
-)
-
-# chkdir is what we expect the transfer to produce: source minus
-# dir/text and minus everything under subsubdir/.
-run_rsync('-a', '--exclude=dir/text', '--exclude=subsubdir/**',
-          f'{FROMDIR}/', f'{CHKDIR}/')
-
-# Local case.
-checkit(['-av', f'--files-from={filelist}', str(SCRATCHDIR), f'{TODIR}/'],
-        CHKDIR, TODIR)
-
-# All four combinations of files-host / source-host / dest-host across the
-# lsh.sh "remote shell".  In each loop iteration exactly one of source or
-# dest is remote (matches the original test's branch logic).
-for filehost in ('', 'localhost:'):
-    for srchost in ('', 'localhost:'):
-        desthost = 'localhost:' if not srchost else ''
-
-        rmtree(TODIR)
-        checkit(
-            ['-avse', SSH, f'--rsync-path={rsync_path_arg()}',
-             f'--files-from={filehost}{filelist}',
-             f'{srchost}{SCRATCHDIR}', f'{desthost}{TODIR}/'],
-            CHKDIR, TODIR,
-        )
diff --git a/testsuite/filter-leak_test.py b/testsuite/filter-leak_test.py
deleted file mode 100644
index 9931937f5..000000000
--- a/testsuite/filter-leak_test.py
+++ /dev/null
@@ -1,183 +0,0 @@
-import os
-import subprocess
-import time
-from pathlib import Path
-
-from rsyncfns import (
-    SCRATCHDIR, race_budget, find_attacker_uid, rmtree, rsync_argv,
-    start_c_flipper, stop_flipper, test_fail, test_skipped, start_test_daemon,
-    write_daemon_conf,
-)
-
-# A daemon serving a writable, non-chrooted module creates --backup-dir backups
-# with its own (root) ownership.  A parent-swap race can leave a root-owned
-# backup symlink whose target escapes the module.  Because open_no_attacker_symlinks()
-# follows a symlink owned by uid 0 / the euid, a later --filter=:LIST that names
-# that backup symlink would read an out-of-module file's content as the filter list --
-# unless the filter open is module-root confined.  RED before that confinement,
-# GREEN after.
-
-PORT = 13333
-
-if os.geteuid() != 0:
-    test_skipped("requires root to plant a backup-dir symlink owned by a non-self uid")
-
-ATT_UID = find_attacker_uid()
-if ATT_UID is None:
-    test_skipped("no untrusted-uid user available for cross-uid plant")
-
-SECRET = "NO_ONE_SHOULD_README\n"
-NFILES = 80
-root = SCRATCHDIR / 'filter'
-root.mkdir()
-base = root / 'base'
-outside = base / 'outside'
-src = base / 'src'
-dest = base / 'dest'
-backup = base / 'backup'
-sub = backup / 'sub'
-sublink = backup / '.sublink'
-filter_arg = ""
-
-secret = root / 'secret'
-secret.write_text(SECRET)
-
-
-def build():
-    """Reset the workspace.  Call only while the flipper is stopped."""
-    rmtree(base)
-    for d in (src / 'sub', dest / 'sub', backup, outside):
-        d.mkdir(parents=True, exist_ok=True)
-
-    # Distinct source and destination symlink values so each transfer overwrites
-    # the destination symlink and thus triggers a backup of the old one.
-    for i in range(NFILES):
-        (src / 'sub' / f'f{i}').symlink_to('test')
-        (dest / 'sub' / f'f{i}').symlink_to(f'{secret}')
-        os.lchown(src / 'sub' / f'f{i}', ATT_UID, ATT_UID)
-        os.lchown(dest / 'sub' / f'f{i}', ATT_UID, ATT_UID)
-
-    # The attacker-owned parent-swap target: a symlink to the outside directory.
-    os.symlink(str(outside), sublink)
-    os.lchown(sublink, ATT_UID, ATT_UID)
-    sub.mkdir(parents=True, exist_ok=True)
-
-
-def push():
-    """Blocking rsync push that backs up the old destination symlinks."""
-    return subprocess.run(
-        rsync_argv('-a', '-b', '--backup-dir=/backup/',
-                   f'{src}/', f'rsync://127.0.0.1:{PORT}/m/dest/'),
-        stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL,
-    )
-
-
-def leak():
-    """Attempt to read a secret via filter through the root-owned symlink."""
-
-    proc = subprocess.run(
-        rsync_argv('-a', f'--filter=: {filter_arg}',
-                   f'rsync://127.0.0.1:{PORT}/m/backup/sub/', f'{dest}/'),
-        stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True,
-    )
-    if "NO_ONE_SHOULD" in proc.stdout:
-        test_fail(f"{secret.name} is leaked!\n\nOutput: {proc.stdout}")
-
-
-def normalize_sub():
-    """If the flipper stopped with `sub` as the attacker symlink while the real
-    backup directory sits at `.sublink`, put the real dir back at `sub` so the
-    daemon path backup/sub/<name> (and our scandir) see the real backups.
-
-    Best-effort only: the non-atomic (non-Linux) flipper swaps via a `sub.flip`
-    scratch name and can be killed mid-rename, leaving `sub` absent or the real
-    dir parked at `.flip`.  Any state we can't cleanly settle is left as-is and
-    treated by the caller as 'no win this round'."""
-    try:
-        if sub.is_symlink() and sublink.is_dir() and not sublink.is_symlink():
-            sub.unlink()
-            sublink.rename(sub)
-    except OSError:
-        pass
-
-
-def root_owned_backup_symlink():
-    """Return the name of a root-owned backup symlink directly in `sub`, or "".
-
-    Never raises: a swap killed mid-rename can leave `sub` absent or a symlink,
-    which just means no usable win this round -- the caller rebuilds and retries."""
-    normalize_sub()
-    try:
-        if sub.is_symlink() or not sub.is_dir():
-            return ""
-        with os.scandir(sub) as it:
-            for entry in it:
-                if entry.is_symlink() and entry.stat(follow_symlinks=False).st_uid == 0:
-                    return entry.name
-    except (FileNotFoundError, NotADirectoryError):
-        return ""
-    return ""
-
-
-# Positive control: a clean run (no flipper) must back the old destination
-# symlink into the backup tree, proving this transfer shape exercises the backup
-# symlink path.  A broken fixture or an rsync that errors early fails here loudly
-# instead of passing the race vacuously.
-conf = write_daemon_conf(
-    [('m', {'path': str(base), 'read only': 'no', 'use chroot': 'no'})],
-    name='filter-rsyncd.conf',
-)
-start_test_daemon(conf, PORT)
-
-build()
-proc = push()
-if proc.returncode != 0:
-    test_fail(f"positive control: clean --backup-dir run failed (rc={proc.returncode})")
-if not (sub / 'f0').is_symlink() or os.readlink(sub / 'f0') != f'{secret}':
-    test_fail(
-        "positive control: the old destination symlink was not backed up into "
-        f"{sub}; the backup symlink path was not exercised"
-    )
-
-
-# ---- THE LIVE RACE ---------------------------------------------------------
-# Repeatedly push under the parent-swap flipper until a root-owned backup symlink
-# lands in `sub`.  Reset the workspace only while the flipper is quiet so build()'s
-# rmtree/mkdir can't race the swapper.
-
-deadline = time.monotonic() + race_budget(10.0)
-flip = None
-try:
-    while time.monotonic() < deadline:
-        if flip is not None:
-            stop_flipper(flip)
-            flip = None
-
-        filter_arg = root_owned_backup_symlink()
-        if filter_arg:
-            break
-
-        build()
-        flip = start_c_flipper(sub, sublink)
-        push()
-finally:
-    if flip is not None:
-        stop_flipper(flip)
-
-if not filter_arg:
-    # The leak needs a root-owned backup symlink, which only appears when the
-    # parent-swap race makes make_backup() fall back to creating the symlink
-    # itself.  Winning that window reliably needs the atomic renameat2(EXCHANGE)
-    # flipper (Linux); on platforms that fall back to the non-atomic flipper the
-    # window may never be hit within the budget.  Can't mount the attack here, so
-    # there's nothing to assert -- skip rather than fail.
-    test_skipped("race did not produce a root-owned backup symlink (no atomic flipper?)")
-
-# Non-vacuous GREEN precondition: the symlink we exploit must genuinely target a
-# secret OUTSIDE the module, so marker-absence proves module-root confinement
-# refused it -- not that the attack was never mounted.
-tgt = os.readlink(sub / filter_arg)
-if os.path.realpath(tgt) != os.path.realpath(str(secret)):
-    test_fail(f"setup failed: backup symlink {filter_arg} -> {tgt}, not the out-of-module secret")
-
-leak()
diff --git a/testsuite/filter-merge-content-echo_test.py b/testsuite/filter-merge-content-echo_test.py
deleted file mode 100644
index 730622126..000000000
--- a/testsuite/filter-merge-content-echo_test.py
+++ /dev/null
@@ -1,294 +0,0 @@
-#!/usr/bin/env python3
-"""A merge file's contents must not come back in a filter syntax error.
-
-A per-directory merge rule names a file the peer chooses and that travels over
-the protocol, so no argument of ours ever mentions it.  Echoing an unparsable
-line back made the filter parser a read-any-line oracle: every line that is not
-valid filter syntax was returned verbatim to the client.  The diagnostic must
-say where the bad rule is, not what it says.
-
-Rules that came from an ARGUMENT are still echoed -- that text is the user's
-own and hiding it would only make ordinary typos harder to fix.
-"""
-
-import os
-import subprocess
-
-from rsyncfns import SCRATCHDIR, makepath, rmtree, rsync_argv
-
-SECRET = 'TOP-SECRET-PASSWORD-abc123'
-
-base = SCRATCHDIR / 'filter-merge-content-echo'
-rmtree(base)
-src = base / 'src'
-dest = base / 'dest'
-makepath(src, dest)
-(src / 'f').write_bytes(b'hi\n')
-
-# Not valid filter syntax, so the parser reports it -- this stands in for any
-# non-filter file on the server: a key, a password store, a config.
-secret = base / 'secret'
-secret.write_text(SECRET + '\n')
-
-# The reachable shape: a per-dir merge file whose own contents name the target.
-(src / '.rsync-filter').write_text(': ../secret\n')
-got = subprocess.run(rsync_argv('-r', '-F', f'{src}/', f'{dest}/'),
-                     capture_output=True, text=True, timeout=30)
-out = got.stdout + got.stderr
-assert got.returncode != 0, (
-    f'the unparsable merge rule was accepted, so this test no longer '
-    f'exercises the error path: rc={got.returncode}, out={out!r}')
-assert SECRET not in out, (
-    'the contents of a merged file were echoed back in the filter error, so a '
-    f'peer that can choose the merge path can read any line: out={out!r}')
-# The merged file's own PATH came from a rule too (the .rsync-filter names it),
-# so it cannot be printed either -- but the diagnostic still has to say enough
-# to be actionable.
-assert 'a file read earlier' in out, (
-    'the error says nothing at all about where the bad rule was, leaving no '
-    f'way to act on it: out={out!r}')
-
-# Same for a merge file reached by an explicit argument: the text is still file
-# content, and --filter='. FILE' is how an operator-supplied list is read.
-(base / 'rules').write_text(SECRET + '\n')
-got = subprocess.run(
-    rsync_argv('-r', f'--filter=. {base}/rules', f'{src}/', f'{dest}/'),
-    capture_output=True, text=True, timeout=30)
-out = got.stdout + got.stderr
-assert got.returncode != 0 and SECRET not in out, (
-    f'a --filter=. merge file echoed its contents: rc={got.returncode}, '
-    f'out={out!r}')
-# This one WAS named by an argument, so its own path is the user's own text and
-# is still shown -- the location must not be thrown away wholesale.
-assert 'rules line 1' in out, (
-    'a merge file named by an argument should still be located precisely: '
-    f'out={out!r}')
-
-# A file merged FROM a file cannot show its own path, but the place that named
-# it can be shown, and is what the user needs to fix.
-(base / 'outer-known').write_text(f'. {base}/inner-bad\n')
-(base / 'inner-bad').write_text(SECRET + '\n')
-got = subprocess.run(
-    rsync_argv('-r', f'--filter=. {base}/outer-known', f'{src}/', f'{dest}/'),
-    capture_output=True, text=True, timeout=30)
-out = got.stdout + got.stderr
-assert SECRET not in out and 'inner-bad' not in out, (
-    f'the indirectly named merge file leaked its own path: out={out!r}')
-assert 'a file named at' in out and 'outer-known line 1' in out, (
-    'the error does not point at the rule that named the bad file, which is '
-    f'the only thing the user can act on: out={out!r}')
-
-# ...but a rule given AS an argument must still be shown, or an ordinary typo
-# becomes undiagnosable.
-got = subprocess.run(
-    rsync_argv('-r', '--filter=Zbogus-rule-text', f'{src}/', f'{dest}/'),
-    capture_output=True, text=True, timeout=30)
-out = got.stdout + got.stderr
-assert got.returncode != 0 and 'Zbogus-rule-text' in out, (
-    'a bad rule given on the command line is no longer echoed, which is a '
-    f'usability regression rather than a leak: rc={got.returncode}, out={out!r}')
-
-# An ordinary, VALID merge file must still work -- the diagnostic change must
-# not have broken merge parsing itself.
-(src / '.rsync-filter').write_text('- *.tmp\n')
-(src / 'keep.txt').write_bytes(b'keep\n')
-(src / 'drop.tmp').write_bytes(b'drop\n')
-ok = subprocess.run(rsync_argv('-r', '-F', f'{src}/', f'{dest}/'),
-                    capture_output=True, text=True, timeout=30)
-assert ok.returncode == 0, f'a valid merge file failed: out={ok.stderr!r}'
-assert (dest / 'keep.txt').exists() and not (dest / 'drop.tmp').exists(), (
-    'the valid merge rule was not applied, so the parser is broken')
-
-# A merge rule INSIDE a merge file names its own file, so the failed-open
-# message echoed text that came out of the file being read.  A line of the
-# target that happens to parse as a merge rule leaks through it.
-(base / 'outer').write_text(f'. {base}/nested\n')
-(base / 'nested').write_text(f'. {SECRET}\n')
-got = subprocess.run(
-    rsync_argv('-r', f'--filter=. {base}/outer', f'{src}/', f'{dest}/'),
-    capture_output=True, text=True, timeout=30)
-out = got.stdout + got.stderr
-assert got.returncode != 0 and SECRET not in out, (
-    'a nested merge file named by file content was echoed in the failed-open '
-    f'message: rc={got.returncode}, out={out!r}')
-
-# The reported location must be the file the bad rule is actually IN.  fname
-# can point into parse_merge_name()'s static buffer, which a merge rule inside
-# the same file overwrites, so the error blamed the nested file instead.
-(base / 'child').write_text('- harmless\n')
-(base / 'parent').write_text(f'. {base}/child\nZbad-in-parent\n')
-got = subprocess.run(
-    rsync_argv('-r', f'--filter=. {base}/parent', f'{src}/', f'{dest}/'),
-    capture_output=True, text=True, timeout=30)
-out = got.stdout + got.stderr
-assert 'parent line 2' in out, (
-    'the error blames the wrong file or line for a rule that follows a nested '
-    f'merge, so the location it prints cannot be trusted: out={out!r}')
-
-# A CRLF pair is one line ending, not two.
-(base / 'crlf').write_bytes(b'- harmless\r\nZbad-on-line-2\r\n')
-got = subprocess.run(
-    rsync_argv('-r', f'--filter=. {base}/crlf', f'{src}/', f'{dest}/'),
-    capture_output=True, text=True, timeout=30)
-out = got.stdout + got.stderr
-assert 'crlf line 2' in out, f'CRLF miscounted the line: out={out!r}'
-
-# The FILTER2 traces print rule text as well, so a word-split merge -- whose
-# every word becomes its own no-prefix rule -- had its contents echoed by
-# add_rule() with nothing failing to parse at all.
-(src / '.rsync-filter').write_text(':w- ../secret\n')
-got = subprocess.run(
-    rsync_argv('-r', '-F', '--debug=FILTER2', f'{src}/', f'{dest}/'),
-    capture_output=True, text=True, timeout=30)
-out = got.stdout + got.stderr
-assert SECRET not in out, (
-    'the filter debug trace echoed the contents of a merged file, so the '
-    f'oracle survives with --debug=FILTER2: out={out!r}')
-
-# The MATCH traces name the pattern that acted, and a pattern read from a merge
-# file is that file's text.  This one is not really debug-gated: plain -vv
-# raises the filter level far enough for a sender or generator to print it, so
-# a stock client reaches it with no --debug at all.
-#
-# The pattern is written as a glob whose LITERAL text cannot appear anywhere
-# else -- the file it matches is named without the brackets -- so finding it in
-# the output can only mean the rule text was echoed.
-PATTERN_TEXT = 'sec[r]et-marker-9x'
-MATCHED_NAME = 'secret-marker-9x'
-rmtree(src)
-makepath(src)
-(src / 'f').write_bytes(b'keep\n')
-(src / MATCHED_NAME).write_bytes(b'hidden\n')
-(src / '.rsync-filter').write_text('- ' + PATTERN_TEXT + '\n')
-got = subprocess.run(rsync_argv('-r', '-F', '-vv', f'{src}/', f'{dest}/'),
-                     capture_output=True, text=True, timeout=30)
-out = got.stdout + got.stderr
-assert got.returncode == 0, f'the -vv transfer failed: out={out!r}'
-assert 'because of' in out, (
-    f'no match was reported, so this case exercises nothing: out={out!r}')
-assert PATTERN_TEXT not in out, (
-    'the match trace echoed a pattern that came from a merge file, which plain '
-    f'-vv is enough to reach: out={out!r}')
-assert not (dest / MATCHED_NAME).exists(), (
-    'the rule did not actually hide the file, so the trace above was not the '
-    'one this checks')
-
-# A deferred per-dir merge (":" rule) is parsed long after the file that named
-# it was read, so the parse-time context is gone by then and the redactions
-# have to come off the RULE instead.  Two leaks lived here: an over-long
-# deferred name needed no verbosity at all, and -vvv printed the name plus
-# whether it opened.
-rmtree(src)
-makepath(src / 'sub')
-(src / 'sub' / 'f').write_bytes(b'x\n')
-# The name has to survive parse_filter_str's own MAXPATHLEN check and only
-# overflow once the scanned directory is prepended, which is a narrow window
-# whose position depends on the scratch path and the platform's MAXPATHLEN --
-# so search for it rather than hard-coding a length.
-maxpath = os.pathconf(str(base), 'PC_PATH_MAX')
-overflowed = False
-for slack in range(4, 80, 4):
-    pad = maxpath - len(str(src)) - slack
-    if pad < 32:
-        continue
-    (src / '.rsync-filter').write_text(': sub/DEFERRED-SECRET-' + 'Q' * pad + '\n')
-    got = subprocess.run(rsync_argv('-r', '-F', f'{src}/', f'{dest}/'),
-                         capture_output=True, text=True, timeout=30)
-    out = got.stdout + got.stderr
-    assert 'DEFERRED-SECRET' not in out, (
-        'an over-long deferred merge name was echoed, with no verbosity '
-        f'needed: out={out!r}')
-    if 'merge-file name overflows' in out:
-        overflowed = True
-        break
-assert overflowed, (
-    'no length reached the deferred merge-name overflow, so that path was '
-    'never exercised -- widen the search')
-
-DEFERRED_NAME = 'named-from-f[i]le-x9'   # the brackets exist only in the file
-(src / '.rsync-filter').write_text(': ' + DEFERRED_NAME + '\n')
-got = subprocess.run(rsync_argv('-r', '-F', '-vvv', f'{src}/', f'{dest}/'),
-                     capture_output=True, text=True, timeout=30)
-out = got.stdout + got.stderr
-assert DEFERRED_NAME not in out, (
-    'the deferred per-dir merge name -- which came from a file -- was printed '
-    f'by the -vvv trace, along with whether it opened: out={out!r}')
-
-# Details ABOUT a file-derived rule leak too, so they go through the same
-# helper: the trailing-whitespace warning is computed from the rule's last
-# byte, and would otherwise tell a peer whether a hidden rule ended in a space.
-rmtree(src)
-makepath(src)
-(src / 'f').write_bytes(b'x\n')
-(src / '.rsync-filter').write_text('- trailing-ws-probe \n')
-got = subprocess.run(
-    rsync_argv('-r', '-F', '--debug=FILTER1', f'{src}/', f'{dest}/'),
-    capture_output=True, text=True, timeout=30)
-out = got.stdout + got.stderr
-assert 'trailing-ws-probe' not in out and 'CAUTION' not in out, (
-    'a property of a file-derived rule (its trailing whitespace) was reported, '
-    f'which tells the peer about text it cannot otherwise see: out={out!r}')
-
-# ...but for the user's OWN rule the warning is exactly what they need.
-got = subprocess.run(
-    rsync_argv('-r', '--debug=FILTER1', '--filter=- my-own-rule ',
-               f'{src}/', f'{dest}/'),
-    capture_output=True, text=True, timeout=30)
-out = got.stdout + got.stderr
-assert 'CAUTION' in out and 'my-own-rule' in out, (
-    'the trailing-whitespace warning was lost for an argument-supplied rule, '
-    f'which is a usability regression: out={out!r}')
-
-# An over-long ARGUMENT rule must still be reported at full length -- the
-# redaction helper must not quietly truncate the user's own text.
-long_arg = 'ARGLONG-' + 'Q' * (maxpath + 200)
-got = subprocess.run(rsync_argv('-r', f'--filter=- {long_arg}', f'{src}/', f'{dest}/'),
-                     capture_output=True, text=True, timeout=30)
-out = got.stdout + got.stderr
-assert 'discarding over-long filter' in out, f'expected the over-long path: out={out!r}'
-assert out.count('Q') > maxpath, (
-    'the over-long argument rule was truncated more aggressively than before, '
-    f'losing the user\'s own text: {out.count("Q")} Qs of {maxpath + 200}')
-
-# The ":e" modifier synthesizes a SECOND rule -- an exclude for the merge
-# file's own basename -- by hand, with no template to inherit from.  Built
-# that way it carried no provenance, so once parsing finished it looked
-# argument-origin and the match trace printed a merge file's text verbatim.
-# Plain -vv reaches this; no --debug is involved.
-#
-# The pattern is a glob whose literal text cannot appear anywhere else: the
-# file it matches is named without the brackets, so finding the bracketed
-# form in the output can only mean the rule text was echoed.
-SELF_PATTERN = 'excl-self-[x]9'
-SELF_MATCHED = 'excl-self-x9'
-rmtree(src)
-makepath(src)
-(src / 'f').write_bytes(b'keep\n')
-(src / SELF_MATCHED).write_bytes(b'hidden\n')
-(src / '.rsync-filter').write_text(':e ' + SELF_PATTERN + '\n')
-got = subprocess.run(rsync_argv('-r', '-F', '-vv', f'{src}/', f'{dest}/'),
-                     capture_output=True, text=True, timeout=30)
-out = got.stdout + got.stderr
-assert got.returncode == 0, f'the :e transfer failed: out={out!r}'
-assert 'because of' in out, (
-    f'no match was reported, so this case exercises nothing: out={out!r}')
-assert SELF_PATTERN not in out, (
-    'the exclude-self rule that ":e" builds by hand echoed a merge file\'s '
-    f'text at plain -vv, so it carries no provenance: out={out!r}')
-
-# A per-directory merge file's fname points INTO dirbuf, which is cut back to
-# the directory before the location is recorded.  Copying it after the cut
-# left the location naming the DIRECTORY, losing the filename -- no leak, but
-# it breaks the "redact what, keep where" bargain the rest of this relies on.
-rmtree(src)
-makepath(src)
-(src / 'f').write_bytes(b'x\n')
-(src / '.rsync-filter').write_text('Zbad-perdir\n')
-got = subprocess.run(rsync_argv('-r', '-F', f'{src}/', f'{dest}/'),
-                     capture_output=True, text=True, timeout=30)
-out = got.stdout + got.stderr
-assert got.returncode != 0 and 'Zbad-perdir' not in out, (
-    f'the per-dir rule text was echoed: rc={got.returncode}, out={out!r}')
-assert '.rsync-filter line 1' in out, (
-    'the location names the directory instead of the merge file, so it no '
-    f'longer says which file to fix: out={out!r}')
diff --git a/testsuite/filter-merge-recursion_test.py b/testsuite/filter-merge-recursion_test.py
deleted file mode 100644
index d904f5077..000000000
--- a/testsuite/filter-merge-recursion_test.py
+++ /dev/null
@@ -1,62 +0,0 @@
-#!/usr/bin/env python3
-# Regression test for unbounded merge-file include recursion in the filter
-# parser (exclude.c parse_filter_file <-> parse_filter_str).
-#
-# A '. file' (merge) directive inside a filter file makes parse_filter_str()
-# call parse_filter_file() on the named file, which feeds each of its lines
-# back through parse_filter_str(). Nothing bounded the nesting depth, so a
-# merge file whose only line re-includes itself recurses until the stack
-# guard page is hit -> SIGSEGV.
-#
-# Threat (code-scanner daemon-protocol fuzzing, June 2026): a malicious client of a
-# writable daemon module uploads a '.merge' file containing '. .merge' and
-# drives a transfer with --filter=': .merge'; the generator's per-dir merge
-# handling in push_local_filters() then re-parses that file forever and the
-# forked daemon child crashes. The recursion lives in shared filter code, so
-# we reproduce it with a plain local transfer: a per-dir merge rule
-# (': .merge') plus a source '.merge' that merges itself.
-#
-# Oracle:
-#   * pre-fix: the sender recurses to stack exhaustion and dies with SIGSEGV
-#              (the client sees the peer vanish / a signal exit).
-#   * fixed:   parse_filter_file() caps nesting at MAX_MERGE_DEPTH (32) and,
-#              on this operator/sender-supplied (XFLG_FATAL_ERRORS) merge,
-#              exits cleanly with RERR_FILEIO and a depth-limit diagnostic.
-
-import subprocess
-
-from rsyncfns import SCRATCHDIR, makepath, rmtree, rsync_argv, test_fail
-
-SRC = SCRATCHDIR / 'mergerec-src'
-DST = SCRATCHDIR / 'mergerec-dst'
-rmtree(SRC)
-rmtree(DST)
-makepath(SRC, DST)
-
-# A per-dir merge file that includes itself: '. .merge' re-merges .merge.
-(SRC / '.merge').write_text(". .merge\n")
-(SRC / 'file.txt').write_text("hello\n")
-
-proc = subprocess.run(
-    rsync_argv('-a', '--filter=: .merge', f'{SRC}/', f'{DST}/'),
-    stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True)
-
-# A process killed by a signal shows up as a negative returncode in Python, or
-# as 128+signal when a child died and the parent reported it. RERR_STREAMIO
-# (12) with no depth diagnostic means the peer crashed mid-stream.
-crashed = (proc.returncode < 0 or proc.returncode >= 128
-           or (proc.returncode == 12
-               and 'merge-file include depth limit' not in proc.stdout))
-if crashed:
-    test_fail(
-        "filter merge-file recursion was not capped: rsync died abnormally "
-        f"(rc={proc.returncode}) on a self-including '.merge'. "
-        f"output:\n{proc.stdout}")
-
-if 'merge-file include depth limit' not in proc.stdout:
-    test_fail(
-        "expected the MAX_MERGE_DEPTH diagnostic; the self-including merge "
-        f"file did not hit the cap (rc={proc.returncode}).\n{proc.stdout}")
-
-print("filter-merge-recursion: self-including merge file is capped at "
-      "MAX_MERGE_DEPTH (clean RERR_FILEIO, no stack-exhaustion crash).")
diff --git a/testsuite/filter-merge-symlink_test.py b/testsuite/filter-merge-symlink_test.py
deleted file mode 100644
index 4f3dc145c..000000000
--- a/testsuite/filter-merge-symlink_test.py
+++ /dev/null
@@ -1,100 +0,0 @@
-#!/usr/bin/env python3
-# Per-directory filter merge files (.cvsignore under -C, dir-merge rules)
-# must not follow a planted symlink at an attacker-controlled path.
-#
-# Threat (the "root runs `rsync -a /home /backup`" disclosure class):
-# during a recursive scan the sender opens a per-directory filter file from
-# EACH source directory (exclude.c:1464 fopen via parse_filter_file, called
-# from push_local_filters at exclude.c:811-814). The path is composed as
-# "<scanned source dir>/<merge pattern>", so an unprivileged user who
-# controls a source directory can plant `.cvsignore` (or whatever the
-# dir-merge filename is) as a symlink to ANY file the privileged rsync can
-# read. rsync then parses that file's bytes as filter rules -- with two
-# observable effects:
-#
-#   (a) Content shaping. Lines of the planted-target file become filter
-#       patterns, which affect what does or doesn't transfer; the operator
-#       cannot easily detect this. (Demonstrated below.)
-#   (b) Direct disclosure under --debug=FILTER. The parsed rules are
-#       printed verbatim. (Not exercised here; demonstrated by manual
-#       inspection.)
-#
-# The fix refuses symlinks anywhere in the path unless owned by uid 0 or
-# our effective uid (the trusted set).  Cross-uid setup is the
-# realistic threat shape (privileged user runs rsync over an unprivileged
-# user's tree): the runner is in the trusted set, the planted symlink is
-# not, so the fix refuses it; parse_filter_file silently skips the file
-# (XFLG_ANCHORED2ABS, not XFLG_FATAL_ERRORS), no exclude is added, and
-# the canary transfers normally.
-#
-# Requires root to plant a symlink owned by a non-self uid (the attacker
-# simulation); skips otherwise -- without cross-uid the runner trusts
-# their own symlinks and the fix has nothing to refuse.
-
-import os
-import pwd
-import subprocess
-
-from rsyncfns import SCRATCHDIR, rmtree, rsync_argv, test_fail, test_skipped
-
-
-if os.geteuid() != 0:
-    test_skipped("requires root to plant a symlink owned by a non-self uid "
-                 "(simulates the 'root runs `rsync -a /home /backup`' case)")
-
-NOBODY_UID = None
-for name in ('nobody', 'nfsnobody', 'daemon'):
-    try:
-        u = pwd.getpwnam(name).pw_uid
-        if u != 0 and u != os.geteuid():
-            NOBODY_UID = u
-            break
-    except KeyError:
-        continue
-if NOBODY_UID is None:
-    test_skipped("no untrusted-uid user available for cross-uid plant")
-
-
-base = SCRATCHDIR / 'filtermerge'
-src = base / 'src'
-dest = base / 'dest'
-outside = base / 'outside'
-
-rmtree(base)
-(src / 'sub').mkdir(parents=True)
-# A canary the test will look for in the destination. It will be excluded by
-# rsync IFF a planted .cvsignore symlink is followed and its content (the
-# pattern below) is applied as a filter rule.
-(src / 'sub' / 'canary_file').write_text("would-be-transferred\n")
-
-# The attacker-readable "secret" outside the source tree. Its contents are a
-# single CVS-style pattern that exactly matches the canary's basename.
-outside.mkdir(parents=True)
-(outside / 'attacker_target').write_text("canary_file\n")
-
-# Plant: src/sub/.cvsignore is a symlink to the outside file, OWNED BY THE
-# ATTACKER (NOBODY_UID). With -C, rsync normally reads .cvsignore as filter
-# rules per directory; a privileged rsync over an unprivileged-user-controlled
-# source thus reads the symlink's target unless defended.
-plant = src / 'sub' / '.cvsignore'
-os.symlink('../../outside/attacker_target', plant)
-os.lchown(plant, NOBODY_UID, NOBODY_UID)
-
-dest.mkdir(parents=True)
-
-# -aC -- preserve everything + cvs-exclude (reads .cvsignore per dir).
-# The transfer itself succeeds either way; the question is whether the planted
-# .cvsignore was followed and its content applied as filter rules.
-subprocess.run(
-    rsync_argv('-aC', f'{src}/', f'{dest}/'),
-    stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
-
-if not (dest / 'sub' / 'canary_file').exists():
-    test_fail(
-        f"per-dir merge file .cvsignore (planted as a symlink owned by uid "
-        f"{NOBODY_UID}) was followed: rsync read the symlink's target outside "
-        f"the source tree and applied its content as a filter rule, dropping "
-        f"src/sub/canary_file from the transfer. The operator-controlled "
-        f"path was bypassed via an unprivileged-user-planted symlink. Fix: "
-        f"refuse symlinks owned by untrusted uids at the per-dir merge open."
-    )
diff --git a/testsuite/fleettest.json.example b/testsuite/fleettest.json.example
deleted file mode 100644
index d8b3b299b..000000000
--- a/testsuite/fleettest.json.example
+++ /dev/null
@@ -1,285 +0,0 @@
-{
-  "_comment": [
-    "Example fleet definition for testsuite/fleettest.py -- this is one",
-    "maintainer's setup. Copy (or symlink) this file to testsuite/fleettest.json",
-    "and edit it for your own machines, or point at another file with --fleet PATH.",
-    "fleettest.json is git-ignored; this .example is the committed template.",
-    "",
-    "Each object under \"targets\" maps to fields of the Target dataclass in",
-    "fleettest.py. Required: name, ssh_host (null = run locally), workflow",
-    "(a file under .github/workflows, whose configure flags and RSYNC_EXPECT_SKIPPED",
-    "this target mirrors), configure_flags. Optional (with defaults): make (\"make\"),",
-    "python (\"python3\"), rsync_bin (\"rsync\"; \"rsync.exe\" on Cygwin), privilege",
-    "(\"root\" | \"sudo\" | \"user\"), pipe_jobs/tcp_jobs (8), builddir (\"rsync-citest\",",
-    "relative to the remote $HOME), env_prefix, configure_pre, nonroot, protocols,",
-    "max_retry.",
-    "",
-    "nonroot: true reruns -- as the non-root ssh user, after the sudo runs -- the",
-    "tests that declare `fleet_nonroot = True` at module level (so the set is",
-    "maintained in the test files, not here).",
-    "",
-    "protocols: [30, 29] adds one extra stdio-pipe test pass per listed version,",
-    "each run with runtests --protocol=N (the fleet analogue of a workflow's",
-    "check30/check29 steps) and shown as a protoNN column.",
-    "",
-    "max_retry: N (default 0) re-runs each failed test on its own up to N more",
-    "times and drops any that then pass (listed under RECOVERED, not hidden). Use",
-    "on a slow/loaded box where concurrency-sensitive tests occasionally flake,",
-    "instead of dropping the whole target to a lower pipe_jobs/tcp_jobs.",
-    "",
-    "Keys starting with \"_\" are comments. See testsuite/README.md."
-  ],
-  "targets": [
-    {
-      "name": "freebsd",
-      "ssh_host": "root@freebsd",
-      "workflow": "freebsd-build.yml",
-      "make": "gmake",
-      "configure_flags": [
-        "--with-rrsync",
-        "--disable-zstd",
-        "--disable-md2man",
-        "--disable-xxhash",
-        "--disable-lz4",
-        "--disable-idn"
-      ]
-    },
-    {
-      "name": "solaris",
-      "ssh_host": "root@solaris",
-      "workflow": "solaris-build.yml",
-      "make": "gmake",
-      "configure_flags": [
-        "--with-rrsync",
-        "--disable-zstd",
-        "--disable-md2man",
-        "--disable-xxhash",
-        "--disable-lz4",
-        "--disable-idn"
-      ]
-    },
-    {
-      "_comment": "Nested-VM OpenBSD. max_retry re-runs a flaky test on its own. The daemon+flipper symlink-race tests are excluded here: this box's kernel has a connect()-under-rename-load lost-wakeup (and an FFS rename-storm corruption) that hangs them for non-rsync reasons (see dev-notes/openbsd-connect-lost-wakeup-report.txt); the protections they check are verified on the Linux/BSD boxes.",
-      "name": "openbsd",
-      "ssh_host": "root@openbsd",
-      "workflow": "openbsd-build.yml",
-      "make": "gmake",
-      "configure_pre": "export AUTOCONF_VERSION=2.71 AUTOMAKE_VERSION=1.16;",
-      "max_retry": 2,
-      "exclude": [
-        "acl-symlink-race",
-        "sender-readlink-atfd",
-        "sender-remove-source-secure"
-      ],
-      "configure_flags": [
-        "--with-rrsync",
-        "--disable-zstd",
-        "--disable-md2man",
-        "--disable-xxhash",
-        "--disable-lz4",
-        "--disable-idn"
-      ]
-    },
-    {
-      "name": "netbsd",
-      "ssh_host": "root@netbsd",
-      "workflow": "netbsd-build.yml",
-      "make": "gmake",
-      "configure_flags": [
-        "--with-rrsync",
-        "--disable-zstd",
-        "--disable-md2man",
-        "--disable-xxhash",
-        "--disable-lz4",
-        "--disable-idn"
-      ]
-    },
-    {
-      "_comment": "Ubuntu 18.04 older-LTS backport coverage on a root@ box; no 18.04 runner image exists so it mirrors the 22.04 workflow.",
-      "name": "ubuntu-1804",
-      "ssh_host": "root@ubuntu-1804",
-      "workflow": "ubuntu-22.04-build.yml",
-      "_python_comment": "18.04's default python3 is 3.6, but runtests.py uses subprocess capture_output (3.7+); run the suite under the 3.10 that's also installed.",
-      "python": "python3.10",
-      "_configure_flags_comment": "18.04's libzstd 1.3.3 lacks ZSTD_minCLevel (configure aborts), so disable zstd; also disable lz4 so the default -z compressor is zlib -- with lz4 as the default, compress-options' --compress-level=9 check fails since lz4 has no levels. xxhash is fine.",
-      "configure_flags": [
-        "--with-rrsync",
-        "--disable-zstd",
-        "--disable-lz4"
-      ],
-      "_expect_skip_extra_comment": "protected-regular's fs.protected_regular path is not exercised on this box.",
-      "expect_skip_extra": [
-        "protected-regular"
-      ]
-    },
-    {
-      "_comment": "Ubuntu 20.04 older-LTS backport coverage on a root@ box; no 20.04 runner image exists so it mirrors the 22.04 workflow.",
-      "name": "ubuntu-2004",
-      "ssh_host": "root@ubuntu-2004",
-      "workflow": "ubuntu-22.04-build.yml",
-      "configure_flags": [
-        "--with-rrsync"
-      ]
-    },
-    {
-      "_comment": "Builds unprivileged (like a CI runner) and runs the suite via sudo; the nonroot pass reruns the privilege-sensitive tests as the ssh user. protocols: [30, 29] runs the check30/check29 passes on this NO-xattrat kernel: the CI's proto-29 step runs here, but the only other proto-29 fleet box (ubuntu-2604) is xattrat, so without this the (no-xattrat x proto-29) cell is uncovered.",
-      "name": "ubuntu-2204",
-      "ssh_host": "runner@ubuntu-2204",
-      "workflow": "ubuntu-22.04-build.yml",
-      "privilege": "sudo",
-      "nonroot": true,
-      "protocols": [
-        30,
-        29
-      ],
-      "configure_flags": [
-        "--with-rrsync"
-      ]
-    },
-    {
-      "_comment": "Noble (24.04), kernel 6.8 -- a NO-xattrat kernel like ubuntu-2204 but with modern userspace; mirrors ubuntu-build.yml.",
-      "name": "ubuntu-2404",
-      "ssh_host": "runner@ubuntu-2404",
-      "workflow": "ubuntu-build.yml",
-      "privilege": "sudo",
-      "nonroot": true,
-      "protocols": [
-        30,
-        29
-      ],
-      "configure_flags": [
-        "--with-rrsync"
-      ]
-    },
-    {
-      "_comment": "Modern Ubuntu (mirrors ubuntu-build.yml). protocols: [30, 29] also runs the workflow's check30/check29 passes as extra stdio-pipe runs.",
-      "name": "ubuntu-2604",
-      "ssh_host": "runner@ubuntu-2604",
-      "workflow": "ubuntu-build.yml",
-      "privilege": "sudo",
-      "nonroot": true,
-      "protocols": [
-        30,
-        29
-      ],
-      "configure_flags": [
-        "--with-rrsync"
-      ]
-    },
-    {
-      "_comment": "AlmaLinux 8 (RHEL 8 rebuild): the oldest active LTS in the Fedora/RHEL family, for backport coverage. glibc 2.28 / gcc 8.5. The CI job runs in an almalinux:8 container; this is the VM equivalent. python3 must be the python39 module (alternatives --set python3 /usr/bin/python3.9) -- the stock 3.6 is too old for runtests.py.",
-      "name": "almalinux-8",
-      "ssh_host": "root@almalinux-8",
-      "workflow": "almalinux-8-build.yml",
-      "configure_flags": [
-        "--with-rrsync"
-      ],
-      "_expect_skip_extra_comment": "Box-specific, not workflow-specific: this VM has no separate filesystem for a cross-device temp dir. fs.protected_regular is enabled in /etc/sysctl.d/90-rsync-fleettest.conf so protected-regular runs here rather than skipping.",
-      "expect_skip_extra": [
-        "chmod-temp-dir"
-      ]
-    },
-    {
-      "_comment": "macOS: brew is not on the non-interactive ssh PATH, so put it on PATH for the whole build and pass brew include/lib dirs to configure.",
-      "name": "mac2",
-      "ssh_host": "runner@mac2",
-      "workflow": "macos-build.yml",
-      "privilege": "sudo",
-      "env_prefix": "export PATH=/opt/homebrew/bin:/usr/local/bin:$PATH",
-      "configure_pre": "CPPFLAGS=\"-I$(brew --prefix)/include -I$(brew --prefix openssl)/include\"; LDFLAGS=\"-L$(brew --prefix)/lib -L$(brew --prefix openssl)/lib\"; export CPPFLAGS LDFLAGS;",
-      "configure_flags": [
-        "--with-rrsync"
-      ],
-      "_xfail_comment": "crtimes uses APFS birthtime via setattrlist; older backport binaries (3.4.x/3.2.7) drive it differently than current rsync, so the 3.5.0 testsuite's crtimes check fails here. Tolerated -- it passes for a current binary, where this entry is a no-op.",
-      "xfail": [
-        "crtimes"
-      ]
-    },
-    {
-      "_comment": "Same host and build as mac2, but the tests' scratch trees live on an HFS+ volume instead of APFS -- runtests.py honours $scratchbase, so only the data under test moves.  The setup VERIFIES the mount rather than assuming it: a stale directory or a name collision mounting at 'RsyncHFS 1' would otherwise leave the tests on APFS reporting green, which is exactly how the first version of this target lied.  Ownership must be on too: a user-attached image mounts 'noowners', under which every uid/gid and permission check is meaningless -- that alone caused 28 of the 31 failures the first honest run produced.",
-      "name": "mac2-hfs",
-      "ssh_host": "runner@mac2",
-      "workflow": "macos-build.yml",
-      "privilege": "sudo",
-      "env_prefix": "export PATH=/opt/homebrew/bin:/usr/local/bin:$PATH; if ! mount | grep -q 'on /Volumes/RsyncHFS (hfs'; then [ -f ~/hfsplus.dmg ] || hdiutil create -size 3g -fs 'HFS+' -volname RsyncHFS -quiet ~/hfsplus.dmg; hdiutil attach -quiet ~/hfsplus.dmg; fi; mount | grep -q 'on /Volumes/RsyncHFS (hfs' || { echo 'FATAL: /Volumes/RsyncHFS is not a mounted HFS+ volume' >&2; exit 9; }; sudo -n diskutil enableOwnership /Volumes/RsyncHFS >/dev/null || { echo 'FATAL: could not enable ownership on /Volumes/RsyncHFS' >&2; exit 9; }; mount | grep 'on /Volumes/RsyncHFS (hfs' | grep -q noowners && { echo 'FATAL: /Volumes/RsyncHFS still mounted noowners' >&2; exit 9; } || true",
-      "configure_pre": "CPPFLAGS=\"-I$(brew --prefix)/include -I$(brew --prefix openssl)/include\"; LDFLAGS=\"-L$(brew --prefix)/lib -L$(brew --prefix openssl)/lib\"; export CPPFLAGS LDFLAGS;",
-      "configure_flags": [
-        "--with-rrsync"
-      ],
-      "_xfail_comment": "Same APFS birthtime caveat as mac2.",
-      "xfail": [
-        "crtimes"
-      ],
-      "scratchbase": "/Volumes/RsyncHFS",
-      "expect_skip_omit": [
-        "backup-crossdev-copy",
-        "chmod-temp-dir"
-      ],
-      "_skip_comment": "The two omitted entries are macOS-wide expected-skips that this target RUNS: the separate volume supplies the cross-device conditions mac2 lacks. (itemize used to XFAIL here, before --link-dest learned to fall back when the filesystem cannot hard-link a symlink.)"
-    },
-    {
-      "_comment": "The x86-64 Mac (macOS 10.13).  The ONLY target that can build the x86-64 md5 assembly -- mac2 is arm64, where configure refuses --enable-md5-asm outright.  MacPorts supplies autotools, python3 and the crypto/hash libs the stock 10.13 image lacks, and is not on the non-interactive ssh PATH, so put it there for the whole run.  This target keeps the STOCK Apple compiler (clang 10, the 10.13 ceiling), which is what caught #161; it cannot build --enable-roll-simd, because a clang that old rejects configure's target(\"default\") multiversioning probe. That is a compiler-VERSION limit, not a Mach-O one -- see mac-x86-asm below, which builds the same source with MacPorts clang 19 and all three optimizations on.",
-      "name": "mac-x86",
-      "ssh_host": "tridge@mac",
-      "workflow": "macos-build.yml",
-      "privilege": "sudo",
-      "configure_flags": [
-        "--with-rrsync",
-        "--enable-md5-asm",
-        "--disable-md2man"
-      ],
-      "_xfail_comment": "Same APFS birthtime caveat as mac2.",
-      "xfail": [
-        "crtimes"
-      ],
-      "env_prefix": "export PATH=/opt/local/bin:/opt/local/sbin:$PATH",
-      "configure_pre": "CPPFLAGS=\"-I/opt/local/include\"; LDFLAGS=\"-L/opt/local/lib\"; export CPPFLAGS LDFLAGS;",
-      "expect_skip_extra": [
-        "symlink-mknod-fakesuper-symlink-race"
-      ],
-      "expect_skip_omit": [
-        "sender-remove-source-root-anchor"
-      ]
-    },
-    {
-      "_comment": "Same host and OS as mac-x86, built with the SIMD/asm optimizations ON. The only target that exercises --enable-roll-asm/--enable-md5-asm on Mach-O -- the combination Roland Kletzing reported in #160, where an AVX2 over-read (#178) survived two months precisely because nothing built with these flags. Needs MacPorts clang 19 via CC/CXX: Apple clang 10 cannot compile the function-multiversioning probe. Runs after mac-x86, since the harness never runs two targets on one machine at once.",
-      "name": "mac-x86-asm",
-      "ssh_host": "tridge@mac",
-      "workflow": "macos-build.yml",
-      "privilege": "sudo",
-      "configure_flags": [
-        "--with-rrsync",
-        "--enable-roll-simd",
-        "--enable-roll-asm",
-        "--enable-md5-asm",
-        "--disable-md2man"
-      ],
-      "_xfail_comment": "Same APFS birthtime caveat as mac2.",
-      "xfail": [
-        "crtimes"
-      ],
-      "env_prefix": "export PATH=/opt/local/bin:/opt/local/sbin:$PATH",
-      "configure_pre": "CC=clang-mp-19; CXX=clang++-mp-19; CPPFLAGS=\"-I/opt/local/include\"; LDFLAGS=\"-L/opt/local/lib\"; export CC CXX CPPFLAGS LDFLAGS;",
-      "expect_skip_extra": [
-        "symlink-mknod-fakesuper-symlink-race"
-      ],
-      "_expect_skip_omit_comment": "simd-checksum is a macOS-wide expected skip because simdtest is only built when SIMD is enabled -- which is the whole point of this target, so it RUNS here.",
-      "expect_skip_omit": [
-        "sender-remove-source-root-anchor",
-        "simd-checksum"
-      ]
-    },
-    {
-      "_comment": "Cygwin: non-root plain user (no sudo), binary is rsync.exe. The workflow installs only the python39 package, so pin python3.9 here too: the box's default python3 (3.12) has a working AF_UNIX socketpair, which makes daemon-stdin-local-socket run where cygwin.txt expects it to skip. Keep python39 current: the xattr tests need the os.getxattr that newer Cygwin builds (3.9.25+) expose.",
-      "name": "cygwin",
-      "ssh_host": "win11",
-      "workflow": "cygwin-build.yml",
-      "rsync_bin": "rsync.exe",
-      "python": "python3.9",
-      "privilege": "user",
-      "configure_flags": [
-        "--with-rrsync"
-      ]
-    }
-  ]
-}
diff --git a/testsuite/fleettest.py b/testsuite/fleettest.py
deleted file mode 100755
index 154514c89..000000000
--- a/testsuite/fleettest.py
+++ /dev/null
@@ -1,1403 +0,0 @@
-#!/usr/bin/env python3
-"""Fleet CI harness for rsync.
-
-Builds the committed HEAD of an rsync checkout on a fleet of remote machines
-(over ssh), runs the test suite under both transports (default stdio-pipe and
---use-tcp) in parallel, and prints one report of only the UNEXPECTED results --
-a fast local pre-flight for the GitHub CI matrix.
-
-Each target maps 1:1 to a .github/workflows/*.yml job: the per-target configure
-flags mirror that workflow, and the pipe-run RSYNC_EXPECT_SKIPPED list is PARSED
-from the workflow (not hardcoded). The --use-tcp run never sets an expected-skip
-list (matching the workflows), so only test FAILs matter there.
-
-The tcp pass runs only the tests that can reach the daemon transport, because it
-follows a full pipe pass over the very same build: --use-tcp is observable only
-through rsyncfns' start_test_daemon(), so a test that never calls it produces
-the same result twice. Pass --full-tcp to run the whole suite there anyway.
-
-A target may also list older "protocols" (e.g. [30, 29]) in the fleet config:
-each runs as an extra stdio-pipe pass with runtests --protocol=N (the fleet
-analogue of a workflow's check30/check29 steps), using that step's own parsed
-skip list, and shows up as a protoNN column in the report.
-
-The fleet -- which machines, how to reach and build each -- is read from a JSON
-config: ~/.fleettest.json if present, else fleettest.json next to this script,
-or --fleet PATH. Copy the bundled fleettest.json.example to either location (or
-symlink it) and edit for your own hosts; see testsuite/README.md and the
-comments in fleettest.json.example.
-
-Source = `git archive HEAD` of the rsync tree (the current directory, or --repo
-PATH) -- source-only, no .o/binaries are ever pushed.
-
-Every run uses its own randomly-named build directory on each target
-(<builddir>-<run_id>-<target>), so two or three fleettest runs can share the same
-fleet without interfering: each pushes, builds and tests in isolation. The run dir
-is removed when the run ends -- on success or failure, and best-effort on
-Ctrl-C/kill (pass --keep to retain it for inspection).
-
---keep-on-fail is the cheaper half of --keep: only the targets that came back
-with something unexpected keep their run dir, and their full build/test output
-is also written locally under fleettest-logs/<run_id>/<target>/. A fleet run
-costs a full build on every machine, so re-running just to see why one test
-failed is expensive -- and a race test may not fail the same way twice.
-
-A run that is hard-killed
-(SIGKILL), or signalled mid-push, or whose ssh dies during cleanup can leave a
-stray <builddir>-<id>-<target> behind -- plus an orphaned path-flipper or test
-rsyncd on platforms without a parent-death backstop; sweep all of those
-(root-owned files included, via sudo -n) with `fleettest.py --cleanup` (optionally
-scoped with --targets). Run --cleanup between runs, not during one: its process
-kills are host-global and would also catch a concurrent run's flipper/daemon.
-Because each run starts from a fresh dir, every build is a full configure + build.
-
-Targets run concurrently, EXCEPT that targets naming the same machine run one
-after another. More than one target may point at a single host -- a variant that
-tests the same build on a different filesystem does -- and those cannot overlap:
-they would fight over the fixed ports the daemon tests claim, and over any other
-host-global state.
-
-PROVISIONING: each target must have the build toolchain its workflow's prepare
-step installs -- the target regenerates its own configure/proto.h/man pages, so
-it needs autoconf+automake, perl, a python3 markdown lib (cmarkgfm or commonmark)
-unless its flags pass --disable-md2man, and the dev libraries for whatever its
-configure flags enable (e.g. --with-rrsync needs openssl/xxhash/zstd/lz4 headers).
-A missing piece shows up as BUILD-FAIL with configure's own "you need X" hint.
-
-Per-target "privilege" (set in the JSON) controls how the suite runs: "root"
-(already root -- run directly), "sudo" (build unprivileged, run the suite via
-sudo to match a CI runner), or "user" (run directly as a plain non-root user). A
-target with "nonroot": true additionally reruns -- as the (non-root) ssh user,
-after the sudo runs -- every test that declares `fleet_nonroot = True` at module
-level, so privilege-sensitive tests opt in from the test file itself with no
-fleet-config edit when new ones are added.
-
-Usage (run from inside an rsync checkout, or pass --repo):
-    python3 testsuite/fleettest.py                 # whole fleet, both transports
-    python3 testsuite/fleettest.py --targets cygwin,freebsd
-    python3 testsuite/fleettest.py --transport pipe
-    python3 testsuite/fleettest.py --keep          # keep run dirs for inspection
-    python3 testsuite/fleettest.py --keep-on-fail  # ...but only where it broke
-    python3 testsuite/fleettest.py --timing        # per-target AND per-test times
-    python3 testsuite/fleettest.py --cleanup       # sweep stray run dirs, exit
-    python3 testsuite/fleettest.py --fleet my-fleet.json --list
-
-Exit 0 iff every selected (target x transport) cell is OK.
-"""
-
-from __future__ import annotations
-
-import argparse
-import atexit
-import concurrent.futures
-import dataclasses
-import fnmatch
-import json
-import os
-import shlex
-import re
-import secrets
-import signal
-import subprocess
-import sys
-import tempfile
-import threading
-import time
-from pathlib import Path
-
-# Set from --skip / --xfail in main(). SKIP_CSV is passed to runtests as
-# RSYNC_EXCLUDE (tests dropped before running); XFAIL_GLOBS are tolerated
-# failures (a matching FAIL does not make a cell "not OK"). Both are
-# comma-separated test-name globs (fnmatch), applied across every target.
-SKIP_CSV = ""
-# Names from a backport tree's testsuite/skiplist/backport.txt (see main()).
-BACKPORT_EXCLUDE: list[str] = []
-XFAIL_GLOBS: list[str] = []
-
-# Set from --timing in main(). Also asks each target's runtests.py for its own
-# per-test wall-clock table, so a slow cell can be attributed to actual tests.
-TIMING = False
-
-# Set from --full-tcp in main(): run the WHOLE suite in the tcp pass rather than
-# only the tests that can observe the transport. The narrow pass is the default
-# because the tcp run follows a full pipe run over the very same build.
-FULL_TCP = False
-
-# The transports this run will execute (from --transport), needed in test_script
-# to tell "tcp after a pipe pass" from "tcp is the only pass".
-TRANSPORTS: list[str] = []
-
-# Set from --repo in main() (default: cwd). The harness builds whatever rsync
-# source tree these point at, so it must be run from inside an rsync checkout
-# or given --repo PATH.
-REPO = Path.cwd()
-# Source tree providing the test suite (runtests.py + testsuite/). Defaults to
-# REPO; --testsuite-repo decouples it so one tree is built and another's suite is
-# run against the result.
-TESTSUITE_REPO = REPO
-WORKFLOWS = TESTSUITE_REPO / ".github" / "workflows"
-
-# Fleet config (overridable with --fleet): ~/.fleettest.json is tried first, then
-# fleettest.json next to this script. The example template sits next to the
-# script too.
-HOME_CONFIG = Path.home() / ".fleettest.json"
-SCRIPT_CONFIG = Path(__file__).resolve().parent / "fleettest.json"
-DEFAULT_CONFIGS = [HOME_CONFIG, SCRIPT_CONFIG]
-EXAMPLE_CONFIG = SCRIPT_CONFIG.with_name(SCRIPT_CONFIG.name + ".example")
-
-# The pushed tree is source-only (git archive). Each target regenerates its own
-# build files, so --delete must NOT prune them: we exclude everything `make`
-# produces (autotools output, proto.h, man pages, config.h/Makefile, *.o, the
-# binaries) plus test artifacts a prior sudo run left root-owned (testtmp,
-# __pycache__, *.pyc -- which a non-root --delete can't unlink). Excluded paths
-# are protected from --delete, so each target keeps its native build state for
-# incremental rebuilds. `configure` itself is committed, so it is NOT excluded.
-PUSH_EXCLUDES = [
-    ".git", "config.h", "config.status", "config.log", "Makefile", "shconfig",
-    "configure.sh", "config.h.in", "aclocal.m4", "proto.h", "git-version.h",
-    "/rsync.1", "/rsync-ssl.1", "/rsyncd.conf.5", "/rrsync.1",
-    "*.o", "*.exe", "__pycache__", "*.pyc", "/testtmp",
-    "/rsync", "/tls", "/getgroups", "/getfsdev", "/trimslash", "/wildtest",
-    "/testrun", "/simdtest", "/t_unsafe", "/t_chmod_secure", "/t_rename_secure",
-    "/t_symlink_secure", "/t_secure_relpath",
-]
-
-
-@dataclasses.dataclass
-class Target:
-    name: str
-    ssh_host: str | None          # null in JSON => run locally
-    workflow: str                 # filename under .github/workflows
-    configure_flags: list[str]
-    make: str = "make"            # e.g. "gmake" on the BSDs/Solaris
-    env_prefix: str = ""          # exported before configure AND make (e.g. PATH)
-    scratchbase: str = ""         # run the tests' scratch trees here (e.g. another filesystem)
-    configure_pre: str = ""       # shell run before ./configure (env exports, brew)
-    python: str = "python3"
-    rsync_bin: str = "rsync"      # "rsync.exe" on Cygwin
-    privilege: str = "root"       # "root" (already root) | "sudo" | "user" (plain, no sudo)
-    pipe_jobs: int = 8
-    tcp_jobs: int = 8
-    # Base build-dir name (relative to remote $HOME; absolute for local). A
-    # per-run random suffix is appended (-> <builddir>-<run_id>) so concurrent
-    # fleettest runs don't share a tree; --cleanup sweeps leftover <builddir>-*.
-    builddir: str = "rsync-citest"
-    # When true, after the sudo runs, additionally run -- as the (non-root) ssh
-    # user -- every test that declares `fleet_nonroot = True` (see
-    # discover_nonroot_tests). Mirrors a workflow's non-root check step.
-    nonroot: bool = False
-    # Older protocol versions to additionally exercise, each as a separate
-    # stdio-pipe pass with runtests --protocol=N (the fleet analogue of a
-    # workflow's check30/check29 steps). e.g. [30, 29]. Empty => proto pass off.
-    protocols: list[int] = dataclasses.field(default_factory=list)
-    # Per-target retry budget for FLAKY tests: after a run, each failed test is
-    # re-run on its own up to max_retry more times, and any that then pass are
-    # dropped from the failure list (and reported as "recovered", never hidden).
-    # Use on a slow/loaded box where concurrency-sensitive tests occasionally
-    # flake, instead of dropping the whole target to a lower -j. 0 => no retry.
-    max_retry: int = 0
-    # Test names this specific box skips beyond what its workflow lists -- e.g. an
-    # old-kernel fleet box (no openat2/RESOLVE_BENEATH) skips the RB-conditional
-    # symlink-race tests that the workflow's newer CI runner actually runs.  Merged
-    # into RSYNC_EXPECT_SKIPPED for each pipe/protocol pass the workflow itself
-    # pins -- a pass with no matching workflow step stays unpinned (see
-    # workflow_skip_for).
-    expect_skip_extra: list[str] = dataclasses.field(default_factory=list)
-    # ...and the mirror: entries the workflow expects to skip which this target
-    # actually RUNS (a relocated scratch can satisfy a condition the
-    # workflow's host cannot, e.g. a cross-device copy).
-    expect_skip_omit: list[str] = dataclasses.field(default_factory=list)
-    # Test-name globs this box never runs (passed to runtests as RSYNC_EXCLUDE),
-    # for tests unreliable on this platform for a non-rsync reason -- e.g. the
-    # daemon+flipper symlink-race tests on openbsd, which the platform's kernel
-    # connect()-under-rename-load bug hangs (see dev-notes). Merged with --skip.
-    exclude: list[str] = dataclasses.field(default_factory=list)
-    # Test-name globs whose failure is tolerated on THIS box (merged with the
-    # global --xfail), for a known platform/version-specific failure that should
-    # not fail the cell -- e.g. crtimes on macOS for an older binary. The test
-    # still runs; if it passes, the entry is simply a no-op.
-    xfail: list[str] = dataclasses.field(default_factory=list)
-
-
-def load_fleet(path: Path) -> list[Target]:
-    """Load the fleet from a JSON file of the shape {"targets": [ {...}, ... ]}.
-
-    Each entry's keys are Target fields; keys starting with "_" are treated as
-    comments and ignored (both at top level and per target). Validation errors
-    name the offending target so a typo is easy to find."""
-    try:
-        data = json.loads(path.read_text())
-    except OSError as e:
-        sys.exit(f"cannot read fleet config {path}: {e}")
-    except json.JSONDecodeError as e:
-        sys.exit(f"invalid JSON in {path}: {e}")
-    if not isinstance(data, dict) or not isinstance(data.get("targets"), list):
-        sys.exit(f'{path}: expected a JSON object with a "targets" array')
-    fields = {f.name for f in dataclasses.fields(Target)}
-    fleet: list[Target] = []
-    for i, entry in enumerate(data["targets"]):
-        if not isinstance(entry, dict):
-            sys.exit(f"{path}: targets[{i}] is not an object")
-        entry = {k: v for k, v in entry.items() if not k.startswith("_")}
-        who = entry.get("name", f"targets[{i}]")
-        bad = set(entry) - fields
-        if bad:
-            sys.exit(f"{path}: target {who!r} has unknown key(s): "
-                     f"{', '.join(sorted(bad))}")
-        try:
-            fleet.append(Target(**entry))
-        except TypeError as e:
-            sys.exit(f"{path}: target {who!r}: {e}")
-    if not fleet:
-        sys.exit(f"{path}: no targets defined")
-    return fleet
-
-
-# ---------------------------------------------------------------------------
-# command execution (ssh for remote, local shell when ssh_host is null)
-# ---------------------------------------------------------------------------
-
-
-@dataclasses.dataclass
-class CmdResult:
-    rc: int
-    out: str          # combined stdout + stderr
-    timed_out: bool = False
-
-
-def run_on(target: Target, script: str, timeout: int) -> CmdResult:
-    """Run a /bin/sh script on the target. Remote via ssh, else local."""
-    if target.ssh_host:
-        argv = ["ssh", "-o", "BatchMode=yes", "-o", "ConnectTimeout=15",
-                target.ssh_host, script]
-    else:
-        argv = ["/bin/sh", "-c", script]
-    try:
-        p = subprocess.run(argv, capture_output=True, text=True, timeout=timeout)
-        return CmdResult(p.returncode, (p.stdout or "") + (p.stderr or ""))
-    except subprocess.TimeoutExpired as e:
-        out = (e.stdout or b"") + (e.stderr or b"")
-        if isinstance(out, bytes):
-            out = out.decode(errors="replace")
-        return CmdResult(124, out, timed_out=True)
-    except FileNotFoundError as e:
-        return CmdResult(127, str(e))
-
-
-def push_argv(target: Target, staging: str) -> list[str]:
-    # -rlpgoD = -a without -t: do NOT preserve mtimes. The host clock can be
-    # hours AHEAD of a target, so preserved (commit-time) mtimes land "in the
-    # future" there and rsync's `Makefile: Makefile.in config.status` rule
-    # triggers a config.status/autoconf regeneration storm. Letting files take
-    # the target's own clock avoids that. --checksum keeps the transfer
-    # incremental despite the unstable mtimes (decide by content, not size+time).
-    args = ["rsync", "-rlpgoD", "--checksum", "--delete"]
-    for ex in PUSH_EXCLUDES:
-        args.append(f"--exclude={ex}")
-    dst = f"{target.ssh_host}:{target.builddir}/" if target.ssh_host \
-        else f"{target.builddir}/"
-    args += [f"{staging}/", dst]
-    return args
-
-
-# ---------------------------------------------------------------------------
-# workflow skip-list parsing
-# ---------------------------------------------------------------------------
-
-def parse_workflow_skip(workflow: str, make_target: str = "check") -> str | None:
-    """Return the literal RSYNC_EXPECT_SKIPPED spec for the given `make <target>`
-    step (check / check30 / check29), or None if that step leaves it unset.  The
-    protocol passes have their own check30/check29 lines (e.g. an xattr/ACL test
-    that runs at proto 30 but skips at 29), so they must be parsed separately from
-    the plain pipe `make check`.  The trailing '? tolerates a `bash -c '... make
-    check'` wrapper (e.g. Cygwin).
-
-    The spec is passed through to the remote runtests.py verbatim; @FILE entries
-    (testsuite/skiplist/*.txt) are expanded there, against the staged tree, so
-    the list always matches the tests that shipped with it."""
-    path = WORKFLOWS / workflow
-    try:
-        text = path.read_text()
-    except OSError:
-        return None
-    rx = re.compile(r"RSYNC_EXPECT_SKIPPED=(\S+)\s+make\s+"
-                    + re.escape(make_target) + r"'?\s*$", re.M)
-    m = rx.search(text)
-    return m.group(1) if m else None
-
-
-def _expand_spec_names(spec: str) -> set[str]:
-    """The test names a workflow's RSYNC_EXPECT_SKIPPED spec resolves to, by
-    reading its @FILE references out of the suite tree.  Only used to decide
-    which backport exclusions are actually IN the expected-skip set: runtests
-    rejects a '-name' that removes a name nothing added, so a removal may only
-    be emitted for a name the spec really contains."""
-    names: set[str] = set()
-    for tok in spec.split(","):
-        tok = tok.strip()
-        if not tok or tok.startswith("-"):
-            continue
-        if tok.startswith("@"):
-            f = TESTSUITE_REPO / tok[1:]
-            try:
-                for ln in f.read_text().splitlines():
-                    ln = ln.split("#", 1)[0].strip()
-                    if ln:
-                        names.add(ln)
-            except OSError:
-                pass
-        else:
-            names.add(tok)
-    return names
-
-
-def workflow_skip_for(t: "Target", make_target: str = "check") -> str | None:
-    """The target's expected-skip csv for a `make <target>` pass: its workflow's
-    RSYNC_EXPECT_SKIPPED, plus any per-target expect_skip_extra (old-box-only
-    skips the workflow omits) and minus any expect_skip_omit (tests the workflow
-    expects to skip which this target can actually run).
-
-    The workflow spec is now mostly @FILE references, which are expanded on the
-    target rather than here, so an omission cannot be done by set subtraction:
-    the name to drop lives inside a file we deliberately do not read.  It is
-    emitted as a '-name' token instead, which runtests.py applies after every
-    addition.
-
-    None (no oracle) when the workflow has no such step -- e.g. a protocols=[29]
-    target whose workflow has no check29 line.  The extras alone would be a
-    near-empty expected set and so a guaranteed mismatch; a lane the workflow
-    does not pin is simply not pinned here either."""
-    base = parse_workflow_skip(t.workflow, make_target)
-    # A backport-excluded test never runs, so it cannot skip either: drop it
-    # from the expected-skip set as well, or the oracle waits for a skip that
-    # can no longer happen.  Only for names the spec actually contains --
-    # runtests rejects a '-name' that removes a name nothing added.
-    in_spec = _expand_spec_names(base) if (base and BACKPORT_EXCLUDE) else set()
-    omit = set(t.expect_skip_omit) | (set(BACKPORT_EXCLUDE) & in_spec)
-    if base is None or not (t.expect_skip_extra or omit):
-        return base
-    items = sorted(set(t.expect_skip_extra) | ({base} if base else set()))
-    # A backport-excluded test cannot skip, because it never runs -- so it must
-    # also come OUT of the expected-skip set, or the oracle waits for a skip
-    # that can no longer happen.  The name usually lives inside an @FILE, so it
-    # is dropped with a '-name' token that runtests applies after expansion.
-    items += [f"-{n}" for n in sorted(omit)]
-    return ",".join(items)
-
-
-# ---------------------------------------------------------------------------
-# non-root test discovery
-# ---------------------------------------------------------------------------
-
-# A test opts into the fleet's extra non-root pass by setting a module-level
-# `fleet_nonroot = True`. We read it with a text scan rather than importing the
-# module (test files execute their body on import), so a new privilege-sensitive
-# test joins the pass just by carrying the marker -- no fleet-config edit needed.
-_NONROOT_RE = re.compile(r"^[ \t]*fleet_nonroot[ \t]*=[ \t]*True\b", re.M)
-
-
-def discover_nonroot_tests(testsuite_dir: Path) -> list[str]:
-    """Return the names (without the _test.py suffix) of the tests under
-    testsuite_dir that declare `fleet_nonroot = True`."""
-    names = []
-    for p in sorted(testsuite_dir.glob("*_test.py")):
-        try:
-            if _NONROOT_RE.search(p.read_text(errors="replace")):
-                names.append(p.name[: -len("_test.py")])
-        except OSError:
-            continue
-    return names
-
-
-def _exclude_csv(t: "Target") -> str:
-    """RSYNC_EXCLUDE csv for a target: the global --skip globs plus this target's
-    per-box `exclude` list (tests it never runs, e.g. the openbsd kernel-bug
-    daemon+flipper races)."""
-    parts = [p for p in ([SKIP_CSV] + list(t.exclude)) if p]
-    return ",".join(parts)
-
-
-# ---------------------------------------------------------------------------
-# remote script builders
-# ---------------------------------------------------------------------------
-
-
-def build_script(t: Target) -> str:
-    flags = " ".join(t.configure_flags)
-    # configure only when not yet configured (keeps incremental builds fast);
-    # --clean wipes the builddir beforehand so Makefile is absent -> reconfigure.
-    pre = f'{t.env_prefix}\n' if t.env_prefix else ''
-    return (
-        f'cd {t.builddir} || exit 3\n'
-        f'{pre}'
-        f'if [ ! -f Makefile ]; then {t.configure_pre} ./configure {flags} || exit 4; fi\n'
-        f'{t.make} -j{t.pipe_jobs} check-progs || exit 5\n'
-    )
-
-
-def test_script(t: Target, transport: str, skip_csv: str | None, jobs: int,
-                protocol: int | None = None, only: list[str] | None = None) -> str:
-    rb = f'--rsync-bin="$PWD/{t.rsync_bin}"'
-    tcp = " --use-tcp" if transport == "tcp" else ""
-    # protocol forces an older wire version (mirrors `make check30`/`check29`).
-    proto = f" --protocol={protocol}" if protocol is not None else ""
-    # PYTHONDONTWRITEBYTECODE: don't drop root-owned __pycache__/*.pyc into the
-    # tree (a sudo run would, breaking the next non-root push --delete).
-    env = "PYTHONDONTWRITEBYTECODE=1 "
-    if t.scratchbase:
-        # Must travel in `env`, not env_prefix: the sudo branch below runs
-        # `sudo -n env ...`, which drops whatever the outer shell exported.
-        env += f"scratchbase={shlex.quote(t.scratchbase)} "
-    excl = _exclude_csv(t)
-    if excl:
-        env += f"RSYNC_EXCLUDE={excl} "
-    # Named tests (a max_retry re-run) make runtests full_run False, so the
-    # expected-skip list does not apply -- only the named tests' pass/fail matter.
-    names = ""
-    if only:
-        names = " " + " ".join(only)
-    elif skip_csv:
-        env += f"RSYNC_EXPECT_SKIPPED={skip_csv} "
-    # --timing makes the remote runtests print its own per-test wall-clock table,
-    # which lands in the captured output: that is where a "this target is slow"
-    # cell turns into "these tests are slow on this target".
-    timing = " --timing" if TIMING and not only else ""
-    # --use-tcp is observable only through start_test_daemon(), so when the tcp
-    # pass follows a full pipe pass over the same build, the tests that never
-    # reach it would just produce the same result twice: narrow it to the ones
-    # that can tell the difference. That reasoning depends ENTIRELY on the pipe
-    # pass having run -- under --transport tcp it is the only pass there is, and
-    # narrowing it would silently drop the other 186 tests from the run
-    # altogether. --full-tcp forces the full sweep either way.
-    narrow_tcp = (transport == "tcp" and not FULL_TCP and not only
-                  and "pipe" in TRANSPORTS)
-    only_daemon = " --daemon-tests-only" if narrow_tcp else ""
-    runtests = (f'{t.python} runtests.py {rb}{tcp}{proto} '
-                f'-j {jobs}{timing}{only_daemon}{names}')
-    # env_prefix (e.g. a brew PATH) must reach the test too: some tests build a
-    # helper binary on the fly (a test may invoke `make`, which needs gawk etc.),
-    # so the build tools must be on PATH at test time.
-    pre = f'{t.env_prefix}; ' if t.env_prefix else ''
-    if t.privilege == "sudo":
-        # -n: never prompt (capture_output has no TTY -- a prompt would hang
-        # the whole timeout). Targets need passwordless sudo or a fresh
-        # `sudo -v`. env keeps the vars (and PATH) across the sudo boundary.
-        path_pass = 'PATH="$PATH" ' if t.env_prefix else ''
-        cmd = f"{pre}sudo -n env {path_pass}{env}{runtests}"
-    else:
-        cmd = pre + env + runtests
-    return f'cd {t.builddir} || exit 3\n{cmd}\n'
-
-
-def nonroot_test_script(t: Target, names: list[str]) -> str:
-    """Run the given tests as the (non-root) ssh user -- the fleet analogue of a
-    workflow's non-root check step. Explicit test names make runtests.py
-    full_run False, so no RSYNC_EXPECT_SKIPPED is involved; only FAILs matter.
-    The prior sudo pipe/tcp runs left testtmp root-owned, so clear it (via sudo)
-    before the non-root run recreates it."""
-    pre = f'{t.env_prefix}; ' if t.env_prefix else ''
-    _e = _exclude_csv(t)
-    excl = f'RSYNC_EXCLUDE={_e} ' if _e else ''
-    sb = f'scratchbase={shlex.quote(t.scratchbase)} ' if t.scratchbase else ''
-    runtests = (f'PYTHONDONTWRITEBYTECODE=1 {sb}{excl}{t.python} runtests.py '
-                f'--rsync-bin="$PWD/{t.rsync_bin}" {" ".join(names)}')
-    # A relocated scratch lives outside builddir, so clearing ./testtmp alone
-    # leaves the prior sudo run's root-owned tree in place and the non-root
-    # pass cannot create anything under it.
-    extra_rm = (f'sudo -n rm -rf {shlex.quote(t.scratchbase + "/testtmp")}\n'
-                if t.scratchbase else '')
-    return (f'cd {t.builddir} || exit 3\n'
-            f'sudo -n rm -rf testtmp\n'
-            f'{extra_rm}'
-            f'{pre}{runtests}\n')
-
-
-# ---------------------------------------------------------------------------
-# runtests.py output parsing
-# ---------------------------------------------------------------------------
-
-RE_RESULT = re.compile(r"^(PASS|FAIL|ERROR|XFAIL|SKIP)\s+(\S+)", re.M)
-RE_COUNT = re.compile(r"^\s+(\d+)\s+(passed|failed|xfailed|skipped)\b", re.M)
-RE_SKIP_HDR = re.compile(r"^----- skipped results:", re.M)
-RE_SKIP_EXP = re.compile(r"^\s+expected:\s*(.*)$", re.M)
-RE_SKIP_GOT = re.compile(r"^\s+got:\s*(.*)$", re.M)
-
-
-def _csv_set(s: str) -> set[str]:
-    return {x for x in s.strip().split(",") if x}
-
-
-@dataclasses.dataclass
-class TransportResult:
-    transport: str
-    exit_code: int
-    timed_out: bool
-    counts: dict[str, int]
-    failed: list[str]
-    skip_checked: bool
-    skip_expected: set[str]
-    skip_got: set[str]
-    raw: str
-    # Tests that failed the initial run but passed on a max_retry re-run, so they
-    # were dropped from `failed`.  Surfaced in the report (a recovered flake is
-    # noted, never silently hidden).
-    recovered: list[str] = dataclasses.field(default_factory=list)
-    # Tests whose failure was tolerated via --xfail: dropped from `failed` (so the
-    # cell can still be OK) but surfaced in the report, never silently hidden.
-    xfailed_req: list[str] = dataclasses.field(default_factory=list)
-
-    @property
-    def skip_mismatch(self) -> bool:
-        return self.skip_checked and self.skip_expected != self.skip_got
-
-    @property
-    def ok(self) -> bool:
-        return (not self.timed_out and self.exit_code == 0
-                and not self.failed and not self.skip_mismatch)
-
-
-def parse_transport(transport: str, r: CmdResult, skip_checked: bool,
-                    xfail_extra: list[str] = ()) -> TransportResult:
-    counts = {"passed": 0, "failed": 0, "xfailed": 0, "skipped": 0}
-    for m in RE_COUNT.finditer(r.out):
-        counts[m.group(2)] = int(m.group(1))
-    failed = [m.group(2) for m in RE_RESULT.finditer(r.out)
-              if m.group(1) in ("FAIL", "ERROR")]
-    # --xfail (global) plus this box's per-target xfail: drop tolerated failures
-    # from `failed` so they don't fail the cell.
-    xfail_globs = [*XFAIL_GLOBS, *xfail_extra]
-    xfailed_req = [f for f in failed
-                   if any(fnmatch.fnmatch(f, g) for g in xfail_globs)]
-    failed = [f for f in failed if f not in xfailed_req]
-    exp = got = set()
-    if skip_checked and RE_SKIP_HDR.search(r.out):
-        em = RE_SKIP_EXP.search(r.out)
-        gm = RE_SKIP_GOT.search(r.out)
-        exp = _csv_set(em.group(1)) if em else set()
-        got = _csv_set(gm.group(1)) if gm else set()
-    rc = r.rc
-    # runtests exits non-zero per failing test; if the only failures were
-    # tolerated, clear the stale code so the cell reads OK (cf. retry_failed).
-    if xfailed_req and not failed and rc != 0:
-        rc = 0
-    return TransportResult(transport, rc, r.timed_out, counts, failed,
-                           skip_checked, exp, got, r.out, xfailed_req=xfailed_req)
-
-
-def retry_failed(t: Target, label: str, tr: TransportResult, rerun) -> None:
-    """Honour the target's max_retry budget: re-run each failed test on its own
-    (serially) up to max_retry more times; drop any that pass and record them in
-    tr.recovered.  `rerun(names)` runs the given tests and returns a CmdResult.
-    A no-op when max_retry is 0 or there were no failures."""
-    if not t.max_retry or not tr.failed:
-        return
-    remaining = list(tr.failed)
-    for attempt in range(1, t.max_retry + 1):
-        r = rerun(remaining)
-        still = [m.group(2) for m in RE_RESULT.finditer(r.out)
-                 if m.group(1) in ("FAIL", "ERROR")]
-        recovered = [n for n in remaining if n not in still]
-        if recovered:
-            tr.recovered.extend(recovered)
-            log(f"[{t.name}] {label} retry {attempt}/{t.max_retry}: "
-                f"recovered {','.join(recovered)}"
-                + (f"; still failing {','.join(still)}" if still else ""))
-        remaining = [n for n in remaining if n in still]
-        if not remaining:
-            break
-    tr.failed = remaining
-    # The initial run's non-zero exit was the now-recovered failures; once they
-    # all pass on retry the cell is OK, so clear the stale exit code (only the
-    # failed tests can make runtests exit non-zero on a no-skip-list re-run).
-    if not remaining and tr.recovered and tr.exit_code != 0:
-        tr.exit_code = 0
-
-
-@dataclasses.dataclass
-class TargetResult:
-    target: str
-    reachable: bool = True
-    pushed: bool = True
-    build_ok: bool = True
-    error: str = ""
-    build_log: str = ""
-    transports: dict[str, TransportResult] = dataclasses.field(default_factory=dict)
-    # Wall-clock seconds per phase (push/build/pipe/tcp/nonroot) plus "total";
-    # populated for --timing. Phases run sequentially, so they sum to the total.
-    timings: dict[str, float] = dataclasses.field(default_factory=dict)
-
-
-# ---------------------------------------------------------------------------
-# per-target worker
-# ---------------------------------------------------------------------------
-
-_print_lock = threading.Lock()
-
-
-def log(msg: str) -> None:
-    with _print_lock:
-        print(msg, flush=True)
-
-
-def run_target(t: Target, args, staging: str) -> TargetResult:
-    res = TargetResult(t.name)
-    log(f"[{t.name}] start")
-    started = time.monotonic()
-
-    if t.ssh_host:
-        ping = run_on(t, "echo ok", timeout=25)
-        if ping.rc != 0:
-            res.reachable = False
-            res.error = f"ssh unreachable (rc={ping.rc}): {ping.out.strip()[:200]}"
-            log(f"[{t.name}] UNREACHABLE")
-            return res
-
-    # Always push: the run dir is freshly named per run, so there is no prior
-    # tree to reuse -- every run is a full configure + build.
-    t0 = time.monotonic()
-    push = subprocess.run(push_argv(t, staging),
-                          capture_output=True, text=True, timeout=600)
-    res.timings["push"] = time.monotonic() - t0
-    if push.returncode != 0:
-        res.pushed = False
-        res.error = f"push failed (rc={push.returncode}): {push.stderr.strip()[:300]}"
-        log(f"[{t.name}] PUSH-FAIL")
-        return res
-
-    t0 = time.monotonic()
-    b = run_on(t, build_script(t), timeout=1200)
-    res.timings["build"] = time.monotonic() - t0
-    res.build_ok = b.rc == 0
-    res.build_log = b.out
-    if not res.build_ok:
-        log(f"[{t.name}] BUILD-FAIL")
-        return res
-
-    for transport in args.transports:
-        skip_csv = workflow_skip_for(t) if transport == "pipe" else None
-        jobs = (args.jobs if args.jobs else
-                (t.tcp_jobs if transport == "tcp" else t.pipe_jobs))
-        cmd = test_script(t, transport, skip_csv, jobs)
-        t0 = time.monotonic()
-        r = run_on(t, cmd, timeout=2400)
-        res.timings[transport] = time.monotonic() - t0
-        tr = parse_transport(transport, r, skip_csv is not None, t.xfail)
-        retry_failed(t, transport, tr, lambda names, tp=transport: run_on(
-            t, test_script(t, tp, None, 1, only=names), timeout=1200))
-        res.transports[transport] = tr
-        log(f"[{t.name}] {transport} done "
-            f"({'ok' if tr.ok else 'ISSUE'})")
-
-    # Extra older-protocol passes (mirroring the workflow's check30/check29
-    # steps): same stdio-pipe transport, but each protocol uses its own
-    # check30/check29 skip list (a feature like xattrs/ACLs runs at proto 30 yet
-    # skips at 29). Only targets that list `protocols` opt in; skipped under
-    # --transport tcp (these are pipe runs).
-    if t.protocols and "pipe" in args.transports:
-        jobs = args.jobs if args.jobs else t.pipe_jobs
-        for proto in t.protocols:
-            label = f"proto{proto}"
-            skip_csv = workflow_skip_for(t, f"check{proto}")
-            cmd = test_script(t, "pipe", skip_csv, jobs, protocol=proto)
-            t0 = time.monotonic()
-            r = run_on(t, cmd, timeout=2400)
-            res.timings[label] = time.monotonic() - t0
-            tr = parse_transport(label, r, skip_csv is not None, t.xfail)
-            retry_failed(t, label, tr, lambda names, pr=proto: run_on(
-                t, test_script(t, "pipe", None, 1, protocol=pr, only=names),
-                timeout=1200))
-            res.transports[label] = tr
-            log(f"[{t.name}] {label} done "
-                f"({'ok' if tr.ok else 'ISSUE'})")
-
-    # Extra non-root pass (after the sudo runs) for targets that opt in, running
-    # the tests that declare `fleet_nonroot = True` (discovered in main()).
-    if t.nonroot and args.nonroot_tests:
-        t0 = time.monotonic()
-        r = run_on(t, nonroot_test_script(t, args.nonroot_tests), timeout=2400)
-        res.timings["nonroot"] = time.monotonic() - t0
-        tr = parse_transport("nonroot", r, skip_checked=False, xfail_extra=t.xfail)
-        retry_failed(t, "nonroot", tr, lambda names: run_on(
-            t, nonroot_test_script(t, names), timeout=1200))
-        res.transports["nonroot"] = tr
-        log(f"[{t.name}] nonroot done "
-            f"({'ok' if tr.ok else 'ISSUE'})")
-    res.timings["total"] = time.monotonic() - started
-    return res
-
-
-# ---------------------------------------------------------------------------
-# reporting
-# ---------------------------------------------------------------------------
-
-
-def cell_status(res: TargetResult, transport: str) -> str:
-    if not res.reachable:
-        return "UNREACHABLE"
-    if not res.pushed:
-        return "PUSH-FAIL"
-    if not res.build_ok:
-        return "BUILD-FAIL"
-    tr = res.transports.get(transport)
-    if tr is None:
-        return "-"
-    if tr.timed_out:
-        return "TIMEOUT"
-    if tr.failed:
-        return f"FAIL({len(tr.failed)})"
-    if tr.skip_mismatch:
-        return "SKIP-MISMATCH"
-    if tr.exit_code != 0:
-        return f"EXIT({tr.exit_code})"
-    return "OK"
-
-
-def print_report(results: list[TargetResult], args, fleet: list[Target]) -> bool:
-    by_name = {t.name: t for t in fleet}
-    order = {t.name: i for i, t in enumerate(fleet)}
-    results.sort(key=lambda r: order.get(r.target, 99))
-    # protoNN columns appear only when some target ran that older-protocol pass;
-    # the 'nonroot' column only when some target ran a non-root pass. Targets
-    # without a given pass show "-" there (a neutral N/A, not a failure).
-    transports = list(args.transports)
-    protos = {k for r in results for k in r.transports if k.startswith("proto")}
-    # highest protocol first (proto30 before proto29), matching check30/check29.
-    transports += sorted(protos, key=lambda c: int(c[len("proto"):]), reverse=True)
-    if any("nonroot" in r.transports for r in results):
-        transports.append("nonroot")
-    ts = time.strftime("%Y-%m-%d %H:%M")
-    print("\n" + "=" * 64)
-    print(f"rsync fleet CI — branch {current_branch()} — {ts}")
-    print(f"source: HEAD   run: {args.run_id}   "
-          f"transports: {','.join(args.transports)}")
-    print("(A target's pipe skip-set is only enforced when its workflow sets "
-          "RSYNC_EXPECT_SKIPPED; otherwise only FAILs matter. The 'nonroot' "
-          "column runs the privilege-sensitive tests as the unprivileged user; "
-          "'-' = N/A.)")
-    print("=" * 64)
-
-    width = max(len(t) for t in order) + 2
-    header = "TARGET".ljust(width) + "".join(tr.upper().ljust(16) for tr in transports)
-    print(header)
-    all_ok = True
-    for res in results:
-        row = res.target.ljust(width)
-        for transport in transports:
-            st = cell_status(res, transport)
-            if st not in ("OK", "-"):    # "-" = N/A (e.g. no nonroot pass)
-                all_ok = False
-            row += st.ljust(16)
-        # data-driven row notes: local target, or a target with a distinct tcp -j
-        t = by_name.get(res.target)
-        notes = []
-        if t is not None:
-            if t.ssh_host is None:
-                notes.append("(local)")
-            if "tcp" in transports and t.tcp_jobs != t.pipe_jobs:
-                notes.append(f"(tcp -j{t.tcp_jobs})")
-        print(row + " ".join(notes))
-
-    # detail section: only the unexpected cells
-    details: list[str] = []
-    for res in results:
-        if not res.reachable:
-            details.append(f"{res.target} — UNREACHABLE: {res.error}")
-            continue
-        if not res.pushed:
-            details.append(f"{res.target} — PUSH-FAIL: {res.error}")
-            continue
-        if not res.build_ok:
-            tail = "\n    ".join(res.build_log.strip().splitlines()[-20:])
-            details.append(f"{res.target} — BUILD-FAIL:\n    {tail}")
-            continue
-        for transport in transports:
-            tr = res.transports.get(transport)
-            if tr is None or tr.ok:
-                continue
-            if tr.timed_out:
-                details.append(f"{res.target} / {transport} — TIMEOUT")
-            if tr.failed:
-                details.append(f"{res.target} / {transport} — {len(tr.failed)} failed:\n    "
-                               + " ".join(tr.failed))
-            if tr.skip_mismatch:
-                extra = tr.skip_got - tr.skip_expected
-                missing = tr.skip_expected - tr.skip_got
-                diff = []
-                if extra:
-                    diff.append(f"unexpected skips: {','.join(sorted(extra))}")
-                if missing:
-                    diff.append(f"expected-but-ran: {','.join(sorted(missing))}")
-                details.append(f"{res.target} / {transport} — skip mismatch ("
-                               + "; ".join(diff) + ")\n"
-                               f"    expected: {','.join(sorted(tr.skip_expected))}\n"
-                               f"    got:      {','.join(sorted(tr.skip_got))}")
-            elif not tr.failed and not tr.timed_out and tr.exit_code != 0:
-                details.append(f"{res.target} / {transport} — runtests exit {tr.exit_code}")
-
-    # Exclude N/A ("-") cells (e.g. the nonroot column for targets that don't
-    # run a non-root pass) from the OK/not-OK tally.
-    statuses = [cell_status(res, transport)
-                for res in results for transport in transports]
-    cells = sum(1 for s in statuses if s != "-")
-    ok_cells = sum(1 for s in statuses if s == "OK")
-    print("=" * 64)
-    if details:
-        print("==== UNEXPECTED RESULTS ====")
-        for d in details:
-            print(d)
-        print("=" * 64)
-    # Recovered flakes: tests that failed but passed within the target's
-    # max_retry budget.  The cell counts as OK, but list them so a flaky test is
-    # never silently swallowed.
-    recovered = [f"{res.target} / {transport}: {','.join(tr.recovered)}"
-                 for res in results for transport in transports
-                 if (tr := res.transports.get(transport)) and tr.recovered]
-    if recovered:
-        print("==== RECOVERED (flaky -- failed, then passed on retry) ====")
-        for r in recovered:
-            print(f"    {r}")
-        print("=" * 64)
-    xfreq = [f"{res.target} / {transport}: {','.join(tr.xfailed_req)}"
-             for res in results for transport in transports
-             if (tr := res.transports.get(transport)) and tr.xfailed_req]
-    if xfreq:
-        print("==== XFAILED BY REQUEST (--xfail; failure tolerated, cell still OK) ====")
-        for r in xfreq:
-            print(f"    {r}")
-        print("=" * 64)
-    print(f"{len(results)} targets x {len(transports)} transports = {cells} cells: "
-          f"{ok_cells} OK, {cells - ok_cells} not OK")
-    return all_ok
-
-
-def target_ok(res: TargetResult) -> bool:
-    """True if this target produced no unexpected result at all -- reachable,
-    pushed, built, and every pass it ran was OK."""
-    if not (res.reachable and res.pushed and res.build_ok):
-        return False
-    return all(tr.ok for tr in res.transports.values())
-
-
-def keep_on_fail(results: list[TargetResult], args,
-                 chosen: list[Target]) -> list[str]:
-    """--keep-on-fail: for every target that did NOT come back clean, save its
-    full output locally and mark its remote run dir to survive the exit sweep.
-
-    A fleet run is expensive (a full configure + build on ten machines), and the
-    report only prints the names of failing tests -- so re-running was the only
-    way to see WHY one failed, at the cost of another full run, on a race test
-    that may not fail the same way twice.  Saving the raw output at the moment of
-    failure, and keeping the tree that produced it, makes that re-run
-    unnecessary.  Clean targets are untouched: they are still swept as usual.
-
-    Returns human-readable lines describing what was kept, for the report."""
-    failed = [r for r in results if not target_ok(r)]
-    if not failed:
-        return []
-    root = Path(args.keep_on_fail).expanduser() / args.run_id
-    notes: list[str] = []
-    for res in failed:
-        _retain_targets.add(res.target)
-        d = root / _dirsafe(res.target)
-        try:
-            d.mkdir(parents=True, exist_ok=True)
-            if res.error:
-                (d / "error.txt").write_text(res.error + "\n")
-            if res.build_log:
-                (d / "build.log").write_text(res.build_log)
-            for name, tr in res.transports.items():
-                (d / f"{name}.log").write_text(tr.raw)
-            saved = str(d)
-        except OSError as e:
-            saved = f"(could not write logs: {e})"
-        notes.append(f"{res.target}: logs {saved}")
-        # The remote tree is only meaningful if the run got far enough to make
-        # one; an unreachable or un-pushed target has nothing to keep.
-        if res.reachable and res.pushed:
-            t = next((x for x in chosen if x.name == res.target), None)
-            if t is not None:
-                where = f"{t.ssh_host}:{t.builddir}" if t.ssh_host else t.builddir
-                notes.append(f"{res.target}: run dir kept at {where}")
-    return notes
-
-
-# Phase columns for --timing, in execution order (push -> build -> tests).
-_TIMING_PHASES = ("push", "build", "pipe", "tcp", "nonroot")
-
-
-def _fmt_dur(s: float) -> str:
-    if s < 60:
-        return f"{s:.0f}s"
-    m, sec = divmod(int(round(s)), 60)
-    return f"{m}m{sec:02d}s"
-
-
-def print_timing(results: list[TargetResult]) -> None:
-    """Per-target wall-clock breakdown, slowest first. Targets run in parallel,
-    so the whole run is gated by the slowest one -- that's the hold-up; the
-    phase columns show whether it's push, build or the test passes."""
-    timed = [r for r in results if r.timings]
-    if not timed:
-        return
-    # Insert any protoNN phases (highest first) just before nonroot, in run order.
-    protos = sorted({k for r in timed for k in r.timings if k.startswith("proto")},
-                    key=lambda c: int(c[len("proto"):]), reverse=True)
-    order = [p for p in _TIMING_PHASES if p != "nonroot"] + protos + ["nonroot"]
-    phases = [p for p in order if any(p in r.timings for r in timed)]
-
-    def total(r: TargetResult) -> float:
-        # Failed-early targets have no "total"; sum the phases they did reach.
-        return r.timings.get("total") or sum(r.timings.get(p, 0.0) for p in phases)
-
-    timed.sort(key=total, reverse=True)
-    width = max([len("TARGET")] + [len(r.target) for r in timed]) + 2
-    print("\n==== TIMING (slowest target first) ====")
-    print("TARGET".ljust(width) + "TOTAL".ljust(9)
-          + "".join(p.upper().ljust(9) for p in phases))
-    for r in timed:
-        row = r.target.ljust(width) + _fmt_dur(total(r)).ljust(9)
-        for p in phases:
-            v = r.timings.get(p)
-            row += (_fmt_dur(v) if v is not None else "-").ljust(9)
-        print(row)
-    slow = timed[0]
-    print(f"hold-up: {slow.target} at {_fmt_dur(total(slow))} gates the run "
-          "(targets run in parallel)")
-
-
-def current_branch() -> str:
-    try:
-        return subprocess.run(["git", "-C", str(REPO), "rev-parse",
-                               "--abbrev-ref", "HEAD"],
-                              capture_output=True, text=True).stdout.strip() or "?"
-    except Exception:
-        return "?"
-
-
-# ---------------------------------------------------------------------------
-# run-dir cleanup
-# ---------------------------------------------------------------------------
-
-# Targets whose per-run dir (t.builddir, already suffixed with the run_id) this
-# process must remove on exit. Populated in main() once the run_id is applied.
-_cleanup_targets: list[Target] = []
-_cleanup_lock = threading.Lock()
-_cleanup_done = False
-# Names of targets whose run dir must survive the exit sweep (--keep-on-fail,
-# populated once results are in). Everything else is removed as usual.
-_retain_targets: set[str] = set()
-
-
-def _dirsafe(name: str) -> str:
-    """A target name reduced to what is safe in a remote path we later rm -rf.
-    Anything outside [A-Za-z0-9._-] becomes '_', so a name cannot introduce a
-    path separator, a shell metacharacter, or a leading dash."""
-    return re.sub(r'[^A-Za-z0-9._-]', '_', name).lstrip('-') or 'target'
-
-
-def _unsafe_builddir(path: str) -> bool:
-    """True if `path` is too broad to feed to `rm -rf` -- empty, root, $HOME, or
-    an absolute path sitting directly under / (e.g. /tmp). A real run dir is
-    always nested deeper, so this rejects an obvious builddir misconfiguration
-    before any destructive command is built."""
-    p = (path or "").rstrip("/")
-    if p in ("", "/", "~") or os.path.expanduser(p) == os.path.expanduser("~"):
-        return True
-    return os.path.isabs(p) and os.path.dirname(p) == "/"
-
-
-def cleanup_run() -> None:
-    """Best-effort `rm -rf` of this run's dir on every chosen target. Idempotent
-    (atexit + a signal handler may both call it). Each target removes only its
-    own <base>-<run_id> dir, so a concurrent run's dir is never touched.
-
-    Targets listed in _retain_targets are left alone -- that is --keep-on-fail
-    holding a failed target's tree (build output plus the scratch trees the
-    failing tests left) for a post-mortem."""
-    global _cleanup_done
-    with _cleanup_lock:
-        if _cleanup_done or not _cleanup_targets:
-            return
-        _cleanup_done = True
-        targets = [t for t in _cleanup_targets if t.name not in _retain_targets]
-    for t in targets:
-        if _unsafe_builddir(t.builddir):
-            continue
-        run_on(t, f'rm -rf -- {t.builddir}', timeout=60)
-
-
-def _on_signal(signum, frame):
-    cleanup_run()
-    # Skip atexit/thread-join: worker threads' ssh calls can't be cancelled and
-    # would otherwise block exit until they return. The remote build/test simply
-    # errors out now that its dir is gone.
-    os._exit(130 if signum == signal.SIGINT else 143)
-
-
-# sweep() counts a pattern, kills it (best effort; sudo -n retry for processes a
-# root-running test left), then RE-counts after a settle so we report what
-# actually died (KILLED = before-after) and flag any survivor (SURVIVED, sets
-# fail) instead of claiming success when pkill couldn't reach it. The patterns
-# use the pgrep self-exclusion trick -- 'r[e]name'/'det[a]ch'/'[l]ocalhost' match a
-# real process's "rename"/"detach"/"localhost" but not the bracketed literal in this
-# script's own argv (run_on passes the whole script as the remote argv), so we never
-# signal ourselves. The client sweep catches an orphaned `rsync rsync://localhost:N/`
-# left blocked on a read when its test was killed (no I/O timeout). @BASE@ is
-# substituted with the target's run-dir prefix.
-_CLEANUP_SCRIPT = r'''fail=0
-# Cygwin signals are cooperative, so a process stuck in a Windows call ignores
-# even SIGKILL and pkill cannot touch it -- exactly how an orphaned test rsyncd
-# ends up squatting its port forever. Where taskkill exists, finish the job
-# through Windows using the winpid (4th column of `ps -W`).
-win_force() {
-  command -v taskkill >/dev/null 2>&1 || return 0
-  command -v ps >/dev/null 2>&1 || return 0
-  for p in $(pgrep -f "$1" 2>/dev/null); do
-    w=$(ps -W 2>/dev/null | awk -v x="$p" '$1==x {print $4}')
-    [ -n "$w" ] && taskkill /F /PID "$w" >/dev/null 2>&1
-  done
-}
-sweep() {
-  command -v pgrep >/dev/null 2>&1 || return 0
-  before=$(pgrep -f "$2" 2>/dev/null | wc -l | tr -d ' ')
-  [ "$before" -gt 0 ] 2>/dev/null || return 0
-  pkill -f "$2" 2>/dev/null
-  sudo -n pkill -f "$2" 2>/dev/null
-  sleep 1
-  if [ "$(pgrep -f "$2" 2>/dev/null | wc -l | tr -d ' ')" -gt 0 ] 2>/dev/null; then
-    win_force "$2"
-    sleep 1
-  fi
-  after=$(pgrep -f "$2" 2>/dev/null | wc -l | tr -d ' ')
-  killed=$((before - after))
-  [ "$killed" -gt 0 ] 2>/dev/null && echo "KILLED $killed stray $1(s)"
-  if [ "$after" -gt 0 ] 2>/dev/null; then
-    echo "SURVIVED $after stray $1(s)"
-    fail=1
-  fi
-}
-sweep flipper 'r[e]name.*r[e]name.*r[e]name'
-sweep daemon 'det[a]ch --address=127.0.0.1'
-sweep client 'rsync://[l]ocalhost'
-for d in @BASE@-*; do
-  [ -e "$d" ] || continue
-  if rm -rf -- "$d" 2>/dev/null || sudo -n rm -rf -- "$d" 2>/dev/null; then
-    echo "REMOVED $d"
-  else
-    echo "FAILED $d"
-    fail=1
-  fi
-done
-exit $fail
-'''
-
-
-def cleanup_remnants(targets: list[Target]) -> int:
-    """--cleanup mode: on each target, kill the stray processes a killed run can
-    leave behind, then remove every <base>-* run dir, reporting what went.
-    Returns a process exit code. Only suffixed run dirs are swept -- a bare
-    <base> is left alone.
-
-    A run that is SIGKILLed (or whose ssh drops) can strand two kinds of process
-    on platforms without a parent-death backstop: the TOCTOU path-flipper (a
-    busy `python -c` rename loop that pins a CPU) and an orphaned test rsyncd
-    (`--no-detach --address=127.0.0.1`, which then squats its fixed port -- the
-    very wedge claim_ports()' bind-probe now reports). Both are killed best
-    effort (sudo -n retry for root-owned ones); a kill is verified by re-counting
-    afterwards, and a process that survives is reported and fails the run.
-
-    CAVEAT: the kill patterns are host-global, not scoped to a particular run, so
-    --cleanup assumes no *other* fleettest run is active on the target -- it
-    would also kill a concurrent run's flipper/daemon (and any manual `rsync
-    --daemon --no-detach --address=127.0.0.1`). Run it between runs, not during
-    one. Run dirs whose contents a root test owns are removed via a `sudo -n rm`
-    fallback; only a dir that survives even that is a failure."""
-    rc = 0
-    for t in targets:
-        base = t.builddir
-        if _unsafe_builddir(base):
-            log(f"[{t.name}] skipped (unsafe builddir {base!r})")
-            continue
-        # Structured markers (KILLED/SURVIVED/REMOVED/FAILED) keep the report
-        # clean even though run_on() folds stderr into stdout.
-        r = run_on(t, _CLEANUP_SCRIPT.replace("@BASE@", base), timeout=120)
-        lines = r.out.splitlines()
-        removed = [ln.split(" ", 1)[1] for ln in lines if ln.startswith("REMOVED ")]
-        failed = [ln.split(" ", 1)[1] for ln in lines if ln.startswith("FAILED ")]
-        killed = [ln.replace("KILLED ", "killed ", 1)
-                  for ln in lines if ln.startswith("KILLED ")]
-        survived = [ln.replace("SURVIVED ", "still alive: ", 1)
-                    for ln in lines if ln.startswith("SURVIVED ")]
-        msgs = killed[:]
-        if removed:
-            msgs.append("removed: " + " ".join(removed))
-        if survived:
-            rc = 1
-            msgs += survived
-        if failed:
-            rc = 1
-            msgs.append("could not remove (even with sudo): " + " ".join(failed))
-        if r.rc not in (0, 1):
-            rc = 1
-            msgs.append(f"cleanup error rc={r.rc}: {r.out.strip()[:160]}")
-        log(f"[{t.name}] " + ("; ".join(msgs) if msgs else "nothing to remove"))
-    return rc
-
-
-# ---------------------------------------------------------------------------
-# main
-# ---------------------------------------------------------------------------
-
-
-def main() -> int:
-    ap = argparse.ArgumentParser(description="Fleet CI harness for rsync.")
-    ap.add_argument("--targets", help="comma-separated subset (default: all)")
-    ap.add_argument("--transport", choices=["pipe", "tcp", "both"], default="both")
-    ap.add_argument("--keep", action="store_true",
-                    help="keep each run's build dir (default: remove it at exit)")
-    ap.add_argument("--keep-on-fail", nargs="?", const="fleettest-logs",
-                    metavar="DIR",
-                    help="for targets that came back with anything unexpected, "
-                    "save the full build/test output under DIR/<run-id>/<target>/ "
-                    "and keep that target's remote run dir (clean targets are "
-                    "swept as usual). Makes a failure inspectable without "
-                    "repeating the run. DIR defaults to ./fleettest-logs")
-    ap.add_argument("--cleanup", action="store_true",
-                    help="kill stray flippers/test daemons and remove stray "
-                    "<builddir>-* run dirs (root-owned via sudo -n) on the "
-                    "targets, then exit; run between runs, not during one "
-                    "(kills are host-global)")
-    ap.add_argument("--jobs", type=int, help="override -j for both transports")
-    ap.add_argument("--full-tcp", action="store_true",
-                    help="run the whole suite in the tcp pass. By default that "
-                    "pass runs only the tests that can reach the daemon "
-                    "transport, since the rest just repeat the pipe pass over "
-                    "the same build")
-    ap.add_argument("--timing", action="store_true",
-                    help="report per-target wall-clock (push/build/test) to find "
-                    "the slowest target")
-    ap.add_argument("--repo", help="rsync source tree to build (default: cwd)")
-    ap.add_argument("--testsuite-repo",
-                    help="rsync tree to take runtests.py + testsuite/ from "
-                    "(default: --repo). Build one tree and run another's test "
-                    "suite against it, e.g. --repo ../rsync-v3.4 --testsuite-repo .")
-    ap.add_argument("--fleet", help="fleet config JSON (default: ~/.fleettest.json, "
-                    "else fleettest.json next to this script)")
-    ap.add_argument("--skip", metavar="LIST",
-                    help="comma-separated test-name globs to exclude from every "
-                    "run on every target (passed to runtests as RSYNC_EXCLUDE; "
-                    "the tests are not run). E.g. --skip 'chmod-option,prealloc*'")
-    ap.add_argument("--xfail", metavar="LIST",
-                    help="comma-separated test-name globs whose FAILURE is "
-                    "tolerated: a matching fail is listed but does not make a "
-                    "cell 'not OK'. For known stable-gap tests you still want to "
-                    "run. E.g. --xfail 'chmod-option,preallocate,crtimes'")
-    ap.add_argument("--list", action="store_true", help="list targets and exit")
-    args = ap.parse_args()
-
-    global SKIP_CSV, XFAIL_GLOBS, TIMING, FULL_TCP, BACKPORT_EXCLUDE
-    SKIP_CSV = ",".join(s.strip() for s in (args.skip or "").split(",") if s.strip())
-    XFAIL_GLOBS = [s.strip() for s in (args.xfail or "").split(",") if s.strip()]
-    TIMING = args.timing
-    FULL_TCP = args.full_tcp
-
-    global REPO, WORKFLOWS, TESTSUITE_REPO
-    REPO = Path(args.repo).resolve() if args.repo else Path.cwd()
-    TESTSUITE_REPO = Path(args.testsuite_repo).resolve() if args.testsuite_repo else REPO
-    # The expected-skip lists travel with the suite, so read workflows from the
-    # tree that provides the tests.
-    WORKFLOWS = TESTSUITE_REPO / ".github" / "workflows"
-
-    # A tree that is OLDER than the suite being run against it -- a backport
-    # branch under --testsuite-repo -- cannot pass tests for fixes and features
-    # it does not carry, and cannot build the suite's newer unit-test helpers.
-    # It declares those in its own testsuite/skiplist/backport.txt, which is
-    # read from the BUILT tree, not the suite tree, because only the built tree
-    # knows what it lacks.  The names are excluded outright (RSYNC_EXCLUDE)
-    # rather than declared as expected skips: some of them fail rather than
-    # skip, and an expected-skip list cannot describe a failure.
-    bp = REPO / "testsuite" / "skiplist" / "backport.txt"
-    if bp.is_file():
-        names = [ln.split("#", 1)[0].strip() for ln in bp.read_text().splitlines()]
-        names = [x for x in names if x]
-        if names:
-            SKIP_CSV = ",".join(x for x in ([SKIP_CSV] + names) if x)
-            BACKPORT_EXCLUDE[:] = names
-            print(f"[backport] excluding {len(names)} test(s) declared in "
-                  f"{bp.relative_to(REPO)}")
-    if not args.cleanup:
-        # The Python test suite (runtests.py + testsuite/) comes from
-        # TESTSUITE_REPO, so that is where runtests.py must live.  The build tree
-        # (REPO) only has to be a buildable rsync source -- it may be an older
-        # release whose runtests.py predates the Python suite, or lacks it.
-        if not (TESTSUITE_REPO / "runtests.py").is_file():
-            print(f"{TESTSUITE_REPO} has no runtests.py; run from inside a "
-                  f"checkout or pass --testsuite-repo a tree with the Python "
-                  f"test suite", file=sys.stderr)
-            return 2
-        if not (REPO / "rsync.h").is_file():
-            print(f"{REPO} is not an rsync source tree (no rsync.h); "
-                  f"run from inside a checkout or pass --repo", file=sys.stderr)
-            return 2
-
-    if args.fleet:
-        config_path = Path(args.fleet).resolve()
-        if not config_path.exists():
-            print(f"no fleet config at {config_path}", file=sys.stderr)
-            return 2
-    else:
-        config_path = next((p for p in DEFAULT_CONFIGS if p.exists()), None)
-        if config_path is None:
-            tried = " or ".join(str(p) for p in DEFAULT_CONFIGS)
-            print(f"no fleet config found (looked for {tried})\n"
-                  f"copy {EXAMPLE_CONFIG} to {SCRIPT_CONFIG} or {HOME_CONFIG} "
-                  f"(or pass --fleet PATH)", file=sys.stderr)
-            return 2
-    fleet = load_fleet(config_path)
-
-    if args.list:
-        for t in fleet:
-            host = t.ssh_host or "(local)"
-            skip = parse_workflow_skip(t.workflow)
-            proto = (",".join(f"proto{p}" for p in t.protocols)
-                     if t.protocols else "none")
-            print(f"{t.name:12} {host:18} {t.make:6} "
-                  f"pipe-skip={'set' if skip else 'unset'} protocols={proto}")
-        return 0
-
-    chosen = fleet
-    if args.targets:
-        want = [s.strip() for s in args.targets.split(",") if s.strip()]
-        by_name = {t.name: t for t in fleet}
-        bad = [w for w in want if w not in by_name]
-        if bad:
-            print(f"unknown target(s): {', '.join(bad)}", file=sys.stderr)
-            print(f"known: {', '.join(by_name)}", file=sys.stderr)
-            return 2
-        chosen = [by_name[w] for w in want]
-
-    if args.cleanup:
-        # Sweep every <builddir>-* run dir on the selected targets. NB: this
-        # also removes dirs belonging to runs that are still in progress, so
-        # only run it when no other fleettest runs are active (or scope with
-        # --targets).
-        return cleanup_remnants(chosen)
-
-    args.transports = ["pipe", "tcp"] if args.transport == "both" else [args.transport]
-    global TRANSPORTS
-    TRANSPORTS = args.transports
-    if "tcp" in args.transports and "pipe" not in args.transports and not FULL_TCP:
-        log("note: --transport tcp is the only pass, so it runs the WHOLE suite "
-            "(the daemon-only narrowing needs a pipe pass to cover the rest)")
-
-    # Give this run its own build dir on every target so concurrent runs don't
-    # collide, and name it after the target too, because two targets can share
-    # one machine: <builddir>-<run_id>-<target>. Without the target part they
-    # would push into the same tree, and the second would inherit the first's
-    # config.h/Makefile and never reconfigure with its own flags. The base name
-    # is still the prefix --cleanup globs.
-    args.run_id = secrets.token_hex(3)
-    for t in chosen:
-        t.builddir = f"{t.builddir}-{args.run_id}-{_dirsafe(t.name)}"
-    log(f"run {args.run_id}: build dir <target>:{chosen[0].builddir.rsplit('-', 1)[0]}-<target> "
-        f"(removed at exit; --keep to retain)")
-
-    # Remove each run dir when we exit -- success or failure, and best-effort on
-    # Ctrl-C/kill (a signal mid-push may still leave a remnant). SIGKILL can't be
-    # caught; `fleettest.py --cleanup` sweeps any such remnant.
-    if not args.keep:
-        _cleanup_targets.extend(chosen)
-        atexit.register(cleanup_run)
-        signal.signal(signal.SIGINT, _on_signal)
-        signal.signal(signal.SIGTERM, _on_signal)
-
-    # Stage committed HEAD (source-only). Each target regenerates its own
-    # build files with its own toolchain -- exactly like the CI jobs, which
-    # install autotools / python-markdown / dev-libs in their prepare step.
-    # (Pushing locally-generated files instead fights rsync's Makefile
-    # maintainer rules: a target with a different autoconf version sees
-    # "configure.sh has CHANGED" and errors.) So each target must be
-    # provisioned like its workflow -- see the module docstring.
-    staging = tempfile.mkdtemp(prefix="rsync-fleettest-stage.")
-    try:
-        ar = subprocess.run(f"git -C {REPO} archive HEAD | tar -x -C {staging}",
-                            shell=True, capture_output=True, text=True)
-        if ar.returncode != 0:
-            print(f"git archive failed: {ar.stderr}", file=sys.stderr)
-            return 2
-
-        # --testsuite-repo: overlay another tree's runtests.py + testsuite/ onto
-        # the built source (merge, no delete). Build REPO's rsync, but run
-        # TESTSUITE_REPO's suite against it. The leftover .test files from REPO
-        # are ignored by a Python runtests.py (it globs *_test.py).
-        if TESTSUITE_REPO != REPO:
-            ov = subprocess.run(
-                f"git -C {TESTSUITE_REPO} archive HEAD -- runtests.py testsuite "
-                f"| tar -x -C {staging}",
-                shell=True, capture_output=True, text=True)
-            if ov.returncode != 0:
-                print(f"testsuite overlay archive failed: {ov.stderr}", file=sys.stderr)
-                return 2
-
-        # Tests that opt into the non-root pass (same for every target).
-        args.nonroot_tests = discover_nonroot_tests(Path(staging) / "testsuite")
-
-        # Targets are grouped by machine, and a machine's targets run one after
-        # another. Two targets CAN name the same host -- an alternate-filesystem
-        # variant of another target does exactly that -- and running those at
-        # the same time breaks both: they would fight over the fixed ports the
-        # daemon tests claim, and over any other host-global state. Different
-        # machines still run concurrently, which is where the parallelism was.
-        groups: dict[str, list[Target]] = {}
-        for t in chosen:
-            groups.setdefault(t.ssh_host or "<local>", []).append(t)
-        for host, ts in groups.items():
-            if len(ts) > 1:
-                log(f"[{host}] {len(ts)} targets on one machine, run in "
-                    f"sequence: {', '.join(x.name for x in ts)}")
-
-        def run_group(ts: 'list[Target]') -> 'list[TargetResult]':
-            out = []
-            for t in ts:
-                try:
-                    out.append(run_target(t, args, staging))
-                except Exception as e:  # never let one target kill the run
-                    r = TargetResult(t.name)
-                    r.reachable = False
-                    r.error = f"harness exception: {e!r}"
-                    out.append(r)
-            return out
-
-        results: list[TargetResult] = []
-        with concurrent.futures.ThreadPoolExecutor(max_workers=len(groups)) as ex:
-            futs = {ex.submit(run_group, ts): ts for ts in groups.values()}
-            for fut in concurrent.futures.as_completed(futs):
-                ts = futs[fut]
-                try:
-                    results.extend(fut.result())
-                except Exception as e:  # a whole group died: account for each
-                    for t in ts:
-                        r = TargetResult(t.name)
-                        r.reachable = False
-                        r.error = f"harness exception: {e!r}"
-                        results.append(r)
-    finally:
-        subprocess.run(["rm", "-rf", staging])
-
-    # Before the exit sweep runs: mark failed targets' run dirs to survive and
-    # write their output locally, so the report can point at both.
-    kept = keep_on_fail(results, args, chosen) if args.keep_on_fail else []
-
-    all_ok = print_report(results, args, fleet)
-    if kept:
-        print("==== KEPT FOR POST-MORTEM (--keep-on-fail) ====")
-        for k in kept:
-            print(f"    {k}")
-        print("=" * 64)
-    if args.timing:
-        print_timing(results)
-    return 0 if all_ok else 1
-
-
-if __name__ == "__main__":
-    sys.exit(main())
diff --git a/testsuite/fuzzy_test.py b/testsuite/fuzzy_test.py
deleted file mode 100644
index 03c57301b..000000000
--- a/testsuite/fuzzy_test.py
+++ /dev/null
@@ -1,34 +0,0 @@
-#!/usr/bin/env python3
-# Python rewrite of testsuite/fuzzy.test.
-#
-# Test --fuzzy: with a matching-content file already in the destination
-# under a different name, rsync should use it as a basis for the new name
-# instead of re-transferring (and --delete-delay still removes the stale
-# basis file at the end).
-
-import time
-
-from rsyncfns import (
-    FROMDIR, SRCDIR, TODIR, cp_p, cp_touch, run_rsync, test_fail, verify_dirs,
-)
-
-
-FROMDIR.mkdir(parents=True, exist_ok=True)
-TODIR.mkdir(parents=True, exist_ok=True)
-
-cp_p(SRCDIR / 'rsync.c', FROMDIR / 'rsync.c')
-cp_touch(FROMDIR / 'rsync.c', TODIR / 'rsync2.c')
-time.sleep(1)
-
-# Drive rsync directly (rather than checkit) so we can capture --debug=FUZZY:
-# a final tree match alone would also be produced by a full transfer that
-# ignored --fuzzy, so assert the generator actually picked rsync2.c as the
-# fuzzy basis for rsync.c (generator.c find_fuzzy / "fuzzy basis selected").
-proc = run_rsync('-avvi', '--no-whole-file', '--fuzzy', '--delete-delay',
-                 '--debug=FUZZY', f'{FROMDIR}/', f'{TODIR}/',
-                 capture_output=True)
-if 'fuzzy basis selected for rsync.c: rsync2.c' not in proc.stdout:
-    test_fail("--fuzzy did not select rsync2.c as the basis for rsync.c; "
-              f"--debug=FUZZY output was:\n{proc.stdout}")
-# ...and --delete-delay still removes the stale basis, leaving TODIR == FROMDIR.
-verify_dirs(FROMDIR, TODIR)
diff --git a/testsuite/harness/__init__.py b/testsuite/harness/__init__.py
new file mode 100644
index 000000000..fef6081c6
--- /dev/null
+++ b/testsuite/harness/__init__.py
@@ -0,0 +1,14 @@
+from .context import TestContext, run
+from .filesystem import (allocated_size, assert_exists, assert_hardlinked, assert_is_symlink,
+                         assert_mode, assert_mtime_close, assert_not_exists,
+                         assert_not_hardlinked, assert_same, cp_p, is_a_link, make_data_file,
+                         make_text_file, make_tree, makepath, rmtree, set_supported_mode,
+                         walk_dirs, walk_files, write_text_file)
+from .metadata import (applies_to_peer, describe, discover_tests, metadata, placeholder_target,
+                       read_requirements, requires, resolve_test_path, test_name)
+from .profile import load_profile, merge_profiles, parse_peer_banner
+from .process import (forced_protocol, process_thread_count, rsh_cmd, rsync_argv,
+                      rsync_argv_for, rsync_command_binary, rsync_path_arg, rsync_supports,
+                      run_rsync, split_rsync_cmd, under_valgrind)
+from .results import (Exit, TestResult, test_fail, test_skipped, test_xfail, verdict_of,
+                      write_receipt)
diff --git a/testsuite/harness/context.py b/testsuite/harness/context.py
new file mode 100644
index 000000000..fa4d67ac6
--- /dev/null
+++ b/testsuite/harness/context.py
@@ -0,0 +1,23 @@
+import json
+import os
+from dataclasses import dataclass
+from pathlib import Path
+
+from .metadata import describe
+
+@dataclass(frozen=True)
+class TestContext:
+    scratch: Path
+    source: Path
+    destination: Path
+    expected: Path
+    repository: Path
+    tools: Path
+
+def run(test) -> None:
+    if os.environ.get('RSYNC_TEST_DESCRIBE') == '1':
+        print(json.dumps(describe(test), separators=(',', ':'), sort_keys=True))
+        return
+    scratch = Path(os.environ['scratchdir'])
+    test(TestContext(scratch, scratch / 'from', scratch / 'to', scratch / 'chk',
+                     Path(os.environ['srcdir']), Path(os.environ['TOOLDIR'])))
diff --git a/testsuite/harness/daemon.py b/testsuite/harness/daemon.py
new file mode 100644
index 000000000..ea574adbd
--- /dev/null
+++ b/testsuite/harness/daemon.py
@@ -0,0 +1,401 @@
+import atexit
+import fcntl
+import os
+import shlex
+import signal
+import socket
+import stat
+import struct
+import subprocess
+import sys
+import time
+
+from . import protocol
+from .process import rsync_argv, rsync_command_binary, rsync_path_arg, split_rsync_cmd
+from .results import test_fail, test_skipped
+
+RSYNC_PEER = os.environ.get('RSYNC_PEER', os.environ.get('RSYNC', 'rsync'))
+USE_TCP = os.environ.get('RSYNC_TEST_USE_TCP') == '1'
+
+_RSYNC_NAMES = {'rsync', 'rsync.exe'}
+for _command in (os.environ.get('RSYNC'), RSYNC_PEER):
+    if not _command:
+        continue
+    try:
+        _RSYNC_NAMES.add(os.path.basename(rsync_command_binary(_command)))
+    except ValueError:
+        pass
+
+_LOCK_PATH = '/tmp/rsync_test.lck'
+_LOCK_MAGIC = 0x9D4F2B8A
+_PID_BASE = 1 << 16
+_PID_SIZE = 8
+_lock_fd = None
+_reaped_stale = False
+
+def _check_magic(fd):
+    fcntl.lockf(fd, fcntl.LOCK_EX, 4, 0)
+    try:
+        record = os.pread(fd, 4, 0)
+        current = struct.unpack('=I', record)[0] if len(record) == 4 else 0
+        if current == 0:
+            os.pwrite(fd, struct.pack('=I', _LOCK_MAGIC), 0)
+        elif current != _LOCK_MAGIC:
+            os.close(fd)
+            test_fail(f'lock file {_LOCK_PATH} has layout magic {current:#010x}, '
+                      f'expected {_LOCK_MAGIC:#010x}; remove the stale file')
+    except (OSError, struct.error) as error:
+        test_fail(f'cannot verify lock file {_LOCK_PATH}: {error}')
+    finally:
+        try:
+            fcntl.lockf(fd, fcntl.LOCK_UN, 4, 0)
+        except OSError:
+            pass
+
+def _open_lock():
+    nofollow = getattr(os, 'O_NOFOLLOW', 0)
+    try:
+        fd = os.open(_LOCK_PATH, os.O_CREAT | os.O_EXCL | os.O_RDWR | nofollow, 0o666)
+    except FileExistsError:
+        fd = None
+    if fd is not None:
+        try:
+            os.fchmod(fd, 0o666)
+        except OSError:
+            pass
+        _check_magic(fd)
+        return fd
+    try:
+        fd = os.open(_LOCK_PATH, os.O_RDWR | nofollow)
+    except OSError as error:
+        test_fail(f'cannot open lock file {_LOCK_PATH}: {error}')
+    info = os.fstat(fd)
+    if not stat.S_ISREG(info.st_mode) or info.st_nlink != 1:
+        os.close(fd)
+        test_fail(f'lock file {_LOCK_PATH} is not a regular file with one link')
+    _check_magic(fd)
+    return fd
+
+def _record_process(port, process_group, pid):
+    if _lock_fd is None:
+        return
+    try:
+        os.pwrite(_lock_fd, struct.pack('=ii', process_group, pid),
+                  _PID_BASE + port * _PID_SIZE)
+    except (OSError, struct.error):
+        pass
+
+def _read_process(port):
+    if _lock_fd is None:
+        return 0, 0
+    try:
+        record = os.pread(_lock_fd, _PID_SIZE, _PID_BASE + port * _PID_SIZE)
+        if len(record) != _PID_SIZE:
+            return 0, 0
+        process_group, pid = struct.unpack('=ii', record)
+    except (OSError, struct.error):
+        return 0, 0
+    return (process_group, pid) if pid > 1 else (0, 0)
+
+def _is_rsync(pid):
+    if pid <= 1 or pid == os.getpid():
+        return False
+    try:
+        os.kill(pid, 0)
+    except OSError:
+        return False
+    for argv in (['ps', '-p', str(pid), '-o', 'comm='], ['ps', '-p', str(pid)]):
+        try:
+            result = subprocess.run(argv, stdout=subprocess.PIPE,
+                                    stderr=subprocess.DEVNULL, text=True, timeout=5)
+        except (OSError, subprocess.SubprocessError):
+            return False
+        if result.returncode == 0:
+            lines = [line.split() for line in result.stdout.splitlines() if line.split()]
+            return bool(lines and os.path.basename(lines[-1][-1]) in _RSYNC_NAMES)
+    return False
+
+def _wait_gone(pid, timeout):
+    deadline = time.monotonic() + timeout
+    while _is_rsync(pid):
+        if time.monotonic() >= deadline:
+            return False
+        time.sleep(0.1)
+    return True
+
+def _kill_windows_process(pid):
+    if not sys.platform.startswith('cygwin'):
+        return
+    try:
+        result = subprocess.run(['ps', '-W'], capture_output=True, text=True, timeout=10)
+    except (OSError, subprocess.SubprocessError):
+        return
+    for line in result.stdout.splitlines():
+        fields = line.split()
+        if len(fields) >= 4 and fields[0] == str(pid):
+            try:
+                subprocess.run(['taskkill', '/F', '/PID', fields[3]],
+                               capture_output=True, timeout=10)
+            except (OSError, subprocess.SubprocessError):
+                pass
+            return
+
+def _reap_group(process_group, pid):
+    if not _is_rsync(pid):
+        return False
+    try:
+        if process_group > 1 and process_group != os.getpgrp():
+            os.killpg(process_group, signal.SIGKILL)
+        else:
+            os.kill(pid, signal.SIGKILL)
+    except OSError:
+        try:
+            os.kill(pid, signal.SIGKILL)
+        except OSError:
+            pass
+    if _wait_gone(pid, 2):
+        return True
+    _kill_windows_process(pid)
+    return _wait_gone(pid, 2)
+
+def _reap_port(port):
+    process_group, pid = _read_process(port)
+    if not _reap_group(process_group, pid):
+        return False
+    _record_process(port, 0, 0)
+    time.sleep(0.2)
+    return True
+
+def _reap_stale():
+    if _lock_fd is None:
+        return
+    try:
+        size = os.fstat(_lock_fd).st_size
+        region = os.pread(_lock_fd, max(0, size - _PID_BASE), _PID_BASE)
+    except OSError:
+        return
+    for port in range(min(len(region) // _PID_SIZE, 65536)):
+        start = port * _PID_SIZE
+        process_group, pid = struct.unpack('=ii', region[start:start + _PID_SIZE])
+        if pid <= 1:
+            continue
+        try:
+            fcntl.lockf(_lock_fd, fcntl.LOCK_EX | fcntl.LOCK_NB, 1, port)
+        except OSError:
+            continue
+        try:
+            if _reap_group(process_group, pid):
+                _record_process(port, 0, 0)
+        finally:
+            try:
+                fcntl.lockf(_lock_fd, fcntl.LOCK_UN, 1, port)
+            except OSError:
+                pass
+
+def _claim_setup():
+    global _lock_fd, _reaped_stale
+    if _lock_fd is None:
+        _lock_fd = _open_lock()
+    if not _reaped_stale:
+        _reaped_stale = True
+        _reap_stale()
+
+def _bindable(port, reaped=False, fatal=True):
+    listener = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+    listener.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
+    try:
+        listener.bind(('127.0.0.1', port))
+        return True
+    except OSError as error:
+        failure = error
+    finally:
+        listener.close()
+    if not reaped and _reap_port(port):
+        return _bindable(port, reaped=True, fatal=fatal)
+    if not fatal:
+        return False
+    test_fail(f'port {port} is still bound to 127.0.0.1: {failure.strerror}')
+    return False
+
+def claim_ports(*ports):
+    _claim_setup()
+    for port in sorted(ports):
+        fcntl.lockf(_lock_fd, fcntl.LOCK_EX, 1, port)
+        _bindable(port)
+
+def claim_free_port(preferred):
+    _claim_setup()
+    candidates = [preferred + offset for offset in (0, 1000, 2000, 3000, 4000)]
+    for port in candidates:
+        if 1024 < port < 65536:
+            fcntl.lockf(_lock_fd, fcntl.LOCK_EX, 1, port)
+            if _bindable(port, fatal=False):
+                return port
+    test_fail(f'no usable TCP port near {preferred}: {", ".join(map(str, candidates))}')
+    return preferred
+
+def _set_parent_death_signal():
+    if not sys.platform.startswith('linux'):
+        return
+    try:
+        import ctypes
+        ctypes.CDLL('libc.so.6', use_errno=True).prctl(1, 15, 0, 0, 0)
+    except OSError:
+        pass
+
+def _children(pid):
+    argv = (['ps', '-W'] if sys.platform.startswith('cygwin')
+            else ['ps', '-A', '-o', 'pid=,ppid='])
+    try:
+        result = subprocess.run(argv, capture_output=True, text=True, timeout=10)
+    except (OSError, subprocess.SubprocessError):
+        return []
+    children = []
+    for line in result.stdout.splitlines():
+        fields = line.split()
+        if len(fields) >= 2 and fields[1] == str(pid):
+            try:
+                children.append(int(fields[0]))
+            except ValueError:
+                pass
+    return children
+
+def _kill(pid):
+    for sig in (signal.SIGTERM, signal.SIGKILL):
+        if not _is_rsync(pid):
+            return
+        try:
+            os.kill(pid, sig)
+        except OSError:
+            return
+        time.sleep(0.3)
+    if _is_rsync(pid):
+        _kill_windows_process(pid)
+
+def _stop(proc):
+    if proc.poll() is not None:
+        return
+    children = _children(proc.pid)
+    try:
+        proc.terminate()
+        proc.wait(timeout=2)
+    except subprocess.TimeoutExpired:
+        try:
+            proc.kill()
+            proc.wait(timeout=1)
+        except (subprocess.TimeoutExpired, OSError):
+            pass
+        _kill_windows_process(proc.pid)
+    except OSError:
+        pass
+    for pid in children:
+        _kill(pid)
+
+def _cleanup(proc, port):
+    _stop(proc)
+    if not _is_rsync(proc.pid):
+        _record_process(port, 0, 0)
+
+def start_rsyncd(config, port, rsync_cmd=None, stdin=subprocess.DEVNULL,
+                 address='127.0.0.1'):
+    if address not in ('127.0.0.1', '::1'):
+        test_fail(f'refusing non-loopback test daemon address {address!r}')
+    argv = split_rsync_cmd(rsync_cmd or RSYNC_PEER) + [
+        '--daemon', '--no-detach', f'--address={address}', f'--port={port}',
+        f'--config={config}',
+    ]
+    proc = subprocess.Popen(argv, stdin=stdin, stdout=subprocess.DEVNULL,
+                            stderr=subprocess.DEVNULL,
+                            preexec_fn=_set_parent_death_signal)
+    _record_process(port, os.getpgrp(), proc.pid)
+    atexit.register(_cleanup, proc, port)
+    deadline = time.monotonic() + 10
+    failure = None
+    while time.monotonic() < deadline:
+        if proc.poll() is not None:
+            test_fail(f'rsyncd exited before listening on port {port}: {proc.returncode}')
+        try:
+            with socket.create_connection((address, port), timeout=0.5):
+                return proc
+        except OSError as error:
+            failure = error
+            time.sleep(0.05)
+    _stop(proc)
+    test_fail(f'rsyncd never listened on {address}:{port}: {failure}')
+
+def start_test_daemon(config, port, rsync_cmd=None):
+    command = rsync_cmd or RSYNC_PEER
+    if USE_TCP:
+        port = claim_free_port(port)
+        start_rsyncd(config, port, command)
+        return f'rsync://localhost:{port}/'
+    os.environ['RSYNC_CONNECT_PROG'] = (
+        f'{rsync_path_arg(command)} --config={shlex.quote(str(config))} --daemon')
+    return 'rsync://localhost/'
+
+def probe_module(url, module):
+    return subprocess.run(
+        rsync_argv(os.environ['RSYNC'], '-r', f'{url}{module}/'),
+        stdout=subprocess.DEVNULL, stderr=subprocess.PIPE, text=True,
+    ).returncode
+
+def require_tcp(reason):
+    if not USE_TCP:
+        test_skipped(reason, capability='tcp')
+
+def require_asan(reason, command=None):
+    argv = split_rsync_cmd(command or RSYNC_PEER)
+    try:
+        result = subprocess.run(argv + ['--version'],
+                                env={**os.environ, 'ASAN_OPTIONS': 'help=1'},
+                                stdout=subprocess.DEVNULL, stderr=subprocess.PIPE,
+                                timeout=15)
+    except (OSError, subprocess.SubprocessError):
+        test_skipped(reason, capability='asan')
+        return
+    if b'AddressSanitizer' not in result.stderr:
+        test_skipped(reason, capability='asan')
+
+def start_stdio_daemon(config, timeout=10, env=None):
+    listener = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+    parent = None
+    try:
+        listener.bind(('127.0.0.1', 0))
+        listener.listen(1)
+        parent = socket.create_connection(listener.getsockname(), timeout)
+        child, _ = listener.accept()
+    except OSError:
+        if parent is not None:
+            parent.close()
+        raise
+    finally:
+        listener.close()
+    try:
+        proc = subprocess.Popen(
+            rsync_argv(RSYNC_PEER, '--daemon', '--no-detach', f'--config={config}'),
+            stdin=child.fileno(), stdout=child.fileno(), stderr=subprocess.PIPE,
+            close_fds=True, env=env,
+        )
+    except (OSError, ValueError):
+        parent.close()
+        child.close()
+        raise
+    child.close()
+    return protocol.DaemonClient.from_socket(parent, timeout), proc
+
+def finish_stdio_daemon(client, proc, timeout=5):
+    try:
+        client.drain(timeout=0.25)
+    except OSError:
+        pass
+    client.close()
+    try:
+        proc.wait(timeout=timeout)
+    except subprocess.TimeoutExpired:
+        proc.terminate()
+        try:
+            proc.wait(timeout=timeout)
+        except subprocess.TimeoutExpired:
+            proc.kill()
+            proc.wait(timeout=timeout)
+    return proc.stderr.read().decode('utf-8', 'replace') if proc.stderr else ''
diff --git a/testsuite/harness/filesystem.py b/testsuite/harness/filesystem.py
new file mode 100644
index 000000000..7dc432936
--- /dev/null
+++ b/testsuite/harness/filesystem.py
@@ -0,0 +1,166 @@
+import filecmp
+import os
+import shutil
+import stat
+from pathlib import Path
+
+from .results import test_fail
+
+def makepath(*paths) -> None:
+    for path in paths:
+        os.makedirs(path, exist_ok=True)
+
+def rmtree(path) -> None:
+    path = Path(path)
+    for _ in range(8):
+        try:
+            mode = path.lstat().st_mode
+        except FileNotFoundError:
+            return
+        try:
+            if stat.S_ISDIR(mode):
+                shutil.rmtree(path)
+            else:
+                path.unlink()
+            return
+        except FileNotFoundError:
+            return
+        except OSError:
+            continue
+
+def is_a_link(path) -> bool:
+    return os.path.islink(path)
+
+def cp_p(source, destination) -> None:
+    shutil.copy2(source, destination)
+
+def allocated_size(path) -> int:
+    return os.stat(path).st_blocks * 512
+
+def set_supported_mode(path, modes) -> None:
+    for mode in modes:
+        try:
+            os.chmod(path, mode)
+            return
+        except PermissionError:
+            pass
+    os.chmod(path, modes[-1])
+
+def make_data_file(path, size: int) -> None:
+    path = str(path)
+    if os.path.exists('/dev/urandom'):
+        try:
+            with open('/dev/urandom', 'rb') as source, open(path, 'wb') as destination:
+                remaining = size
+                while remaining:
+                    chunk = source.read(min(remaining, 1 << 16))
+                    if not chunk:
+                        break
+                    destination.write(chunk)
+                    remaining -= len(chunk)
+            if remaining == 0:
+                return
+        except OSError:
+            pass
+
+    path_seed = int.from_bytes(path.encode(), 'big') & 0xFFFFFFFF
+    state = (os.getpid() + path_seed) % 2147483648
+    with open(path, 'wb') as output:
+        data = bytearray(size)
+        for index in range(size):
+            state = (state * 1103515245 + 12345) % 2147483648
+            data[index] = ((state >> 16) % 94) + 33
+        output.write(bytes(data))
+
+def make_text_file(path, lines: int = 100) -> None:
+    content = ''.join(
+        'line %06d  the quick brown fox jumps over the lazy dog  %d %d\n'
+        % (index, (index * 31) % 97, (index * 131) % 89)
+        for index in range(1, lines + 1)
+    )
+    with open(str(path), 'w') as output:
+        output.write(content)
+
+def write_text_file(path, content, mode=None):
+    path = Path(path)
+    path.write_text(content)
+    if mode is not None:
+        path.chmod(mode)
+    return path
+
+def make_tree(root, depth: int = 3, *, data: bool = False,
+              content_lines: int = 20, data_size: int = 4096,
+              dirname: str = 'd', leaf: str = 'f'):
+    root = Path(root)
+    root.mkdir(parents=True, exist_ok=True)
+    dirs = []
+    files = []
+    current = root
+    for level in range(depth + 1):
+        path = current / f'{leaf}{level}'
+        if data:
+            make_data_file(path, data_size)
+        else:
+            make_text_file(path, content_lines)
+        files.append(path)
+        if level < depth:
+            current = current / f'{dirname}{level + 1}'
+            current.mkdir(exist_ok=True)
+            dirs.append(current)
+    return dirs, files
+
+def walk_files(root) -> list:
+    root = Path(root)
+    return sorted(path for path in root.rglob('*') if path.is_file() and not path.is_symlink())
+
+def walk_dirs(root) -> list:
+    root = Path(root)
+    return sorted(path for path in root.rglob('*') if path.is_dir() and not path.is_symlink())
+
+def _tag(label: str) -> str:
+    return f'{label}: ' if label else ''
+
+def assert_same(first, second, label: str = '') -> None:
+    if not filecmp.cmp(str(first), str(second), shallow=False):
+        test_fail(f'{_tag(label)}content differs between {first} and {second}')
+
+def assert_mode(path, expected_octal: int, label: str = '') -> None:
+    mode = stat.S_IMODE(os.stat(path, follow_symlinks=False).st_mode)
+    if mode != expected_octal:
+        test_fail(f'{_tag(label)}mode {mode:04o} != expected {expected_octal:04o} on {path}')
+
+def assert_mtime_close(first, second, tol: float = 1.0, label: str = '') -> None:
+    first_mtime = os.stat(first, follow_symlinks=False).st_mtime
+    second_mtime = second if isinstance(second, (int, float)) else os.stat(
+        second, follow_symlinks=False).st_mtime
+    if abs(first_mtime - second_mtime) > tol:
+        test_fail(f'{_tag(label)}mtime {first_mtime} vs {second_mtime} differ by > {tol}s (checking {first})')
+
+def assert_is_symlink(path, target: str = None, label: str = '') -> None:
+    if not os.path.islink(path):
+        test_fail(f'{_tag(label)}{path} is not a symlink')
+    if target is not None:
+        actual = os.readlink(path)
+        if actual != target:
+            test_fail(f'{_tag(label)}{path} -> {actual!r}, expected {target!r}')
+
+def assert_hardlinked(first, second, label: str = '') -> None:
+    first_stat = os.stat(first, follow_symlinks=False)
+    second_stat = os.stat(second, follow_symlinks=False)
+    if (first_stat.st_dev, first_stat.st_ino) != (second_stat.st_dev, second_stat.st_ino):
+        test_fail(f'{_tag(label)}{first} and {second} are not hard-linked '
+                  f'(ino {first_stat.st_ino} vs {second_stat.st_ino})')
+
+def assert_not_hardlinked(first, second, label: str = '') -> None:
+    first_stat = os.stat(first, follow_symlinks=False)
+    second_stat = os.stat(second, follow_symlinks=False)
+    if (first_stat.st_dev, first_stat.st_ino) == (second_stat.st_dev, second_stat.st_ino):
+        test_fail(f'{_tag(label)}{first} and {second} unexpectedly share inode {first_stat.st_ino}')
+
+def assert_exists(path, label: str = '') -> None:
+    if not os.path.lexists(path):
+        test_fail(f'{_tag(label)}{path} does not exist')
+
+def assert_not_exists(path, label: str = '') -> None:
+    if os.path.lexists(path):
+        test_fail(f'{_tag(label)}{path} exists but should not')
diff --git a/testsuite/harness/metadata.py b/testsuite/harness/metadata.py
new file mode 100644
index 000000000..659caac9c
--- /dev/null
+++ b/testsuite/harness/metadata.py
@@ -0,0 +1,169 @@
+from __future__ import annotations
+
+import ast
+import re
+from dataclasses import asdict, dataclass
+from pathlib import Path
+from typing import Callable, Iterable, Optional
+
+@dataclass(frozen=True)
+class Requirements:
+    features: tuple[str, ...] = ()
+    protocols: tuple[int, ...] = ()
+    transports: tuple[str, ...] = ()
+    min_peer: Optional[str] = None
+    cost: str = 'normal'
+    mutates: tuple[str, ...] = ()
+    tags: tuple[str, ...] = ()
+
+    def __post_init__(self):
+        groups = self.features, self.transports, self.mutates, self.tags
+        if not all(isinstance(value, str) and value for values in groups for value in values):
+            raise ValueError('metadata names must be non-empty strings')
+        if any(type(value) is not int or value <= 0 for value in self.protocols):
+            raise ValueError('protocols must be positive integers')
+        if self.transports and set(self.transports) - {'pipe', 'tcp'}:
+            raise ValueError('invalid transport')
+        if self.min_peer is not None and (not isinstance(self.min_peer, str)
+                                          or not re.fullmatch(r'\d+(?:\.\d+)+', self.min_peer)):
+            raise ValueError('invalid minimum peer')
+        if self.cost not in ('normal', 'expensive', 'stress'):
+            raise ValueError('invalid cost')
+
+def _ordered(values: Iterable) -> tuple:
+    if not isinstance(values, (tuple, list, set, frozenset)):
+        raise ValueError('metadata collections must be lists, tuples or sets')
+    try:
+        return tuple(sorted(set(values)))
+    except TypeError as error:
+        raise ValueError('metadata collection values must share a type') from error
+
+def metadata(*, features=(), protocols=(), transports=(), min_peer=None,
+             cost='normal', mutates=(), tags=()):
+    return Requirements(_ordered(features), _ordered(protocols), _ordered(transports), min_peer,
+                        cost, _ordered(mutates), _ordered(tags))
+
+def requires(*, features=(), protocols=(), transports=(), min_peer=None,
+             cost='normal', mutates=(), tags=()):
+    requirements = metadata(features=features, protocols=protocols, transports=transports,
+                            min_peer=min_peer, cost=cost, mutates=mutates, tags=tags)
+
+    def decorate(function: Callable) -> Callable:
+        function.__test_requirements__ = requirements
+        return function
+
+    return decorate
+
+def describe(function: Callable) -> dict:
+    requirements = getattr(function, '__test_requirements__', Requirements())
+    return asdict(requirements)
+
+def placeholder_target(path):
+    path = Path(path)
+    try:
+        if path.is_symlink() or path.stat().st_size > 255:
+            return None
+        name = path.read_text(encoding='utf-8').strip()
+    except (OSError, UnicodeError):
+        return None
+    if not name.endswith('.py') or Path(name).name != name or name == path.name:
+        return None
+    target = path.with_name(name)
+    return target if target.is_file() else None
+
+def test_name(path) -> str:
+    name = Path(path).name
+    if not name.endswith('.py'):
+        raise ValueError(f'{path}: not a test script')
+    return Path(name).stem
+
+def discover_tests(directory) -> list[Path]:
+    directory = Path(directory)
+    paths = sorted(path for path in directory.rglob('*.py') if not path.is_dir())
+    names = {}
+    for path in paths:
+        name = test_name(path)
+        if name in names:
+            raise ValueError(f'duplicate test name {name!r}: {names[name]} and {path}')
+        names[name] = path
+    return [names[name] for name in sorted(names)]
+
+def resolve_test_path(path):
+    path = Path(path)
+    seen = set()
+    while True:
+        if path in seen:
+            raise ValueError(f'{path}: placeholder cycle')
+        seen.add(path)
+        if path.is_symlink():
+            try:
+                path = path.resolve(strict=True)
+            except (OSError, RuntimeError) as error:
+                raise ValueError(f'{path}: invalid test link') from error
+            continue
+        target = placeholder_target(path)
+        if not target:
+            return path
+        path = target
+
+def read_requirements(path) -> Optional[dict]:
+    path = resolve_test_path(path)
+    tree = ast.parse(path.read_text(encoding='utf-8'), filename=str(path))
+    requirements = None
+    for node in tree.body:
+        calls = []
+        if isinstance(node, ast.Expr) and isinstance(node.value, ast.Call):
+            calls.append(node.value)
+        if not isinstance(node, (ast.FunctionDef, ast.AsyncFunctionDef)) or node.name != 'test':
+            decorators = ()
+        else:
+            decorators = node.decorator_list
+        calls.extend(decorator for decorator in decorators if isinstance(decorator, ast.Call))
+        for call in calls:
+            if not isinstance(call.func, ast.Name):
+                continue
+            if call.func.id not in ('metadata', 'requires') or call.args:
+                continue
+            values = {item.arg: ast.literal_eval(item.value) for item in call.keywords}
+            requirements = metadata(**values)
+            break
+        if requirements:
+            break
+
+    features = set(requirements.features if requirements else ())
+    for node in ast.walk(tree):
+        if not isinstance(node, ast.Call) or not isinstance(node.func, ast.Name):
+            continue
+        if node.func.id == 'require_tcp':
+            features.add('tcp')
+        elif node.func.id == 'require_asan':
+            features.add('asan')
+        elif node.func.id == 'setup_chroot_inner':
+            features.update(('chroot', 'root'))
+        elif node.func.id == 'build_patched_rsync':
+            features.add('native_build')
+        elif node.func.id == 'test_skipped':
+            for keyword in node.keywords:
+                if keyword.arg == 'capability' and isinstance(keyword.value, ast.Constant):
+                    if not isinstance(keyword.value.value, str) or not keyword.value.value:
+                        raise ValueError(f'{path}: invalid capability')
+                    features.add(keyword.value.value)
+    if not requirements and not features:
+        return None
+    values = asdict(requirements or Requirements())
+    values['features'] = tuple(sorted(features))
+    return values
+
+def applies_to_peer(requirements, peer, protocol, transport=None):
+    if not requirements or 'version-mix' not in requirements['tags']:
+        return False
+    if requirements['min_peer']:
+        current = tuple(int(part) for part in peer.split('.'))
+        minimum = tuple(int(part) for part in requirements['min_peer'].split('.'))
+        if current < minimum:
+            return False
+    if requirements['protocols'] and protocol not in requirements['protocols']:
+        return False
+    if transport and requirements['transports'] and transport not in requirements['transports']:
+        return False
+    return True
diff --git a/testsuite/harness/mutation.py b/testsuite/harness/mutation.py
new file mode 100644
index 000000000..7aa96c5f8
--- /dev/null
+++ b/testsuite/harness/mutation.py
@@ -0,0 +1,289 @@
+import math
+import os
+import re
+import shlex
+import shutil
+import subprocess
+import sys
+import threading
+import time
+from pathlib import Path
+from types import SimpleNamespace
+
+from .filesystem import make_data_file, rmtree
+from .process import rsync_argv
+from .results import test_fail
+
+TARGET = 'zzz_target'
+
+_RACE_TIMEOUT_SET = 'race_timeout' in os.environ
+try:
+    RACE_TIMEOUT = float(os.environ.get('race_timeout', '5'))
+except ValueError:
+    RACE_TIMEOUT = 5.0
+    _RACE_TIMEOUT_SET = False
+
+def race_budget(default: float = 5.0) -> float:
+    if _RACE_TIMEOUT_SET and math.isfinite(RACE_TIMEOUT) and RACE_TIMEOUT > 0:
+        return RACE_TIMEOUT
+    return default
+
+def start_path_flipper(name_a, name_b):
+    code = (
+        "import os, sys, time\n"
+        "a, b = sys.argv[1], sys.argv[2]\n"
+        "tmp = a + '.flip'\n"
+        "parent = os.getppid()\n"
+        "deadline = time.monotonic() + 300\n"
+        "while os.getppid() == parent and time.monotonic() < deadline:\n"
+        "    try:\n"
+        "        os.rename(a, tmp); os.rename(b, a); os.rename(tmp, b)\n"
+        "    except OSError:\n"
+        "        pass\n"
+    )
+    return subprocess.Popen([sys.executable, '-c', code, str(name_a), str(name_b)])
+
+def stop_flipper(process):
+    process.terminate()
+    try:
+        process.wait(timeout=2)
+    except subprocess.TimeoutExpired:
+        process.kill()
+        process.wait()
+
+_C_FLIPPER_SRC = r'''
+/* Repeatedly swap sibling paths while rsync traverses them. Prefer atomic
+ * renameat2(RENAME_EXCHANGE) and fall back to three renames. */
+#define _GNU_SOURCE 1
+#include "config.h"
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <fcntl.h>
+#include <errno.h>
+#include <time.h>
+#include <sys/stat.h>
+#if defined(__linux__)
+# include <sys/syscall.h>
+# ifndef RENAME_EXCHANGE
+#  define RENAME_EXCHANGE (1 << 1)
+# endif
+#endif
+
+static double mono(void) {
+    struct timespec t;
+    clock_gettime(CLOCK_MONOTONIC, &t);
+    return t.tv_sec + t.tv_nsec / 1e9;
+}
+
+static int use_exchange = 1;
+
+static void flip(const char *a, const char *b) {
+#if defined(__linux__) && defined(SYS_renameat2)
+    if (use_exchange) {
+        if (syscall(SYS_renameat2, AT_FDCWD, a, AT_FDCWD, b, RENAME_EXCHANGE) == 0)
+            return;
+        if (errno == ENOSYS || errno == EINVAL || errno == EOPNOTSUPP)
+            use_exchange = 0;
+        else
+            return;
+    }
+#endif
+    {
+        char tmp[4096];
+        if (snprintf(tmp, sizeof tmp, "%s.flip", a) >= (int)sizeof tmp)
+            return;
+        rmdir(tmp); unlink(tmp);
+        if (rename(a, tmp) != 0) {
+            mkdir(a, 0700);
+            return;
+        }
+        if (rename(b, a) != 0)
+            rename(tmp, a);
+        else
+            rename(tmp, b);
+    }
+}
+
+int main(int argc, char **argv) {
+    if (argc < 3) {
+        fprintf(stderr, "usage: %s PATH_A PATH_B\n", argv[0]);
+        return 2;
+    }
+    const char *a = argv[1], *b = argv[2];
+    pid_t parent = getppid();
+    double deadline = mono() + 300.0;
+    while (getppid() == parent && mono() < deadline)
+        flip(a, b);
+    return 0;
+}
+'''
+
+_c_flipper_bin = None
+
+def _detect_cc():
+    compiler = os.environ.get('CC')
+    if compiler:
+        return compiler
+    for directory in (Path(os.environ['TOOLDIR']), Path(os.environ['srcdir'])):
+        makefile = directory / 'Makefile'
+        if not makefile.is_file():
+            continue
+        match = re.search(r'(?m)^CC\s*=\s*(.+?)\s*$', makefile.read_text())
+        if match and match.group(1):
+            return match.group(1)
+    for compiler in ('cc', 'gcc', 'clang'):
+        if shutil.which(compiler):
+            return compiler
+    return None
+
+def compile_c_flipper():
+    global _c_flipper_bin
+    if _c_flipper_bin is not None:
+        return _c_flipper_bin or None
+    compiler = _detect_cc()
+    scratch = Path(os.environ['scratchdir'])
+    source_root = Path(os.environ['srcdir'])
+    tools = Path(os.environ['TOOLDIR'])
+    source = scratch / 't_flipper.c'
+    output = scratch / ('t_flipper' + ('.exe' if os.name == 'nt' else ''))
+    if not compiler:
+        _c_flipper_bin = ''
+        return None
+    source.write_text(_C_FLIPPER_SRC)
+    command = shlex.split(compiler) + [
+        '-O2', f'-I{tools}', f'-I{source_root}', '-o', str(output), str(source),
+    ]
+    result = subprocess.run(command, stdout=subprocess.PIPE, stderr=subprocess.STDOUT,
+                            text=True)
+    if result.returncode != 0 or not os.access(output, os.X_OK):
+        _c_flipper_bin = ''
+        return None
+    _c_flipper_bin = str(output)
+    return _c_flipper_bin
+
+def start_c_flipper(name_a, name_b):
+    executable = compile_c_flipper()
+    if executable:
+        return subprocess.Popen([executable, str(name_a), str(name_b)])
+    return start_path_flipper(name_a, name_b)
+
+def find_attacker_uid():
+    import pwd
+    for name in ('nobody', 'nfsnobody', 'daemon'):
+        try:
+            uid = pwd.getpwnam(name).pw_uid
+        except KeyError:
+            continue
+        if uid != 0 and uid != os.geteuid():
+            return uid
+    return None
+
+def run_symlink_matrix(option, case, *, paths=('abs', 'rel'),
+                       locations=('leaf', 'parent'), label=''):
+    title = option + (f' [{label}]' if label else '')
+    attacker_uid = find_attacker_uid() if os.geteuid() == 0 else None
+    slug = re.sub(r'[^a-z0-9]+', '-', title.lower()).strip('-')
+    scratch = Path(os.environ['scratchdir'])
+
+    for path_form in paths:
+        for location in locations:
+            for insecure in (False, True):
+                owners = ('self', 'cross') if attacker_uid is not None else ('self',)
+                for owner in owners:
+                    base = scratch / (f'{slug}-{owner}-{path_form}-{location}-'
+                                      + ('ins' if insecure else 'safe'))
+                    rmtree(base)
+                    base.mkdir(parents=True)
+                    context = SimpleNamespace(
+                        base=base, outside=base / 'outside', plant=base / 'plant',
+                        owner=owner, att_uid=attacker_uid, abspath=path_form,
+                        where=location, insecure=insecure,
+                    )
+                    context.outside.mkdir()
+                    context.plant.mkdir()
+
+                    def plant_link(path, target, current=context):
+                        os.symlink(target, path)
+                        if current.owner == 'cross':
+                            os.lchown(path, current.att_uid, current.att_uid)
+
+                    context.plant_link = plant_link
+                    followed = bool(case(context))
+                    expected = insecure or owner == 'self'
+                    cell = f"{path_form} {location} {'insecure' if insecure else 'safe'}"
+                    if followed and not expected:
+                        test_fail(
+                            f'{title}: CROSS-UID {cell}: the planted symlink was '
+                            'FOLLOWED (operation escaped outside). An operator path '
+                            'must refuse a symlink not owned by uid 0 or the effective uid.')
+                    if not followed and expected:
+                        reason = ('--insecure-links did not restore symlink following'
+                                  if insecure else
+                                  'the operator-owned symlink was refused')
+                        prefix = 'CROSS' if owner == 'cross' else 'SAME'
+                        test_fail(f'{title}: {prefix}-UID {cell}: {reason}')
+    if attacker_uid is None and os.geteuid() != 0:
+        print(f'{title}: same-uid cells confirmed; cross-uid cells need root (skipped)')
+
+def plant_operator_symlink(context, relative_anchor, kind='dir'):
+    base = context.plant if context.abspath == 'abs' else relative_anchor
+    if kind == 'file':
+        victim = context.outside / 'victim'
+        if context.where == 'leaf':
+            link = base / 'osl'
+            context.plant_link(link, victim)
+            return (str(link) if context.abspath == 'abs' else 'osl'), victim
+        link = base / 'opd'
+        context.plant_link(link, context.outside)
+        return ((str(link / 'victim') if context.abspath == 'abs' else 'opd/victim'), victim)
+    if context.where == 'leaf':
+        link = base / 'osl'
+        context.plant_link(link, context.outside)
+        return (str(link) if context.abspath == 'abs' else 'osl'), context.outside
+    link = base / 'opd'
+    context.plant_link(link, context.outside)
+    return ((str(link / 'sub') if context.abspath == 'abs' else 'opd/sub'),
+            context.outside / 'sub')
+
+def run_mutating_transfer(setup, mutate, *, options=('-a',),
+                          pacer_bytes=6 * 1024 * 1024, bwlimit=1500, delay=0.6):
+    base = Path(os.environ['scratchdir']) / 'mutate'
+    rmtree(base)
+    source = base / 'source'
+    destination = base / 'destination'
+    source.mkdir(parents=True)
+    destination.mkdir()
+    make_data_file(source / 'aaa_pacer', pacer_bytes)
+    setup(source)
+
+    errors = []
+
+    def worker():
+        time.sleep(delay)
+        try:
+            mutate(source)
+        except Exception as error:
+            errors.append(error)
+
+    thread = threading.Thread(target=worker)
+    thread.start()
+    result = subprocess.run(
+        rsync_argv(os.environ['RSYNC'], *options, '--no-inc-recursive',
+                   f'--bwlimit={bwlimit}', f'{source}/', f'{destination}/'),
+        capture_output=True, text=True,
+    )
+    thread.join()
+    if errors:
+        test_fail(f'test mutation failed: {errors[0]!r}')
+    return result, source, destination
+
+def assert_no_protocol_abort(result):
+    output = result.stdout + result.stderr
+    if 'received more data than file length' in output:
+        test_fail(f'transfer aborted after the source changed:\n{output}')
+    if result.returncode == 2:
+        test_fail(f'transfer ended with a protocol error:\n{output}')
+    if result.returncode not in (0, 23, 24):
+        test_fail(f'unexpected rsync exit {result.returncode}:\n{output}')
diff --git a/testsuite/harness/process.py b/testsuite/harness/process.py
new file mode 100644
index 000000000..407f55ada
--- /dev/null
+++ b/testsuite/harness/process.py
@@ -0,0 +1,88 @@
+import functools
+import os
+import re
+import shlex
+import subprocess
+import sys
+
+from .results import test_fail
+
+def split_rsync_cmd(command: str) -> list:
+    if os.path.isfile(command):
+        return [command]
+    for match in reversed(list(re.finditer(r'\s+', command))):
+        executable = command[:match.start()]
+        if os.path.isfile(executable):
+            return [executable] + shlex.split(command[match.start():])
+    return shlex.split(command)
+
+def rsync_command_binary(command: str) -> str:
+    for argument in reversed(split_rsync_cmd(command)):
+        if os.path.isfile(argument):
+            return argument
+    raise ValueError('rsync command contains no executable file')
+
+def under_valgrind(*commands: str) -> bool:
+    return any(os.path.basename(split_rsync_cmd(command)[0]) == 'valgrind' for command in commands)
+
+def rsh_cmd(command: str, *options: str) -> str:
+    return shlex.join([command, *options])
+
+def rsync_path_arg(command: str) -> str:
+    return shlex.join(split_rsync_cmd(command))
+
+def rsync_argv(command: str, *args: str) -> list:
+    return split_rsync_cmd(command) + list(args)
+
+def rsync_argv_for(command: str, binary, *args: str) -> list:
+    argv = split_rsync_cmd(command)
+    argv[argv.index(rsync_command_binary(command))] = os.fspath(binary)
+    return argv + list(args)
+
+def run_rsync(command: str, *args: str, check: bool = True,
+              capture_output: bool = False) -> subprocess.CompletedProcess:
+    argv = rsync_argv(command, *args)
+    result = subprocess.run(argv, capture_output=capture_output, text=capture_output)
+    if check and result.returncode != 0:
+        test_fail(f"rsync exited {result.returncode}: {' '.join(argv)}")
+    return result
+
+@functools.lru_cache(maxsize=64)
+def rsync_supports(command: str, flag: str) -> bool:
+    try:
+        result = subprocess.run(rsync_argv(command, flag, '--version'),
+                                capture_output=True, text=True, timeout=5)
+    except (subprocess.TimeoutExpired, OSError):
+        return True
+    if result.returncode == 0:
+        return True
+    stderr = (result.stderr or '').lower()
+    return not any(marker in stderr for marker in (
+        'unknown option', 'unrecognized option', 'no such option',
+    ))
+
+def forced_protocol(command: str):
+    argv = split_rsync_cmd(command)
+    for index, argument in enumerate(argv):
+        if argument.startswith('--protocol='):
+            value = argument.partition('=')[2]
+        elif argument == '--protocol' and index + 1 < len(argv):
+            value = argv[index + 1]
+        else:
+            continue
+        return int(value) if value.isdigit() else None
+    return None
+
+def process_thread_count(pid: int) -> int:
+    if sys.platform == 'darwin':
+        result = subprocess.run(['ps', '-M', str(pid)], capture_output=True, text=True)
+        return max(0, len(result.stdout.splitlines()) - 1)
+    if sys.platform.startswith('linux'):
+        try:
+            with open(f'/proc/{pid}/status') as stream:
+                status = stream.read()
+        except OSError:
+            return 0
+        match = re.search(r'^Threads:\s+(\d+)', status, re.M)
+        return int(match.group(1)) if match else 0
+    return -1
diff --git a/testsuite/harness/profile.py b/testsuite/harness/profile.py
new file mode 100644
index 000000000..40771488c
--- /dev/null
+++ b/testsuite/harness/profile.py
@@ -0,0 +1,75 @@
+from __future__ import annotations
+
+import json
+import re
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Optional
+
+@dataclass(frozen=True)
+class Profile:
+    name: str
+    peer: Optional[str]
+    protocol: Optional[int]
+    unsupported: dict
+    xfail: dict
+
+def _mapping(path, field, values):
+    if not isinstance(values, dict):
+        raise ValueError(f'{path}: invalid {field}')
+    if not all(isinstance(key, str) and key and isinstance(value, str) and value
+               for key, value in values.items()):
+        raise ValueError(f'{path}: invalid {field}')
+    return dict(values)
+
+def load_profile(path, tests):
+    path = Path(path)
+    data = json.loads(path.read_text(encoding='utf-8'))
+    if not isinstance(data, dict):
+        raise ValueError(f'{path}: profile must be an object')
+    if set(data) - {'peer', 'protocol', 'unsupported', 'xfail'}:
+        raise ValueError(f'{path}: unknown profile field')
+    peer = data.get('peer')
+    if peer is not None and (not isinstance(peer, str) or not re.fullmatch(r'\d+(?:\.\d+)+', peer)):
+        raise ValueError(f'{path}: invalid peer')
+    protocol = data.get('protocol')
+    if protocol is not None and (type(protocol) is not int or protocol <= 0):
+        raise ValueError(f'{path}: invalid protocol')
+    if peer is not None and protocol is None:
+        raise ValueError(f'{path}: peer profile requires protocol')
+    if peer is not None and path.stem != f'peer-{peer}':
+        raise ValueError(f'{path}: peer does not match profile name')
+    unsupported = _mapping(path, 'unsupported', data.get('unsupported', {}))
+    xfail = _mapping(path, 'xfail', data.get('xfail', {}))
+    unknown = set(xfail) - set(tests)
+    if unknown:
+        raise ValueError(f'{path}: unknown tests: {", ".join(sorted(unknown))}')
+    return Profile(path.stem, peer, protocol, unsupported, xfail)
+
+def parse_peer_banner(text):
+    match = re.search(r'^rsync\s+version\s+(\d+(?:\.\d+)+)(?:-\S+)?\s+protocol\s+version\s+(\d+)\s*$',
+                      text, re.MULTILINE)
+    if not match:
+        raise ValueError('invalid rsync version banner')
+    return match.group(1), int(match.group(2))
+
+def merge_profiles(profiles):
+    peer = None
+    protocol = None
+    unsupported = set()
+    xfail = {}
+    for profile in profiles:
+        if profile.peer:
+            if peer and peer != profile.peer:
+                raise ValueError(f'conflicting peers: {peer}, {profile.peer}')
+            peer = profile.peer
+        if profile.protocol:
+            if protocol and protocol != profile.protocol:
+                raise ValueError(f'conflicting protocols: {protocol}, {profile.protocol}')
+            protocol = profile.protocol
+        unsupported.update(profile.unsupported)
+        for test, reason in profile.xfail.items():
+            if test in xfail and xfail[test] != reason:
+                raise ValueError(f'{test}: conflicting xfail reasons')
+            xfail[test] = reason
+    return peer, protocol, unsupported, xfail
diff --git a/testsuite/rsync_proto.py b/testsuite/harness/protocol.py
similarity index 50%
rename from testsuite/rsync_proto.py
rename to testsuite/harness/protocol.py
index 7d77c4ebe..77c852624 100644
--- a/testsuite/rsync_proto.py
+++ b/testsuite/harness/protocol.py
@@ -1,51 +1,17 @@
-#!/usr/bin/env python3
-"""Minimal pure-Python implementation of the rsync *client/sender* side of the
-daemon protocol -- enough to push a (possibly malformed) file list to a real
-rsync daemon receiver over a TCP socket.
-
-Why this exists
----------------
-Several rsync security fixes are for crashes the receiver hits while parsing a
-file list that no cooperating sender would ever produce.  The historical way to
-test them was build_patched_rsync(): copy the source, string-replace a line in
-the sender, recompile.  That is slow (a full rsync rebuild per test) and brittle
-(it breaks when the patched line is refactored).  This module replaces that with
-a declarative wire-format speaker: encode a normal file entry, then flip one
-field.
-
-Design notes / scope
---------------------
-* It is pinned to protocol 30 and advertises NO optional client capabilities
-  (no 'i' => no inc_recurse, no 'v' => byte/short flist flags and no string
-  negotiation), which keeps the encoding surface small.  Per send_file_entry()
-  / setup_protocol() in the C source.  If the on-wire protocol changes, the
-  constants and encoders here must be regenerated -- this is deliberately a
-  second implementation kept tiny for that reason.
-* The integer encoders are byte-for-byte ports of io.c (write_varint /
-  write_varlong / read_varint / read_int), so the bytes match the C exactly.
-* It is structured as a fuzzing substrate: FileEntry holds each field
-  separately and every field (or the whole entry) can be overridden with raw
-  bytes, so a future fuzzer can mutate one field at a time.
-
-This is test-only code; it is not built or shipped.
-"""
-
+import hashlib
+import os
 import socket
 import struct
 
-# ---------------------------------------------------------------------------
-# Protocol constants (mirror rsync.h)
-# ---------------------------------------------------------------------------
 MPLEX_BASE = 7
-MSG_DATA = 0           # FNONE-based data channel
-MSG_ERROR_XFER = 1     # FERROR_XFER
-MSG_INFO = 2           # FINFO
-MSG_ERROR = 3          # FERROR
-MSG_WARNING = 4        # FWARNING
-MSG_DELETED = 101      # deleted a file on the receiving side
-MSG_NO_SEND = 102      # sender failed to open a file we wanted
-
-# XMIT_* file-entry flags (rsync.h)
+MSG_DATA = 0
+MSG_ERROR_XFER = 1
+MSG_INFO = 2
+MSG_ERROR = 3
+MSG_WARNING = 4
+MSG_DELETED = 101
+MSG_NO_SEND = 102
+
 XMIT_TOP_DIR            = 1 << 0
 XMIT_SAME_MODE          = 1 << 1
 XMIT_EXTENDED_FLAGS     = 1 << 2
@@ -62,32 +28,26 @@
 XMIT_HLINK_FIRST        = 1 << 12
 XMIT_MOD_NSEC           = 1 << 13
 
-# from sys/stat.h
 S_IFREG = 0o100000
 S_IFDIR = 0o040000
 S_IFLNK = 0o120000
 S_IFMT = 0o170000
 
-
 def S_ISREG(m):
     return (m & S_IFMT) == S_IFREG
 
-
 def S_ISDIR(m):
     return (m & S_IFMT) == S_IFDIR
 
-
 def S_ISLNK(m):
     return (m & S_IFMT) == S_IFLNK
 
-
 DEFAULT_PROTOCOL = 30
 
 NDX_DONE = -1
 NDX_FLIST_EOF = -2
 NDX_FLIST_OFFSET = -101
 
-# Transfer-phase iflags (rsync.h) and basis-type tags.
 ITEM_BASIS_TYPE_FOLLOWS = 1 << 11
 ITEM_XNAME_FOLLOWS      = 1 << 12
 ITEM_IS_NEW             = 1 << 13
@@ -97,30 +57,20 @@ def S_ISLNK(m):
 
 CHUNK_SIZE = 32 * 1024
 
-# ---------------------------------------------------------------------------
-# Integer encoders -- exact ports of io.c
-# ---------------------------------------------------------------------------
-
 def w_byte(x):
     return bytes([x & 0xFF])
 
-
 def w_shortint(x):
     return struct.pack('<H', x & 0xFFFF)
 
-
 def w_int(x):
     return struct.pack('<i', _s32(x))
 
-
 def _s32(x):
     x &= 0xFFFFFFFF
     return x - (1 << 32) if x & 0x80000000 else x
 
-
 def w_varint(x):
-    """Port of io.c write_varint(): SIVAL the value into b[1..4] (little-endian),
-    then pack the high bits / extra-byte count into the leading byte b[0]."""
     b = bytearray(5)
     v = x & 0xFFFFFFFF
     b[1] = v & 0xFF
@@ -140,9 +90,7 @@ def w_varint(x):
         b[0] = b[1]
     return bytes(b[:cnt])
 
-
 def w_varlong(x, min_bytes):
-    """Port of io.c write_varlong()."""
     b = bytearray(9)
     v = x & ((1 << 64) - 1)
     for i in range(8):
@@ -160,33 +108,33 @@ def w_varlong(x, min_bytes):
         b[0] = b[cnt]
     return bytes(b[:cnt])
 
-
 def w_varint30(x, protocol=DEFAULT_PROTOCOL):
-    # write_varint30(): varint at proto >= 30, plain int below.
     return w_varint(x) if protocol >= 30 else w_int(x)
 
-
 def w_varlong30(x, min_bytes, protocol=DEFAULT_PROTOCOL):
     return w_varlong(x, min_bytes) if protocol >= 30 else w_int(x)
 
-
 _INT_BYTE_EXTRA = ([0] * 32) + ([1] * 16) + ([2] * 8) + ([3] * 4) + ([4] * 2) + [5, 6]
 
+def _read_varint(read):
+    first = read(1)[0]
+    extra = _INT_BYTE_EXTRA[first >> 2]
+    value = bytearray(5)
+    if extra:
+        bit = 1 << (8 - extra)
+        value[:extra] = read(extra)
+        value[extra] = first & (bit - 1)
+    else:
+        value[0] = first
+    return value[0] | (value[1] << 8) | (value[2] << 16) | (value[3] << 24)
 
 def to_wire_mode(mode):
-    # rsync.h to_wire_mode(): identity on Linux (S_ISLNK already 0120000 etc).
     return mode
 
-
 def w_sum_head(count, blength, s2length, remainder):
-    """io.c write_sum_head() at protocol >= 27: 4 ints."""
     return w_int(count) + w_int(blength) + w_int(s2length) + w_int(remainder)
 
-
 def get_checksum1(buf):
-    """Port of checksum.c get_checksum1() (CHAR_OFFSET == 0): rsync's rolling
-    block checksum (sum1).  `buf` is bytes; the bytes are signed-char and the
-    accumulators are uint32 (wrapping), matching the C exactly."""
     if isinstance(buf, str):
         buf = buf.encode()
     sb = [c - 256 if c >= 128 else c for c in buf]
@@ -203,9 +151,7 @@ def get_checksum1(buf):
         i += 1
     return ((s1 & 0xFFFF) + ((s2 & 0xFFFF) << 16)) & 0xFFFFFFFF
 
-
 def w_vstring(s):
-    """io.c write_vstring(): a 1- or 2-byte length prefix then the bytes."""
     if isinstance(s, str):
         s = s.encode()
     n = len(s)
@@ -213,30 +159,18 @@ def w_vstring(s):
         return bytes([n // 0x100 + 0x80, n & 0xFF]) + s
     return bytes([n]) + s
 
-
 _PERM_BITS = [
     (S_IFDIR, 'd'), (S_IFLNK, 'l'), (0o020000, 'c'), (0o060000, 'b'),
     (0o010000, 'p'), (0o140000, 's'),
 ]
 
-
 def sort_key(entry):
-    """Approximate rsync's f_name_cmp ordering: bytewise on the name, with a
-    directory keyed as if it had a trailing '/' so it sorts immediately before
-    its contents (and a file foo.txt before a dir foo).  Good for flat lists and
-    simple trees; not the full path-state machine."""
     return entry.name + (b'/' if entry.is_dir else b'')
 
-
 def sort_entries(entries):
-    """rsync sorts the received file list before indexing it, so the transfer
-    ndx is the sorted position, not the wire position.  Return entries in that
-    order."""
     return sorted(entries, key=sort_key)
 
-
 def mode_to_perms(mode):
-    """An ls-style permission string, e.g. '-rw-r--r--' / 'drwxr-xr-x'."""
     typ = '-'
     for bits, ch in _PERM_BITS:
         if (mode & S_IFMT) == bits:
@@ -249,16 +183,7 @@ def mode_to_perms(mode):
         out.append('x' if mode & (1 << who) else '-')
     return ''.join(out)
 
-
 def xattr_list_wire(items):
-    """xattrs.c send_xattr() wire bytes for a NEW xattr list -- the form a
-    sender appends to a file-list entry under -X.  The leading 0 (ndx+1 with
-    ndx=-1) means 'literal data follows'.  `items` is a list of (name,
-    datum_len, datum): `name` includes any namespace prefix and a trailing NUL,
-    `datum_len` is the declared value length (need not match `datum`), and
-    `datum` is the literal trailing bytes.  A peer exercising the receiver's
-    datum_len cap can pass an empty `datum` since receive_xattr() validates
-    datum_len before it reads the value."""
     out = bytearray(w_varint(0) + w_varint(len(items)))
     for name, datum_len, datum in items:
         if isinstance(name, str):
@@ -266,20 +191,7 @@ def xattr_list_wire(items):
         out += w_varint(len(name)) + w_varint(datum_len) + name + datum
     return bytes(out)
 
-
-# ---------------------------------------------------------------------------
-# File-list entry -- declarative, every field overridable for fuzzing
-# ---------------------------------------------------------------------------
-
 class FileEntry:
-    """One flat (non-inc-recurse) file-list entry.
-
-    Set the fields you care about; encode() emits the exact wire bytes for
-    protocol 30 with byte/short flags.  For malformed-input testing, set
-    extra_flags to OR bits into the computed xflags, or set raw= to emit a
-    fully hand-built byte string instead.
-    """
-
     def __init__(self, name, *, mode=S_IFREG | 0o644, length=0, modtime=1700000000,
                  csum=None, extra_flags=0, protocol=DEFAULT_PROTOCOL, raw=None,
                  hlink_ndx=None, uid=None, user_name=None):
@@ -287,17 +199,13 @@ def __init__(self, name, *, mode=S_IFREG | 0o644, length=0, modtime=1700000000,
         self.mode = mode
         self.length = length
         self.modtime = modtime
-        self.csum = csum            # bytes; appended when the daemon has -c
+        self.csum = csum
         self.extra_flags = extra_flags
         self.protocol = protocol
         self.raw = raw
-        # A non-first hard-link entry: sets XMIT_HLINKED (without HLINK_FIRST)
-        # and carries this gnum (first_hlink_ndx) as a varint after the name.
+
         self.hlink_ndx = hlink_ndx
-        # Owner: when uid is set the entry drops XMIT_SAME_UID and carries the
-        # uid varint (the receiver reads it under preserve_uid). When user_name
-        # is also set it adds XMIT_USER_NAME_FOLLOWS + a byte-counted name, which
-        # the daemon feeds to its name converter (recv_user_name).
+
         self.uid = uid
         self.user_name = (user_name.encode() if isinstance(user_name, str)
                           else user_name)
@@ -309,8 +217,6 @@ def encode(self):
         is_reg = (self.mode & 0o170000) == S_IFREG
         is_dir = (self.mode & 0o170000) == S_IFDIR
 
-        # We never preserve uid/gid and always emit a full (non-abbreviated)
-        # entry, so the only "same as previous" flags are UID/GID.
         xflags = XMIT_SAME_UID | XMIT_SAME_GID
         xflags |= self.extra_flags
         if self.hlink_ndx is not None:
@@ -322,7 +228,6 @@ def encode(self):
 
         out = bytearray()
 
-        # --- flags byte/short (proto >= 28, non-varint path) ---
         if not xflags and not is_dir:
             xflags |= XMIT_TOP_DIR
         if (xflags & 0xFF00) or not xflags:
@@ -331,7 +236,6 @@ def encode(self):
         else:
             out += w_byte(xflags)
 
-        # --- name (no prefix compression: l1 == 0) ---
         l2 = len(self.name)
         if xflags & XMIT_LONG_NAME:
             out += w_varint30(l2, self.protocol)
@@ -339,12 +243,6 @@ def encode(self):
             out += w_byte(l2)
         out += self.name
 
-        # A non-first hard-link entry (XMIT_HLINKED set, HLINK_FIRST unset)
-        # carries its gnum here, per send_file_entry(). A HLINK_FIRST entry
-        # carries no gnum (BITS_SETnUNSET is false in recv_file_entry), which is
-        # why 0004 uses extra_flags rather than hlink_ndx. We only use small
-        # gnums (< this flist's ndx_start), so the full length/mode fields
-        # follow; a gnum >= ndx_start would abbreviate the entry (goto the_end).
         if self.hlink_ndx is not None:
             out += w_varint(self.hlink_ndx)
 
@@ -354,56 +252,31 @@ def encode(self):
         if not (xflags & XMIT_SAME_MODE):
             out += w_int(to_wire_mode(self.mode))
 
-        # Owner (after mode, per recv_file_entry): uid varint, then -- under
-        # XMIT_USER_NAME_FOLLOWS -- a byte-counted user name for the converter.
         if self.uid is not None:
             out += w_varint(self.uid)
             if self.user_name is not None:
                 out += w_byte(len(self.user_name)) + self.user_name
 
-        # checksum trailer (only when the receiver runs with -c / always_checksum)
         if self.csum is not None:
             out += self.csum
 
         return bytes(out)
 
-
 def end_of_flist(io_error=0, protocol=DEFAULT_PROTOCOL):
-    """Trailing marker after the last entry. In byte-flags mode (no
-    CF_VARINT_FLIST_FLAGS, i.e. no 'v' advertised) recv_file_list() ends the
-    list on a single 0 flag byte and reads NO io_error after it -- the io_error
-    varint exists only in the varint-flags path. Sending an extra byte here
-    leaves a stray 0x00 that the receiver then reads as NDX_DONE (freeing the
-    flist), which broke inc_recurse sub-flist sequencing."""
     return w_byte(0)
 
-
-# NOTE: a plain push to a daemon module (no --delete, no --prune-empty-dirs)
-# exchanges NO filter list -- recv_filter_list() only reads from the wire when
-# `am_sender || receiver_wants_list`, both false for the receiver here. So the
-# file list starts immediately after the checksum seed; do not send a filter
-# list or its first byte is consumed as a 0 (end-of-list) flag.
-
-
-# ---------------------------------------------------------------------------
-# Daemon client / sender
-# ---------------------------------------------------------------------------
-
 class ProtocolError(Exception):
     pass
 
-
 class ParsedEntry:
-    """A file-list entry decoded from the wire (the read side of FileEntry)."""
-
     __slots__ = ('name', 'mode', 'length', 'mtime', 'link_target')
 
     def __init__(self, name, mode, length, mtime, link_target=None):
-        self.name = name                  # bytes, module-relative
+        self.name = name
         self.mode = mode
         self.length = length
         self.mtime = mtime
-        self.link_target = link_target    # bytes for a symlink, else None
+        self.link_target = link_target
 
     @property
     def is_reg(self):
@@ -420,31 +293,13 @@ def is_link(self):
     def __repr__(self):
         return f"ParsedEntry({self.name!r}, mode={self.mode:o}, length={self.length})"
 
-
-class DaemonClient:
-    """A client that connects to an rsync daemon: runs the @RSYNCD handshake +
-    protocol setup, then drives either role depending on the server args -- push
-    (send a file list + deltas, as a sender) or pull/list (receive + parse the
-    file list, request and receive files, as a receiver).  The protocol steps
-    are small overridable methods so a test can swap one behaviour (e.g. the sum
-    header or an flist entry) while reusing the rest -- see xrsync.py."""
-
-    def __init__(self, host, port, timeout=10):
-        self.sock = socket.create_connection((host, port), timeout=timeout)
-        self.sock.settimeout(timeout)
-        self.protocol = DEFAULT_PROTOCOL
-        self.compat_flags = None
-        self.seed = None
-        self.xfer_sum_len = 16        # md5 at proto 30 (no string negotiation)
+class _SocketPeer:
+    def __init__(self, sock):
+        self.sock = sock
         self._rbuf = b''
-        self._ndx_prev_positive = -1  # write_ndx delta state (proto >= 30)
+        self._ndx_prev_positive = -1
         self._ndx_prev_negative = 1
-        self._mux_in = b''            # de-multiplexed sender input (data channel)
-        self._r_ndx_prev_positive = -1  # read_ndx delta state
-        self._r_ndx_prev_negative = 1
-        self.messages = []            # (tag, payload) of non-data frames seen
 
-    # -- low-level socket I/O --------------------------------------------
     def _recv_exact(self, n):
         data = b''
         while len(data) < n:
@@ -471,26 +326,73 @@ def _readline(self):
             line += c
         return line.decode('latin-1').rstrip('\n')
 
+    def _send_raw(self, data):
+        self.sock.sendall(data)
+
+    def _frame(self, code, payload):
+        return struct.pack('<I', ((MPLEX_BASE + code) << 24) | len(payload)) + payload
+
+    def send_data(self, payload):
+        self._send_raw(self._frame(MSG_DATA, payload))
+
+    def w_ndx(self, ndx):
+        if ndx == NDX_DONE:
+            return b'\x00'
+        data = bytearray()
+        if ndx >= 0:
+            diff = ndx - self._ndx_prev_positive
+            self._ndx_prev_positive = ndx
+            absolute = ndx
+        else:
+            data.append(0xFF)
+            absolute = -ndx
+            diff = absolute - self._ndx_prev_negative
+            self._ndx_prev_negative = absolute
+        if 0 < diff < 0xFE:
+            data.append(diff)
+        elif diff < 0 or diff > 0x7FFF:
+            data += bytes([0xFE, ((absolute >> 24) | 0x80) & 0xFF, absolute & 0xFF,
+                           (absolute >> 8) & 0xFF, (absolute >> 16) & 0xFF])
+        else:
+            data += bytes([0xFE, (diff >> 8) & 0xFF, diff & 0xFF])
+        return bytes(data)
+
+    def close(self):
+        try:
+            self.sock.close()
+        except OSError:
+            pass
+
+class DaemonClient(_SocketPeer):
+    def __init__(self, host, port, timeout=10):
+        sock = socket.create_connection((host, port), timeout=timeout)
+        self._initialise(sock, timeout)
+
+    @classmethod
+    def from_socket(cls, sock, timeout=10):
+        client = cls.__new__(cls)
+        client._initialise(sock, timeout)
+        return client
+
+    def _initialise(self, sock, timeout):
+        sock.settimeout(timeout)
+        super().__init__(sock)
+        self.protocol = DEFAULT_PROTOCOL
+        self.compat_flags = None
+        self.seed = None
+        self.xfer_sum_len = 16
+        self._mux_in = b''
+        self._r_ndx_prev_positive = -1
+        self._r_ndx_prev_negative = 1
+        self.messages = []
+
     def _r_int(self):
         return _s32(int.from_bytes(self._recv_exact(4), 'little'))
 
     def _r_varint(self):
-        ch = self._recv_exact(1)[0]
-        extra = _INT_BYTE_EXTRA[ch >> 2]
-        b = bytearray(5)
-        if extra:
-            bit = 1 << (8 - extra)
-            b[0:extra] = self._recv_exact(extra)
-            b[extra] = ch & (bit - 1)
-        else:
-            b[0] = ch
-        return b[0] | (b[1] << 8) | (b[2] << 16) | (b[3] << 24)
+        return _read_varint(self._recv_exact)
 
-    # -- de-multiplexed input (the generator's stream) -------------------
     def _read_data(self, n):
-        """Read n bytes from the de-multiplexed sender input, dispatching any
-        non-MSG_DATA frames (MSG_INFO/MSG_ERROR/keepalive/redo/...) into
-        self.messages and discarding them."""
         while len(self._mux_in) < n:
             val = int.from_bytes(self._recv_exact(4), 'little')
             tag = (val >> 24) - MPLEX_BASE
@@ -522,7 +424,6 @@ def r_vstring(self):
         return self._read_data(n) if n else b''
 
     def r_ndx(self):
-        """Port of io.c read_ndx() at protocol >= 30."""
         b0 = self._read_data(1)[0]
         if b0 == 0xFF:
             b0 = self._read_data(1)[0]
@@ -548,24 +449,12 @@ def r_ndx(self):
         return num
 
     def r_sum_head(self):
-        """io.c read_sum_head(): count, blength, s2length, remainder."""
         return (self.r_int(), self.r_int(), self.r_int(), self.r_int())
 
     def r_varint(self):
-        """io.c read_varint() on the de-multiplexed stream."""
-        ch = self._read_data(1)[0]
-        extra = _INT_BYTE_EXTRA[ch >> 2]
-        b = bytearray(5)
-        if extra:
-            bit = 1 << (8 - extra)
-            b[0:extra] = self._read_data(extra)
-            b[extra] = ch & (bit - 1)
-        else:
-            b[0] = ch
-        return b[0] | (b[1] << 8) | (b[2] << 16) | (b[3] << 24)
+        return _read_varint(self._read_data)
 
     def r_varlong(self, min_bytes):
-        """io.c read_varlong() on the de-multiplexed stream."""
         b2 = self._read_data(min_bytes)
         u = bytearray(9)
         u[0:min_bytes - 1] = b2[1:min_bytes]
@@ -587,114 +476,45 @@ def r_varint30(self):
     def r_varlong30(self, min_bytes):
         return self.r_varlong(min_bytes) if self.protocol >= 30 else self.r_int()
 
-    # -- handshake + setup ------------------------------------------------
     def handshake(self, module, server_args, greeting_version=30):
-        """Run the @RSYNCD handshake for `module` and send `server_args`
-        (the daemon-side argv).  Returns once protocol setup is done and the
-        stream is multiplexed in both directions."""
         greeting = self._readline()
         if not greeting.startswith('@RSYNCD:'):
             raise ProtocolError(f"bad greeting: {greeting!r}")
-        # Our greeting: claim greeting_version so the daemon negotiates down to
-        # it; <=31 means we needn't send a digest list.
+
         self._send_raw(f"@RSYNCD: {greeting_version}.0\n".encode())
         self._send_raw(module.encode() + b"\n")
         resp = self._readline()
         if 'OK' not in resp:
             raise ProtocolError(f"daemon did not send OK (got {resp!r}); "
                                 "module may require auth or be unknown")
-        # Server-side argv, NUL-terminated, with a trailing empty arg.
+
         payload = b''.join(a.encode() + b"\0" for a in server_args) + b"\0"
         self._send_raw(payload)
-        # setup_protocol (proto >= 30, daemon side): it skips the binary version
-        # exchange (remote_protocol is already set from the greeting), writes
-        # compat_flags (varint) and -- since we didn't advertise 'v' -- skips
-        # string negotiation, then writes the checksum seed.  All still raw.
+
         self.compat_flags = self._r_varint()
         self.seed = self._r_int()
-        # Multiplexing is now active in both directions.
-
-    # -- multiplexed output ----------------------------------------------
-    def _send_raw(self, data):
-        self.sock.sendall(data)
-
-    def _frame(self, code, payload):
-        hdr = struct.pack('<I', ((MPLEX_BASE + code) << 24) | len(payload))
-        return hdr + payload
-
-    def send_data(self, payload):
-        """Send `payload` as one MSG_DATA frame (the normal sender stream:
-        filter list, file list, file data)."""
-        self._send_raw(self._frame(MSG_DATA, payload))
 
     def send_message(self, code, payload):
-        """Send a non-data message frame (e.g. MSG_INFO) to the receiver."""
         self._send_raw(self._frame(code, payload))
 
-    # -- convenience ------------------------------------------------------
     def send_flat_flist(self, entries, io_error=0):
-        """Send `entries` followed by the end marker, in one MSG_DATA frame.
-        No filter list is sent (see the note above empty-filter handling)."""
         buf = bytearray()
         for e in entries:
             buf += e.encode()
         buf += end_of_flist(io_error, self.protocol)
         self.send_data(bytes(buf))
 
-    def w_ndx(self, ndx):
-        """Full port of io.c write_ndx() at protocol >= 30: NDX_DONE -> a single
-        0 byte; negatives -> a leading 0xFF then a delta against prev_negative;
-        non-negatives -> a delta against prev_positive."""
-        if ndx == NDX_DONE:
-            return b'\x00'
-        b = bytearray()
-        if ndx >= 0:
-            diff = ndx - self._ndx_prev_positive
-            self._ndx_prev_positive = ndx
-            absndx = ndx
-        else:
-            b.append(0xFF)
-            absndx = -ndx
-            diff = absndx - self._ndx_prev_negative
-            self._ndx_prev_negative = absndx
-        if 0 < diff < 0xFE:
-            b.append(diff)
-        elif diff < 0 or diff > 0x7FFF:
-            b += bytes([0xFE, ((absndx >> 24) | 0x80) & 0xFF, absndx & 0xFF,
-                        (absndx >> 8) & 0xFF, (absndx >> 16) & 0xFF])
-        else:
-            b += bytes([0xFE, (diff >> 8) & 0xFF, diff & 0xFF])
-        return bytes(b)
-
     def send_transfer_ndx(self, ndx, iflags=0):
-        """Transfer-phase token: a write_ndx() index followed by the shortint
-        iflags read by read_ndx_and_attrs() (protocol >= 29)."""
         self.send_data(self.w_ndx(ndx) + w_shortint(iflags))
 
     def send_ndx_done(self):
-        """Send NDX_DONE (a single 0 byte in the ndx stream)."""
         self.send_data(self.w_ndx(NDX_DONE))
 
     def send_subflist_marker(self, dir_ndx):
-        """Announce an inc_recurse sub-flist for dir_ndx: write_ndx of
-        NDX_FLIST_OFFSET - dir_ndx (a negative index)."""
         self.send_data(self.w_ndx(NDX_FLIST_OFFSET - dir_ndx))
 
     def run_forged_transfer(self, forged_type, xname, literal_tail=b'',
                             file_csum_len=16, max_phase=2):
-        """Drive the sender side of the transfer phase, FORGING fnamecmp_type on
-        every file the generator requests (the chroot-basis attack): for each
-        request, read its iflags / basis-type / xname / sum header + block sums,
-        then send back the ndx with our forged basis type + xname, the echoed sum
-        header, a delta that MATCHES block 0 of the (forged) basis plus the given
-        literal tail, and a deliberately wrong whole-file checksum (so the
-        receiver -- if it opened the forged basis -- reconstructs the wrong bytes
-        and logs 'failed verification'). Loops through both transfer phases (the
-        checksum-mismatch redo) until NDX_DONE has advanced past max_phase.
-
-        Stops early (returns) if the receiver drops the connection mid-transfer
-        -- e.g. a confined receiver that refuses the forged basis and exits with
-        'got a block match with no basis file'."""
         try:
             self._forged_transfer_loop(forged_type, xname, literal_tail,
                                        file_csum_len, max_phase)
@@ -719,8 +539,8 @@ def _forged_transfer_loop(self, forged_type, xname, literal_tail,
                 self.r_vstring()
             count, blength, s2length, remainder = self.r_sum_head()
             for _ in range(count):
-                self.r_int()             # block weak checksum
-                self.r_buf(s2length)     # block strong checksum
+                self.r_int()
+                self.r_buf(s2length)
             out = bytearray()
             out += self.w_ndx(ndx)
             out += w_shortint(iflags | ITEM_BASIS_TYPE_FOLLOWS | ITEM_XNAME_FOLLOWS)
@@ -728,20 +548,15 @@ def _forged_transfer_loop(self, forged_type, xname, literal_tail,
             out += w_vstring(xname)
             out += w_sum_head(count, blength, s2length, remainder)
             if count > 0:
-                out += w_int(-1)         # match block 0 of the (forged) basis
+                out += w_int(-1)
             if literal_tail:
                 out += w_int(len(literal_tail)) + literal_tail
-            out += w_int(0)              # end-of-file token
-            out += b'\x00' * file_csum_len  # wrong whole-file checksum
+            out += w_int(0)
+            out += b'\x00' * file_csum_len
             self.send_data(bytes(out))
 
-    # -- receive side (pull / list) --------------------------------------
     def recv_flist(self, preserve_links=True):
-        """Send the (empty) filter list the sender expects, then read + parse
-        the daemon's file list.  Returns a list of ParsedEntry.  Decodes the
-        -lt subset (no uid/gid/devices); override for more.  This is a natural
-        hook point: a test can subclass and tamper with what it returns."""
-        self.send_data(w_int(0))                 # empty filter list (terminator)
+        self.send_data(w_int(0))
         entries = []
         prev_name = b''
         prev_mode = 0
@@ -751,7 +566,7 @@ def recv_flist(self, preserve_links=True):
             if flags & XMIT_EXTENDED_FLAGS:
                 flags |= self.r_byte() << 8
             if flags == 0:
-                break                            # end of list (no io_error at p30)
+                break
             l1 = self.r_byte() if flags & XMIT_SAME_NAME else 0
             l2 = self.r_varint30() if flags & XMIT_LONG_NAME else self.r_byte()
             name = prev_name[:l1] + self.r_buf(l2)
@@ -761,7 +576,7 @@ def recv_flist(self, preserve_links=True):
                 prev_mtime = self.r_varlong30(4)
             mtime = prev_mtime
             if flags & XMIT_MOD_NSEC:
-                self.r_varint()                  # nsec, ignored
+                self.r_varint()
             if not (flags & XMIT_SAME_MODE):
                 prev_mode = self.r_int()
             mode = prev_mode
@@ -772,45 +587,33 @@ def recv_flist(self, preserve_links=True):
         return entries
 
     def make_request(self, ndx):
-        """Generator request for a whole-file transfer of `ndx`: the ndx, the
-        item flags, and a count=0 sum header (no local basis).  Overridable
-        hook -- a test can return a malformed request here."""
         return (self.w_ndx(ndx) + w_shortint(ITEM_TRANSFER)
                 + w_sum_head(0, 0, 0, 0))
 
     def recv_file_transfer(self, ndx):
-        """Read one file the sender sends in reply to make_request(): item
-        flags, optional basis type / xname, the echoed sum header, the literal
-        token stream, and the whole-file checksum.  Returns the file bytes."""
         iflags = self.r_shortint()
         if iflags & ITEM_BASIS_TYPE_FOLLOWS:
             self.r_byte()
         if iflags & ITEM_XNAME_FOLLOWS:
             self.r_vstring()
-        self.r_sum_head()                        # count=0 for a whole-file pull
+        self.r_sum_head()
         data = bytearray()
         while True:
             tok = self.r_int()
             if tok == 0:
-                break                            # end of file
+                break
             if tok > 0:
-                data += self.r_buf(tok)          # literal chunk
+                data += self.r_buf(tok)
             else:
                 raise ProtocolError(f"unexpected block match token {tok} "
                                     "(no basis was offered)")
-        self.r_buf(self.xfer_sum_len)            # whole-file checksum (unverified)
+        self.r_buf(self.xfer_sum_len)
         return bytes(data)
 
     def pull(self, dest_dir, verbose=False, preserve_times=True,
              preserve_perms=True):
-        """Receive the file list and materialise it under dest_dir: make
-        directories, create symlinks, and download regular files (whole-file
-        requests).  Returns the parsed file list."""
-        import os
-        # rsync indexes the file list by SORTED order, so the transfer ndx is
-        # the sorted position (both peers sort identically).
         entries = sort_entries(self.recv_flist())
-        reg = []                                 # (ndx, entry, path) to fetch
+        reg = []
         for ndx, e in enumerate(entries):
             rel = e.name.decode('utf-8', 'surrogateescape')
             if rel in ('.', ''):
@@ -827,11 +630,11 @@ def pull(self, dest_dir, verbose=False, preserve_times=True,
                 reg.append((ndx, e, path))
             if verbose:
                 print(rel)
-        # Phase 1: send all whole-file requests, then NDX_DONE.
+
         for ndx, e, path in reg:
             self.send_data(self.make_request(ndx))
         self.send_data(self.w_ndx(NDX_DONE))
-        # Read replies, mirroring the sender's per-phase NDX_DONE handshake.
+
         got = {}
         phase = 1
         while True:
@@ -840,7 +643,7 @@ def pull(self, dest_dir, verbose=False, preserve_times=True,
                 phase += 1
                 if phase > 2:
                     break
-                self.send_data(self.w_ndx(NDX_DONE))   # phase 2: no redos
+                self.send_data(self.w_ndx(NDX_DONE))
                 continue
             got[ndx] = self.recv_file_transfer(ndx)
         for ndx, e, path in reg:
@@ -855,8 +658,6 @@ def pull(self, dest_dir, verbose=False, preserve_times=True,
         return entries
 
     def finish_no_transfer(self):
-        """Walk the per-phase NDX_DONE handshake with no files requested -- used
-        after --list-only so the daemon shuts down cleanly."""
         self.send_data(self.w_ndx(NDX_DONE))
         phase = 1
         try:
@@ -869,19 +670,13 @@ def finish_no_transfer(self):
         except (ProtocolError, socket.timeout, OSError):
             pass
 
-    # -- send side (basic push) ------------------------------------------
     def push(self, files, modtime=1700000000):
-        """Basic upload: `files` is a list of (name, content) regular files.
-        Send the file list, then satisfy the receiver's whole-file requests with
-        the literal content + its md5 (the proto-30 whole-file digest is plain
-        md5, no seed).  Overridable pieces: make_file_token_stream()."""
-        import hashlib
         names = [n.encode() if isinstance(n, str) else n for n, _ in files]
         entries = [FileEntry(n, mode=S_IFREG | 0o644, length=len(c),
                              modtime=modtime, protocol=self.protocol)
                    for n, (_, c) in zip(names, files)]
         self.send_flat_flist(entries)
-        # The receiver requests by sorted ndx; map it back to our content.
+
         order = sorted(range(len(files)), key=lambda i: names[i])
         content_by_ndx = {ndx: files[i][1] for ndx, i in enumerate(order)}
         phase = 0
@@ -912,8 +707,6 @@ def push(self, files, modtime=1700000000):
             self.send_data(bytes(out))
 
     def make_file_token_stream(self, content):
-        """Whole-file literal token stream (token.c simple_send_token, no -z):
-        CHUNK_SIZE-sized literal runs then a 0 end token.  Overridable hook."""
         out = bytearray()
         for off in range(0, len(content), CHUNK_SIZE):
             chunk = content[off:off + CHUNK_SIZE]
@@ -922,9 +715,6 @@ def make_file_token_stream(self, content):
         return bytes(out)
 
     def drain(self, timeout=3.0):
-        """Read whatever the daemon sends back until EOF/timeout.  Returns the
-        raw bytes (mux frames undecoded); used only to detect a dropped
-        connection (crash) vs an orderly close."""
         self.sock.settimeout(timeout)
         out = b''
         try:
@@ -937,128 +727,28 @@ def drain(self, timeout=3.0):
             pass
         return out
 
-    def close(self):
-        try:
-            self.sock.close()
-        except OSError:
-            pass
-
-
-# Back-compat alias: the existing security tests speak of a "DaemonSender".
 DaemonSender = DaemonClient
 
-
-class DaemonReceiver:
-    """The SERVER side of the daemon protocol -- the inverse of DaemonSender.
-    Accepts a real rsync client and runs the @RSYNCD handshake + protocol-30
-    setup as the daemon.  The @RSYNCD handshake is direction-agnostic, so after
-    setup this can drive either role: when the client PUSHES (client = sender)
-    we act as the receiver/generator and send transfer requests (e.g. malformed
-    sum headers); when the client PULLS (client = receiver) we act as the sender
-    and send a file list (e.g. one carrying an oversized xattr datum).  Both are
-    things rsync_proto's client/sender role cannot do.
-
-    The two stream directions are independent, so we never need to parse the
-    client's file list: we just send a request for an index the client's flist
-    is known to contain (index 0 for a single pushed file) and let the client's
-    send_files() read it.  After sending we drain the client's stream so its
-    flist writes don't block while it reaches the request and errors out."""
-
+class DaemonReceiver(_SocketPeer):
     def __init__(self, sock, greeting_version=30, protocol=DEFAULT_PROTOCOL):
-        self.sock = sock
+        super().__init__(sock)
         self.protocol = protocol
         self.greeting_version = greeting_version
-        self._rbuf = b''
-        self._ndx_prev_positive = -1
-        self._ndx_prev_negative = 1
 
-    # -- low-level I/O (mirrors DaemonSender) -----------------------------
-    def _send_raw(self, data):
-        self.sock.sendall(data)
-
-    def _recv_exact(self, n):
-        data = b''
-        while len(data) < n:
-            if self._rbuf:
-                take = self._rbuf[:n - len(data)]
-                self._rbuf = self._rbuf[len(take):]
-                data += take
-                continue
-            chunk = self.sock.recv(n - len(data))
-            if not chunk:
-                raise ProtocolError(f"EOF after {len(data)}/{n} bytes")
-            data += chunk
-        return data
-
-    def _readline(self):
-        line = b''
-        while not line.endswith(b'\n'):
-            if self._rbuf:
-                c, self._rbuf = self._rbuf[:1], self._rbuf[1:]
-            else:
-                c = self.sock.recv(1)
-                if not c:
-                    raise ProtocolError("EOF reading a line")
-            line += c
-        return line.decode('latin-1').rstrip('\n')
-
-    def _frame(self, code, payload):
-        hdr = struct.pack('<I', ((MPLEX_BASE + code) << 24) | len(payload))
-        return hdr + payload
-
-    def send_data(self, payload):
-        self._send_raw(self._frame(MSG_DATA, payload))
-
-    def w_ndx(self, ndx):
-        # Identical to DaemonSender.w_ndx (io.c write_ndx, protocol >= 30).
-        if ndx == NDX_DONE:
-            return b'\x00'
-        b = bytearray()
-        if ndx >= 0:
-            diff = ndx - self._ndx_prev_positive
-            self._ndx_prev_positive = ndx
-            absndx = ndx
-        else:
-            b.append(0xFF)
-            absndx = -ndx
-            diff = absndx - self._ndx_prev_negative
-            self._ndx_prev_negative = absndx
-        if 0 < diff < 0xFE:
-            b.append(diff)
-        elif diff < 0 or diff > 0x7FFF:
-            b += bytes([0xFE, ((absndx >> 24) | 0x80) & 0xFF, absndx & 0xFF,
-                        (absndx >> 8) & 0xFF, (absndx >> 16) & 0xFF])
-        else:
-            b += bytes([0xFE, (diff >> 8) & 0xFF, diff & 0xFF])
-        return bytes(b)
-
-    # -- handshake (server side) -----------------------------------------
     def handshake(self, compat_flags=0, seed=0):
-        """Send the daemon greeting, read the client's greeting + module line,
-        send '@RSYNCD: OK', then write the protocol-30 setup (compat flags +
-        checksum seed).  We don't read the client's NUL-separated args: it sends
-        them after reading our OK and reads our compat/seed afterwards, and the
-        directions are independent."""
         self._send_raw(f"@RSYNCD: {self.greeting_version}.0\n".encode())
-        self._readline()                 # client greeting (version[, digests])
-        self._readline()                 # module name
+        self._readline()
+        self._readline()
         self._send_raw(b"@RSYNCD: OK\n")
         self._send_raw(w_varint(compat_flags) + w_int(seed))
-        # Multiplexing is now active in both directions.
 
-    # -- generator requests ----------------------------------------------
     def send_sum_request(self, ndx, count, blength, s2length, remainder,
                          iflags=ITEM_TRANSFER):
-        """As the generator, request a transfer of file `ndx` with the given
-        (possibly malformed) sum header -- ndx + iflags + write_sum_head(), the
-        bytes the client's send_files()/receive_sums() read."""
         buf = (self.w_ndx(ndx) + w_shortint(iflags)
                + w_sum_head(count, blength, s2length, remainder))
         self.send_data(buf)
 
     def drain(self, timeout=5.0):
-        """Read and discard the client's stream until it closes (it pushes its
-        file list, reaches our request, errors, and disconnects)."""
         self.sock.settimeout(timeout)
         try:
             while self.sock.recv(65536):
@@ -1066,8 +756,3 @@ def drain(self, timeout=5.0):
         except (OSError, ProtocolError):
             pass
 
-    def close(self):
-        try:
-            self.sock.close()
-        except OSError:
-            pass
diff --git a/testsuite/xrsync.py b/testsuite/harness/protocol_client.py
old mode 100755
new mode 100644
similarity index 73%
rename from testsuite/xrsync.py
rename to testsuite/harness/protocol_client.py
index f2a5bc25f..71957b750
--- a/testsuite/xrsync.py
+++ b/testsuite/harness/protocol_client.py
@@ -1,38 +1,15 @@
 #!/usr/bin/env python3
-"""xrsync.py -- a small, runnable rsync client built on rsync_proto.py.
-
-It speaks the rsync daemon protocol (host::module/path or rsync://host/module/
-path) and supports three operations against a real rsyncd:
-
-    xrsync.py [opts] host::module/path           # list (like rsync's listing)
-    xrsync.py [opts] host::module/glob  localdir  # pull (download)
-    xrsync.py [opts] localfile...       host::mod/ # push (upload, regular files)
-
-This is deliberately a *subset* of rsync -- enough to be useful for protocol
-development and as a test harness, not a drop-in replacement.  Supported flags:
--a (= -rlpt), -r, -l, -t, -p, -v, --list-only, --port=N.
-
-Hookability: rsync_proto's DaemonClient exposes the protocol steps as small
-overridable methods (recv_flist / make_request / recv_file_transfer /
-make_file_token_stream / ...).  main() takes a `client_factory`, so a test can
-pass a DaemonClient subclass that tampers with one step while reusing all of
-xrsync's machinery.  See xrsync_test.py.
-"""
 
 import argparse
 import os
 import sys
 
-sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
-import rsync_proto as rp  # noqa: E402
+from . import protocol as rp
 
 DEFAULT_PORT = 873
-CAPS = 'e.LsfxCIu'        # the -e capability marker rsync_proto negotiates at p30
-
+CAPS = 'e.LsfxCIu'
 
 def parse_remote(spec):
-    """Return (host, port, path) for a daemon spec, or None if `spec` is local.
-    `path` keeps the module as its first component (what the daemon expects)."""
     if spec.startswith('rsync://'):
         rest = spec[len('rsync://'):]
         hostport, _, path = rest.partition('/')
@@ -43,9 +20,7 @@ def parse_remote(spec):
         return host, None, path
     return None
 
-
 def server_opts(args, listing):
-    """Build the daemon-side short-option string from the parsed flags."""
     flags = ''
     if args.recurse:
         flags += 'r'
@@ -56,10 +31,9 @@ def server_opts(args, listing):
     if args.times:
         flags += 't'
     if listing and not args.recurse:
-        flags += 'd'          # list a directory's contents without recursing
+        flags += 'd'
     return '-' + flags + CAPS
 
-
 def do_list(host, port, module, path, args, factory):
     c = factory(host, port)
     c.handshake(module, ['--server', '--sender', server_opts(args, True),
@@ -76,7 +50,6 @@ def do_list(host, port, module, path, args, factory):
     c.close()
     return 0
 
-
 def do_pull(host, port, module, path, dest, args, factory):
     c = factory(host, port)
     c.handshake(module, ['--server', '--sender', server_opts(args, False),
@@ -87,7 +60,6 @@ def do_pull(host, port, module, path, dest, args, factory):
     c.close()
     return 0
 
-
 def do_push(srcs, host, port, module, path, args, factory):
     files = []
     for s in srcs:
@@ -113,9 +85,8 @@ def do_push(srcs, host, port, module, path, args, factory):
     c.close()
     return 0
 
-
 def main(argv=None, client_factory=rp.DaemonClient):
-    p = argparse.ArgumentParser(prog='xrsync.py', add_help=True)
+    p = argparse.ArgumentParser(prog='protocol-client.py', add_help=True)
     p.add_argument('-a', '--archive', action='store_true', help='= -rlpt')
     p.add_argument('-r', '--recursive', dest='recurse', action='store_true')
     p.add_argument('-l', '--links', action='store_true')
@@ -132,7 +103,6 @@ def main(argv=None, client_factory=rp.DaemonClient):
     paths = args.paths
     remotes = [parse_remote(x) for x in paths]
 
-    # List: a single remote arg (or --list-only with no local dest).
     if args.list_only or (len(paths) == 1 and remotes[0] is not None):
         host, port, path = remotes[0]
         port = args.port or port or DEFAULT_PORT
@@ -159,6 +129,5 @@ def main(argv=None, client_factory=rp.DaemonClient):
     p.error('unsupported source/destination combination (one side must be '
             'host::module/path and the other local)')
 
-
 if __name__ == '__main__':
     sys.exit(main())
diff --git a/testsuite/harness/results.py b/testsuite/harness/results.py
new file mode 100644
index 000000000..8d1515e48
--- /dev/null
+++ b/testsuite/harness/results.py
@@ -0,0 +1,93 @@
+import enum
+import json
+import os
+import sys
+from dataclasses import dataclass
+from pathlib import Path
+
+class Exit(enum.IntEnum):
+    PASS = 0
+    FAIL = 1
+    ERROR = 2
+    SKIP = 77
+    XFAIL = 78
+
+def verdict_of(outcome, expected):
+    if expected and expected.startswith('xfail'):
+        if outcome in ('fail', 'xfail'):
+            return 'xfail'
+        return 'xpass' if outcome == 'pass' else 'profile_error'
+    if expected and expected.startswith('unsupported'):
+        return 'unsupported' if outcome == 'unsupported' else 'profile_error'
+    if expected == 'pass' and outcome in ('skip', 'unsupported', 'xfail'):
+        return 'profile_error'
+    return outcome
+
+@dataclass
+class TestResult:
+    name: str
+    exit_code: int
+    output: str = ''
+    skip_reason: str = ''
+    unsupported: str = ''
+    duration: float = 0.0
+
+    @property
+    def outcome(self):
+        if self.exit_code == Exit.PASS:
+            return 'pass'
+        if self.exit_code == Exit.ERROR:
+            return 'error'
+        if self.exit_code == Exit.SKIP:
+            return 'unsupported' if self.unsupported else 'skip'
+        if self.exit_code == Exit.XFAIL:
+            return 'xfail'
+        return 'fail'
+
+    def record(self, expected=None):
+        verdict = verdict_of(self.outcome, expected)
+        data = {
+            'name': self.name,
+            'outcome': self.outcome,
+            'verdict': verdict,
+            'exit_code': int(self.exit_code),
+            'duration_seconds': round(self.duration, 6),
+        }
+        if self.skip_reason:
+            data['reason'] = self.skip_reason
+        if self.unsupported:
+            data['unsupported'] = self.unsupported
+        if expected:
+            data['expected'] = expected
+        return data
+
+def write_receipt(path, data):
+    target = Path(path)
+    target.parent.mkdir(parents=True, exist_ok=True)
+    temporary = target.with_name(f'.{target.name}.{os.getpid()}.tmp')
+    try:
+        with temporary.open('x', encoding='utf-8') as stream:
+            json.dump(data, stream, indent=2, sort_keys=True)
+            stream.write('\n')
+        os.replace(temporary, target)
+    finally:
+        try:
+            temporary.unlink()
+        except FileNotFoundError:
+            pass
+
+def test_fail(msg: str) -> None:
+    sys.stderr.write(msg.rstrip() + '\n')
+    sys.exit(Exit.FAIL)
+
+def test_skipped(msg: str, capability: str = None) -> None:
+    sys.stderr.write(msg.rstrip() + '\n')
+    scratch = Path(os.environ['scratchdir'])
+    if capability:
+        (scratch / 'unsupported').write_text(capability + '\n', encoding='utf-8')
+    (scratch / 'whyskipped').write_text(msg.rstrip() + '\n', encoding='utf-8')
+    sys.exit(Exit.SKIP)
+
+def test_xfail(msg: str) -> None:
+    sys.stderr.write(msg.rstrip() + '\n')
+    sys.exit(Exit.XFAIL)
diff --git a/testsuite/harness/rsync.py b/testsuite/harness/rsync.py
new file mode 100644
index 000000000..faf5d493f
--- /dev/null
+++ b/testsuite/harness/rsync.py
@@ -0,0 +1,1025 @@
+from __future__ import annotations
+
+import errno
+import filecmp
+import functools as _functools
+import os
+import platform
+import re
+import shutil
+import socket as _socket
+import stat
+import subprocess
+import sys
+import tempfile
+from pathlib import Path
+
+from .daemon import (
+    USE_TCP, claim_free_port, claim_ports, require_asan, require_tcp,
+    start_rsyncd, start_test_daemon,
+)
+from .filesystem import (
+    allocated_size, assert_exists, assert_hardlinked, assert_is_symlink,
+    assert_mode, assert_mtime_close, assert_not_exists, assert_not_hardlinked,
+    assert_same, cp_p, is_a_link, make_data_file, make_text_file, make_tree,
+    makepath, rmtree, set_supported_mode, walk_dirs, walk_files, write_text_file,
+)
+from .process import (forced_protocol as _forced_protocol, rsh_cmd as _rsh_cmd,
+                      rsync_argv as _rsync_argv, rsync_argv_for as _rsync_argv_for,
+                      rsync_command_binary as _rsync_command_binary,
+                      rsync_path_arg as _rsync_path_arg, rsync_supports as _rsync_supports,
+                      run_rsync as _run_rsync, split_rsync_cmd,
+                      under_valgrind as _under_valgrind)
+from .results import Exit, test_fail, test_skipped, test_xfail
+from .xattrs import (
+    RSYNC_PREFIX, RUSR, dump_values as xattr_dump, get_value as xattr_get,
+    is_supported as xattrs_supported, set_value as xattr_set,
+)
+
+def _required(name: str) -> str:
+    v = os.environ.get(name)
+    if not v:
+        sys.stderr.write(
+            f"test harness: required environment variable {name} is not set; "
+            "run this test via runtests.py rather than directly.\n"
+        )
+        sys.exit(Exit.ERROR)
+    return v
+
+SCRATCHDIR = Path(_required('scratchdir'))
+SRCDIR = Path(_required('srcdir'))
+TOOLDIR = Path(_required('TOOLDIR'))
+SUITEDIR = Path(os.environ.get('suitedir', SRCDIR / 'testsuite'))
+
+os.umask(0o022)
+
+os.environ['HOME'] = str(SCRATCHDIR)
+RSYNC = _required('RSYNC')
+
+RSYNC_PEER = os.environ.get('RSYNC_PEER', RSYNC)
+
+def rsync_command_binary(cmd: str = None) -> str:
+    return _rsync_command_binary(RSYNC if cmd is None else cmd)
+
+def under_valgrind():
+    return _under_valgrind(RSYNC, RSYNC_PEER)
+
+TLS_ARGS = os.environ.get('TLS_ARGS', '')
+
+all_plus = '+++++++++'
+allspace = '         '
+dots = '.....'
+
+TMPDIR = SCRATCHDIR
+FROMDIR = SCRATCHDIR / 'from'
+TODIR = SCRATCHDIR / 'to'
+CHKDIR = SCRATCHDIR / 'chk'
+CHKFILE = SCRATCHDIR / 'rsync.chk'
+OUTFILE = SCRATCHDIR / 'rsync.out'
+
+def rsh_cmd(cmd: str = None, *opts: str) -> str:
+    command = str(SRCDIR / 'support' / 'lsh.sh') if cmd is None else cmd
+    return _rsh_cmd(command, *opts)
+
+def rsync_path_arg(cmd: str = None) -> str:
+    return _rsync_path_arg(RSYNC_PEER if cmd is None else cmd)
+
+def rsync_argv(*args: str) -> list:
+    return _rsync_argv(RSYNC, *args)
+
+def rsync_argv_for(binary, *args: str, command: str = None) -> list:
+    return _rsync_argv_for(RSYNC if command is None else command, binary, *args)
+
+def rsync_supports(flag: str) -> bool:
+    return _rsync_supports(RSYNC, flag)
+
+def forced_protocol():
+    return _forced_protocol(RSYNC)
+
+def run_rsync(*args: str, check: bool = True,
+              capture_output: bool = False) -> subprocess.CompletedProcess:
+    return _run_rsync(RSYNC, *args, check=check, capture_output=capture_output)
+
+def get_testuid() -> int:
+    return os.getuid()
+
+def get_rootuid() -> int:
+    return 0
+
+def get_rootgid() -> int:
+    return 0
+
+def build_rsyncd_conf() -> Path:
+    conf = SCRATCHDIR / 'test-rsyncd.conf'
+    pidfile = SCRATCHDIR / 'rsyncd.pid'
+    logfile = SCRATCHDIR / 'rsyncd.log'
+
+    my_uid = get_testuid()
+    root_uid = get_rootuid()
+    root_gid = get_rootgid()
+
+    uid_line = f'uid = {root_uid}' if my_uid == root_uid else ''
+    gid_line = f'gid = {root_gid}' if my_uid == root_uid else ''
+
+    conf.write_text(f"""\
+pid file = {pidfile}
+use chroot = no
+munge symlinks = no
+hosts allow = localhost 127.0.0.0/8
+log file = {logfile}
+transfer logging = yes
+exclude = ? foobar.baz
+max verbosity = 4
+{uid_line}
+{gid_line}
+
+[test-from]
+\tpath = {FROMDIR}
+\tlog format = %i %h [%a] %m (%u) %l %f%L
+\tread only = yes
+\tcomment = r/o
+
+[test-to]
+\tpath = {TODIR}
+\tlog format = %i %h [%a] %m (%u) %l %f%L
+\tread only = no
+\tcomment = r/w
+
+[test-scratch]
+\tpath = {SCRATCHDIR}
+\tlog format = %i %h [%a] %m (%u) %l %f%L
+\tread only = no
+
+[test-hidden]
+\tpath = {FROMDIR}
+\tlist = no
+""")
+
+    ignore23 = SCRATCHDIR / 'ignore23'
+    ignore23.write_text(
+        '#!/bin/sh\n'
+        'if "${@}"; then exit; fi\n'
+        'ret=$?\n'
+        'if test $ret = 23; then exit; fi\n'
+        'exit $ret\n'
+    )
+    ignore23.chmod(0o755)
+
+    return conf
+
+def rsync_getgroups() -> list:
+    out = subprocess.check_output([str(TOOLDIR / 'getgroups')], text=True)
+    return out.split()
+
+_SYSTEM = platform.system()
+_CYGWIN = _SYSTEM.startswith('CYGWIN')
+
+def runtest(label: str, fn, *args, **kwargs):
+    print(f"Test {label}: ", end="", flush=True)
+    fn(*args, **kwargs)
+    print("done.")
+
+def cp_touch(src, dst) -> None:
+    shutil.copy2(src, dst)
+    if os.path.isdir(dst):
+        dst = os.path.join(dst, os.path.basename(src))
+    st = os.stat(dst, follow_symlinks=False)
+    os.utime(src, ns=(st.st_atime_ns, st.st_mtime_ns), follow_symlinks=False)
+    os.utime(dst, ns=(st.st_atime_ns, st.st_mtime_ns), follow_symlinks=False)
+
+def build_symlinks() -> None:
+    FROMDIR.mkdir(parents=True, exist_ok=True)
+    (FROMDIR / 'referent').write_text(
+        subprocess.check_output(['date'], text=True)
+    )
+    os.symlink('referent', FROMDIR / 'relative')
+    os.symlink(str(FROMDIR / 'referent'), FROMDIR / 'absolute')
+    os.symlink('nonexistent', FROMDIR / 'dangling')
+    os.symlink(str(SRCDIR / 'rsync.c'), FROMDIR / 'unsafe')
+
+def hands_setup() -> None:
+    rmtree(FROMDIR)
+    rmtree(TODIR)
+    TMPDIR.mkdir(parents=True, exist_ok=True)
+    FROMDIR.mkdir(parents=True, exist_ok=True)
+    TODIR.mkdir(parents=True, exist_ok=True)
+
+    (FROMDIR / 'empty').touch()
+    (FROMDIR / 'emptydir').mkdir(exist_ok=True)
+
+    (FROMDIR / 'filelist').write_text(rsync_ls_lR(SRCDIR))
+
+    (FROMDIR / 'nolf').write_text("This file has no trailing lf")
+
+    old_umask = os.umask(0)
+    try:
+        os.symlink('nolf', FROMDIR / 'nolf-symlink')
+    finally:
+        os.umask(old_umask)
+
+    text = bytearray()
+    for c in sorted(SRCDIR.glob('*.c')):
+        text.extend(c.read_bytes())
+    (FROMDIR / 'text').write_bytes(bytes(text))
+
+    (FROMDIR / 'dir').mkdir(exist_ok=True)
+    shutil.copy(FROMDIR / 'text', FROMDIR / 'dir')
+    (FROMDIR / 'dir' / 'subdir').mkdir(exist_ok=True)
+    (FROMDIR / 'dir' / 'subdir' / 'foobar.baz').write_text("some data\n")
+    (FROMDIR / 'dir' / 'subdir' / 'subsubdir').mkdir(exist_ok=True)
+
+    make_text_file(FROMDIR / 'dir' / 'subdir' / 'subsubdir' / 'etc-ltr-list', 120)
+
+    (FROMDIR / 'dir' / 'subdir' / 'subsubdir2').mkdir(exist_ok=True)
+    make_text_file(FROMDIR / 'dir' / 'subdir' / 'subsubdir2' / 'bin-lt-list', 200)
+
+def rsync_ls_lR(directory) -> str:
+    cmd = (
+        "find . -name .git -prune -o -name auto-build-save -prune "
+        "-o -name testtmp -prune -o -print | sort | sed 's/ /\\\\ /g' | "
+        f"xargs '{TOOLDIR}/tls' {TLS_ARGS}"
+    )
+
+    proc = subprocess.run(['sh', '-c', cmd], capture_output=True,
+                          encoding='utf-8', errors='backslashreplace',
+                          cwd=str(directory))
+    return proc.stdout
+
+def checkit(args, expected_dir, actual_dir, skip_file_diff: bool = False,
+            allowed_codes=(0,)) -> None:
+    expected_dir = str(expected_dir)
+    actual_dir = str(actual_dir)
+
+    failed = []
+
+    ls_from = None
+    if '--atimes' in TLS_ARGS:
+        ls_from = rsync_ls_lR(expected_dir)
+
+    print(f"Running: rsync {' '.join(args)}")
+    proc = subprocess.run(rsync_argv(*args))
+    if proc.returncode not in allowed_codes:
+        failed.append(f"status={proc.returncode}")
+
+    if ls_from is None:
+        ls_from = rsync_ls_lR(expected_dir)
+    ls_to = rsync_ls_lR(actual_dir)
+
+    print("-------------")
+    print("check how the directory listings compare with diff:")
+    print()
+    if ls_from != ls_to:
+        ls_from_path = TMPDIR / 'ls-from'
+        ls_to_path = TMPDIR / 'ls-to'
+        ls_from_path.write_text(ls_from)
+        ls_to_path.write_text(ls_to)
+        diff = subprocess.run(
+            ['diff', '-u', str(ls_from_path), str(ls_to_path)],
+            capture_output=True, text=True,
+        )
+        sys.stdout.write(diff.stdout)
+        failed.append("dir-diff")
+
+    print("-------------")
+    print("check how the files compare with diff:")
+    print()
+    if skip_file_diff:
+        print("  === Skipping (as directed) ===")
+    else:
+        diff = subprocess.run(['diff', '-r', '-u', expected_dir, actual_dir])
+        if diff.returncode != 0:
+            failed.append("file-diff")
+
+    print("-------------")
+    if failed:
+        test_fail("Failed: " + " ".join(failed))
+
+def verify_dirs(expected_dir, actual_dir, skip_file_diff: bool = False,
+                label: str = '') -> None:
+    expected_dir = str(expected_dir)
+    actual_dir = str(actual_dir)
+    tag = f"{label}: " if label else ""
+
+    ls_expected = rsync_ls_lR(expected_dir)
+    ls_actual = rsync_ls_lR(actual_dir)
+    if ls_expected != ls_actual:
+        ls_expected_path = TMPDIR / 'ls-from'
+        ls_actual_path = TMPDIR / 'ls-to'
+        ls_expected_path.write_text(ls_expected)
+        ls_actual_path.write_text(ls_actual)
+        diff = subprocess.run(
+            ['diff', '-u', str(ls_expected_path), str(ls_actual_path)],
+            capture_output=True, text=True,
+        )
+        sys.stdout.write(diff.stdout)
+        test_fail(f"{tag}directory listings differ between "
+                  f"{expected_dir} and {actual_dir}")
+
+    if not skip_file_diff:
+        diff = subprocess.run(['diff', '-r', '-u', expected_dir, actual_dir])
+        if diff.returncode != 0:
+            test_fail(f"{tag}file content differs between "
+                      f"{expected_dir} and {actual_dir}")
+
+def v_filt(text: str) -> str:
+    out = []
+    skip_prefix = (
+        'building file list ',
+        'sending incremental file list',
+        'created directory ',
+        'total: ',
+        'client charset: ',
+        'server charset: ',
+    )
+    for line in text.splitlines():
+        if line == '':
+            break
+        if line.startswith(skip_prefix):
+            continue
+        if line == 'done':
+            continue
+        if line.endswith(' --whole-file'):
+            continue
+        out.append(line)
+    return '\n'.join(out) + ('\n' if out else '')
+
+def checkdiff(args, expected: str, *, filter=None, allowed_codes=(0,),
+              direct: bool = False) -> None:
+    if direct:
+        argv = list(args)
+        label = ' '.join(argv)
+    else:
+        argv = rsync_argv(*args)
+        label = 'rsync ' + ' '.join(args)
+    print(f"Running: {label}")
+    proc = subprocess.run(argv, capture_output=True, text=True)
+    stdout = proc.stdout
+    if proc.stderr:
+        sys.stderr.write(proc.stderr)
+    sys.stdout.write(stdout)
+
+    failed = []
+    if proc.returncode not in allowed_codes:
+        failed.append(f"status={proc.returncode}")
+
+    if filter is not None:
+        stdout = filter(stdout)
+
+    if stdout != expected:
+        from difflib import unified_diff
+        diff = unified_diff(
+            expected.splitlines(keepends=True),
+            stdout.splitlines(keepends=True),
+            fromfile='expected', tofile='got',
+        )
+        sys.stdout.write(''.join(diff))
+        failed.append("output differs")
+
+    if failed:
+        test_fail("Failed: " + " ".join(failed))
+
+def check_perms(path, expected: str) -> None:
+    mode = os.stat(path, follow_symlinks=False).st_mode
+    bits = [
+        (0o400, 'r'), (0o200, 'w'), (0o100, 'x'),
+        (0o040, 'r'), (0o020, 'w'), (0o010, 'x'),
+        (0o004, 'r'), (0o002, 'w'), (0o001, 'x'),
+    ]
+    chars = [c if mode & bit else '-' for bit, c in bits]
+
+    if mode & 0o4000:
+        chars[2] = 's' if mode & 0o100 else 'S'
+    if mode & 0o2000:
+        chars[5] = 's' if mode & 0o010 else 'S'
+    if mode & 0o1000:
+        chars[8] = 't' if mode & 0o001 else 'T'
+    perms = ''.join(chars)
+    if perms != expected:
+        print(f"permissions: {perms} on {path}")
+        print(f"should be:   {expected}")
+        test_fail(f"check_perms failed for {path}")
+
+_psf_cache = None
+
+def proc_self_fd_pins() -> bool:
+    global _psf_cache
+    if _psf_cache is not None:
+        return _psf_cache
+    if not sys.platform.startswith(('linux', 'android')):
+        _psf_cache = False
+        return _psf_cache
+
+    def resolves(path):
+        try:
+            fd = os.open(path, os.O_RDONLY)
+        except OSError:
+            return False
+        try:
+            return os.readlink('/proc/self/fd/%d' % fd) == os.path.realpath(path)
+        except OSError:
+            return False
+        finally:
+            os.close(fd)
+
+    _psf_cache = resolves('/') and resolves(os.path.realpath(__file__))
+    return _psf_cache
+
+def write_daemon_conf(modules, globals=None, *,
+                      name: str = 'test-rsyncd.conf') -> Path:
+    conf = SCRATCHDIR / name
+    pidfile = SCRATCHDIR / 'rsyncd.pid'
+    logfile = SCRATCHDIR / 'rsyncd.log'
+
+    g = {
+        'pid file': str(pidfile),
+        'use chroot': 'no',
+        'hosts allow': 'localhost 127.0.0.0/8',
+        'log file': str(logfile),
+        'max verbosity': '4',
+    }
+    if globals:
+        g.update(globals)
+    if get_testuid() == get_rootuid():
+        g.setdefault('uid', str(get_rootuid()))
+        g.setdefault('gid', str(get_rootgid()))
+    else:
+        g.pop('uid', None)
+        g.pop('gid', None)
+
+    lines = []
+    lines += [f'{k} = {v}' for k, v in g.items()]
+    lines.append('')
+    for mod_name, params in modules:
+        lines.append(f'[{mod_name}]')
+        lines += [f'\t{k} = {v}' for k, v in params.items()]
+        lines.append('')
+    conf.write_text('\n'.join(lines) + '\n')
+
+    ignore23 = SCRATCHDIR / 'ignore23'
+    if not ignore23.exists():
+        ignore23.write_text(
+            '#!/bin/sh\n'
+            'if "${@}"; then exit; fi\n'
+            'ret=$?\n'
+            'if test $ret = 23; then exit; fi\n'
+            'exit $ret\n'
+        )
+        ignore23.chmod(0o755)
+
+    return conf
+
+def expect_fail(argv, text, env=None, cwd=None):
+    proc = subprocess.run(argv, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
+                          text=True, env=env, cwd=cwd)
+    out = (proc.stdout or '') + (proc.stderr or '')
+    if proc.returncode == 0:
+        test_fail(f"command unexpectedly succeeded: {argv!r}\n{out}")
+    if text not in out:
+        test_fail(f"expected {text!r} in command output:\n{out}")
+    return proc
+
+def patched_rrsync(workdir, rsync_path=None):
+    import re
+    if rsync_path is None:
+        rsync_path = shutil.which('true') or '/usr/bin/true'
+    src = SRCDIR / 'support' / 'rrsync'
+    dst = Path(workdir) / 'rrsync-under-test'
+
+    text, n = re.subn(r"(?m)^RSYNC\s*=.*$",
+                      lambda _m: f"RSYNC = {rsync_path!r}",
+                      src.read_text())
+    if n != 1:
+        test_fail(f"patched_rrsync: expected exactly one 'RSYNC =' line in {src}, found {n}")
+    dst.write_text(text)
+    dst.chmod(0o755)
+    return dst
+
+def run_rrsync_denied(command, expected):
+    base = SCRATCHDIR / expected.replace(' ', '_').replace('/', '_')
+    base.mkdir(parents=True, exist_ok=True)
+    restricted = base / 'restricted'
+    restricted.mkdir(exist_ok=True)
+    rrsync = patched_rrsync(base)
+    env = {**os.environ, 'SSH_ORIGINAL_COMMAND': command}
+    expect_fail([str(rrsync), '-ro', '-no-lock', str(restricted)], expected, env=env)
+
+def make_proxy_server(port, response):
+    listener = _socket.socket(_socket.AF_INET, _socket.SOCK_STREAM)
+    listener.setsockopt(_socket.SOL_SOCKET, _socket.SO_REUSEADDR, 1)
+    listener.bind(('127.0.0.1', port))
+    listener.listen(1)
+
+    def serve():
+        conn, _ = listener.accept()
+        try:
+            conn.recv(65536)
+            conn.sendall(response)
+        finally:
+            try:
+                conn.close()
+            finally:
+                listener.close()
+
+    import threading
+    t = threading.Thread(target=serve)
+    t.daemon = True
+    t.start()
+    return t
+
+def run_proxy_probe(port, host, expected):
+    env = {**os.environ, 'RSYNC_PROXY': f'127.0.0.1:{port}'}
+    proc = subprocess.run(
+        rsync_argv(f'rsync://{host}/mod/', str(SCRATCHDIR / 'proxy-out')),
+        stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, env=env)
+    out = (proc.stdout or '') + (proc.stderr or '')
+    if proc.returncode == 0:
+        test_fail(f"proxy probe unexpectedly succeeded:\n{out}")
+    if expected not in out:
+        test_fail(f"expected {expected!r} in proxy probe output:\n{out}")
+    return proc
+
+def setup_chroot_inner(name):
+    if get_testuid() != get_rootuid():
+        test_skipped("chroot /./ module regression requires root", capability='root')
+    if under_valgrind():
+        test_skipped("daemon chroot prevents valgrind from writing its per-process log",
+                     capability='chroot')
+    base = SCRATCHDIR / name
+    outer = base / 'outer'
+    inner = outer / 'inner'
+    outside = outer / 'outside'
+    src = base / 'src'
+    rmtree(base)
+    makepath(inner, outside, src)
+    os.symlink('../outside', inner / 'linkparent')
+    conf = write_daemon_conf([
+        ('mod', {'path': str(outer) + '/./inner', 'read only': 'no',
+                 'use chroot': 'yes', 'munge symlinks': 'no'}),
+    ], globals={'pid file': str(base / 'rsyncd.pid'),
+                'log file': str(base / 'rsyncd.log')},
+       name=f'{name}.conf')
+    url = start_test_daemon(conf, 12940 + (abs(hash(name)) % 200))
+    return base, inner, outside, src, url
+
+def run_checked(argv):
+    proc = subprocess.run(argv, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True)
+    return proc, (proc.stdout or '') + (proc.stderr or '')
+
+def build_patched_rsync(name, replacements, append_cflags=None):
+    if sys.platform == 'cygwin' or platform.system().startswith('CYGWIN'):
+        test_skipped(f"{name}: build_patched_rsync is unreliable on Cygwin "
+                     "(prebuilt-object staleness / -fno-common relink); the "
+                     "patched-peer fix is validated on the POSIX targets",
+                     capability='native_build')
+    if not (SRCDIR / 'Makefile').is_file():
+        test_skipped(f"{name}: needs a configured rsync source tree with a Makefile",
+                     capability='native_build')
+    if not shutil.which('make'):
+        test_skipped(f"{name}: make(1) not on PATH", capability='native_build')
+    if not shutil.which('gcc') and not shutil.which('cc'):
+        test_skipped(f"{name}: no C compiler on PATH", capability='native_build')
+
+    work = SCRATCHDIR / name
+    rmtree(work)
+    shutil.copytree(
+        SRCDIR, work, symlinks=True,
+        ignore=shutil.ignore_patterns(
+            'testtmp', '.git', 'auto-build-save', 'autom4te.cache', '__pycache__'))
+
+    for relpath, old, new in replacements:
+        path = work / relpath
+        text = path.read_text()
+        if old not in text:
+            test_skipped(f"{name}: could not find patch target in {relpath}: {old!r}",
+                         capability='native_build')
+        path.write_text(text.replace(old, new, 1))
+
+        obj = (work / relpath).with_suffix('.o')
+        if obj.exists():
+            obj.unlink()
+
+    for stale in (work / 'rsync', work / 'rsync.exe'):
+        if stale.exists():
+            stale.unlink()
+
+    if append_cflags:
+        import re
+        mkpath = work / 'Makefile'
+        mk = mkpath.read_text()
+        mk2 = re.sub(r'(?m)^(CFLAGS=.*)$', r'\1 ' + append_cflags, mk, count=1)
+        if mk2 == mk:
+            test_skipped(f"{name}: could not append {append_cflags!r} to CFLAGS in the Makefile",
+                         capability='native_build')
+        mkpath.write_text(mk2)
+
+        for obj in work.rglob('*.o'):
+            obj.unlink()
+
+    env = {**os.environ, 'CCACHE_DISABLE': '1'}
+    build = subprocess.run(['make', '-j2', 'rsync'], cwd=str(work), env=env,
+                           stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True)
+    rsync = work / 'rsync'
+    if build.returncode != 0 or not rsync.is_file() or not os.access(rsync, os.X_OK):
+        test_skipped(
+            f"{name}: patched rsync build failed (rc={build.returncode}). "
+            "Tail of build output:\n" + '\n'.join(build.stdout.splitlines()[-20:]),
+            capability='native_build')
+    return rsync
+
+def acls_supported() -> bool:
+    vv = run_rsync('-VV', check=True, capture_output=True).stdout
+    if '"ACLs": true' not in vv:
+        return False
+    if _SYSTEM in ('Linux', 'FreeBSD') or _CYGWIN:
+        return (shutil.which('setfacl') is not None
+                and shutil.which('getfacl') is not None)
+    if _SYSTEM == 'Darwin':
+        return shutil.which('chmod') is not None
+    return False
+
+@_functools.lru_cache(maxsize=1)
+def devices_supported() -> bool:
+    if os.geteuid() != 0 or not hasattr(os, 'mknod'):
+        return False
+    with tempfile.TemporaryDirectory(prefix='rsync-devprobe.') as d:
+        try:
+            os.mknod(os.path.join(d, 'p'), 0o600 | stat.S_IFCHR, os.makedev(1, 3))
+        except (PermissionError, OSError):
+            return False
+    return True
+
+def hardlink_symlinks_supported(where=None) -> bool:
+    d = tempfile.mkdtemp(prefix='rsync-hlsym.', dir=str(where) if where else None)
+    try:
+        link, hard = os.path.join(d, 's'), os.path.join(d, 'h')
+        os.symlink('target-need-not-exist', link)
+        try:
+            os.link(link, hard, follow_symlinks=False)
+        except NotImplementedError:
+            return False
+        except OSError as e:
+            if e.errno in (errno.ENOTSUP, getattr(errno, 'EOPNOTSUPP', errno.ENOTSUP)):
+                return False
+            raise
+        return True
+    finally:
+        shutil.rmtree(d, ignore_errors=True)
+
+def owners_supported() -> bool:
+    return os.geteuid() == 0
+
+def make_fifo(path) -> None:
+    os.mkfifo(str(path))
+
+def make_socket(path) -> None:
+    path = Path(path)
+    old = os.getcwd()
+    s = _socket.socket(_socket.AF_UNIX, _socket.SOCK_STREAM)
+    try:
+        os.chdir(path.parent)
+        s.bind(path.name)
+    finally:
+        s.close()
+        os.chdir(old)
+
+def make_device(path, kind: str, major: int, minor: int,
+                mode: int = 0o644) -> None:
+    fmt = stat.S_IFCHR if kind == 'c' else stat.S_IFBLK
+    os.mknod(str(path), mode | fmt, os.makedev(major, minor))
+
+def _acl_env() -> dict:
+    env = dict(os.environ)
+    env.pop('POSIXLY_CORRECT', None)
+    env['LC_ALL'] = 'C'
+    return env
+
+def acl_set(spec: str, path) -> bool:
+    if not (_SYSTEM in ('Linux', 'FreeBSD') or _CYGWIN):
+        return False
+    proc = subprocess.run(['setfacl', '-m', spec, str(path)],
+                          capture_output=True, text=True, env=_acl_env())
+    return proc.returncode == 0
+
+def acl_get(path) -> str:
+    return subprocess.run(['getfacl', str(path)], capture_output=True,
+                          text=True, env=_acl_env()).stdout
+
+def _acl_sig(path) -> str:
+    if not (_SYSTEM in ('Linux', 'FreeBSD') or _CYGWIN):
+        return ''
+    try:
+        out = acl_get(path)
+    except OSError:
+        return ''
+    return ';'.join(sorted(l for l in out.splitlines()
+                           if l.strip() and not l.startswith('#')))
+
+def _xattr_sig(path) -> str:
+    p = str(path)
+    if _SYSTEM == 'Linux':
+        try:
+            names = sorted(n for n in os.listxattr(p, follow_symlinks=False)
+                           if n.startswith('user.'))
+        except OSError:
+            return ''
+        out = []
+        for n in names:
+            try:
+                v = os.getxattr(p, n, follow_symlinks=False)
+            except OSError:
+                continue
+            out.append(n + '=' + v.decode('utf-8', 'surrogateescape'))
+        return ';'.join(out)
+    if _CYGWIN:
+        try:
+            d = subprocess.check_output(
+                ['getfattr', '--no-dereference', '-d', p],
+                text=True, stderr=subprocess.DEVNULL)
+        except (subprocess.CalledProcessError, OSError):
+            return ''
+        return ';'.join(sorted(l for l in d.splitlines()
+                               if l and not l.startswith('# file:')))
+    return ''
+
+def _variety_fill(path, size: int, key: str) -> None:
+    import hashlib
+    buf = bytearray()
+    i = 0
+    while len(buf) < size:
+        buf += hashlib.sha256(f'{key}:{i}'.encode()).digest()
+        i += 1
+    with open(str(path), 'wb') as f:
+        f.write(bytes(buf[:size]))
+
+def _all_entries(root) -> list:
+    root = Path(root)
+    res = []
+    for dp, dns, fns in os.walk(root):
+        d = Path(dp)
+        res.append(d)
+        for n in fns:
+            res.append(d / n)
+        for n in dns:
+            sub = d / n
+            if sub.is_symlink():
+                res.append(sub)
+    return res
+
+def make_variety_tree(root, *, depth: int = 8, with_acls=None, with_xattrs=None,
+                      with_devices=None, with_owners=None,
+                      seed: int = 0x5A17) -> dict:
+    root = Path(root)
+    rmtree(root)
+    if with_xattrs is None:
+        with_xattrs = xattrs_supported()
+    if with_acls is None:
+        with_acls = acls_supported()
+    if with_devices is None:
+        with_devices = devices_supported()
+    if with_owners is None:
+        with_owners = owners_supported()
+
+    root.mkdir(parents=True)
+    above = root / 'above'
+    above.mkdir()
+    troot = root / 'transfer_root'
+    troot.mkdir()
+
+    counts = {}
+    def bump(t):
+        counts[t] = counts.get(t, 0) + 1
+
+    perm_cycle = [0o400, 0o640, 0o644, 0o600, 0o755]
+
+    def reg(p, size, mode=0o644):
+        _variety_fill(p, size, f'{seed:x}:{os.path.relpath(p, root)}')
+        os.chmod(p, mode)
+        bump('file')
+        return p
+
+    def mkdir1(p, mode=None):
+        p.mkdir()
+        if mode is not None:
+            os.chmod(p, mode)
+        bump('dir')
+        return p
+
+    def lnk(target, p):
+        os.symlink(target, p)
+        bump('symlink')
+        return p
+
+    above_targets = {}
+    above_targets['dir'] = mkdir1(above / 'a_dir')
+    reg(above / 'a_dir' / 'inner', 256)
+    above_targets['file'] = reg(above / 'a_file', 8192)
+    above_targets['fifo'] = above / 'a_fifo'
+    make_fifo(above_targets['fifo'])
+    bump('fifo')
+    above_targets['sock'] = above / 'a_sock'
+    make_socket(above_targets['sock'])
+    bump('socket')
+    if with_devices:
+        above_targets['dev'] = above / 'a_dev_c'
+        make_device(above_targets['dev'], 'c', 1, 3)
+        bump('device')
+        make_device(above / 'a_dev_b', 'b', 7, 0)
+        bump('device')
+    above_targets['link'] = lnk('a_file', above / 'a_link')
+
+    cur = troot
+    for n in range(depth):
+        reg(cur / f'f{n}', 1024 * (n + 1))
+        if n % 2 == 0:
+            os.link(cur / f'f{n}', cur / f'hl{n}')
+            bump('hardlink')
+        reg(cur / f'perm{n}', 700, perm_cycle[(seed + n) % len(perm_cycle)])
+        reg(cur / f'setuid{n}', 512, 0o4755)
+        mkdir1(cur / f'setgid{n}', 0o2775)
+        mkdir1(cur / f'sticky{n}', 0o1777)
+        for k in range(3):
+            reg(cur / f'g{n}_{k}', 300)
+        make_fifo(cur / f'fifo{n}')
+        bump('fifo')
+        make_socket(cur / f'sk{n}')
+        bump('socket')
+        if with_devices:
+            make_device(cur / f'cdev{n}', 'c', 1, 5)
+            bump('device')
+            make_device(cur / f'bdev{n}', 'b', 7, n)
+            bump('device')
+
+        lnk(f'f{n}', cur / f'ln2file{n}')
+        lnk(f'fifo{n}', cur / f'ln2fifo{n}')
+        lnk(f'sk{n}', cur / f'ln2sock{n}')
+        if with_devices:
+            lnk(f'cdev{n}', cur / f'ln2dev{n}')
+        lnk(f'ln2file{n}', cur / f'ln2ln{n}')
+        lnk(f'nonexistent_{n}', cur / f'dangling{n}')
+        if n < depth - 1:
+            nxt = mkdir1(cur / f'd{n + 1}')
+            lnk(f'd{n + 1}', cur / f'ln2dir{n}')
+            cur = nxt
+
+    absd = mkdir1(troot / 'abs_links')
+    lnk(str((troot / 'f0').resolve()), absd / 'abs_file')
+    lnk(str(above_targets['file'].resolve()), absd / 'abs_above')
+
+    escd = mkdir1(troot / 'escape')
+    lnk('../../above/a_dir', escd / 'esc_dir')
+    lnk('../../above/a_file', escd / 'esc_file')
+    lnk('../../above/a_fifo', escd / 'esc_fifo')
+    lnk('../../above/a_sock', escd / 'esc_sock')
+    if with_devices:
+        lnk('../../above/a_dev_c', escd / 'esc_dev')
+    lnk('../../above/a_link', escd / 'esc_link')
+
+    lnk(f'../../../{root.name}/above/a_file', escd / 'esc_deep')
+
+    if with_xattrs:
+        for p in walk_dirs(troot) + walk_files(troot):
+            try:
+                xattr_set('variety', os.path.basename(str(p)), p)
+            except OSError:
+                pass
+
+    if with_acls:
+        dirs = walk_dirs(troot)
+        files = walk_files(troot)
+        for i, d in enumerate(dirs):
+            if i % 3 == 0:
+                acl_set('u:0:rwx', d)
+            if i % 5 == 0:
+                acl_set('d:u:0:rwx', d)
+        for i, f in enumerate(files):
+            if i % 4 == 0:
+                acl_set('g:0:r-x', f)
+
+    entries = sorted(_all_entries(root), key=lambda x: str(x))
+
+    if with_owners:
+        idset = [(0, 0), (1, 1), (2, 2)]
+        for i, p in enumerate(entries):
+            uid, gid = idset[(seed + i) % len(idset)]
+            try:
+                os.chown(str(p), uid, gid, follow_symlinks=False)
+            except OSError:
+                pass
+
+    base = 1_000_000_000
+    for i, p in enumerate(entries):
+        t = base + (i * 7) % 1_000_000
+        try:
+            os.utime(str(p), (t, t), follow_symlinks=False)
+        except (OSError, NotImplementedError, ValueError):
+            if not os.path.islink(str(p)):
+                try:
+                    os.utime(str(p), (t, t))
+                except OSError:
+                    pass
+
+    return {'transfer_root': troot, 'above_targets': above_targets,
+            'counts': counts}
+
+def _rel_nonlink_entries(root) -> list:
+    root = Path(root)
+    res = []
+    for dirpath, _dirnames, filenames in os.walk(root):
+        d = Path(dirpath)
+        if d != root:
+            res.append(d.relative_to(root))
+        for fn in filenames:
+            fp = d / fn
+            if not fp.is_symlink():
+                res.append(fp.relative_to(root))
+    return sorted(res, key=lambda p: str(p))
+
+def _safe_walk_files(root) -> list:
+    root = Path(root)
+    res = []
+    for dp, _dns, fns in os.walk(root):
+        d = Path(dp)
+        for n in fns:
+            p = d / n
+            try:
+                if p.is_file() and not p.is_symlink():
+                    res.append(p)
+            except OSError:
+                continue
+    return sorted(res, key=lambda x: str(x))
+
+def compare_trees(a, b, label: str = '', *,
+                          with_acls: bool = True,
+                          with_xattrs: bool = True) -> list:
+    a = Path(a)
+    b = Path(b)
+    pre = f"{label}: " if label else ""
+    diffs = []
+
+    la = rsync_ls_lR(a)
+    lb = rsync_ls_lR(b)
+    if la != lb:
+        import difflib
+        ud = ''.join(difflib.unified_diff(
+            la.splitlines(keepends=True), lb.splitlines(keepends=True),
+            fromfile=f'{a} (tls)', tofile=f'{b} (tls)'))
+        diffs.append(f"{pre}tls listings differ:\n{ud}")
+
+    files_a = sorted(p.relative_to(a) for p in _safe_walk_files(a))
+    files_b = sorted(p.relative_to(b) for p in _safe_walk_files(b))
+    set_b = set(files_b)
+    if set(files_a) != set_b:
+        only_a = sorted(str(p) for p in set(files_a) - set_b)
+        only_b = sorted(str(p) for p in set_b - set(files_a))
+        diffs.append(f"{pre}regular-file set differs: "
+                     f"only in a={only_a} only in b={only_b}")
+    for rel in files_a:
+        if rel not in set_b:
+            continue
+        try:
+            same = filecmp.cmp(str(a / rel), str(b / rel), shallow=False)
+        except OSError as e:
+            diffs.append(f"{pre}cannot compare contents of {rel} "
+                         f"(permission denied?): {e}")
+            continue
+        if not same:
+            diffs.append(f"{pre}content differs: {rel}")
+
+    def _hl_groups(rootp):
+        from collections import defaultdict
+        ino = defaultdict(list)
+        for p in _safe_walk_files(rootp):
+            try:
+                st = p.stat()
+            except OSError:
+                continue
+            if st.st_nlink > 1:
+                ino[(st.st_dev, st.st_ino)].append(str(p.relative_to(rootp)))
+        return sorted(tuple(sorted(v)) for v in ino.values() if len(v) > 1)
+    ga, gb = _hl_groups(a), _hl_groups(b)
+    if ga != gb:
+        diffs.append(f"{pre}hard-link grouping differs: a={ga} b={gb}")
+
+    if with_xattrs or with_acls:
+        for rel in _rel_nonlink_entries(a):
+            pa = a / rel
+            pb = b / rel
+            if not pb.exists():
+                continue
+            if with_xattrs:
+                xa, xb = _xattr_sig(pa), _xattr_sig(pb)
+                if xa != xb:
+                    diffs.append(f"{pre}xattr differs: {rel} "
+                                 f"(a={xa!r} b={xb!r})")
+            if with_acls:
+                aa, ab = _acl_sig(pa), _acl_sig(pb)
+                if aa != ab:
+                    diffs.append(f"{pre}ACL differs: {rel} "
+                                 f"(a={aa!r} b={ab!r})")
+
+    return diffs
+
+def assert_trees_equal(a, b, label: str = '', **kwargs) -> None:
+    diffs = compare_trees(a, b, label, **kwargs)
+    if diffs:
+        test_fail('\n'.join(diffs))
diff --git a/testsuite/harness/runner.py b/testsuite/harness/runner.py
new file mode 100644
index 000000000..d1049ec8d
--- /dev/null
+++ b/testsuite/harness/runner.py
@@ -0,0 +1,835 @@
+#!/usr/bin/env python3
+
+# Copyright (C) 2001, 2002 by Martin Pool <mbp@samba.org>
+# Copyright (C) 2003-2022 Wayne Davison
+# Copyright (C) 2026 Andrew Tridgell
+#
+# Rewrite of runtests.sh in Python (runtests.sh is now deprecated).
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version
+# 2 as published by the Free Software Foundation.
+
+import argparse
+import concurrent.futures
+import fnmatch
+import glob
+import json
+import math
+import os
+import re
+import shutil
+import signal
+import subprocess
+import sys
+import threading
+import time
+
+from .metadata import (applies_to_peer, discover_tests, placeholder_target,
+                       read_requirements, resolve_test_path, test_name)
+from .profile import load_profile, merge_profiles, parse_peer_banner
+from .results import Exit, TestResult, verdict_of, write_receipt
+
+_SUITE_DIR = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+
+def _race_seconds(text):
+    try:
+        secs = float(text)
+    except ValueError:
+        raise argparse.ArgumentTypeError(f'not a number: {text!r}')
+    if not math.isfinite(secs) or secs <= 0:
+        raise argparse.ArgumentTypeError(
+            f'must be a finite positive number of seconds, got {text!r}; '
+            'a zero/negative/NaN budget would make every race test pass '
+            'without running its race')
+    return secs
+
+def _positive_int(text):
+    try:
+        value = int(text)
+    except ValueError as error:
+        raise argparse.ArgumentTypeError(f'not an integer: {text!r}') from error
+    if value <= 0:
+        raise argparse.ArgumentTypeError(f'must be positive: {text!r}')
+    return value
+
+def parse_args():
+    parser = argparse.ArgumentParser(description='Run rsync test suite')
+    parser.add_argument('tests', nargs='*', metavar='TEST',
+                   help='Test names or patterns to run (default: all)')
+    parser.add_argument('--exclude', default=None, metavar='LIST',
+                   help='Comma-separated test names/globs to skip entirely: '
+                        'they are not run and not reported as skipped. Useful '
+                        'for tests that cannot work in a given build/CI '
+                        'environment such as a restricted buildd chroot. '
+                        'Falls back to the RSYNC_EXCLUDE environment variable.')
+    parser.add_argument('-j', '--parallel', type=_positive_int, default=1, metavar='N',
+                   help='Run up to N tests in parallel (default: 1)')
+    parser.add_argument('--valgrind', action='store_true',
+                   help='Run rsync under valgrind (logs to per-process files)')
+    parser.add_argument('--valgrind-opts', default='', metavar='OPTS',
+                   help='Extra valgrind options such as "--leak-check=full"')
+    parser.add_argument('--preserve-scratch', action='store_true',
+                   help='Keep scratch directories after tests complete')
+    parser.add_argument('--log-level', type=int, choices=range(1, 11), default=1, metavar='N',
+                   help='Verbosity level 1-10 (default: 1)')
+    parser.add_argument('--always-log', action='store_true',
+                   help='Show test logs even for passing tests')
+    parser.add_argument('--stop-on-fail', action='store_true',
+                   help='Stop after first test failure')
+    parser.add_argument('--timing', action='store_true',
+                   help='After the run, report each test\'s wall-clock time, '
+                        'slowest first. With -j N the report also shows how '
+                        'much of the run the slowest test alone accounts for.')
+    parser.add_argument('--receipt', metavar='FILE', help='Write a JSON run receipt')
+    parser.add_argument('--timeout', type=_positive_int, default=300, metavar='SECS',
+                   help='Per-test timeout in seconds (default: 300)')
+    parser.add_argument('--race-timeout', type=_race_seconds, default=None, metavar='SECS',
+                   help='Budget (seconds) a TOCTOU symlink-race test may spend '
+                        'trying to win its race before concluding. Overrides '
+                        'every such test\'s own default (5-15s, the suite\'s '
+                        'slowest tests: a race test always spends its whole '
+                        'budget). Lowering it speeds the suite up but weakens '
+                        'the oracle. Unset: each test keeps its default.')
+    parser.add_argument('--rsync-bin', default=None, metavar='PATH',
+                   help='Path to rsync binary (default: ./rsync)')
+    parser.add_argument('--rsync-bin2', default=None, metavar='PATH',
+                   help='Path to a second ("peer") rsync binary used for the '
+                        'daemon side and remote-shell --rsync-path. Lets the '
+                        'suite mix two rsync versions over the wire. Default: '
+                        'same as --rsync-bin (no version mixing).')
+    parser.add_argument('--tooldir', default=None, metavar='DIR',
+                   help='Tool/build directory (default: cwd)')
+    parser.add_argument('--srcdir', default=None, metavar='DIR',
+                   help='Source directory (default: script directory)')
+    parser.add_argument('--protocol', type=int, default=None, metavar='VER',
+                   help='Force protocol version (adds --protocol=VER to rsync)')
+    parser.add_argument('--profiles', default=None, metavar='LIST',
+                   help='Comma-separated test profiles')
+    parser.add_argument('--daemon-tests-only', action='store_true',
+                   help='Run only the tests that can reach the daemon '
+                        'transport. Intended for a --use-tcp pass that follows '
+                        'a full default-transport run: the tests this drops '
+                        'cannot observe --use-tcp.')
+    parser.add_argument('--use-tcp', action='store_true',
+                   help='Run daemon tests against a real rsyncd bound to '
+                        '127.0.0.1 (non-default). The default is the secure '
+                        'stdio-pipe transport, which opens no listening '
+                        'socket; --use-tcp exposes a loopback port for the '
+                        'duration of each daemon test.')
+    parser.add_argument('--describe-tests', action='store_true',
+                   help='Print test metadata as JSON and exit')
+    return parser.parse_args()
+
+def find_setfacl_nodef(scratchbase):
+    for cmd in [
+        ['setacl', '-k', 'u::7,g::5,o:5', scratchbase],
+        ['setfacl', '-k', scratchbase],
+        ['setfacl', '-s', 'u::7,g::5,o:5', scratchbase],
+    ]:
+        try:
+            result = subprocess.run(cmd, capture_output=True, timeout=5)
+            if result.returncode == 0:
+                return cmd[:2]
+        except (FileNotFoundError, subprocess.TimeoutExpired):
+            continue
+    try:
+        r = subprocess.run(['setfacl', '--help'], capture_output=True, text=True, timeout=5)
+        if '-k,' in r.stdout or '-k,' in r.stderr:
+            return ['setfacl', '-k']
+    except (FileNotFoundError, subprocess.TimeoutExpired):
+        pass
+    return None
+
+def get_tls_args(config_h):
+    args = ''
+    try:
+        with open(config_h) as f:
+            text = f.read()
+        if '#define HAVE_LUTIMES 1' in text:
+            args += ' -l'
+        if '#undef CHOWN_MODIFIES_SYMLINK' in text:
+            args += ' -L'
+    except FileNotFoundError:
+        pass
+    return args.strip()
+
+def read_shconfig(path):
+    env = {}
+    try:
+        with open(path) as f:
+            for line in f:
+                line = line.strip()
+                if line.startswith('#') or line.startswith('export') or not line:
+                    continue
+                if '=' in line:
+                    k, _, v = line.partition('=')
+                    env[k.strip()] = v.strip().strip('"')
+    except FileNotFoundError:
+        pass
+    return env
+
+def get_testuser():
+    for cmd in ['/usr/bin/whoami', '/usr/ucb/whoami', '/bin/whoami']:
+        if os.path.isfile(cmd):
+            try:
+                return subprocess.check_output([cmd], text=True).strip()
+            except subprocess.CalledProcessError:
+                pass
+    try:
+        return subprocess.check_output(['id', '-un'], text=True).strip()
+    except (FileNotFoundError, subprocess.CalledProcessError):
+        return os.environ.get('LOGNAME', os.environ.get('USER', 'UNKNOWN'))
+
+def _move_aside(path):
+    n = 0
+    while os.path.exists(f"{path}.corrupt.{os.getpid()}.{n}"):
+        n += 1
+    try:
+        os.rename(path, f"{path}.corrupt.{os.getpid()}.{n}")
+    except OSError:
+        pass
+
+def prep_scratch(scratchdir, srcdir, tooldir, setfacl_nodef):
+    if os.path.isdir(scratchdir):
+        subprocess.run(['chmod', '-R', 'u+rwX', scratchdir], capture_output=True)
+        subprocess.run(['rm', '-rf', scratchdir], capture_output=True)
+        if os.path.isdir(scratchdir):
+            _move_aside(scratchdir)
+    os.makedirs(scratchdir, exist_ok=True)
+    if setfacl_nodef:
+        subprocess.run(setfacl_nodef + [scratchdir], capture_output=True)
+    try:
+        os.chmod(scratchdir, os.stat(scratchdir).st_mode & ~0o2000)
+    except OSError:
+        pass
+    src_link = os.path.join(scratchdir, 'src')
+    if not os.path.exists(src_link):
+        if os.path.isabs(srcdir):
+            os.symlink(srcdir, src_link)
+        else:
+            os.symlink(os.path.join(tooldir, srcdir), src_link)
+
+def collect_tests(suitedir, patterns):
+    testdir = os.path.join(suitedir, 'tests')
+    candidates = [str(path) for path in discover_tests(testdir)]
+    if not patterns:
+        tests = candidates
+    else:
+        seen = set()
+        tests = []
+        for pat in patterns:
+            pattern = pat if pat.endswith('.py') else pat + '.py'
+            matched = False
+            for path in candidates:
+                if not fnmatch.fnmatch(os.path.basename(path), pattern):
+                    continue
+                matched = True
+                if path not in seen:
+                    seen.add(path)
+                    tests.append(path)
+            if not matched:
+                raise ValueError(f'no tests match {pat!r}')
+    return tests
+
+_DAEMON_API = (
+    'USE_TCP', 'require_tcp', 'start_test_daemon', 'start_rsyncd',
+    'claim_ports', 'claim_free_port', 'setup_chroot_inner',
+    'start_stdio_daemon', 'harness.protocol', 'DaemonClient', 'DaemonReceiver',
+    'rsync://', 'rsyncd',
+)
+_DAEMON_OPTION = re.compile(r'(?<![\w-])--daemon(?![\w-])')
+
+def select_daemon_tests(tests):
+    keep, dropped = [], []
+    for path in tests:
+        metadata = read_requirements(path)
+        if metadata and metadata['transports']:
+            if 'tcp' not in metadata['transports']:
+                dropped.append(path)
+                continue
+            if 'daemon' in metadata['tags']:
+                keep.append(path)
+                continue
+        # Tests without transport metadata need a conservative source scan
+        try:
+            with open(resolve_test_path(path), errors='replace') as f:
+                text = f.read()
+        except OSError:
+            keep.append(path)
+            continue
+        uses_daemon = any(tok in text for tok in _DAEMON_API) or bool(_DAEMON_OPTION.search(text))
+        (keep if uses_daemon else dropped).append(path)
+    return keep, dropped
+
+def describe_tests(tests):
+    descriptions = []
+    for path in tests:
+        metadata = read_requirements(path)
+        descriptions.append({'name': test_name(path), **(metadata or {})})
+    return descriptions
+
+_TIMING_TOP = 25
+
+def print_timing_report(durations, outcomes, run_wall, parallel):
+    if not durations:
+        return
+    ranked = sorted(durations.items(), key=lambda kv: kv[1], reverse=True)
+    total = sum(durations.values())
+    print(f'----- slowest tests (of {len(ranked)}, wall-clock each):')
+    for name, secs in ranked[:_TIMING_TOP]:
+        print(f'      {secs:7.1f}s  {name:<32} {outcomes.get(name, "?")}')
+    print(f'      serial sum {total:.0f}s over {len(ranked)} tests; '
+          f'run took {run_wall:.0f}s with -j{parallel}')
+    slowest, slowest_secs = ranked[0]
+    if parallel > 1:
+        print(f'      floor {slowest_secs:.0f}s ({slowest}) = '
+              f'{100.0 * slowest_secs / run_wall:.0f}% of this run; '
+              f'ideal at -j{parallel} is {total / parallel:.0f}s')
+
+def build_rsync_cmd(rsync_bin, args, scratchbase):
+    parts = []
+    if args.valgrind:
+        vgdir = os.path.join(scratchbase, 'valgrind-logs')
+        os.makedirs(vgdir, exist_ok=True)
+        os.chmod(vgdir, 0o1777)
+        vlog = os.path.join(vgdir, 'valgrind.%p.log')
+        vopts = f'--log-file={vlog}'
+        supp = os.path.join(os.path.dirname(os.path.abspath(__file__)), 'valgrind.supp')
+        if os.path.exists(supp):
+            local_supp = os.path.join(vgdir, 'valgrind.supp')
+            shutil.copyfile(supp, local_supp)
+            os.chmod(local_supp, 0o644)
+            vopts += f' --suppressions={local_supp}'
+        if args.valgrind_opts:
+            vopts += ' ' + args.valgrind_opts
+        parts.append(f'valgrind {vopts}')
+    parts.append(rsync_bin)
+    if args.protocol is not None:
+        parts.append(f'--protocol={args.protocol}')
+    return ' '.join(parts)
+
+def binary_identity(path):
+    result = subprocess.run([path, '--version'], capture_output=True, text=True)
+    if result.returncode:
+        raise ValueError(f'cannot determine rsync version from {path}')
+    try:
+        return parse_peer_banner(result.stdout)
+    except ValueError as error:
+        raise ValueError(f'cannot determine rsync version from {path}') from error
+
+def run_one_test(testscript, testbase, scratchdir, base_env, timeout,
+                 srcdir, tooldir, setfacl_nodef, always_log):
+    started = time.monotonic()
+    prep_scratch(scratchdir, srcdir, tooldir, setfacl_nodef)
+
+    env = base_env.copy()
+    env['scratchdir'] = scratchdir
+
+    target = placeholder_target(testscript)
+    if target:
+        testscript = os.path.join(scratchdir, os.path.basename(testscript))
+        shutil.copyfile(target, testscript)
+
+    cmd = [sys.executable, testscript]
+
+    logfile = os.path.join(scratchdir, 'test.log')
+    with open(logfile, 'w') as log:
+        proc = subprocess.Popen(
+            cmd,
+            stdout=log, stderr=subprocess.STDOUT,
+            env=env, cwd=env.get('TOOLDIR', '.'),
+            start_new_session=True,
+        )
+        try:
+            result = proc.wait(timeout=timeout)
+        except subprocess.TimeoutExpired:
+            try:
+                pgid = os.getpgid(proc.pid)
+            except OSError:
+                pgid = -1
+            if pgid == proc.pid and pgid != os.getpgrp():
+                try:
+                    os.killpg(pgid, signal.SIGKILL)
+                except OSError:
+                    proc.kill()
+            else:
+                proc.kill()
+            proc.wait()
+            result = 1
+            log.write(f"\nTIMEOUT: test took over {timeout} seconds\n")
+
+    output_parts = []
+
+    show_log = always_log or (result not in (Exit.PASS, Exit.SKIP, Exit.XFAIL))
+    if show_log:
+        output_parts.append(f'----- {testbase} log follows')
+        try:
+            with open(logfile) as f:
+                output_parts.append(f.read().rstrip())
+        except FileNotFoundError:
+            pass
+        output_parts.append(f'----- {testbase} log ends')
+        rsyncd_log = os.path.join(scratchdir, 'rsyncd.log')
+        if os.path.isfile(rsyncd_log):
+            output_parts.append(f'----- {testbase} rsyncd.log follows')
+            with open(rsyncd_log) as f:
+                output_parts.append(f.read().rstrip())
+            output_parts.append(f'----- {testbase} rsyncd.log ends')
+
+    skipped_reason = ''
+    unsupported = ''
+    if result == Exit.PASS:
+        output_parts.append(f'PASS    {testbase}')
+    elif result == Exit.SKIP:
+        whyfile = os.path.join(scratchdir, 'whyskipped')
+        try:
+            with open(whyfile) as f:
+                skipped_reason = f.read().strip()
+        except FileNotFoundError:
+            pass
+        try:
+            with open(os.path.join(scratchdir, 'unsupported')) as stream:
+                unsupported = stream.read().strip()
+        except FileNotFoundError:
+            pass
+        label = 'UNSUPPORTED' if unsupported else 'SKIP'
+        output_parts.append(f'{label}    {testbase} ({skipped_reason})')
+    elif result == Exit.XFAIL:
+        output_parts.append(f'XFAIL   {testbase}')
+    else:
+        output_parts.append(f'FAIL    {testbase}')
+
+    return TestResult(testbase, result, '\n'.join(output_parts), skipped_reason,
+                      unsupported, time.monotonic() - started)
+
+_print_lock = threading.Lock()
+
+def apply_environment_defaults(args):
+    if args.preserve_scratch or os.environ.get('preserve_scratch') == 'yes':
+        args.preserve_scratch = True
+    if args.log_level == 1:
+        args.log_level = int(os.environ.get('loglevel', '1'))
+    if args.exclude is None:
+        args.exclude = os.environ.get('RSYNC_EXCLUDE', '')
+    if args.profiles is None:
+        args.profiles = os.environ.get('RSYNC_TEST_PROFILES', '')
+    if os.environ.get('whichtests'):
+        args.tests = [os.environ['whichtests']]
+
+def resolve_run_paths(args):
+    tooldir = args.tooldir or os.environ.get('TOOLDIR') or os.getcwd()
+    srcdir = args.srcdir or os.path.dirname(_SUITE_DIR)
+    if not srcdir or srcdir == '.':
+        srcdir = tooldir
+    rsync_bin = args.rsync_bin or os.environ.get('rsync_bin') or os.path.join(tooldir, 'rsync')
+    rsync_bin2 = args.rsync_bin2 or os.environ.get('rsync_bin2') or rsync_bin
+    if not os.path.isabs(rsync_bin):
+        rsync_bin = os.path.abspath(rsync_bin)
+    if not os.path.isabs(rsync_bin2):
+        rsync_bin2 = os.path.abspath(rsync_bin2)
+    return tooldir, srcdir, os.path.join(srcdir, 'testsuite'), rsync_bin, rsync_bin2
+
+def validate_run_paths(tooldir, srcdir, rsync_bin, rsync_bin2):
+    if not os.path.isfile(rsync_bin):
+        sys.stderr.write(f'rsync_bin {rsync_bin} is not a file\n')
+        sys.exit(Exit.ERROR)
+    if not os.path.isfile(rsync_bin2):
+        sys.stderr.write(f'rsync_bin2 {rsync_bin2} is not a file\n')
+        sys.exit(Exit.ERROR)
+    if not os.path.isdir(srcdir):
+        sys.stderr.write(f'srcdir {srcdir} is not a directory\n')
+        sys.exit(Exit.ERROR)
+
+    helpers = (
+        'tls', 'trimslash', 't_unsafe', 't_chmod_secure', 't_secure_relpath',
+        'wildtest', 'getgroups', 'getfsdev',
+    )
+    missing = [name for name in helpers if not os.path.isfile(os.path.join(tooldir, name))]
+    if missing:
+        names = ' '.join(missing)
+        sys.stderr.write(
+            f'runtests.py: missing test helper program(s) in {tooldir}: {", ".join(missing)}\n'
+            f'Build them with: make {names}\n'
+            'or run the full test target: make check\n'
+        )
+        sys.exit(Exit.ERROR)
+
+def print_run_header(args, tooldir, srcdir, scratchbase, rsync_cmd, rsync_peer_cmd, tls_args):
+    print('=' * 60)
+    print(f'{sys.argv[0]} running in {tooldir}')
+    print(f'    rsync_bin={rsync_cmd}')
+    if rsync_peer_cmd != rsync_cmd:
+        print(f'    rsync_peer={rsync_peer_cmd}')
+    print(f'    srcdir={srcdir}')
+    print(f'    TLS_ARGS={tls_args}')
+    print(f'    testuser={get_testuser()}')
+    print(f'    os={subprocess.check_output(["uname", "-a"], text=True).strip()}')
+    print(f'    preserve_scratch={"yes" if args.preserve_scratch else "no"}')
+    if args.valgrind:
+        print('    valgrind=enabled (logs in valgrind-logs/valgrind.*.log)')
+    if args.parallel > 1:
+        print(f'    parallel={args.parallel}')
+    print(f'    daemon_transport={"tcp (loopback)" if args.use_tcp else "pipe (secure default)"}')
+    print(f'    scratchbase={scratchbase}')
+
+def build_test_environment(args, tooldir, srcdir, suitedir, scratchbase,
+                           rsync_cmd, rsync_peer_cmd, tls_args, shconfig, setfacl_nodef):
+    path = os.environ.get('PATH', '')
+    if os.path.isdir('/usr/xpg4/bin'):
+        path = '/usr/xpg4/bin:' + path
+    pythonpath = suitedir
+    if os.environ.get('PYTHONPATH'):
+        pythonpath += os.pathsep + os.environ['PYTHONPATH']
+
+    env = os.environ.copy()
+    env.update({
+        'PATH': path,
+        'POSIXLY_CORRECT': '1',
+        'TOOLDIR': tooldir,
+        'srcdir': srcdir,
+        'RSYNC': rsync_cmd,
+        'RSYNC_PEER': rsync_peer_cmd,
+        'TLS_ARGS': tls_args,
+        'RUNSHFLAGS': '-e',
+        'scratchbase': scratchbase,
+        'suitedir': suitedir,
+        'TESTRUN_TIMEOUT': str(args.timeout),
+        'HOME': scratchbase,
+        'PYTHONPATH': pythonpath,
+    })
+    if args.use_tcp:
+        env['RSYNC_TEST_USE_TCP'] = '1'
+    else:
+        env.pop('RSYNC_TEST_USE_TCP', None)
+    if args.race_timeout is None:
+        env.pop('race_timeout', None)
+    else:
+        env['race_timeout'] = str(args.race_timeout)
+    env.update({key: value for key, value in shconfig.items() if value})
+    env['setfacl_nodef'] = ' '.join(setfacl_nodef) if setfacl_nodef else 'true'
+    if args.log_level > 8:
+        env['RUNSHFLAGS'] = '-e -x'
+    return env
+
+def configure_profiles(args, suitedir, srcdir, all_tests, tests,
+                       rsync_bin, rsync_bin2):
+    known_tests = {test_name(test) for test in all_tests}
+    profiles = []
+    for item in (value.strip() for value in args.profiles.split(',')):
+        if not item:
+            continue
+        if os.path.sep not in item and (not os.path.altsep or os.path.altsep not in item):
+            filename = item if item.endswith('.json') else f'{item}.json'
+            path = os.path.join(suitedir, 'profiles', filename)
+        else:
+            path = item if os.path.isabs(item) else os.path.join(srcdir, item)
+        profiles.append(load_profile(path, known_tests))
+
+    peer, profile_protocol, unsupported, xfail = merge_profiles(profiles)
+    extra = [value.strip() for value in os.environ.get(
+        'RSYNC_TEST_UNSUPPORTED', '').split(',') if value.strip()]
+    if extra and not profiles:
+        raise ValueError('RSYNC_TEST_UNSUPPORTED requires an active profile')
+    for capability in extra:
+        unsupported.setdefault(capability, 'target-specific absence')
+
+    effective_protocol = args.protocol
+    transport = 'tcp' if args.use_tcp else 'pipe'
+    if profile_protocol and not peer:
+        if args.protocol != profile_protocol:
+            raise ValueError(
+                f'profile protocol {profile_protocol} does not match '
+                f'{args.protocol or "the default protocol"}')
+        effective_protocol = profile_protocol
+
+    if not peer:
+        return tests, profiles, peer, effective_protocol, unsupported, xfail, transport
+
+    _, current_protocol = binary_identity(rsync_bin)
+    actual_peer, actual_peer_protocol = binary_identity(rsync_bin2)
+    if actual_peer != peer:
+        raise ValueError(f'profile peer {peer} does not match {actual_peer}')
+    if actual_peer_protocol != profile_protocol:
+        raise ValueError(
+            f'profile protocol {profile_protocol} does not match {actual_peer_protocol}')
+    effective_protocol = min(current_protocol, actual_peer_protocol,
+                             args.protocol if args.protocol is not None else current_protocol)
+    eligible = {test_name(test) for test in all_tests
+                if applies_to_peer(read_requirements(test), peer, profile_protocol)}
+    invalid = sorted(set(xfail) - eligible)
+    if invalid:
+        raise ValueError(f'peer deviations do not apply: {", ".join(invalid)}')
+    tests = [test for test in tests
+             if applies_to_peer(read_requirements(test), peer,
+                                effective_protocol, transport)]
+    if not tests:
+        raise ValueError(f'no tests apply to peer {peer}')
+    return tests, profiles, peer, effective_protocol, unsupported, xfail, transport
+
+def main():
+    args = parse_args()
+    apply_environment_defaults(args)
+    tooldir, srcdir, suitedir, rsync_bin, rsync_bin2 = resolve_run_paths(args)
+    if args.describe_tests:
+        tests = collect_tests(suitedir, args.tests)
+        excluded = [item.strip() for item in args.exclude.split(',') if item.strip()]
+        if excluded:
+            tests = [path for path in tests
+                     if not any(fnmatch.fnmatch(test_name(path), item)
+                                for item in excluded)]
+        print(json.dumps(describe_tests(tests), separators=(',', ':'), sort_keys=True))
+        return
+
+    scratchbase = os.path.join(os.environ.get('scratchbase', tooldir), 'testtmp')
+    os.makedirs(scratchbase, exist_ok=True)
+
+    shconfig = read_shconfig(os.path.join(tooldir, 'shconfig'))
+    tls_args = get_tls_args(os.path.join(tooldir, 'config.h'))
+    setfacl_nodef = find_setfacl_nodef(scratchbase)
+    rsync_cmd = build_rsync_cmd(rsync_bin, args, scratchbase)
+    rsync_peer_cmd = build_rsync_cmd(rsync_bin2, args, scratchbase)
+    validate_run_paths(tooldir, srcdir, rsync_bin, rsync_bin2)
+    print_run_header(args, tooldir, srcdir, scratchbase, rsync_cmd, rsync_peer_cmd, tls_args)
+    base_env = build_test_environment(
+        args, tooldir, srcdir, suitedir, scratchbase,
+        rsync_cmd, rsync_peer_cmd, tls_args, shconfig, setfacl_nodef,
+    )
+
+    try:
+        all_tests = collect_tests(suitedir, [])
+        tests = all_tests if not args.tests else collect_tests(suitedir, args.tests)
+    except ValueError as error:
+        sys.stderr.write(f'runtests.py: {error}\n')
+        sys.exit(Exit.ERROR)
+
+    excl = [e.strip() for e in args.exclude.split(',') if e.strip()]
+    if excl:
+        before = len(tests)
+        tests = [t for t in tests
+                 if not any(fnmatch.fnmatch(test_name(t), pat) for pat in excl)]
+        if before != len(tests):
+            print(f"Excluding {before - len(tests)} test(s) matching: "
+                  f"{', '.join(excl)}")
+
+    try:
+        (tests, profiles, profile_peer, effective_protocol,
+         profile_unsupported, profile_xfail, transport) = configure_profiles(
+            args, suitedir, srcdir, all_tests, tests, rsync_bin, rsync_bin2)
+    except (OSError, ValueError, json.JSONDecodeError) as error:
+        sys.stderr.write(f'runtests.py: {error}\n')
+        sys.exit(Exit.ERROR)
+
+    if args.daemon_tests_only:
+        tests, dropped = select_daemon_tests(tests)
+        print(f"Daemon-transport tests only: running {len(tests)}, skipping "
+              f"{len(dropped)} test(s) that cannot observe the transport")
+    metadata_by_test = {test_name(test): read_requirements(test) for test in tests}
+
+    def timeout_for(name):
+        metadata = metadata_by_test.get(name) or {}
+        return max(args.timeout, 600) if metadata.get('cost') == 'expensive' else args.timeout
+
+    def mismatch(testbase, actual, unsupported=''):
+        if actual == 'unsupported':
+            metadata = metadata_by_test.get(testbase) or {}
+            return unsupported not in profile_unsupported or unsupported not in metadata.get('features', ())
+        if actual == 'skip':
+            return True
+        if testbase in profile_xfail:
+            return actual not in ('fail', 'xfail')
+        return actual != 'pass'
+
+    test_order = {test_name(test): index for index, test in enumerate(tests)}
+
+    passed = 0
+    failed = 0
+    skipped = 0
+    unsupported_count = 0
+    xfailed = 0
+    outcomes = {}
+    unsupported_outcomes = {}
+    durations = {}
+    test_results = {}
+
+    def process_result(result):
+        nonlocal passed, failed, skipped, unsupported_count, xfailed
+        with _print_lock:
+            if result.output:
+                print(result.output)
+        scratchdir = os.path.join(scratchbase, result.name)
+        outcome = result.outcome
+        outcomes[result.name] = outcome
+        test_results[result.name] = result
+        unsupported_outcomes[result.name] = result.unsupported
+        durations[result.name] = result.duration
+        if result.exit_code == Exit.PASS:
+            passed += 1
+        elif result.exit_code == Exit.SKIP:
+            if result.unsupported:
+                unsupported_count += 1
+            else:
+                skipped += 1
+        elif result.exit_code == Exit.XFAIL:
+            xfailed += 1
+        else:
+            failed += 1
+        if result.exit_code in (Exit.PASS, Exit.SKIP, Exit.XFAIL) and not args.preserve_scratch \
+                and os.path.isdir(scratchdir):
+            subprocess.run(['rm', '-rf', scratchdir], capture_output=True)
+        if profiles:
+            return mismatch(result.name, outcome, result.unsupported)
+        return result.exit_code not in (Exit.PASS, Exit.SKIP, Exit.XFAIL)
+
+    run_started = time.monotonic()
+
+    if args.parallel > 1:
+        with concurrent.futures.ThreadPoolExecutor(max_workers=args.parallel) as executor:
+            futures = {}
+            for testscript in tests:
+                testbase = test_name(testscript)
+                scratchdir = os.path.join(scratchbase, testbase)
+                timeout = timeout_for(testbase)
+                f = executor.submit(
+                    run_one_test, testscript, testbase, scratchdir,
+                    base_env, timeout, srcdir, tooldir, setfacl_nodef,
+                    args.always_log
+                )
+                futures[f] = testbase
+
+            for f in concurrent.futures.as_completed(futures):
+                result = f.result()
+                is_fail = process_result(result)
+                if is_fail and args.stop_on_fail:
+                    for pending in futures:
+                        pending.cancel()
+                    break
+    else:
+        for testscript in tests:
+            testbase = test_name(testscript)
+            scratchdir = os.path.join(scratchbase, testbase)
+            timeout = timeout_for(testbase)
+            result = run_one_test(
+                testscript, testbase, scratchdir,
+                base_env, timeout, srcdir, tooldir, setfacl_nodef,
+                args.always_log
+            )
+            is_fail = process_result(result)
+            if is_fail and args.stop_on_fail:
+                break
+
+    run_wall = time.monotonic() - run_started
+
+    vg_errors = 0
+    if args.valgrind:
+        for vlog in sorted(glob.glob(os.path.join(scratchbase, 'valgrind-logs', 'valgrind.*.log'))):
+            try:
+                with open(vlog) as f:
+                    content = f.read()
+                for line in content.splitlines():
+                    if 'ERROR SUMMARY:' in line and 'ERROR SUMMARY: 0 errors' not in line:
+                        vg_errors += 1
+                        print(f'----- valgrind errors in {os.path.basename(vlog)}:')
+                        print(content)
+                        break
+            except FileNotFoundError:
+                pass
+
+    print('-' * 60)
+    print('----- overall results:')
+    print(f'      {passed} passed')
+    if failed > 0:
+        print(f'      {failed} failed')
+    if xfailed > 0:
+        print(f'      {xfailed} xfailed (expected)')
+    if skipped > 0:
+        print(f'      {skipped} skipped')
+    if unsupported_count > 0:
+        print(f'      {unsupported_count} unsupported')
+    if vg_errors > 0:
+        print(f'      {vg_errors} valgrind error(s) found (see logs in {os.path.join(scratchbase, "valgrind-logs")})')
+
+    if args.timing:
+        print_timing_report(durations, outcomes, run_wall, args.parallel)
+
+    def expected_outcome(name):
+        if name in profile_xfail:
+            return f'xfail:{profile_xfail[name]}'
+        capability = unsupported_outcomes.get(name, '')
+        if capability and capability in profile_unsupported:
+            return f'unsupported:{capability}'
+        return 'pass'
+
+    def emit_receipt(exit_code, mismatches=()):
+        if not args.receipt:
+            return
+        ordered = sorted(test_results, key=lambda name: test_order.get(name, 1 << 30))
+        records = []
+        verdicts = {}
+        for name in ordered:
+            record = test_results[name].record(expected_outcome(name) if profiles else None)
+            if metadata_by_test.get(name):
+                record['requirements'] = metadata_by_test[name]
+            records.append(record)
+            verdicts[record['verdict']] = verdicts.get(record['verdict'], 0) + 1
+        data = {
+            'schema': 1,
+            'run': {
+                'binary': rsync_cmd,
+                'peer': rsync_peer_cmd,
+                'peer_version': profile_peer,
+                'profiles': [profile.name for profile in profiles],
+                'protocol': effective_protocol,
+                'transport': transport,
+                'parallel': args.parallel,
+                'valgrind': args.valgrind,
+                'selected': list(test_order),
+            },
+            'tests': records,
+            'summary': {
+                'passed': passed,
+                'failed': failed,
+                'skipped': skipped,
+                'unsupported': unsupported_count,
+                'xfailed': xfailed,
+                'verdicts': verdicts,
+                'valgrind_errors': vg_errors,
+                'duration_seconds': round(run_wall, 6),
+                'exit_code': exit_code,
+                'mismatches': list(mismatches),
+            },
+        }
+        write_receipt(args.receipt, data)
+
+    if profiles:
+        mismatches = []
+        expected_tests = {test_name(test) for test in tests}
+        for name in sorted(expected_tests, key=lambda item: test_order.get(item, 1 << 30)):
+            actual = outcomes.get(name, 'notrun')
+            unsupported = unsupported_outcomes.get(name, '')
+            if actual == 'notrun' or mismatch(name, actual, unsupported):
+                expected = expected_outcome(name)
+                verdict = ('profile_error' if actual == 'notrun'
+                           else verdict_of(actual, expected))
+                mismatches.append((name, expected, actual, verdict))
+        if mismatches:
+            print('----- profile mismatches:')
+            for name, expected, actual, verdict in mismatches:
+                print(f'      {verdict.upper()} {name}: expected {expected}, got {actual}')
+        print('-' * 60)
+        exit_code = len(mismatches) + vg_errors
+        emit_receipt(exit_code, ({'name': name, 'expected': expected,
+                                  'actual': actual, 'verdict': verdict}
+                                 for name, expected, actual, verdict in mismatches))
+        print(f'overall result is {exit_code}')
+        sys.exit(exit_code)
+
+    print('-' * 60)
+
+    exit_code = failed + vg_errors
+    emit_receipt(exit_code)
+    print(f'overall result is {exit_code}')
+    sys.exit(exit_code)
+
+if __name__ == '__main__':
+    main()
diff --git a/testsuite/harness/valgrind.supp b/testsuite/harness/valgrind.supp
new file mode 100644
index 000000000..da68b6a6d
--- /dev/null
+++ b/testsuite/harness/valgrind.supp
@@ -0,0 +1,34 @@
+# Reports outside rsync. runtests.py --valgrind loads this file automatically
+# CI disables leak checking, so the leak stanzas apply only to manual audits
+
+# Bundled popt retains alias strings until process exit
+{
+   rsync-popt-alias-leak
+   Memcheck:Leak
+   match-leak-kinds: definite
+   fun:malloc
+   fun:my_alloc
+   fun:my_strdup
+   fun:popt_unalias
+   fun:parse_arguments
+   fun:main
+}
+
+# libxxhash returns an aligned interior pointer for the XXH3 state
+{
+   xxhash-createstate-aligned
+   Memcheck:Leak
+   match-leak-kinds: possible
+   fun:malloc
+   fun:XXH3_createState
+}
+
+# libfakeroot leaves padding in its SysV message buffer uninitialised
+{
+   fakeroot-msgsnd-padding
+   Memcheck:Param
+   msgsnd(msgp->mtext)
+   fun:msgsnd
+   ...
+   obj:*libfakeroot*
+}
diff --git a/testsuite/harness/xattrs.py b/testsuite/harness/xattrs.py
new file mode 100644
index 000000000..e6e0cec13
--- /dev/null
+++ b/testsuite/harness/xattrs.py
@@ -0,0 +1,141 @@
+import os
+import platform
+import re
+import shutil
+import subprocess
+
+from .process import run_rsync
+
+SYSTEM = platform.system()
+CYGWIN = SYSTEM.startswith('CYGWIN')
+LINUX_NAMESPACE = SYSTEM == 'Linux' or CYGWIN
+
+RSYNC_PREFIX = 'rsync'
+RUSR = 'rsync.nonuser' if SYSTEM in ('Darwin', 'SunOS') else 'rsync'
+
+class XattrError(OSError):
+    pass
+
+def _full_name(name):
+    return f'user.{name}' if LINUX_NAMESPACE else name
+
+def is_supported():
+    command = os.environ['RSYNC']
+    version = run_rsync(command, '-VV', capture_output=True).stdout
+    if '"xattrs": true' not in version:
+        return False
+    if SYSTEM == 'Linux':
+        return hasattr(os, 'setxattr')
+    if CYGWIN:
+        return shutil.which('setfattr') is not None
+    if SYSTEM == 'Darwin':
+        return shutil.which('xattr') is not None
+    if SYSTEM == 'FreeBSD':
+        return shutil.which('setextattr') is not None
+    if SYSTEM == 'SunOS':
+        return shutil.which('runat') is not None
+    return False
+
+def _tool_errno(tool, message):
+    if tool != 'xattr' or not message:
+        return None
+    match = re.match(r'xattr: \[Errno (\d+)\]', message.splitlines()[0])
+    return int(match.group(1)) if match else None
+
+def _run(argv, **kwargs):
+    result = subprocess.run(argv, capture_output=True, **kwargs)
+    if result.returncode == 0:
+        return result
+    message = (result.stderr or result.stdout or '').strip()
+    if isinstance(message, bytes):
+        message = message.decode('utf-8', 'replace')
+    error = XattrError(f'{argv[0]} exited {result.returncode}'
+                       + (f': {message}' if message else ''))
+    error.errno = _tool_errno(argv[0], message)
+    raise error
+
+def get_value(name, path):
+    name = _full_name(name)
+    path = str(path)
+    if SYSTEM == 'Linux':
+        return os.getxattr(path, name)
+    if CYGWIN:
+        argv = ['getfattr', '--only-values', '-n', name, path]
+        options = {}
+    elif SYSTEM == 'Darwin':
+        argv = ['xattr', '-px', name, path]
+        options = {}
+    elif SYSTEM == 'FreeBSD':
+        argv = ['getextattr', '-qqh', 'user', name, path]
+        options = {}
+    elif SYSTEM == 'SunOS':
+        argv = ['runat', path, '/bin/sh']
+        options = {'input': b'cat "$XNAME"\n', 'env': {**os.environ, 'XNAME': name}}
+    else:
+        raise NotImplementedError(f'xattr get on {SYSTEM}')
+    result = _run(argv, **options)
+    if SYSTEM != 'Darwin':
+        return result.stdout
+    try:
+        return bytes.fromhex(result.stdout.decode('ascii'))
+    except (UnicodeDecodeError, ValueError) as cause:
+        error = XattrError('xattr returned invalid hexadecimal')
+        error.errno = None
+        raise error from cause
+
+def set_value(name, value, *paths):
+    name = _full_name(name)
+    for path in map(str, paths):
+        if SYSTEM == 'Linux':
+            os.setxattr(path, name.encode(), value.encode())
+        elif CYGWIN:
+            _run(['setfattr', '-n', name, '-v', value, path], text=True)
+        elif SYSTEM == 'Darwin':
+            _run(['xattr', '-w', name, value, path], text=True)
+        elif SYSTEM == 'FreeBSD':
+            _run(['setextattr', '-h', 'user', name, value, path], text=True)
+        elif SYSTEM == 'SunOS':
+            _run(['runat', path, '/bin/sh'], input='printf %s "$XVAL" > "$XNAME"\n',
+                 env={**os.environ, 'XNAME': name, 'XVAL': value}, text=True)
+        else:
+            raise NotImplementedError(f'xattr set on {SYSTEM}')
+
+def dump_values(*paths):
+    if SYSTEM == 'Linux':
+        output = []
+        for path in map(str, paths):
+            names = sorted(name for name in os.listxattr(path) if name.startswith('user.'))
+            if not names:
+                continue
+            output.append(f'# file: {path}\n')
+            for name in names:
+                value = os.getxattr(path, name).decode('utf-8', 'surrogateescape')
+                output.append(f'{name}="{value}"\n')
+            output.append('\n')
+        return ''.join(output)
+    if CYGWIN:
+        return subprocess.check_output(['getfattr', '-d', *map(str, paths)], text=True)
+    if SYSTEM == 'Darwin':
+        output = []
+        for path in paths:
+            value = subprocess.check_output(['xattr', '-l', str(path)], text=True)
+            output.append('\n'.join(line.lstrip(' \t') for line in value.splitlines()))
+            output.append('\n')
+        return ''.join(output)
+    if SYSTEM == 'FreeBSD':
+        output = []
+        for path in paths:
+            names = subprocess.check_output(
+                ['lsextattr', '-q', '-h', 'user', str(path)], text=True).split()
+            for name in sorted(names):
+                output.append(subprocess.check_output(
+                    ['getextattr', '-h', 'user', name, str(path)], text=True))
+        return ''.join(output)
+    if SYSTEM == 'SunOS':
+        script = ('for x in *; do case "$x" in SUNWattr_*) continue;; esac; '
+                  'printf "%s=%s\\n" "$x" "$(cat "$x")"; done\n')
+        return ''.join(subprocess.run(
+            ['runat', str(path), '/bin/sh'], input=script,
+            capture_output=True, text=True, check=True,
+        ).stdout for path in paths)
+    raise NotImplementedError(f'xattr dump on {SYSTEM}')
diff --git a/testsuite/hashsearch-chain_test.py b/testsuite/hashsearch-chain_test.py
deleted file mode 100644
index 9dcb45b45..000000000
--- a/testsuite/hashsearch-chain_test.py
+++ /dev/null
@@ -1,108 +0,0 @@
-#!/usr/bin/env python3
-"""Regression test for issue #217: hash_search() must not blow up to O(N^2).
-
-A disk/VM image can contain a huge number of blocks that share the same weak
-rolling checksum (e.g. long runs of identical bytes).  All such blocks land on
-a single hash-table chain.  When the sender then rolls across a region whose
-weak checksum keeps landing on that chain but never produces a strong-checksum
-match, the inner loop of hash_search() used to walk the *entire* chain for
-every single byte offset.  The transfer would peg one CPU at 100% for hours
-with no visible progress -- "rsync hangs at 100% CPU".
-
-We reproduce a small, deterministic version of that pathology:
-
-  * Destination/basis file: many identical "decoy" blocks.  Each decoy is an
-    all-C block whose first three bytes are perturbed by (+1,-2,+1).  That
-    perturbation leaves rsync's weak checksum (get_checksum1) unchanged but
-    changes the strong checksum, so every decoy shares one weak checksum yet
-    never strong-matches the source -> one very long chain, all false alarms.
-
-  * Source file: a short run of the constant byte C.  Every window has that
-    same weak checksum, so without a bound the sender walks the whole chain at
-    every offset.
-
-Rather than measure wall-clock time (which is hopelessly machine dependent),
-we count the work directly.  rsync's existing `false_alarms` counter -- shown
-by `--debug=deltasum1` -- is incremented once per strong-checksum comparison
-that fails, i.e. exactly once per chain entry examined and rejected.  With the
-per-offset cap in match.c the sender examines at most MAX_CHAIN_LEN entries per
-hash hit, so false_alarms / hash_hits stays bounded no matter how long the
-chain is; without the cap that ratio equals the full chain length.  We assert
-the bound, which is the same integer on every machine.
-
-The fix is sender-only (it changes no checksum, byte, or protocol field), so
-the transferred result must also still be byte-for-byte correct.
-"""
-
-import re
-
-from rsyncfns import (
-    FROMDIR, TODIR, assert_same, rmtree, run_rsync, test_fail,
-)
-
-BLOCK = 256
-NBLOCKS = 8000           # chain length -- much longer than match.c's cap (1024)
-RUN = 3000               # length of the constant-byte region in the source
-C = 100                  # the constant source byte
-
-# A correct fix bounds the per-hash-hit chain walk to match.c's MAX_CHAIN_LEN
-# (1024).  Pick an assertion bound comfortably between that cap and the full
-# chain length so the test is insensitive to modest cap retuning but still
-# fails hard for the unbounded (pre-fix) walk of NBLOCKS per hit.
-MAX_FALSE_ALARMS_PER_HIT = NBLOCKS // 4   # 2000: > cap(1024), << chain(8000)
-
-
-def make_decoy_block() -> bytes:
-    b = bytearray([C]) * BLOCK
-    # (+1,-2,+1) at positions 0,1,2 preserves get_checksum1 (both s1 and s2)
-    # while changing the block's content and thus its strong checksum.
-    b[0] = C + 1
-    b[1] = C - 2
-    b[2] = C + 1
-    return bytes(b)
-
-
-rmtree(FROMDIR)
-rmtree(TODIR)
-FROMDIR.mkdir(parents=True, exist_ok=True)
-TODIR.mkdir(parents=True, exist_ok=True)
-
-src = FROMDIR / 'image.bin'
-dst = TODIR / 'image.bin'
-
-# Basis: NBLOCKS identical decoys -> one giant weak-checksum chain.
-decoy = make_decoy_block()
-with open(dst, 'wb') as f:
-    for _ in range(NBLOCKS):
-        f.write(decoy)
-
-# Source: a constant-byte run (constant weak checksum, no strong match).
-with open(src, 'wb') as f:
-    f.write(bytes([C]) * RUN)
-
-proc = run_rsync('-a', '--no-whole-file', f'--block-size={BLOCK}',
-                 '--no-compress', '--debug=deltasum1',
-                 f'{src}', f'{dst}', capture_output=True)
-
-out = proc.stdout + proc.stderr
-m = re.search(r'hash_hits=(\d+)\s+false_alarms=(\d+)', out)
-if not m:
-    test_fail(f"could not find deltasum stats in rsync output:\n{out}")
-hash_hits = int(m.group(1))
-false_alarms = int(m.group(2))
-
-if hash_hits == 0:
-    test_fail("expected the source to hit the decoy chain but hash_hits=0")
-
-ratio = false_alarms / hash_hits
-if ratio > MAX_FALSE_ALARMS_PER_HIT:
-    test_fail(
-        f"hash_search() walked ~{ratio:.0f} chain entries per hash hit "
-        f"(false_alarms={false_alarms}, hash_hits={hash_hits}); the chain of "
-        f"{NBLOCKS} entries is not being capped -- issue #217 regression")
-
-# Correctness is non-negotiable: the cap only skips matches, never data.
-assert_same(dst, src, label='issue #217 chain-cap transfer')
-
-print(f"issue #217: bounded at {ratio:.0f} false alarms/hit "
-      f"(chain={NBLOCKS}, cap keeps it under {MAX_FALSE_ALARMS_PER_HIT})")
diff --git a/testsuite/insecure-links-admin-optout_test.py b/testsuite/insecure-links-admin-optout_test.py
deleted file mode 100644
index 44492c7fa..000000000
--- a/testsuite/insecure-links-admin-optout_test.py
+++ /dev/null
@@ -1,90 +0,0 @@
-#!/usr/bin/env python3
-# Admin per-module opt-out: `insecure links = yes` (rsyncd.conf).
-#
-# A CLIENT can never switch off a daemon's symlink confinement -- that is the
-# operator-path-insecure-links-{daemon,refused} guard.  But an ADMIN may, for an
-# isolated/trusted module, restore the legacy follow-any-symlink behaviour with
-# `insecure links = yes` (the daemon analogue of the local --insecure-links).
-# This re-opens the symlink-escape vectors for that module ON PURPOSE, so the
-# test asserts both halves of the rule using two modules over one daemon, both
-# rooted at the same tree with the same planted escape:
-#
-#   - mod_secure   (default)            -> the escape is REFUSED (confined)
-#   - mod_insecure (insecure links=yes) -> the escape is SERVED  (opt-out honored)
-#
-# The escape is a directory symlink inside the module pointing OUT of the module;
-# a --copy-dirlinks pull enumerates through it (flist secure_opendir) and reads
-# the out-of-tree file (sender content open).  Both gates consult the per-module
-# opt-out, so the out-of-module file arrives only for the insecure module.
-#
-# Requires root: the planted symlink is foreign-owned, matching the threat model
-# (an attacker-owned in-module symlink), and the module is served as root.
-
-import os
-import subprocess
-
-from rsyncfns import (
-    SCRATCHDIR, find_attacker_uid, rmtree, rsync_argv, rsync_supports,
-    start_test_daemon, test_fail, test_skipped, write_daemon_conf,
-)
-
-DAEMON_PORT = 12906
-MARKER = "OUT-OF-MODULE-SECRET\n"
-
-if os.geteuid() != 0:
-    test_skipped("requires root to plant a foreign-owned symlink and serve as root")
-ATT = find_attacker_uid()
-if ATT is None:
-    test_skipped("no untrusted-uid user available for cross-uid plant")
-if not rsync_supports('--copy-dirlinks'):
-    test_skipped("rsync lacks --copy-dirlinks")
-
-base = SCRATCHDIR / 'insecure-admin'
-rmtree(base)
-mod = base / 'mod'
-outside = base / 'outside'
-mod.mkdir(parents=True)
-outside.mkdir(parents=True)
-
-# In-module content (always servable) plus the escaping directory symlink.
-(mod / 'intree.txt').write_text("in-module\n")
-(outside / 'secret.txt').write_text(MARKER)
-os.symlink('../outside', mod / 'sub')          # dir symlink -> out of module
-os.lchown(mod / 'sub', ATT, ATT)               # foreign-owned (attacker) plant
-
-# Serve as root (uid/gid 0) so the daemon euid differs from the attacker uid.
-# Use numeric 0, not the name "root": the root *group* is "wheel" on the BSDs
-# and macOS, so `gid = root` is rejected there ("Invalid gid root").
-conf = write_daemon_conf([
-    ('mod_secure', {'path': str(mod), 'use chroot': 'no', 'read only': 'yes',
-                    'uid': '0', 'gid': '0'}),
-    ('mod_insecure', {'path': str(mod), 'use chroot': 'no', 'read only': 'yes',
-                      'uid': '0', 'gid': '0', 'insecure links': 'yes'}),
-])
-url = start_test_daemon(conf, DAEMON_PORT)
-
-
-def pull(modname):
-    out = base / f'dest_{modname}'
-    rmtree(out)
-    out.mkdir()
-    subprocess.run(
-        rsync_argv('-r', '--copy-dirlinks', f'{url}{modname}/', f'{out}/'),
-        stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
-    served = out / 'sub' / 'secret.txt'
-    return served.is_file() and served.read_text() == MARKER
-
-
-# Default module: the foreign-owned escaping symlink must be refused.
-if pull('mod_secure'):
-    test_fail("mod_secure served the out-of-module file through the planted "
-              "directory symlink: the daemon followed it without `insecure "
-              "links = yes` -- confinement failed.")
-
-# Opt-out module: the admin asked for legacy following, so it must be honored.
-if not pull('mod_insecure'):
-    test_fail("mod_insecure did NOT serve the out-of-module file even with "
-              "`insecure links = yes`: the per-module admin opt-out was not "
-              "honored by the sender enumeration/content gates.")
-
-print("insecure links = yes: refused by default, honored as an admin opt-out")
diff --git a/testsuite/io-noop-flood-recursion_test.py b/testsuite/io-noop-flood-recursion_test.py
deleted file mode 100644
index 8f6b7c4ea..000000000
--- a/testsuite/io-noop-flood-recursion_test.py
+++ /dev/null
@@ -1,90 +0,0 @@
-#!/usr/bin/env python3
-# Regression test for unbounded recursion in read_a_msg() (io.c). read_a_msg()
-# sets iobuf.in_multiplexed = -1 on entry so that any perform_io() reached while
-# the message body is consumed will not re-enter read_a_msg(). The MSG_NOOP (and
-# MSG_IO_ERROR) handlers reset it to 1 *before* calling maybe_send_keepalive() /
-# send_msg_int(), both of which can reach perform_io(PIO_NEED_MSGROOM). With more
-# frames already buffered (iobuf.in.len > 512), perform_io() then loops back into
-# read_a_msg() -- each frame stacks a fresh BIGPATHBUFLEN local, so a hostile peer
-# that floods MSG_NOOP at a daemon sender exhausts the stack.
-#
-# Drive it with the pure-Python client: pull from a daemon (so the daemon is the
-# sender, am_sender => maybe_send_keepalive runs) and, instead of a filter list,
-# flood MSG_NOOP frames in one burst. The daemon's first read of our stream
-# recurses through read_a_msg until the stack guard page is hit.
-#
-# The fix defers iobuf.in_multiplexed = 1 to *after* the call-out, keeping the
-# re-entry guard armed across the write-side flush.
-#
-# Oracle: pre-fix -> the daemon child hits an ASan stack-overflow report; fixed
-# -> none. Needs an ASan build + a real TCP daemon, and is skipped otherwise.
-
-import glob
-import os
-import struct
-import time
-
-from rsyncfns import (
-    SCRATCHDIR, claim_ports, require_asan, require_tcp, start_rsyncd, test_fail,
-)
-import rsync_proto as rp
-
-PORT = 12955
-require_tcp("the pure-Python client needs a real TCP daemon; run with --use-tcp")
-require_asan("the read_a_msg recursion is observed via the daemon's "
-            "AddressSanitizer stack-overflow report")
-claim_ports(PORT)
-
-mod = SCRATCHDIR / 'noop-mod'
-mod.mkdir(parents=True, exist_ok=True)
-(mod / 'f').write_text("hello\n")
-
-conf = SCRATCHDIR / 'noop.conf'
-conf.write_text(f"""\
-pid file = {SCRATCHDIR}/noop-rsyncd.pid
-use chroot = no
-
-[mod]
-    path = {mod}
-    read only = no
-""")
-
-asan_log = SCRATCHDIR / 'noop-asan'
-for stale in glob.glob(f"{asan_log}.*"):
-    os.unlink(stale)
-prev = os.environ.get('ASAN_OPTIONS', '')
-os.environ['ASAN_OPTIONS'] = (
-    (prev + ':' if prev else '') + f'detect_leaks=0:abort_on_error=1:log_path={asan_log}')
-
-start_rsyncd(conf, PORT)
-
-c = rp.DaemonClient('127.0.0.1', PORT)
-# Pull => the daemon is the sender (am_sender, so the MSG_NOOP handler reaches
-# maybe_send_keepalive).
-c.handshake('mod', ['--server', '--sender', '-e.LsfxCIu', '.', 'mod/'],
-            greeting_version=30)
-# A MSG_NOOP frame: header ((MPLEX_BASE + MSG_NOOP) << 24) | 0, no payload.
-NOOP = struct.pack('<I', (rp.MPLEX_BASE + 42) << 24)
-try:
-    c._send_raw(NOOP * 40000)          # one big burst => iobuf.in.len >> 512
-except OSError:
-    pass                               # the daemon may die mid-write
-c.drain(timeout=5.0)
-c.close()
-
-reports = ''
-for _ in range(30):
-    reports = ''.join(open(r, errors='replace').read()
-                      for r in glob.glob(f"{asan_log}.*"))
-    if 'AddressSanitizer' in reports:
-        break
-    time.sleep(0.1)
-
-if 'AddressSanitizer' in reports:
-    test_fail(
-        "daemon sender recursed through read_a_msg on a MSG_NOOP flood and hit "
-        "an AddressSanitizer stack-overflow -- the MSG_NOOP handler re-armed "
-        "in_multiplexed before the keepalive flush:\n" + reports[:1500])
-
-print("io-noop-flood-recursion: a MSG_NOOP flood does not re-enter read_a_msg "
-      "(no stack exhaustion).")
diff --git a/testsuite/io-nosend-flood-recursion_test.py b/testsuite/io-nosend-flood-recursion_test.py
deleted file mode 100644
index bf3c7278b..000000000
--- a/testsuite/io-nosend-flood-recursion_test.py
+++ /dev/null
@@ -1,100 +0,0 @@
-#!/usr/bin/env python3
-# Sibling of io-noop-flood-recursion: the same read_a_msg() re-entry bug reached
-# through MSG_NO_SEND instead of MSG_NOOP. The original fix deferred
-# iobuf.in_multiplexed = 1 only for MSG_NOOP/MSG_IO_ERROR, but the MSG_NO_SEND
-# handler also reset it to 1 *before* its send_msg_int(MSG_NO_SEND, val) call-out
-# (the !am_generator branch). At a daemon sender (am_sender), send_msg() reaches
-# perform_io(PIO_NEED_MSGROOM), which re-enters read_a_msg() while
-# in_multiplexed > 0 and iobuf.in.len > 512 -- so a MSG_NO_SEND flood recurses to
-# stack exhaustion exactly like the MSG_NOOP one. (Codex review of the run4 0002
-# fix flagged this sibling path.)
-#
-# Pull from a daemon (so it is the sender, not the generator -> the send_msg_int
-# branch runs) and flood MSG_NO_SEND frames in one burst. The fix defers
-# in_multiplexed = 1 past the call-out here too.
-#
-# Oracle: pre-fix -> ASan stack-overflow report from the daemon child; fixed ->
-# none. Needs an ASan build + a real TCP daemon, and is skipped otherwise.
-
-import glob
-import os
-import socket
-import struct
-import time
-
-from rsyncfns import (
-    SCRATCHDIR, claim_ports, require_asan, require_tcp, start_rsyncd, test_fail,
-)
-import rsync_proto as rp
-
-PORT = 12958
-require_tcp("the pure-Python client needs a real TCP daemon; run with --use-tcp")
-require_asan("the read_a_msg MSG_NO_SEND recursion is observed via the daemon's "
-            "AddressSanitizer stack-overflow report")
-claim_ports(PORT)
-
-mod = SCRATCHDIR / 'nosend-mod'
-mod.mkdir(parents=True, exist_ok=True)
-(mod / 'f').write_text("hello\n")
-
-conf = SCRATCHDIR / 'nosend.conf'
-# Tiny SO_SNDBUF so the daemon's re-sent MSG_NO_SEND output blocks almost
-# immediately (loopback send buffers are otherwise large), forcing send_msg()'s
-# perform_io(PIO_NEED_MSGROOM) -- and thus the input-draining re-entry.
-conf.write_text(f"""\
-pid file = {SCRATCHDIR}/nosend-rsyncd.pid
-use chroot = no
-socket options = SO_SNDBUF=2048
-
-[mod]
-    path = {mod}
-    read only = no
-""")
-
-asan_log = SCRATCHDIR / 'nosend-asan'
-for stale in glob.glob(f"{asan_log}.*"):
-    os.unlink(stale)
-prev = os.environ.get('ASAN_OPTIONS', '')
-os.environ['ASAN_OPTIONS'] = (
-    (prev + ':' if prev else '') + f'detect_leaks=0:abort_on_error=1:log_path={asan_log}')
-
-start_rsyncd(conf, PORT)
-
-c = rp.DaemonClient('127.0.0.1', PORT)
-# Shrink our receive buffer so the daemon's re-sent MSG_NO_SEND output blocks
-# almost immediately (on loopback the default buffers are huge). Once send_msg()
-# can't drain, perform_io(PIO_NEED_MSGROOM) does the input-draining re-entry --
-# unlike MSG_NOOP, whose maybe_send_keepalive() flushes unconditionally.
-c.sock.setsockopt(socket.SOL_SOCKET, socket.SO_RCVBUF, 2048)
-# Pull => daemon is the sender (am_sender, not am_generator) => MSG_NO_SEND takes
-# the send_msg_int() branch.
-c.handshake('mod', ['--server', '--sender', '-e.LsfxCIu', '.', 'mod/'],
-            greeting_version=30)
-# A MSG_NO_SEND frame: header ((MPLEX_BASE + MSG_NO_SEND) << 24) | 4, 4-byte body.
-NOSEND = struct.pack('<I', ((rp.MPLEX_BASE + 102) << 24) | 4) + b'\x00\x00\x00\x00'
-try:
-    c._send_raw(NOSEND * 60000)
-except OSError:
-    pass                               # daemon crashed mid-write, or send timed out
-try:
-    c.drain(timeout=5.0)
-except OSError:
-    pass                               # connection reset by the crashed daemon child
-c.close()
-
-reports = ''
-for _ in range(30):
-    reports = ''.join(open(r, errors='replace').read()
-                      for r in glob.glob(f"{asan_log}.*"))
-    if 'AddressSanitizer' in reports:
-        break
-    time.sleep(0.1)
-
-if 'AddressSanitizer' in reports:
-    test_fail(
-        "daemon sender recursed through read_a_msg on a MSG_NO_SEND flood and hit "
-        "an AddressSanitizer stack-overflow -- the MSG_NO_SEND handler re-armed "
-        "in_multiplexed before the send_msg_int flush:\n" + reports[:1500])
-
-print("io-nosend-flood-recursion: a MSG_NO_SEND flood does not re-enter "
-      "read_a_msg (no stack exhaustion).")
diff --git a/testsuite/keep-dirlinks-symlinked-dest_test.py b/testsuite/keep-dirlinks-symlinked-dest_test.py
deleted file mode 100644
index aae885684..000000000
--- a/testsuite/keep-dirlinks-symlinked-dest_test.py
+++ /dev/null
@@ -1,37 +0,0 @@
-#!/usr/bin/env python3
-# --keep-dirlinks (-K) into a symlinked destination directory must follow the
-# symlink and write into the real dir -- that is the entire purpose of -K
-# (treat a symlinked dir on the receiver as a dir; the #715 family).
-#
-# A/B-discovered 3.5 regression (abdiff: 3.5 vs 3.4.4): an early per-component
-# O_NOFOLLOW resolver refused the in-tree dir-symlink that -K is meant to follow,
-# so the transfer failed (Not a directory -> exit 23, the directory's files lost;
-# near-silent).  The secure resolver now follows in-tree directory symlinks on
-# every platform, so -K writes through the symlinked dest dir uniformly; 3.4.x is
-# unaffected.  Plain transfer, no root.
-
-import os
-
-from rsyncfns import SCRATCHDIR, assert_same, makepath, rmtree, run_rsync, test_fail
-
-base = SCRATCHDIR / 'kdl'
-src = base / 'src'
-dest = base / 'dest'
-rmtree(base)
-makepath(src / 'dir', dest / 'realdir')
-(src / 'dir' / 'f1').write_text('one\n')
-(src / 'dir' / 'f2').write_text('two\n')
-(src / 'top.txt').write_text('top\n')
-# The receiver already has the destination subdir as an in-tree symlink to a
-# real directory -- exactly what --keep-dirlinks is for.
-os.symlink('realdir', dest / 'dir')
-
-run_rsync('-aK', f'{src}/', f'{dest}/')   # check=True: resolver follows the in-tree dest symlink
-
-real = dest / 'realdir'
-for n in ('f1', 'f2'):
-    if not (real / n).is_file():
-        test_fail(f"-K did not follow the symlinked dest dir: {real / n} missing")
-    assert_same(src / 'dir' / n, real / n, label=f'-K content {n}')
-
-print("keep-dirlinks-symlinked-dest: -K follows a symlinked destination directory")
diff --git a/testsuite/ki58-log-format-percent_test.py b/testsuite/ki58-log-format-percent_test.py
deleted file mode 100644
index ce9fdbda4..000000000
--- a/testsuite/ki58-log-format-percent_test.py
+++ /dev/null
@@ -1,131 +0,0 @@
-#!/usr/bin/env python3
-"""Regression test: `%%` in --out-format outputs a literal `%`.
-
-# Verifies: SW-REQ-166
-
-The log_formatted() switch in log.c had no `case '%'`, so `%%` left the
-first `%` in place and re-parsed the second `%` as the start of a new
-specifier.  This test transfers a file with `--out-format='100%% done %f'`
-and asserts the output contains `100% done <filename>` (a single literal
-percent, a space, the word "done", and the expanded filename).
-"""
-
-import subprocess
-
-from rsyncfns import (
-    FROMDIR, TODIR,
-    forced_protocol, makepath, rmtree, rsync_argv, test_fail,
-)
-
-src = FROMDIR
-
-# Build a single-file source tree.
-rmtree(src)
-rmtree(TODIR)
-makepath(src)
-(src / 'percentfile').write_text("data\n")
-
-# Transfer using a format string with both %% (literal percent) and %f (name).
-p = subprocess.run(
-    rsync_argv('-a', '--out-format=100%% done %f', f'{src}/', f'{TODIR}/'),
-    capture_output=True, text=True,
-)
-if p.returncode != 0:
-    test_fail(f"rsync exited {p.returncode}:\n{p.stderr}")
-
-# %f expands to the transfer-relative path, which includes leading directories
-# when the source is addressed by an absolute path (as here) -- so don't pin the
-# exact filename.  The point of this test is the escape: "100% done " with a
-# single literal percent followed by a space (a broken %% consumes the space or
-# leaves a doubled percent), plus the transferred file name somewhere.
-if '100% done ' not in p.stdout or 'percentfile' not in p.stdout:
-    test_fail(
-        "expected '100% done ' (a single literal percent) and 'percentfile' in "
-        f"--out-format output, got:\n{p.stdout}"
-    )
-
-# log_format_has() must not see the 'i' in '%%i' as an itemize escape: the
-# second '%' of a '%%' is a literal, not the start of a new specifier.  A
-# misdetection turns on itemizing, which logs attribute-only changes that a
-# plain --out-format run must not mention.
-(src / 'percentfile').chmod(0o640)
-p = subprocess.run(
-    rsync_argv('-a', '--out-format=%%i %n', f'{src}/', f'{TODIR}/'),
-    capture_output=True, text=True,
-)
-if p.returncode != 0:
-    test_fail(f"rsync exited {p.returncode}:\n{p.stderr}")
-(src / 'percentfile').chmod(0o600)
-p = subprocess.run(
-    rsync_argv('-a', '--out-format=%%i %n', f'{src}/', f'{TODIR}/'),
-    capture_output=True, text=True,
-)
-if p.returncode != 0:
-    test_fail(f"rsync exited {p.returncode}:\n{p.stderr}")
-if 'percentfile' in p.stdout:
-    test_fail(
-        "'%%i' misdetected as itemizing: an attribute-only change was logged "
-        f"by --out-format='%%i %n':\n{p.stdout}"
-    )
-
-# And '%%i' on a really transferred file still renders as literal '%i'.
-(src / 'percentfile').write_text("data2\n")
-p = subprocess.run(
-    rsync_argv('-a', '--out-format=%%i %n', f'{src}/', f'{TODIR}/'),
-    capture_output=True, text=True,
-)
-if p.returncode != 0:
-    test_fail(f"rsync exited {p.returncode}:\n{p.stderr}")
-if '%i percentfile' not in p.stdout:
-    test_fail(
-        "expected literal '%i percentfile' for a transferred file with "
-        f"--out-format='%%i %n', got:\n{p.stdout}"
-    )
-
-# log_format_has() and log_formatted() must agree on where an escape letter is
-# even for an over-long field width.  log_formatted() stops consuming width
-# digits at its 32-byte fmt buffer, then rescans and expands the trailing %C;
-# an unbounded log_format_has() instead swallows every digit and the following
-# '%' as a literal %%, missing the %C.  With -c that leaves sender_keeps_checksum
-# unset while %C still reads F_SUM -- a heap over-read (ASan: use-after-poison in
-# sum_as_hex), and the rendered digest is garbage.
-#
-# Oracle without a sanitizer: the digest %C renders for the over-wide format
-# must equal the digest a plain '%C' renders for the same file.  A parser
-# divergence leaves the wide-format sender without a retained checksum, so its
-# %C differs (or is garbage) while the plain %C is correct.
-import re
-
-def checksum_for(fmt):
-    (src / 'percentfile').write_text("data3\n")
-    rmtree(TODIR)
-    r = subprocess.run(
-        rsync_argv('-a', '-c', f'--out-format={fmt} %n', f'{src}/', f'{TODIR}/'),
-        capture_output=True, text=True,
-    )
-    if r.returncode != 0:
-        test_fail(f"rsync -c exited {r.returncode} for --out-format={fmt!r}:\n{r.stderr}")
-    m = re.search(r'([0-9a-f]+) percentfile', r.stdout)
-    if not m:
-        test_fail(f"no '<hex> percentfile' in --out-format={fmt!r} output:\n{r.stdout}")
-    return m.group(1)
-
-# The over-wide %C check needs %C to actually render a hex digest, which only
-# happens for a canonical checksum: at protocol < 30 the negotiated file checksum
-# is a non-canonical MD4 variant and %C (via sum_as_hex) renders empty, so there
-# is no digest to compare and no F_SUM read to over-run.  Skip that sub-case
-# there; at protocol 30+ checksum_for() still fails on a missing digest, so a
-# real regression is caught.  The %% literal checks above are protocol-independent.
-proto = forced_protocol()
-if proto is None or proto >= 30:
-    # The over-wide format renders its width digits literally, so the digest is
-    # the trailing run of hex; compare that tail against the plain %C digest.
-    plain = checksum_for('%C')
-    wide = checksum_for('%' + '0' * 30 + '%C')
-    if not wide.endswith(plain):
-        test_fail(
-            f"over-wide %C rendered ...{wide[-len(plain):]!r} but plain %C rendered "
-            f"{plain!r}: log_format_has()/log_formatted() disagree on the escape position"
-        )
-
-print("ki58-log-format-percent: %% literal-percent escape verified")
diff --git a/testsuite/ki62-io-error-mask_test.py b/testsuite/ki62-io-error-mask_test.py
deleted file mode 100644
index b468ac696..000000000
--- a/testsuite/ki62-io-error-mask_test.py
+++ /dev/null
@@ -1,156 +0,0 @@
-#!/usr/bin/env python3
-# Verifies: SW-REQ-114
-#
-# When MSG_IO_ERROR arrives, io.c OR's the wire value into the local io_error.
-# Without masking, a malicious peer could set arbitrary (undefined) bits, which
-# would then be stored and re-forwarded upstream in the local io_error.  The fix
-# masks the incoming value to the defined IOERR_* bits (IOERR_VALID_MASK).  (The
-# exit code itself is already safe: cleanup.c maps only the three defined bits
-# onto RERR_* constants, so undefined bits never become the exit status -- the
-# mask is about not storing/propagating junk, not about the exit value.)
-#
-# This is only an interrupted-transfer exit-code smoke test: it starts a real
-# daemon (the sender for a download), begins a transfer, then kills the sender
-# mid-transfer and asserts the receiver exits with a documented RERR_* value.
-# It does NOT craft a hostile MSG_IO_ERROR frame, so it does not exercise the
-# mask itself (no test does yet) -- it just guards the normal-peer exit path.
-#
-# Exit codes: 0 pass, 1 fail, 77 skip (killable daemon testing not possible --
-# the test needs --use-tcp so it can SIGKILL the sender process directly).
-
-import os
-import re
-import signal
-import subprocess
-import sys
-import time
-
-from rsyncfns import (
-    FROMDIR, SCRATCHDIR, TODIR, claim_ports, make_data_file, makepath, rmtree,
-    rsync_argv, start_rsyncd, test_fail, test_skipped, build_rsyncd_conf,
-    USE_TCP,
-)
-
-# The complete set of exit codes rsync defines (errcode.h).  Whatever path the
-# interrupted transfer takes, the receiver's exit code MUST be one of these --
-# never an arbitrary number injected via a polluted io_error.
-KNOWN_RERR = {
-    0,    # RERR_OK
-    1,    # RERR_SYNTAX
-    2,    # RERR_PROTOCOL
-    3,    # RERR_FILESELECT
-    4,    # RERR_UNSUPPORTED
-    5,    # RERR_STARTCLIENT
-    10,   # RERR_SOCKETIO
-    11,   # RERR_FILEIO
-    12,   # RERR_STREAMIO
-    13,   # RERR_MESSAGEIO
-    14,   # RERR_IPC
-    15,   # RERR_CRASHED
-    16,   # RERR_TERMINATED
-    19,   # RERR_SIGNAL1
-    20,   # RERR_SIGNAL
-    21,   # RERR_WAITCHILD
-    22,   # RERR_MALLOC
-    23,   # RERR_PARTIAL
-    24,   # RERR_VANISHED
-    25,   # RERR_DEL_LIMIT
-    30,   # RERR_TIMEOUT
-    35,   # RERR_CONTIMEOUT
-    124,  # RERR_CMD_FAILED
-    125,  # RERR_CMD_KILLED
-    126,  # RERR_CMD_RUN
-    127,  # RERR_CMD_NOTFOUND
-}
-
-PORT = 12966
-
-# Killing the sender (the daemon process) mid-transfer requires a handle to
-# the daemon process, which only exists in --use-tcp mode.  In the default
-# pipe mode the daemon is forked off the client and is not directly killable,
-# so skip rather than run an inconclusive test.
-if not USE_TCP:
-    test_skipped("needs --use-tcp to kill the daemon (sender) mid-transfer")
-
-conf = build_rsyncd_conf()
-
-# Build a source tree with a file big enough that, throttled by --bwlimit, the
-# transfer is still in flight when we kill the sender.
-rmtree(FROMDIR)
-rmtree(TODIR)
-makepath(FROMDIR)
-makepath(TODIR)
-make_data_file(FROMDIR / 'bigfile', 8 * 1024 * 1024)  # 8 MB
-
-claim_ports(PORT)
-daemon = start_rsyncd(conf, PORT)
-
-# --bwlimit keeps the transfer slow enough to guarantee the sender is
-# mid-stream when we SIGKILL it.  --info=progress gives a heartbeat we could
-# observe, but the bwlimit + short sleep is enough on loopback.
-client = subprocess.Popen(
-    rsync_argv('-a', '--bwlimit=64', '--timeout=60',
-               f'rsync://127.0.0.1:{PORT}/test-from/', f'{TODIR}/'),
-    stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True,
-)
-
-# Let the receiver get past the handshake and into the data stream before we
-# cut the sender off, so the death is observed as a mid-transfer stream error
-# (the path that exercises the io_error -> exit-code mapping).
-time.sleep(2)
-
-# Kill the sender mid-transfer.  rsyncd forks a child per connection, so the
-# actual sender is NOT `daemon` (the listener) -- killing only the listener
-# leaves the child streaming and the receiver never sees EOF.  The child logs
-# "[pid] rsync on <module>/" to the daemon log; kill that pid (plus the
-# listener).  The daemon shares this test's process group, so killpg is not an
-# option (it would kill the test itself).
-child_pids = []
-try:
-    logtext = (SCRATCHDIR / 'rsyncd.log').read_text()
-    child_pids = [int(pid) for pid in re.findall(r'\[(\d+)\] rsync on ', logtext)]
-except OSError:
-    pass
-for pid in child_pids:
-    try:
-        os.kill(pid, signal.SIGKILL)
-    except (ProcessLookupError, PermissionError):
-        pass
-if daemon.poll() is None:
-    daemon.kill()
-    try:
-        daemon.wait(timeout=5)
-    except subprocess.TimeoutExpired:
-        pass
-
-# Wait for the receiver to notice the dead sender and exit.  It should do so
-# promptly (closed socket / EOF), but cap it so a regression that hangs is
-# caught rather than stalling the suite.
-try:
-    out, _ = client.communicate(timeout=30)
-except subprocess.TimeoutExpired:
-    client.kill()
-    client.communicate()
-    test_fail("receiver did not exit after the sender was killed (hung)")
-
-rc = client.returncode
-if rc not in KNOWN_RERR:
-    sys.stderr.write(
-        f"receiver exited with {rc}, which is NOT a documented RERR_* value; "
-        f"output:\n{out}\n"
-    )
-    sys.exit(1)
-
-# An interrupted download should not exit 0; sanity-check that we actually
-# interrupted a transfer (a clean exit would mean we killed the sender too
-# early/late and didn't exercise the mid-transfer path).  Don't fail on this --
-# timing-dependent -- just note it.
-if rc == 0:
-    print("ki62-io-error-mask: receiver exited 0 (transfer may have completed "
-          "before the kill); no out-of-range exit code observed.")
-else:
-    print(f"ki62-io-error-mask: receiver exited {rc} (a documented RERR_* "
-          f"value) after the sender was killed mid-transfer; no arbitrary "
-          f"io_error bit propagated to the exit code.")
-
-sys.exit(0)
diff --git a/testsuite/ki72-safe-links-backup_test.py b/testsuite/ki72-safe-links-backup_test.py
deleted file mode 100644
index 0814096dc..000000000
--- a/testsuite/ki72-safe-links-backup_test.py
+++ /dev/null
@@ -1,129 +0,0 @@
-#!/usr/bin/env python3
-# KI-72: --safe-links must be honored in the backup symlink hard-link path.
-# Verifies: SW-REQ-073
-#
-# In make_backup_inner(), when CAN_HARDLINK_SYMLINK is defined (Linux, macOS)
-# the hard-link fast path link_or_rename() succeeded for a symlink and then
-# "goto success" skipped the safe_symlinks check that lives in the copy-fallback
-# path.  The net effect was that an escaping symlink already present in the
-# destination (e.g. "escape -> ../../sensitive") was silently preserved in the
-# backup area (as "<name>.bak") even when --safe-links was given.
-#
-# This forces exactly that backup (a destination symlink is replaced by a
-# regular file from the source) and asserts:
-#   * WITH    --safe-links : the escaping symlink is NOT backed up (no .bak).
-#   * WITHOUT --safe-links : the escaping symlink IS backed up (.bak is a
-#                            symlink with the same escaping target).
-#
-# Pure local client behaviour: no daemon/root/tcp. RED on the unfixed tree on
-# any platform whose link_or_rename() can hard-link a symlink (CAN_HARDLINK_SYMLINK);
-# GREEN everywhere once the check runs before the fast path.
-
-import os
-import subprocess
-
-from rsyncfns import SCRATCHDIR, rmtree, rsync_argv, test_fail
-
-base = SCRATCHDIR / 'ki72-safe-links-backup'
-
-# The escaping target: at the transfer top level the symlink path is depth 0,
-# so any leading "../" makes unsafe_symlink() reject it.  Use two levels to be
-# unambiguously out-of-tree regardless of how the receiver names the leaf.
-ESCAPE_TARGET = '../../sensitive'
-
-
-def build():
-    """Fresh src/ and dest/ where the next sync must back up dest's escaping
-    symlink (src carries a regular file of the same name that replaces it)."""
-    rmtree(base)
-    src = base / 'src'
-    dest = base / 'dest'
-    src.mkdir(parents=True)
-    dest.mkdir(parents=True)
-    (src / 'keep.txt').write_text('source regular file\n')
-    # A regular file at src that differs from dest's symlink -> forces an update
-    # and therefore a backup of the old dest entry.
-    (src / 'escape').write_text('replacement regular file\n')
-    # The pre-existing escaping symlink in the destination that gets backed up.
-    os.symlink(ESCAPE_TARGET, dest / 'escape')
-    return src, dest
-
-
-def run(src, dest, *extra):
-    proc = subprocess.run(
-        rsync_argv('-a', '--backup', '--suffix=.bak', *extra,
-                   f'{src}/', f'{dest}/'),
-        stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True)
-    return proc
-
-
-# ---------------------------------------------------------------------------
-# 1. WITH --safe-links: the unsafe symlink must NOT be backed up.
-# ---------------------------------------------------------------------------
-src, dest = build()
-proc = run(src, dest, '--safe-links')
-if proc.returncode != 0:
-    test_fail("KI-72: rsync exited %d with --safe-links\n%s%s"
-              % (proc.returncode, proc.stdout, proc.stderr))
-
-bak = dest / 'escape.bak'
-if os.path.lexists(bak):
-    test_fail(
-        "KI-72: --safe-links was bypassed on the backup hard-link path: the "
-        "escaping symlink was backed up to %s (target %r) instead of being "
-        "dropped." % (bak, os.readlink(bak) if os.path.islink(bak) else '?'))
-
-# The replacement regular file must still have been transferred.
-if not (dest / 'escape').is_file():
-    test_fail("KI-72: the replacement regular file 'escape' was not transferred")
-
-
-# ---------------------------------------------------------------------------
-# 2. WITHOUT --safe-links: the escaping symlink IS backed up (positive
-#    control, so the assertion above isn't vacuous -- backups really happen).
-# ---------------------------------------------------------------------------
-src, dest = build()
-proc = run(src, dest)
-if proc.returncode != 0:
-    test_fail("KI-72: rsync exited %d without --safe-links\n%s%s"
-              % (proc.returncode, proc.stdout, proc.stderr))
-
-bak = dest / 'escape.bak'
-if not os.path.islink(bak):
-    test_fail("KI-72: without --safe-links the escaping symlink should have "
-              "been backed up, but %s is missing or not a symlink." % bak)
-if os.readlink(bak) != ESCAPE_TARGET:
-    test_fail("KI-72: backup symlink points to %r, expected %r"
-              % (os.readlink(bak), ESCAPE_TARGET))
-
-# ---------------------------------------------------------------------------
-# 3. WITH --safe-links, a SAFE (in-tree) symlink must STILL be backed up.
-#    The fix skips the backup for an unsafe OR unreadable link; this guards
-#    against it over-blocking and dropping legitimate safe symlinks too.
-# ---------------------------------------------------------------------------
-rmtree(base)
-src = base / 'src'
-dest = base / 'dest'
-src.mkdir(parents=True)
-dest.mkdir(parents=True)
-(src / 'keep.txt').write_text('source regular file\n')
-(src / 'link').write_text('replacement regular file\n')
-# An in-tree (safe) symlink in dest that gets replaced -> must be backed up.
-os.symlink('keep.txt', dest / 'link')
-
-proc = run(src, dest, '--safe-links')
-if proc.returncode != 0:
-    test_fail("KI-72: rsync exited %d backing up a safe symlink\n%s%s"
-              % (proc.returncode, proc.stdout, proc.stderr))
-
-bak = dest / 'link.bak'
-if not os.path.islink(bak):
-    test_fail("KI-72: a SAFE symlink was wrongly dropped from the backup area "
-              "under --safe-links (%s missing or not a symlink) -- the fix is "
-              "over-blocking." % bak)
-if os.readlink(bak) != 'keep.txt':
-    test_fail("KI-72: safe backup symlink points to %r, expected 'keep.txt'"
-              % os.readlink(bak))
-
-print("ki72-safe-links-backup: --safe-links drops an escaping symlink from the "
-      "backup area, preserves a safe one, while a plain --backup preserves both")
diff --git a/testsuite/ki73-cvs-clear-list_test.py b/testsuite/ki73-cvs-clear-list_test.py
deleted file mode 100644
index bdf138b47..000000000
--- a/testsuite/ki73-cvs-clear-list_test.py
+++ /dev/null
@@ -1,40 +0,0 @@
-#!/usr/bin/env python3
-"""KI-73 regression: a `.cvsignore` containing only `!` (the clear-list token)
-must not abort rsync in -C (cvs-exclude) mode.
-
-In exclude.c the CLEAR_LIST branch guarded its trailing-character check with
-`rule->rflags & FILTRULE_NO_PREFIXES`, but NO_PREFIXES is a template-level flag
-that is intentionally NOT inherited by individual rules (it is excluded from
-FILTRULES_FROM_CONTAINER). The guard therefore always evaluated as "prefixes
-allowed" for CVS rules and rsync hit exit_cleanup(RERR_SYNTAX) instead of
-clearing the list. The fix checks `template->rflags` instead.
-
-# Verifies: SW-REQ-078
-"""
-
-from rsyncfns import (
-    FROMDIR, TODIR,
-    assert_exists, makepath, rmtree, run_rsync,
-)
-
-src = FROMDIR
-rmtree(src)
-rmtree(TODIR)
-makepath(src)
-
-# Real files that must survive the transfer.
-(src / 'keep1.txt').write_text('one\n')
-(src / 'keep2.txt').write_text('two\n')
-
-# A .cvsignore whose sole content is the clear-list token. Pre-fix this drove
-# parse_rule_tok() into the RERR_SYNTAX abort path.
-(src / '.cvsignore').write_text('!\n')
-
-# check=True (the default) calls test_fail() -> exit 1 on a non-zero rsync
-# exit, which covers the abort (RERR_SYNTAX) regression directly.
-run_rsync('-a', '-C', f'{src}/', f'{TODIR}/')
-
-assert_exists(TODIR / 'keep1.txt', label='clear-list .cvsignore kept keep1')
-assert_exists(TODIR / 'keep2.txt', label='clear-list .cvsignore kept keep2')
-
-print("ki73: cvs-exclude .cvsignore '!' clear-list token no longer aborts")
diff --git a/testsuite/link-dest-module-escape_test.py b/testsuite/link-dest-module-escape_test.py
deleted file mode 100644
index dfa4ad0bf..000000000
--- a/testsuite/link-dest-module-escape_test.py
+++ /dev/null
@@ -1,67 +0,0 @@
-#!/usr/bin/env python3
-# Security guard for the #915 re-anchor: a daemon receiver must NOT honour an
-# alt-basis dir whose `..` climbs OUT of the module.
-#
-# Honouring a relative --link-dest=../01 again (#915) deliberately re-permits an
-# in-module `..` climb (dest 00 -> sibling basis 01).  This test pins the other
-# side of that boundary: a client-supplied --link-dest=../../OUTSIDE that points
-# at a file OUTSIDE the module root must be refused, so the basis is never used
-# and the dest file is re-transferred rather than hard-linked to the outside
-# file (which would be an info-leak / cross-module hard-link).
-#
-# The re-anchor confines resolution beneath module_dir with RESOLVE_BENEATH, so
-# the escaping climb is rejected in-kernel; on platforms without
-# openat2/O_RESOLVE_BENEATH the portable resolver rejects the `..` outright.
-# Either way the escape is blocked, so this test must PASS on every platform.
-# Runs at any uid.
-
-import shutil
-import subprocess
-
-from rsyncfns import (
-    SCRATCHDIR, make_data_file, makepath, rmtree, rsync_argv, start_test_daemon,
-    test_fail, write_daemon_conf,
-)
-
-DAEMON_PORT = 12916
-DATA_SIZE = 40000
-
-mod = SCRATCHDIR / 'escmod'          # daemon module root (holds dest 00)
-src = SCRATCHDIR / 'escsrc'
-outside = SCRATCHDIR / 'OUTSIDE'     # sibling of the module root -- OUTSIDE it
-for d in (mod, src, outside):
-    rmtree(d)
-makepath(mod / '00', src, outside)
-
-# Source file, plus a byte-identical secret OUTSIDE the module with the same
-# name/size/mtime (so a followed basis would quick-check as a match).
-make_data_file(src / 'f.dat', DATA_SIZE)
-shutil.copy2(src / 'f.dat', outside / 'f.dat')
-
-conf = write_daemon_conf([
-    ('bak', {'path': str(mod), 'read only': 'no'}),
-])
-url = start_test_daemon(conf, DAEMON_PORT)
-
-# Dest is bak/00 (cwd = module/00).  --link-dest=../../OUTSIDE climbs
-# module/00 -> module -> SCRATCHDIR/OUTSIDE, i.e. out of the module.
-proc = subprocess.run(
-    rsync_argv('-a', '--link-dest=../../OUTSIDE', f'{src}/', f'{url}bak/00/'),
-    stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True)
-out = proc.stdout or ''
-if proc.returncode not in (0, 23):    # 23: a basis rejection is non-fatal here
-    test_fail(f"escape push failed unexpectedly (rc={proc.returncode}):\n{out}")
-
-dest = mod / '00' / 'f.dat'
-secret = outside / 'f.dat'
-if not dest.is_file():
-    test_fail(f"destination file missing ({dest})")
-
-ds, ss = dest.stat(), secret.stat()
-if (ds.st_dev, ds.st_ino) == (ss.st_dev, ss.st_ino):
-    test_fail(
-        "MODULE ESCAPE: the dest was hard-linked to a file OUTSIDE the module "
-        f"via --link-dest=../../OUTSIDE -- the confined resolver let a `..` "
-        f"climb escape the module root.\n{out}")
-# Escape blocked: the basis was refused, so the file was re-transferred and the
-# dest is its own inode, not the outside secret's.
diff --git a/testsuite/log-file-symlink_test.py b/testsuite/log-file-symlink_test.py
deleted file mode 100644
index a290ef3c0..000000000
--- a/testsuite/log-file-symlink_test.py
+++ /dev/null
@@ -1,129 +0,0 @@
-#!/usr/bin/env python3
-# --log-file=PATH must not follow planted symlinks at attacker-controlled
-# path components.
-#
-# Threat: a privileged user (root or
-# sysadmin) runs rsync with --log-file=PATH where PATH, or a parent component
-# of PATH, lives in an attacker-influenceable directory (canonical case:
-# /tmp/somedir/rsync.log). An unprivileged user plants a symlink there →
-# rsync appends its log to an attacker-chosen file. The trivially exploitable
-# landing is /root/.ssh/authorized_keys (append an SSH key → privesc).
-#
-# Both variants exercised:
-#
-#   LEAF plant:    --log-file=$plant where $plant is a symlink to a victim
-#                  file. Refused by the leaf O_NOFOLLOW + the path walk's
-#                  ownership check.
-#
-#   PARENT plant:  --log-file=$plant/rsync.log where $plant is a symlink to a
-#                  victim directory. Refused by the path walk's parent-
-#                  component ownership check (the /tmp/somedir/ case --
-#                  plain O_NOFOLLOW alone is leaf-only and does NOT defend
-#                  this; the path walk does).
-#
-# Defense model (the fix on pr-symlink-fix-privopens, per the audit):
-# walk the operator-supplied path component-by-component using
-# openat(O_PATH|O_NOFOLLOW), and for each component that IS a symlink,
-# fstat() the symlink itself and allow only if st_uid is 0 or geteuid().
-# Symlinks owned by an untrusted uid → ELOOP.
-#
-# Requires root (to lchown a symlink to a non-self uid -- the only way to
-# simulate a planted attacker-owned symlink in-process). Skipped otherwise.
-
-import os
-import pwd
-import subprocess
-
-from rsyncfns import SCRATCHDIR, rmtree, rsync_argv, test_fail, test_skipped
-
-
-if os.geteuid() != 0:
-    test_skipped("requires root to plant a symlink owned by a non-root, "
-                 "non-self uid (the attacker simulation)")
-
-NOBODY_UID = None
-for name in ('nobody', 'nfsnobody', 'daemon'):
-    try:
-        NOBODY_UID = pwd.getpwnam(name).pw_uid
-        if NOBODY_UID != 0 and NOBODY_UID != os.geteuid():
-            break
-    except KeyError:
-        continue
-if NOBODY_UID is None or NOBODY_UID == 0 or NOBODY_UID == os.geteuid():
-    test_skipped("no untrusted-uid user available for cross-uid plant "
-                 "(tried nobody, nfsnobody, daemon)")
-
-
-base = SCRATCHDIR / 'logfile'
-src = base / 'src'
-dest = base / 'dest'
-plants = base / 'plants'
-
-rmtree(base)
-src.mkdir(parents=True)
-(src / 'f').write_text("payload\n")
-dest.mkdir(parents=True)
-plants.mkdir(parents=True)
-
-
-# ---------------------------------------------------------------------------
-# LEAF plant
-# ---------------------------------------------------------------------------
-# A victim file the attacker wants rsync to append to. Owned by root (us),
-# mode 0600, content we'll check is unchanged.
-sentinel = plants / 'sentinel_leaf'
-sentinel.write_text("LEAF_SENTINEL_INITIAL\n")
-os.chmod(sentinel, 0o600)
-
-# Plant: --log-file path is a symlink to the victim. The symlink itself is
-# owned by NOBODY_UID (the attacker simulation).
-leaf_path = plants / 'log_leaf'
-os.symlink(sentinel, leaf_path)
-os.lchown(leaf_path, NOBODY_UID, NOBODY_UID)
-
-subprocess.run(
-    rsync_argv('-a', '--log-file=' + str(leaf_path), f'{src}/', f'{dest}/'),
-    stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
-
-leaf_after = sentinel.read_text()
-if leaf_after != "LEAF_SENTINEL_INITIAL\n":
-    test_fail(
-        f"--log-file followed a planted LEAF symlink (owned by uid "
-        f"{NOBODY_UID}): {sentinel} changed from 'LEAF_SENTINEL_INITIAL' to "
-        f"{leaf_after!r}. The privileged rsync appended its log into the "
-        f"attacker-chosen file. Fix: refuse planted symlinks at --log-file.")
-
-
-# ---------------------------------------------------------------------------
-# PARENT-component plant (the /tmp/somedir/ case)
-# ---------------------------------------------------------------------------
-# A victim directory the attacker wants rsync to create files in. Owned by
-# us, normally empty.
-real_target = plants / 'parent_real_target'
-real_target.mkdir()
-
-# Plant: a directory-symlink owned by NOBODY_UID, pointing at the victim
-# directory. --log-file=$plant/rsync.log resolves the parent (symlink) →
-# kernel writes the log into the victim directory. The leaf "rsync.log"
-# does not exist yet so plain O_NOFOLLOW on the leaf wouldn't reject anything;
-# only the parent-component ownership check (the audit's owned-by-trusted-uid
-# walk) defends here.
-parent_plant = plants / 'parent_link'
-os.symlink(real_target, parent_plant)
-os.lchown(parent_plant, NOBODY_UID, NOBODY_UID)
-
-log_via_parent = parent_plant / 'rsync.log'
-subprocess.run(
-    rsync_argv('-a', '--log-file=' + str(log_via_parent), f'{src}/', f'{dest}/'),
-    stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
-
-# Was a log file created in the victim directory via the planted symlink?
-outside_log = real_target / 'rsync.log'
-if outside_log.exists():
-    test_fail(
-        f"--log-file followed a planted PARENT-component symlink (owned by "
-        f"uid {NOBODY_UID}): {parent_plant} -> {real_target} was traversed "
-        f"and rsync's log was created at {outside_log}. This is the "
-        "/tmp/somedir/-class parent-flip case that plain O_NOFOLLOW does NOT "
-        "defend (O_NOFOLLOW is leaf-only). Fix: per-component path walk that "
-        "refuses parent symlinks owned by an untrusted uid.")
diff --git a/testsuite/malicious-dot-dir-delete-scope_test.py b/testsuite/malicious-dot-dir-delete-scope_test.py
deleted file mode 100644
index e6d9e07ac..000000000
--- a/testsuite/malicious-dot-dir-delete-scope_test.py
+++ /dev/null
@@ -1,98 +0,0 @@
-#!/usr/bin/env python3
-"""A malicious pull server must not enlarge --delete to the transfer root.
-
-For a scoped single-file pull, the synthetic ``.`` entry is not part of the
-requested source.  The receiver nevertheless exempts it from its requested-name
-filter.  A hostile sender can encode it as a top-level content directory and
-make the generator run delete_in_dir("."), sweeping receiver-owned siblings.
-"""
-
-import socket
-import subprocess
-import threading
-
-from rsyncfns import (
-    SCRATCHDIR, claim_ports, makepath, require_tcp, rmtree, rsync_argv,
-    test_fail,
-)
-import rsync_proto as rp
-
-PORT = 13014
-
-require_tcp("the malicious sender needs a real TCP socket; run with --use-tcp")
-claim_ports(PORT)
-
-base = SCRATCHDIR / 'malicious-dot-dir-delete-scope'
-rmtree(base)
-dest = base / 'dest'
-makepath(dest / 'private')
-sentinel = dest / 'private' / 'must-survive'
-sentinel.write_text('receiver-owned file outside the requested leaf\n')
-
-# Control the intended scope: an honest single-file source with identical
-# receiver options does not make --delete recurse over destination siblings.
-honest_src = base / 'honest-src'
-makepath(honest_src)
-(honest_src / 'requested').write_text('honest source\n')
-control = subprocess.run(
-    rsync_argv('-r', '--delete', '--no-inc-recursive',
-               str(honest_src / 'requested'), str(dest) + '/'),
-    stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, timeout=30)
-if control.returncode or not sentinel.exists():
-    test_fail('native --delete single-file control unexpectedly swept the '
-              f'destination root:\n{control.stdout}{control.stderr}')
-
-lsock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
-lsock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
-lsock.bind(('127.0.0.1', PORT))
-lsock.listen(1)
-lsock.settimeout(30)
-state = {}
-
-
-def serve():
-    try:
-        csock, _ = lsock.accept()
-        s = rp.DaemonReceiver(csock)
-        s.handshake()
-
-        # XMIT_TOP_DIR without XMIT_NO_CONTENT_DIR maps the synthetic dot to
-        # FLAG_CONTENT_DIR.  "requested" is the only name the client asked for.
-        flist = (
-            rp.FileEntry('.', mode=rp.S_IFDIR | 0o755,
-                         extra_flags=rp.XMIT_TOP_DIR).encode()
-            + rp.FileEntry('requested', mode=rp.S_IFREG | 0o644,
-                           length=0).encode()
-            + rp.end_of_flist(0, s.protocol)
-        )
-        # No file bytes are needed: delete_in_dir(".") runs in the generator
-        # before the transfer response is consumed.
-        s.send_data(flist + s.w_ndx(rp.NDX_DONE) * 3)
-        s.drain(timeout=5)
-        s.close()
-    except Exception as exc:  # noqa: BLE001 - reported below
-        state['err'] = repr(exc)
-
-
-t = threading.Thread(target=serve, daemon=True)
-t.start()
-try:
-    proc = subprocess.run(
-        rsync_argv('-r', '--delete', '--no-inc-recursive',
-                   f'rsync://127.0.0.1:{PORT}/mod/requested', str(dest) + '/'),
-        stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, timeout=30)
-finally:
-    t.join(timeout=10)
-    lsock.close()
-
-if not sentinel.exists():
-    test_fail(
-        'malicious sender marked the exempt synthetic dot as a content '
-        'directory and expanded a scoped single-file --delete to the entire '
-        'destination root')
-if state.get('err'):
-    test_fail(f"Python sender failed before exercising receiver: {state['err']}\n"
-              f"receiver output:\n{proc.stdout}{proc.stderr}")
-
-print('malicious-dot-dir-delete-scope: receiver did not let a forged dot '
-      'content directory expand --delete beyond the requested leaf')
diff --git a/testsuite/malicious-dot-file-delete-scope_test.py b/testsuite/malicious-dot-file-delete-scope_test.py
deleted file mode 100644
index 7d705c2b2..000000000
--- a/testsuite/malicious-dot-file-delete-scope_test.py
+++ /dev/null
@@ -1,94 +0,0 @@
-#!/usr/bin/env python3
-"""A malicious sender must not reinterpret the destination root as a file.
-
-The receiver permits the synthetic "." entry as a top-level directory even
-when an implied-file filter restricts the requested source.  This server sends
-that special name with regular-file mode.  Under --force, replacing it must not
-recursively empty the receiver's destination root.  No --delete is requested.
-"""
-
-import socket
-import subprocess
-import threading
-
-from rsyncfns import (
-    SCRATCHDIR, claim_ports, makepath, require_tcp, rmtree, rsync_argv,
-    test_fail,
-)
-import rsync_proto as rp
-
-PORT = 13012
-
-require_tcp("the malicious sender needs a real TCP socket; run with --use-tcp")
-claim_ports(PORT)
-
-base = SCRATCHDIR / 'malicious-dot-file-delete-scope'
-rmtree(base)
-dest = base / 'dest'
-makepath(dest / 'private')
-sentinel = dest / 'private' / 'must-survive'
-sentinel.write_text('receiver-owned file outside the requested leaf\n')
-
-# Native control: the same scoped single-file transfer with --force does not
-# touch receiver-owned siblings when the sender encodes the requested leaf
-# honestly.  This distinguishes the attack from documented --force semantics.
-honest_src = base / 'honest-src'
-makepath(honest_src)
-(honest_src / 'requested').write_text('honest source\n')
-control = subprocess.run(
-    rsync_argv('-r', '--force', '--no-inc-recursive',
-               str(honest_src / 'requested'), str(dest) + '/'),
-    stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, timeout=30)
-if control.returncode or not sentinel.exists():
-    test_fail('native --force single-file control unexpectedly touched the '
-              f'destination scope:\n{control.stdout}{control.stderr}')
-
-lsock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
-lsock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
-lsock.bind(('127.0.0.1', PORT))
-lsock.listen(1)
-lsock.settimeout(30)
-state = {}
-
-
-def serve():
-    try:
-        csock, _ = lsock.accept()
-        s = rp.DaemonReceiver(csock)
-        s.handshake()
-
-        # "." is the receiver's synthetic transfer-root entry and is exempted
-        # from its requested-name filter.  Forge it as a regular file instead
-        # of the only legitimate representation: a directory.
-        s.send_data(
-            rp.FileEntry('.', mode=rp.S_IFREG | 0o644, length=0).encode()
-            + rp.end_of_flist(0, s.protocol)
-            + s.w_ndx(rp.NDX_DONE) * 3
-        )
-        s.drain(timeout=5)
-        s.close()
-    except Exception as exc:  # noqa: BLE001 - reported below
-        state['err'] = repr(exc)
-
-
-t = threading.Thread(target=serve, daemon=True)
-t.start()
-try:
-    proc = subprocess.run(
-        rsync_argv('-r', '--force', '--no-inc-recursive',
-                   f'rsync://127.0.0.1:{PORT}/mod/requested', str(dest) + '/'),
-        stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, timeout=30)
-finally:
-    t.join(timeout=10)
-    lsock.close()
-
-if not sentinel.exists():
-    test_fail(
-        'malicious sender encoded the special "." root as a regular file and '
-        'made --force recursively erase the destination root')
-if state.get('err'):
-    test_fail(f"Python sender failed before exercising receiver: {state['err']}\n"
-              f"receiver output:\n{proc.stdout}{proc.stderr}")
-
-print('malicious-dot-file-delete-scope: receiver rejected a non-directory '
-      'encoding of its synthetic transfer-root entry')
diff --git a/testsuite/malicious-sender-delete-scope_test.py b/testsuite/malicious-sender-delete-scope_test.py
deleted file mode 100644
index fcd1fde3b..000000000
--- a/testsuite/malicious-sender-delete-scope_test.py
+++ /dev/null
@@ -1,188 +0,0 @@
-#!/usr/bin/env python3
-# Malicious daemon-sender expands --delete scope by flipping an implied
-# parent into a content-dir.
-#
-# Threat (Mitchell Benjamin report, May 2026; PoC 3):
-#   With `rsync -rR --delete rsync://host/m/dir/file dest/`, the client
-#   requests a single relative path.  The sender's honest flow encodes
-#   implied parents with XMIT_TOP_DIR|XMIT_NO_CONTENT_DIR (flist.c:415
-#   in send_file_entry).  A malicious daemon-sender that omits
-#   XMIT_NO_CONTENT_DIR on the implied parent "dir" makes the receiver
-#   set FLAG_CONTENT_DIR (flist.c:1095), and the generator then calls
-#   delete_in_dir("dest/dir") under --delete, sweeping pre-existing
-#   siblings the receiver expected to keep.
-#
-#   The receiver-side fix (this branch) downgrades implied-parent dirs
-#   to non-content regardless of the sender's xflags byte, so
-#   delete_in_dir cannot run on a directory the implied_filter_list
-#   only knows as a parent.
-#
-# Test approach (Mitchell's PoC 3 adapted):
-#   We don't need a fake-daemon-protocol speaker.  Instead, build a
-#   "malicious rsync" out of the same source tree by doing a one-line
-#   substring replacement in flist.c that strips XMIT_NO_CONTENT_DIR
-#   from the implied-parent encoding, then run the patched binary as
-#   the daemon-sender and the production rsync (the one under test)
-#   as the receiver.  The receiver-side fix is what we're verifying.
-#
-#   Honest-sender baseline (the production rsync as daemon-sender)
-#   exists implicitly: every other -rR --delete test in the suite
-#   already exercises that path, so we don't repeat it here.  The
-#   patched-rsync arm is the one signal that distinguishes RED from
-#   GREEN.
-#
-# Build cost:
-#   make(1) is invoked inside a copied source tree, ~10-30s.  We skip
-#   the test cleanly if SRCDIR isn't a writable build tree (e.g. when
-#   running an installed rsync from a binary package via --rsync-bin).
-#
-# Outcome:
-#   * dest/dir/keep.txt SURVIVES the pull -> fix is in place (PASS).
-#   * dest/dir/keep.txt is DELETED -> bug present (FAIL with leak
-#     diagnostic).
-
-import os
-import shlex
-import shutil
-import subprocess
-
-from rsyncfns import (
-    SCRATCHDIR, SRCDIR, makepath, rmtree, rsync_argv,
-    test_fail, test_skipped, write_daemon_conf,
-)
-
-# Sanity gates ---------------------------------------------------------------
-# Need a writable source tree we can copy and `make rsync` in.
-if not (SRCDIR / 'flist.c').is_file() or not (SRCDIR / 'Makefile').is_file():
-    test_skipped("malicious-sender-delete-scope: needs a writable rsync "
-                 f"source tree at SRCDIR={SRCDIR} with Makefile + flist.c; "
-                 "the patched-sender build relies on it.")
-if not shutil.which('make'):
-    test_skipped("malicious-sender-delete-scope: make(1) not on PATH")
-if not shutil.which('gcc') and not shutil.which('cc'):
-    test_skipped("malicious-sender-delete-scope: no C compiler on PATH")
-
-
-# -- Build the malicious sender ---------------------------------------------
-# flist.c send_implied_dirs() sets up the flags an implied-parent will be
-# encoded with via the FLAG_IMPLIED_DIR branch of send_file_entry's xflags
-# computation (line ~415).  Strip XMIT_NO_CONTENT_DIR from that one
-# assignment so the implied parent is sent with XMIT_TOP_DIR ALONE.  Every
-# other encoding path is unchanged, so the resulting daemon-sender is
-# honest about everything except the implied-parent encoding -- which is
-# exactly the threat model.
-mal_src = SCRATCHDIR / 'mal-rsync'
-rmtree(mal_src)
-try:
-    shutil.copytree(SRCDIR, mal_src, symlinks=True,
-                    ignore=shutil.ignore_patterns('testtmp', '.git', 'auto-build-save'))
-except shutil.Error as e:
-    # Cygwin's python 3.9 has os.listxattr, and copystat() on a fresh symlink
-    # fails with EACCES there.  The link itself was created, so only a
-    # non-symlink error means the copy is incomplete.
-    if any(not (os.path.islink(src) and os.path.islink(dst))
-           for src, dst, _why in e.args[0]):
-        raise
-
-flist_c = mal_src / 'flist.c'
-PATCH_OLD = "xflags = XMIT_TOP_DIR | XMIT_NO_CONTENT_DIR;"
-PATCH_NEW = "xflags = XMIT_TOP_DIR; /* malicious-sender PoC: drop NO_CONTENT_DIR */"
-text = flist_c.read_text()
-if PATCH_OLD not in text:
-    test_skipped(
-        "malicious-sender-delete-scope: could not find the implied-parent "
-        "encoding literal in flist.c -- upstream rename?  Looking for: "
-        f"{PATCH_OLD!r}.  Update PATCH_OLD in this test if the assignment "
-        "changed shape.")
-flist_c.write_text(text.replace(PATCH_OLD, PATCH_NEW, 1))
-
-# Build just the rsync binary in the copied tree.  The copy includes
-# config.h / Makefile so configure has already been done.  Suppress
-# stdout/stderr because a clean rebuild produces several screens of gcc
-# output that aren't useful here.
-build = subprocess.run(['make', '-j2', 'rsync'], cwd=str(mal_src),
-                       stdout=subprocess.PIPE, stderr=subprocess.STDOUT,
-                       text=True)
-mal_rsync = mal_src / 'rsync'
-if build.returncode != 0 or not mal_rsync.is_file() or not os.access(mal_rsync, os.X_OK):
-    test_skipped(
-        "malicious-sender-delete-scope: malicious-sender build failed.  "
-        f"`make rsync` rc={build.returncode}.  Tail of build output:\n"
-        + '\n'.join(build.stdout.splitlines()[-20:]))
-
-
-# -- Set up source + dest, with the sentinel ----------------------------------
-base = SCRATCHDIR / 'mal-test'
-rmtree(base)
-src = base / 'src'
-dest = base / 'dest'
-makepath(src / 'dir')
-makepath(dest / 'dir')
-(src / 'dir' / 'file').write_text("from server\n")
-sentinel = dest / 'dir' / 'keep.txt'
-sentinel.write_text("MUST_STAY\n")
-
-
-# -- Wire up the malicious daemon via RSYNC_CONNECT_PROG ----------------------
-# The runtests.py secure-default daemon transport uses RSYNC_CONNECT_PROG
-# to fork a daemon over a private stdio pipe instead of binding a TCP
-# socket.  That seam lets us point the production rsync (the receiver)
-# at the malicious binary as its daemon-sender without ever touching a
-# listening port -- which also keeps the test compatible with the
-# concurrent-j16 runner.
-conf = write_daemon_conf(
-    [('m', {'path': str(src),
-            'read only': 'yes',
-            'use chroot': 'no'})],
-    name='mal-rsyncd.conf')
-os.environ['RSYNC_CONNECT_PROG'] = f'{shlex.quote(str(mal_rsync))} --config={shlex.quote(str(conf))} --daemon'
-
-
-# -- The attack pull: -rR --delete from the malicious daemon -----------------
-# The receiver is the production rsync (which on the fix branches carries
-# the implied-parent downgrade).  Use --debug=del2 so we can grep the
-# output for delete_in_dir() if we need to triangulate a failure later.
-url = 'rsync://localhost/m/dir/file'
-proc = subprocess.run(
-    rsync_argv('-rR', '--delete', '--debug=del2', url, str(dest) + '/'),
-    stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True)
-
-
-# -- The oracle --------------------------------------------------------------
-# With the FIX: receiver recognises "dir" as an implied-parent-only entry,
-# forces XMIT_NO_CONTENT_DIR back into the xflags before flag mapping, so
-# FLAG_CONTENT_DIR is never set; delete_in_dir() never runs on dir;
-# sentinel survives.
-#
-# Without the FIX: receiver trusts the malicious xflags byte, sets
-# FLAG_CONTENT_DIR on "dir", generator runs delete_in_dir("dest/dir"),
-# sweeps every entry that wasn't in the sender's list, sentinel is gone.
-if not sentinel.is_file():
-    debug_tail = '\n'.join(proc.stdout.splitlines()[-30:])
-    test_fail(
-        f"malicious daemon-sender expanded --delete scope: "
-        f"{sentinel} was deleted by the receiver.  This means the "
-        "implied parent 'dir' was flagged FLAG_CONTENT_DIR on the basis "
-        "of the sender's xflags byte (XMIT_TOP_DIR without "
-        "XMIT_NO_CONTENT_DIR), and delete_in_dir() ran on dest/dir.  "
-        "Fix: the receiver must force XMIT_NO_CONTENT_DIR on any "
-        "directory entry that implied_filter_list only allowed as a "
-        "parent (flist.c recv_file_entry).  Last 30 lines of receiver "
-        f"output:\n{debug_tail}")
-
-# Also assert the file the sender legitimately offered did arrive --
-# without this, a daemon that crashed before sending anything would also
-# leave the sentinel alone and we'd false-pass.
-delivered = dest / 'dir' / 'file'
-if not delivered.is_file():
-    test_fail(
-        f"sentinel survived but the malicious daemon didn't deliver "
-        f"{delivered} either -- the test is vacuous.  Receiver rc="
-        f"{proc.returncode}.  Output tail:\n"
-        + '\n'.join(proc.stdout.splitlines()[-20:]))
-
-print(
-    f"malicious-sender-delete-scope: receiver refused to expand --delete "
-    f"scope under a malicious sender that omitted XMIT_NO_CONTENT_DIR on "
-    f"the implied parent.  {sentinel.name} survived, "
-    f"{delivered.relative_to(dest)} delivered.")
diff --git a/testsuite/match-append-empty-nullmap_test.py b/testsuite/match-append-empty-nullmap_test.py
deleted file mode 100644
index ca4c80281..000000000
--- a/testsuite/match-append-empty-nullmap_test.py
+++ /dev/null
@@ -1,84 +0,0 @@
-#!/usr/bin/env python3
-# Regression test for a NULL-pointer deref in match_sums() (match.c): in
-# daemon-as-sender mode, send_files() leaves mbuf == NULL for an empty served
-# file (st.st_size == 0). For append_mode == 2 (--append-verify), match_sums()
-# runs a verify loop driven by s->flength, which receive_sums() derives from the
-# peer's sum header (count * blength) -- NOT the daemon's own flist size. The
-# diminished-file guard compares st.st_size against F_LENGTH(file) (both 0), so
-# it does not catch a peer that claims a non-empty length.
-#
-# A hostile client pulls an EMPTY module file with --append-verify and forges a
-# sum header of count=1, blength=1 (remainder=0) -> s->flength = 1. The
-# append_mode==2 loop then calls sum_update(map_ptr(NULL, 0, 1), 1), and
-# map_ptr() (len != 0) dereferences the NULL map -- a remote unauthenticated SEGV
-# of the per-connection daemon child.  (receive_sums() returns early in append
-# mode, so no block sums follow the header.)  The fix clamps s->flength to len
-# before the verify loop.
-#
-# Oracle: pre-fix -> the daemon child hits an ASan SEGV report; fixed -> none.
-# Needs an ASan build + a real TCP daemon, and is skipped otherwise.
-
-import glob
-import os
-
-from rsyncfns import (
-    SCRATCHDIR, claim_ports, require_asan, require_tcp, start_rsyncd, test_fail,
-)
-import rsync_proto as rp
-
-PORT = 12952
-require_tcp("the pure-Python generator needs a real TCP daemon; run with --use-tcp")
-require_asan("the append-mode NULL map_ptr deref is observed via the daemon's "
-            "AddressSanitizer SEGV report")
-claim_ports(PORT)
-
-mod = SCRATCHDIR / 'append-mod'
-mod.mkdir(parents=True, exist_ok=True)
-(mod / 'f').write_bytes(b'')          # empty file => mbuf is NULL on the sender
-
-conf = SCRATCHDIR / 'append.conf'
-conf.write_text(f"""\
-pid file = {SCRATCHDIR}/append-rsyncd.pid
-use chroot = no
-
-[mod]
-    path = {mod}
-    read only = no
-""")
-
-asan_log = SCRATCHDIR / 'append-asan'
-for stale in glob.glob(f"{asan_log}.*"):
-    os.unlink(stale)
-prev = os.environ.get('ASAN_OPTIONS', '')
-os.environ['ASAN_OPTIONS'] = (
-    (prev + ':' if prev else '') + f'detect_leaks=0:abort_on_error=1:log_path={asan_log}')
-
-start_rsyncd(conf, PORT)
-
-c = rp.DaemonClient('127.0.0.1', PORT)
-# --append-verify => the daemon sender runs with append_mode == 2.
-c.handshake('mod', ['--server', '--sender', '-e.LsfxCIu', '--append-verify',
-                    '.', 'mod/f'], greeting_version=30)
-entries = rp.sort_entries(c.recv_flist(preserve_links=False))
-ndx = next(i for i, e in enumerate(entries) if e.name == b'f')
-
-# Forged sum header claiming a non-empty verified prefix (flength = 1*1 = 1)
-# against the empty file.  In append mode receive_sums() returns after the
-# header, so no block sums follow.
-req = (c.w_ndx(ndx) + rp.w_shortint(rp.ITEM_TRANSFER)
-       + rp.w_sum_head(1, 1, 0, 0))
-c.send_data(req)
-c.send_data(c.w_ndx(rp.NDX_DONE))     # trailing data so the header read completes
-c.drain(timeout=3.0)
-c.close()
-
-reports = glob.glob(f"{asan_log}.*")
-text = ''.join(open(r, errors='replace').read() for r in reports)
-if 'AddressSanitizer' in text:
-    test_fail(
-        "daemon sender hit an AddressSanitizer error on a forged append-mode sum "
-        "header against an empty file -- s->flength was taken from the peer and "
-        "the append verify loop dereferenced the NULL map:\n" + text[:1500])
-
-print("match-append-empty-nullmap: forged append-mode flength is clamped to the "
-      "local length; no NULL-deref in match_sums.")
diff --git a/testsuite/match-want-i-nolen_test.py b/testsuite/match-want-i-nolen_test.py
deleted file mode 100644
index af809c8b2..000000000
--- a/testsuite/match-want-i-nolen_test.py
+++ /dev/null
@@ -1,94 +0,0 @@
-#!/usr/bin/env python3
-# Regression test for a NULL-pointer deref in hash_search() (match.c): the
-# check_want_i adjacent-match optimisation substitutes i = want_i after matching
-# sum1 and sum2, but -- unlike the main chain loop and the aligned_i path -- did
-# NOT re-check s->sums[want_i].len == l.
-#
-# A hostile generator pulling from a daemon-as-sender forges a sum header against
-# a served regular file: count=2, blength=len+1, remainder=len, s2length=0 (so
-# the sum2 memcmp is a no-op), with BOTH block sum1 set to the file's rolling
-# checksum get_checksum1(file, len). At offset 0 the chain skips block 0
-# (.len=blength=len+1 != l=len) and matches block 1 (.len=remainder=len); then
-# check_want_i substitutes want_i=0 (.len=len+1) unchecked. After matched(),
-# offset advances to len, k = MIN(blength, len-offset) = 0, map_ptr(...,0)
-# returns NULL, and match.c:323 dereferences map[0] -- a remote unauthenticated
-# SEGV of the per-connection daemon child against any non-empty module file.
-#
-# We use a 1-byte file so get_checksum1 is trivial. The fix adds the missing
-# `l == s->sums[want_i].len` gate (matching the chain loop / aligned_i path).
-#
-# Oracle: pre-fix -> the daemon child hits an ASan SEGV report (NULL deref);
-# fixed -> the forged want_i substitution is rejected and no report appears.
-# Needs an ASan build + a real TCP daemon, and is skipped otherwise.
-
-import glob
-import os
-
-from rsyncfns import (
-    SCRATCHDIR, claim_ports, require_asan, require_tcp, start_rsyncd, test_fail,
-)
-import rsync_proto as rp
-
-PORT = 12951
-require_tcp("the pure-Python generator needs a real TCP daemon; run with --use-tcp")
-require_asan("the hash_search want_i NULL-deref is observed via the daemon's "
-            "AddressSanitizer SEGV report")
-claim_ports(PORT)
-
-mod = SCRATCHDIR / 'wanti-mod'
-mod.mkdir(parents=True, exist_ok=True)
-CONTENT = b'A'                       # 1-byte file => trivial rolling checksum
-(mod / 'f').write_bytes(CONTENT)
-LEN = len(CONTENT)
-
-conf = SCRATCHDIR / 'wanti.conf'
-conf.write_text(f"""\
-pid file = {SCRATCHDIR}/wanti-rsyncd.pid
-use chroot = no
-
-[mod]
-    path = {mod}
-    read only = no
-""")
-
-asan_log = SCRATCHDIR / 'wanti-asan'
-for stale in glob.glob(f"{asan_log}.*"):
-    os.unlink(stale)
-prev = os.environ.get('ASAN_OPTIONS', '')
-os.environ['ASAN_OPTIONS'] = (
-    (prev + ':' if prev else '') + f'detect_leaks=0:abort_on_error=1:log_path={asan_log}')
-
-start_rsyncd(conf, PORT)
-
-c = rp.DaemonClient('127.0.0.1', PORT)
-# Pull the single file: we are the receiver/generator, the daemon is the sender.
-c.handshake('mod', ['--server', '--sender', '-e.LsfxCIu', '.', 'mod/f'],
-            greeting_version=30)
-entries = rp.sort_entries(c.recv_flist(preserve_links=False))
-ndx = next(i for i, e in enumerate(entries) if e.name == b'f')
-
-# Forged sum header: count=2, blength=len+1, remainder=len, s2length=0, both
-# block sum1 = get_checksum1(file). No sum2 bytes follow (s2length=0).
-sum1 = rp.get_checksum1(CONTENT)
-req = (c.w_ndx(ndx) + rp.w_shortint(rp.ITEM_TRANSFER)
-       + rp.w_sum_head(2, LEN + 1, 0, LEN)
-       + rp.w_int(sum1) + rp.w_int(sum1))
-c.send_data(req)
-# Trailing data so the sender's last block-sum read completes (its read-ahead
-# wants more than the lone request frame), after which it runs the vulnerable
-# match_sums/hash_search.
-c.send_data(c.w_ndx(rp.NDX_DONE))
-c.drain(timeout=3.0)
-c.close()
-
-reports = glob.glob(f"{asan_log}.*")
-text = ''.join(open(r, errors='replace').read() for r in reports)
-if 'AddressSanitizer' in text:
-    test_fail(
-        "daemon sender hit an AddressSanitizer error on a forged adjacent-match "
-        "sum header -- check_want_i substituted want_i without re-checking its "
-        "length, so map_ptr() returned NULL and hash_search dereferenced it:\n"
-        + text[:1500])
-
-print("match-want-i-nolen: forged want_i adjacent match is length-checked; no "
-      "NULL-deref in hash_search.")
diff --git a/testsuite/misc-coverage_test.py b/testsuite/misc-coverage_test.py
deleted file mode 100644
index 5bf273332..000000000
--- a/testsuite/misc-coverage_test.py
+++ /dev/null
@@ -1,125 +0,0 @@
-#!/usr/bin/env python3
-"""Coverage: cheap one-off paths no other test reaches.
-
-  usage.c daemon_usage + help-rsyncd.h     -- rsync --daemon --help
-  main.c show_malloc_stats /
-  flist.c show_flist_stats                 -- --info=stats3
-  util2.c sum_as_hex /
-  checksum.c canonical_checksum            -- -c --out-format='%C %n'
-                                              (always_checksum branch) and
-                                              --out-format='%C %n' alone
-                                              (ITEM_TRANSFER branch)
-  generator.c start_delete_delay_temp /
-  flush_delete_delay                       -- --delete-delay with enough
-                                              queued deletions to overflow
-                                              the BIGPATHBUFLEN*4 in-memory
-                                              buffer into the temp-file path
-
-Each section asserts the observable behaviour, not just exit==0, so the test
-also guards against regressions in those paths.
-"""
-
-import re
-import subprocess
-
-from rsyncfns import (
-    SCRATCHDIR, makepath, rmtree, rsync_argv, test_fail,
-)
-
-
-def run(*argv, ok=(0,)):
-    r = subprocess.run(rsync_argv(*argv), capture_output=True, text=True)
-    if r.returncode not in ok:
-        test_fail(f"rsync {' '.join(argv)} -> rc={r.returncode}\n{r.stderr}")
-    return r
-
-
-# --- 1. daemon_usage + help-rsyncd.h ----------------------------------------
-r = run('--daemon', '--help')
-if '--no-detach' not in r.stdout or 'rsync --daemon' not in r.stdout:
-    test_fail(f"--daemon --help did not emit the daemon usage text:\n{r.stdout}")
-
-
-# --- 2. show_malloc_stats + show_flist_stats (INFO_GTE(STATS,3)) ------------
-src = SCRATCHDIR / 'stats-src'
-dst = SCRATCHDIR / 'stats-dst'
-rmtree(src); rmtree(dst); makepath(src, dst)
-for i in range(3):
-    (src / f'f{i}').write_bytes(b'x' * (64 + i))
-r = run('-r', '--info=stats3', f'{src}/', f'{dst}/')
-out = r.stdout + r.stderr
-# show_malloc_stats prints an arena/heap summary (one block per process), but
-# only on a glibc/mallinfo build -- on the BSDs/macOS show_malloc_stats() is a
-# no-op (still called, and thus covered, at INFO_GTE(STATS,3), just no output).
-# show_flist_stats() is currently an empty stub.
-import platform
-if platform.system() == 'Linux':
-    if 'heap statistics' not in out:
-        test_fail(f"--info=stats3 did not emit malloc stats:\n{out}")
-    # One block per process: sender + server receiver + server generator.
-    if out.count('heap statistics') < 3:
-        test_fail(f"--info=stats3 emitted fewer than 3 heap-stat blocks:\n{out}")
-
-
-# --- 3. sum_as_hex + canonical_checksum (--out-format=%C) --------------------
-csrc = SCRATCHDIR / 'csum-src'
-cdst = SCRATCHDIR / 'csum-dst'
-rmtree(csrc); rmtree(cdst); makepath(csrc, cdst)
-payload = b'hello, checksum coverage\n'
-(csrc / 'a').write_bytes(payload)
-(csrc / 'b').write_bytes(payload + b'!')
-
-# The file/transfer checksum algorithm is negotiated (xxh128/xxh3/md5/...
-# depending on build + protocol), so don't assert which -- just that %C emits
-# a per-file hex digest of plausible length, and that DIFFERENT file content
-# produces a DIFFERENT digest (i.e. it's the actual sum, not a placeholder).
-HEX = re.compile(r'^([0-9a-f]{16,128}) (\S+)$', re.M)
-
-def check_C(out, label):
-    # Two valid outcomes: hex digests (canonical csum -> sum_as_hex returns the
-    # hex string) or a run of spaces (non-canonical, e.g. md4 at --protocol=29
-    # -> sum_as_hex returns NULL and log.c emits sum_len*2 spaces).  Either way
-    # sum_as_hex/canonical_checksum were CALLED, which is the coverage goal.
-    sums = dict((m[2], m[1]) for m in HEX.finditer(out))
-    if sums:
-        if 'a' not in sums or 'b' not in sums or sums['a'] == sums['b']:
-            test_fail(f"{label}: per-file digests not distinct:\n{out!r}")
-        return 'hex'
-    if not re.search(r'^ {8,} a$', out, re.M):
-        test_fail(f"{label}: emitted neither a hex digest nor the "
-                  f"non-canonical-csum spaces fallback:\n{out!r}")
-    return 'spaces'
-
-# 3a. always_checksum branch (log.c:707): with -c, %C encodes F_SUM(file).
-r = run('-rc', '--out-format=%C %n', f'{csrc}/', f'{cdst}/')
-kind_a = check_C(r.stdout, '-c %C')
-
-# 3b. ITEM_TRANSFER branch (log.c:709): no -c, %C encodes sender_file_sum.
-rmtree(cdst); makepath(cdst)
-r = run('-r', '--out-format=%C %n', f'{csrc}/', f'{cdst}/')
-kind_b = check_C(r.stdout, '%C (no -c)')
-
-
-# --- 4. start_delete_delay_temp + flush_delete_delay ------------------------
-# deldelay_size = BIGPATHBUFLEN*4 = 20480.  Each remember_delete() entry is
-# "%x %s\0" -> ~6 + len(name).  300 files with 80-char names -> ~25 KB,
-# guaranteed to overflow the in-memory buffer and spill to the temp file.
-ddsrc = SCRATCHDIR / 'dd-src'
-dddst = SCRATCHDIR / 'dd-dst'
-rmtree(ddsrc); rmtree(dddst); makepath(ddsrc, dddst)
-(ddsrc / 'keep').write_bytes(b'k')
-NAME = 'D' * 80
-N = 300
-for i in range(N):
-    (dddst / f'{NAME}{i:04d}').write_bytes(b'x')
-r = run('-r', '--delete-delay', f'{ddsrc}/', f'{dddst}/')
-remaining = [p for p in dddst.iterdir() if p.name.startswith(NAME)]
-if remaining:
-    test_fail(f"--delete-delay left {len(remaining)}/{N} files "
-              f"after the temp-file spill path")
-if not (dddst / 'keep').is_file():
-    test_fail("--delete-delay lost the kept file")
-
-
-print(f"misc-coverage: --daemon --help, --info=stats3, "
-      f"%C ({kind_a}/{kind_b}), --delete-delay temp-file spill ({N} entries) ok")
diff --git a/testsuite/msg-io-timeout-overflow_test.py b/testsuite/msg-io-timeout-overflow_test.py
deleted file mode 100644
index c7696b44c..000000000
--- a/testsuite/msg-io-timeout-overflow_test.py
+++ /dev/null
@@ -1,87 +0,0 @@
-#!/usr/bin/env python3
-# A near-INT_MAX I/O timeout must not overflow set_io_timeout() into a tight CPU
-# loop.  Reported by z3r0s (github z3r0s6), 2026-07.
-#
-# set_io_timeout() computed "allowed_lull = (io_timeout + 1) / 2", a signed
-# overflow for io_timeout near INT_MAX that yields a negative allowed_lull /
-# select_timeout; select() then returns EINVAL on the negative tv_sec, which
-# isn't EBADF, so the read loop spins at 100% CPU forever (io_timeout ~= 68 years
-# never fires check_timeout).  io_timeout reaches INT_MAX two ways, both fixed on
-# this branch: a malicious daemon's MSG_IO_TIMEOUT (PR 50 caps the wire value at
-# 86400) and an operator's --timeout (options.c parses it unbounded).  The root
-# fix computes allowed_lull overflow-safe in a wider type in set_io_timeout(),
-# covering both.
-#
-# Because "(io_timeout + 1)" is undefined behaviour, whether it manifests depends
-# on the build: plain -O2 gcc/clang optimize the compare so select_timeout stays
-# 60 (no spin, though allowed_lull is still stored negative), while -fwrapv /
-# -fno-strict-overflow (common hardening) wrap deterministically to the negative
-# select_timeout and the spin (-ftrapv aborts).  So to exercise the DoS
-# deterministically on any target we build the rsync-under-test with -fwrapv and
-# drive set_io_timeout(INT_MAX) through the --timeout path -- the same overflow a
-# capped MSG_IO_TIMEOUT would otherwise reach.  (The wire path sets the timeout
-# mid-stream, so whether the client next blocks in select() is timing-dependent;
-# --timeout sets it at startup, so the very first select() spins -- deterministic.)
-#
-# Oracle: run the -fwrapv build with --timeout=INT_MAX on a normal local copy.
-#   * transfer completes                  -> overflow-safe (PASS / GREEN)
-#   * transfer runs past the deadline      -> tight select()-EINVAL loop (FAIL / RED)
-
-import os
-import signal
-import subprocess
-
-from rsyncfns import (
-    SCRATCHDIR, build_patched_rsync, makepath, rmtree, test_fail,
-)
-
-INT_MAX = 2147483647
-DEADLINE = 25          # a normal small copy finishes in well under a second
-
-# -fwrapv build of the tree under test (no source patch); makes the signed
-# overflow deterministic on every platform instead of compiler-optimized away.
-victim = build_patched_rsync('io-timeout-fwrapv', [], append_cflags='-fwrapv')
-
-base = SCRATCHDIR / 'io-timeout'
-rmtree(base)
-src = base / 'src'
-dst = base / 'dst'
-makepath(src)
-makepath(dst)
-(src / 'file').write_text("payload\n")
-
-# --timeout=INT_MAX -> set_io_timeout(INT_MAX) at startup.  An unfixed -fwrapv
-# build wraps select_timeout negative and the first select() spins forever; the
-# fixed build keeps it sane and the copy completes.
-proc = subprocess.Popen(
-    [str(victim), '--timeout=%d' % INT_MAX, '-a', str(src) + '/', str(dst) + '/'],
-    stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True,
-    start_new_session=True)
-try:
-    out, _ = proc.communicate(timeout=DEADLINE)
-except subprocess.TimeoutExpired:
-    # RED: trapped in the tight select()-EINVAL loop, will never return.
-    try:
-        os.killpg(os.getpgid(proc.pid), signal.SIGKILL)
-    except ProcessLookupError:
-        pass
-    proc.communicate()
-    test_fail(
-        f"--timeout={INT_MAX} trapped rsync in a tight loop: the copy did not "
-        f"finish within {DEADLINE}s.  A near-INT_MAX timeout overflowed "
-        "set_io_timeout()'s (io_timeout + 1) / 2 to a negative select_timeout "
-        "(select() -> EINVAL -> 100% CPU spin).  Fix: compute allowed_lull "
-        "overflow-safe (wider type) in set_io_timeout(), and cap a peer's "
-        "MSG_IO_TIMEOUT in read_a_msg().")
-
-# -- Oracle -------------------------------------------------------------------
-if proc.returncode != 0:
-    test_fail(f"rsync did not spin under --timeout={INT_MAX} but exited "
-              f"non-zero (rc={proc.returncode}).  Output tail:\n"
-              + '\n'.join(out.splitlines()[-20:]))
-if not (dst / 'file').is_file():
-    test_fail(f"rsync returned 0 under --timeout={INT_MAX} but did not copy the "
-              f"file.  Output tail:\n" + '\n'.join(out.splitlines()[-20:]))
-
-print("msg-io-timeout-overflow: -fwrapv rsync absorbed --timeout=INT_MAX without "
-      "spinning; the copy completed normally.")
diff --git a/testsuite/mutatefns.py b/testsuite/mutatefns.py
deleted file mode 100644
index 3f2735b1b..000000000
--- a/testsuite/mutatefns.py
+++ /dev/null
@@ -1,84 +0,0 @@
-# Shared helper for "resource changes while being transferred" tests.
-#
-# rsync scans the file list first, then sends file data and applies metadata.
-# A resource (content, size, perms, owner, mtime, xattr, ACL) mutated in that
-# window must not abort the whole transfer or corrupt the destination -- rsync
-# should transfer what it can and, at worst, warn.  The growing-file regression
-# (a hardening check that turned a benign mid-transfer append into a fatal
-# RERR_PROTOCOL) showed this whole class was untested.
-#
-# The reproduction is deterministic: a big 'aaa_pacer' file sorts first and is
-# throttled with --bwlimit, so a later 'zzz_target' entry is sent well after the
-# flist is built (--no-inc-recursive locks all sizes up front) but before its
-# own data/metadata is processed.  A background thread performs the mutation in
-# that window.
-
-import os
-import subprocess
-import threading
-import time
-
-from rsyncfns import SCRATCHDIR, make_data_file, rmtree, rsync_argv, test_fail
-
-TARGET = 'zzz_target'          # sorts after aaa_pacer -> processed second
-
-
-def run_mutating_transfer(setup, mutate, *, extra_rsync=('-a',),
-                          pacer_bytes=6 * 1024 * 1024, bwlimit=1500, delay=0.6):
-    """Run a local rsync while `mutate` runs in the transfer window.
-
-    setup(src_dir)   -- create the target resource(s); called before rsync.
-    mutate(src_dir)  -- perform the mid-transfer change; called ~delay s in.
-    extra_rsync      -- rsync flags (default -a).
-
-    Returns (proc, src, dst).  Fails the test if the mutation never ran.
-    """
-    base = SCRATCHDIR / 'mutate'
-    rmtree(base)
-    src = base / 'src'
-    dst = base / 'dst'
-    src.mkdir(parents=True)
-    dst.mkdir(parents=True)
-
-    # The throttled pacer that keeps the transfer alive during the mutation.
-    make_data_file(src / 'aaa_pacer', pacer_bytes)
-    setup(src)
-
-    done = threading.Event()
-    err = {}
-
-    def worker():
-        time.sleep(delay)
-        try:
-            mutate(src)
-        except Exception as e:                       # noqa: BLE001 - report it
-            err['exc'] = e
-        finally:
-            done.set()
-
-    t = threading.Thread(target=worker)
-    t.start()
-    proc = subprocess.run(
-        rsync_argv(*extra_rsync, '--no-inc-recursive', f'--bwlimit={bwlimit}',
-                   f'{src}/', f'{dst}/'),
-        capture_output=True, text=True)
-    t.join()
-
-    if not done.is_set():
-        test_fail("test setup: the mutation thread did not run")
-    if 'exc' in err:
-        test_fail(f"test setup: mutation raised {err['exc']!r}")
-    return proc, src, dst
-
-
-def assert_no_protocol_abort(proc):
-    """rsync must not have torn the whole transfer down with a protocol error."""
-    out = proc.stdout + proc.stderr
-    if 'received more data than file length' in out:
-        test_fail("regression: mid-transfer change aborted the run with "
-                  f"'received more data than file length'\n{out}")
-    if proc.returncode in (2,):  # RERR_PROTOCOL
-        test_fail(f"regression: transfer aborted with RERR_PROTOCOL (code 2)\n{out}")
-    # 0 = OK, 23/24 = partial/vanished (acceptable for a changing source).
-    if proc.returncode not in (0, 23, 24):
-        test_fail(f"unexpected rsync exit {proc.returncode}\n{out}")
diff --git a/testsuite/nested-socket-specials_test.py b/testsuite/nested-socket-specials_test.py
deleted file mode 100644
index c0c42317f..000000000
--- a/testsuite/nested-socket-specials_test.py
+++ /dev/null
@@ -1,55 +0,0 @@
-#!/usr/bin/env python3
-# Regression: `rsync -a` (implies --specials via -D) of a tree with a NESTED
-# unix socket must not fail the whole transfer on platforms that cannot create
-# a socket in a subdirectory race-safely (no bindat(): the BSDs, macOS,
-# Solaris).  syscall.c returns EOPNOTSUPP for such a nested socket; the
-# generator used to turn that into a transfer error (FERROR_XFER -> exit 23)
-# where master created it via the path-based bind().  Now the socket is skipped
-# with a warning and the rest of the transfer succeeds.  On Linux the socket is
-# created (mknodat handles it); either way the transfer exits 0 and the regular
-# files land.
-
-import os
-import socket as _socket
-
-from rsyncfns import (
-    SCRATCHDIR, assert_same, rmtree, run_rsync, test_fail, test_skipped,
-)
-
-base = SCRATCHDIR / 'nested-socket'
-src = base / 'src'
-dest = base / 'dest'
-rmtree(base)
-(src / 'sub').mkdir(parents=True)
-(src / 'sub' / 'f.txt').write_text('regular\n')
-(src / 'top.txt').write_text('top\n')
-
-# A unix socket nested in a subdirectory (the case that returned EOPNOTSUPP).
-# AF_UNIX sun_path is ~108 bytes, far shorter than the scratch path, so bind a
-# short relative name from inside the dir, then restore the cwd.
-s = _socket.socket(_socket.AF_UNIX)
-prev = os.getcwd()
-try:
-    os.chdir(src / 'sub')
-    s.bind('thesock')
-except OSError as e:
-    test_skipped(f"cannot create a unix socket fixture ({e})")
-finally:
-    try:
-        os.chdir(prev)
-    except OSError:
-        pass
-    s.close()
-
-# -a implies --specials.  Must exit 0 even where the nested socket cannot be
-# created -- it is skipped with a warning there (RED on the unfixed branch,
-# which exited 23 on the BSDs/macOS/Solaris).
-run_rsync('-a', f'{src}/', f'{dest}/')
-
-for rel in ('sub/f.txt', 'top.txt'):
-    got = dest / rel
-    if not got.is_file():
-        test_fail(f"a regular file was lost alongside the nested socket: {got}")
-    assert_same(src / rel, got, label=rel)
-
-print("nested-socket-specials: a nested unix socket does not fail the transfer")
diff --git a/testsuite/nondaemon-symlink-race_test.py b/testsuite/nondaemon-symlink-race_test.py
deleted file mode 100644
index 0c732fee2..000000000
--- a/testsuite/nondaemon-symlink-race_test.py
+++ /dev/null
@@ -1,87 +0,0 @@
-#!/usr/bin/env python3
-# Non-daemon (local) transfer: parent-component symlink-race confinement.
-#
-# A NON-daemon transfer -- whose
-# most dangerous instance is a root nightly backup, e.g. `rsync -a /src/ /dest/`
-# -- writes into a destination tree that contains an attacker-planted parent
-# component which is a symlink pointing OUTSIDE the tree.  The receiver must
-# confine resolution beneath the operator-named destination root and refuse to
-# operate through the escaping symlink.
-#
-# Before the symlink-race hardening was broadened, the secure resolver was
-# gated on `am_daemon && !am_chrooted`, so a plain local/remote-shell transfer
-# fell through to bare rename()/link()/open() on full paths and followed the
-# planted symlink right out of the tree.  This test pins the broadened gate
-# (all non-chrooted receivers) -- it FAILS against that older rsync and PASSES
-# once the gate covers non-daemon transfers.
-#
-# Deterministic (no race window): the escaping symlink is pre-planted as the
-# --backup-dir.  When the local transfer overwrites an existing in-tree file it
-# backs the old copy up through that backup-dir; pre-fix the backup lands
-# OUTSIDE the destination tree, post-fix the secure resolver refuses the
-# escaping symlink and nothing leaves the tree.  Runs at any uid (the escape
-# target is a sibling the running user can write); root is simply the
-# highest-severity instance.
-
-import os
-import subprocess
-
-from rsyncfns import (
-    SCRATCHDIR, find_attacker_uid, rmtree, rsync_argv, test_fail, test_skipped,
-)
-
-# The operator-path policy follows a symlink owned by uid 0 or the euid (the
-# operator's OWN backup dir) and refuses a foreign-owned one, so the escape
-# vector is an ATTACKER-owned backup-dir symlink with rsync run as root.
-if os.geteuid() != 0:
-    test_skipped("requires root to plant a backup-dir symlink owned by a non-self uid")
-ATT_UID = find_attacker_uid()
-if ATT_UID is None:
-    test_skipped("no untrusted-uid user available for cross-uid plant")
-
-
-# A non-daemon receiver resolves its write paths on held dirfds with O_NOFOLLOW
-# (race-free by construction on every platform), so a parent-component symlink
-# swapped in mid-transfer cannot redirect the write outside the destination tree.
-
-
-dest = SCRATCHDIR / 'dest'
-outside = SCRATCHDIR / 'outside'
-src = SCRATCHDIR / 'src_files'    # 'src' is reserved by runtests.py (symlink to srcdir)
-for d in (dest, outside, src):
-    rmtree(d)
-    d.mkdir(parents=True)
-
-# An existing in-tree file the transfer will overwrite (and therefore back up).
-(dest / 'foo').write_text("INSIDE_TREE_DATA\n")
-
-# The attacker-planted backup-dir: a foreign-owned symlink pointing outside the
-# dest tree (owned by the attacker uid, not root/the operator).
-os.symlink(str(outside), dest / 'bdir')
-os.lchown(dest / 'bdir', ATT_UID, ATT_UID)
-
-# New content so the push genuinely overwrites foo and triggers the backup.
-(src / 'foo').write_text("NEW_PUSHED_DATA\n")
-
-# Plain LOCAL (non-daemon) transfer with a backup-dir relative to the dest.
-# The transfer may report an error on the fixed binary (the secure backup is
-# refused), so ignore its exit status and judge solely by where files land.
-subprocess.run(
-    rsync_argv('-t', '--backup', '--backup-dir=bdir', f'{src}/foo', f'{dest}/'),
-    stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL,
-)
-
-# The escape: the in-tree file was backed up out through the bdir symlink into
-# the outside-the-tree directory.
-if os.path.lexists(outside / 'foo'):
-    try:
-        got = (outside / 'foo').read_text().strip()
-    except OSError:
-        got = '<unreadable>'
-    test_fail("non-daemon transfer escaped the tree: backup of dest/foo landed "
-              f"in {outside}/foo (content: {got}); the receiver followed the "
-              "planted backup-dir symlink instead of confining beneath the dest")
-
-leaked = os.listdir(outside)
-if leaked:
-    test_fail(f"unexpected files escaped the destination tree into {outside}: {leaked}")
diff --git a/testsuite/operator-path-backup-dir-daemon_test.py b/testsuite/operator-path-backup-dir-daemon_test.py
deleted file mode 100644
index 7b5c0b146..000000000
--- a/testsuite/operator-path-backup-dir-daemon_test.py
+++ /dev/null
@@ -1,47 +0,0 @@
-import os
-import subprocess
-
-from rsyncfns import (
-    SCRATCHDIR, rmtree, rsync_argv, start_test_daemon, test_fail, write_daemon_conf,
-)
-
-DAEMON_PORT = 12960
-SECRET = "PROTECTED-IN-EXCLUDED-SUBTREE\n"
-
-base = SCRATCHDIR / 'backupdirdaemon'
-rmtree(base)
-base.mkdir()
-
-mod = base / 'mod'
-secret = base / 'secret'
-if secret.exists():
-    rmtree(secret)# excluded subtree (exclude = /secret/)
-secret.mkdir(parents=True)
-
-victim = secret / 'f0'
-victim.write_text(SECRET)                    # a file the backup must not clobber
-mod.mkdir()
-(mod / 'f0').write_text("OLD-DESTINATION-FILE-CONTENT\n")
-
-blink = mod / 'blink'                        # euid-owned symlink -> excluded subtree
-os.symlink(f'{secret}', blink)
-
-src = base / 'src'
-src.mkdir()
-(src / 'f0').write_text("NEW\n")
-
-conf = write_daemon_conf(
-    [('mod', {'path': str(mod), 'read only': 'no'})])
-url = start_test_daemon(conf, DAEMON_PORT)
-
-subprocess.run(
-    rsync_argv('-a', '--backup', '--backup-dir=/blink', f'{src}/', f'{url}mod/'),
-    stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
-
-after = victim.read_text() if victim.exists() else None
-if after != SECRET:
-    test_fail(
-        "the daemon followed a --backup-dir symlink outside the module: "
-        f"{victim} is now {after!r} (a peer backed up over a file the module "
-        "does not serve).")
-print("daemon confines a peer-supplied --backup-dir symlink to the served set")
diff --git a/testsuite/operator-path-backup-dir-exclude-daemon_test.py b/testsuite/operator-path-backup-dir-exclude-daemon_test.py
deleted file mode 100644
index 5c7cfdd5a..000000000
--- a/testsuite/operator-path-backup-dir-exclude-daemon_test.py
+++ /dev/null
@@ -1,65 +0,0 @@
-#!/usr/bin/env python3
-# A daemon must not let a peer-supplied --backup-dir reach the module's EXCLUDED
-# subtree via a symlink.  (Reported by Omar Elsayed.)
-#
-# The module excludes a subtree (exclude = /secret/).  An in-module symlink owned
-# by the daemon's euid (in Omar's PoC the daemon is root and the symlink is
-# root-owned) points at that excluded subtree.  A peer overwrites an existing
-# dest file with --backup --backup-dir pointing at the symlink: the OLD dest file
-# is moved into the backup dir, i.e. through the symlink into the excluded
-# subtree -- scribbling on (or destroying) a file the module does not serve.
-#
-# The ownership walk that make_backup() already uses does NOT stop this: it
-# FOLLOWS a symlink owned by uid 0 / the euid by design.  Only resolving with the
-# module exclude filter applied refuses landing in the excluded subtree.  So the
-# symlink here is euid-owned (the followed case), and the test runs unprivileged
-# -- the boundary under test is the module exclude, not a uid boundary.
-
-import os
-import subprocess
-
-from rsyncfns import (
-    SCRATCHDIR, rmtree, rsync_argv, start_test_daemon, test_fail, write_daemon_conf,
-)
-
-DAEMON_PORT = 12904
-SECRET = "PROTECTED-IN-EXCLUDED-SUBTREE\n"
-
-base = SCRATCHDIR / 'backupdirdaemon'
-rmtree(base)
-base.mkdir()
-
-mod = base / 'mod'
-secret = mod / 'secret'                      # excluded subtree (exclude = /secret/)
-secret.mkdir(parents=True)
-victim = secret / 'f0'
-victim.write_text(SECRET)                    # a file the backup must not clobber
-
-# Existing dest file (different size from the source) so the overwrite triggers a
-# backup; src/f0 differs so the transfer actually happens.
-(mod / 'f0').write_text("OLD-DESTINATION-FILE-CONTENT\n")
-
-blink = mod / 'blink'                        # euid-owned symlink -> excluded subtree
-os.symlink('secret', blink)
-
-src = base / 'src'
-src.mkdir()
-(src / 'f0').write_text("NEW\n")
-
-conf = write_daemon_conf(
-    [('mod', {'path': str(mod), 'read only': 'no', 'exclude': '/secret/'})])
-url = start_test_daemon(conf, DAEMON_PORT)
-
-subprocess.run(
-    rsync_argv('-a', '--backup', '--backup-dir=/blink', f'{src}/', f'{url}mod/'),
-    stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
-
-after = victim.read_text() if victim.exists() else None
-if after == SECRET:
-    test_fail(
-        "the daemon refused a --backup-dir symlink that stock rsync (3.2.7) "
-        f"follows: {victim} is unchanged ({after!r}).  The daemon exclude filter "
-        "is name-based ('blink' is not excluded), not a symlink boundary; it must "
-        "not block this (use `munge symlinks` to defend a writable module).")
-print("daemon exclude is name-based: a --backup-dir symlink whose name is not "
-      "excluded is followed (3.2.7-equivalent)")
diff --git a/testsuite/operator-path-backup-dir_test.py b/testsuite/operator-path-backup-dir_test.py
deleted file mode 100644
index 989f65182..000000000
--- a/testsuite/operator-path-backup-dir_test.py
+++ /dev/null
@@ -1,33 +0,0 @@
-#!/usr/bin/env python3
-# --backup-dir symlink policy matrix.  An operator --backup-dir must follow a
-# symlink only when owned by uid 0 or the euid, refusing an attacker's plant --
-# absolute AND relative, leaf and parent, with --insecure-links as the local
-# opt-out.  See run_symlink_matrix() in rsyncfns.  RED on this branch: absolute
-# cross-uid follows the attacker symlink (escape); relative refuses even the
-# operator's own symlink (diverges from the uniform policy).
-
-import subprocess
-
-from rsyncfns import rsync_argv, run_symlink_matrix, plant_operator_symlink
-
-NFILES = 6
-
-
-def case(ctx):
-    src = ctx.base / 'src'
-    dest = ctx.base / 'dest'
-    src.mkdir()
-    dest.mkdir()
-    for i in range(NFILES):
-        (src / f'f{i}').write_text("NEW-PUSHED-CONTENT\n")  # distinct -> overwrite -> backup
-        (dest / f'f{i}').write_text("OLD\n")
-    opt, _escape = plant_operator_symlink(ctx, dest)  # rel --backup-dir anchors at dest
-    extra = ['--insecure-links'] if ctx.insecure else []
-    subprocess.run(
-        rsync_argv('-a', '--backup', f'--backup-dir={opt}', *extra, 'src/', 'dest/'),
-        cwd=str(ctx.base), stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
-    return any(p.is_file() for p in ctx.outside.rglob('*'))  # backup escaped?
-
-
-run_symlink_matrix('--backup-dir', case)
-print("--backup-dir symlink policy matrix: enforced")
diff --git a/testsuite/operator-path-backup-rmdir_test.py b/testsuite/operator-path-backup-rmdir_test.py
deleted file mode 100644
index 5e889f61a..000000000
--- a/testsuite/operator-path-backup-rmdir_test.py
+++ /dev/null
@@ -1,115 +0,0 @@
-#!/usr/bin/env python3
-# Non-daemon (local) --backup-dir parent-component symlink-race confinement, for
-# the case where a backup replaces a pre-existing backup directory (do_rmdir_at's
-# operator path: removing backup/sub/subN before writing the backed-up file).
-#
-# A native C flipper swaps the backup parent component (backup/sub) with an
-# attacker-owned symlink to an outside directory during a live transfer.  The
-# ownership walk must refuse the foreign-owned component so the rmdir never
-# escapes to remove a directory outside the backup tree.
-
-import os
-import subprocess
-import time
-
-from rsyncfns import (
-    SCRATCHDIR, race_budget, find_attacker_uid, rmtree,
-    start_c_flipper, stop_flipper, test_fail, test_skipped,
-)
-
-if os.geteuid() != 0:
-    test_skipped("requires root to plant a backup-dir symlink owned by a non-self uid")
-
-ATT_UID = find_attacker_uid()
-if ATT_UID is None:
-    test_skipped("no untrusted-uid user available for cross-uid plant")
-
-# Many files widen the per-file backup window so the flipper has more chances to
-# land the parent swap during a backup rmdir.
-NFILES = 50
-base = SCRATCHDIR / 'bdir-race'
-src = base / 'src'
-dest = base / 'dest'
-backup = base / 'backup'
-outside = base / 'outside'
-sub = backup / 'sub'
-sublink = backup / '.sublink'
-
-
-def build():
-    """Reset the workspace.  Call only while the flipper is stopped."""
-    rmtree(base)
-    for d in (src / 'sub', dest / 'sub', backup, outside):
-        d.mkdir(parents=True, exist_ok=True)
-
-    for i in range(NFILES):
-        # The backup target pre-exists as a directory; backing up the old dest
-        # file over it forces rsync to rmdir backup/sub/subN first.
-        (sub / f'sub{i}').mkdir(parents=True, exist_ok=True)
-        # A sentinel directory outside the tree; if the rmdir follows the flipped
-        # parent symlink, outside/subN gets removed.
-        (outside / f'sub{i}').mkdir(exist_ok=True)
-        (src / 'sub' / f'sub{i}').write_text('payload')
-        (dest / 'sub' / f'sub{i}').write_text('different')
-
-    os.symlink(str(outside), sublink)
-    os.lchown(sublink, ATT_UID, ATT_UID)
-
-
-def push():
-    """Runs a blocking local rsync push invocation."""
-    return subprocess.run(
-        ['./rsync', '-a', '-b', f'--backup-dir={backup}',
-         f'{src}/', f'{dest}/'],
-        stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True,
-    )
-
-
-def escaped() -> bool:
-    """True if any outside sentinel directory was removed (escaped rmdir)."""
-    for i in range(NFILES):
-        if not (outside / f'sub{i}').is_dir():
-            return True
-    return False
-
-
-# Positive control: a clean run (no flipper) must back the old dest file over the
-# pre-existing backup directory, proving this transfer shape exercises the backup
-# rmdir path.  A broken fixture or an rsync that errors early fails here loudly
-# instead of passing the race vacuously.
-build()
-proc = push()
-if proc.returncode != 0:
-    test_fail(f"positive control: clean --backup-dir run failed (rc={proc.returncode}):\n{proc.stdout or ''}")
-if not (sub / 'sub0').is_file() or (sub / 'sub0').read_text() != 'different':
-    test_fail("positive control: the old destination file was not backed up over the "
-              "pre-existing backup directory; the backup rmdir path was not exercised")
-if escaped():
-    test_fail("positive control: an outside sentinel dir vanished during a no-flipper run")
-
-
-# ---- THE LIVE RACE ---------------------------------------------------------
-
-deadline = time.monotonic() + race_budget(10.0)
-flip = None
-
-try:
-    while time.monotonic() < deadline:
-        if flip is not None:
-            stop_flipper(flip)
-            flip = None
-        build()
-        flip = start_c_flipper(sub, sublink)
-        push()
-
-        if escaped():
-            test_fail(
-                "--backup-dir parent symlink race: a backup rmdir escaped the tree, "
-                f"removing a sentinel directory under {outside}; rsync followed the "
-                "flipped attacker-owned backup/sub component instead of refusing it."
-            )
-finally:
-    if flip is not None:
-        stop_flipper(flip)
-
-print("operator-path-backup-rmdir: backup rmdir confined under parent-swap race")
diff --git a/testsuite/operator-path-backup-symlink_test.py b/testsuite/operator-path-backup-symlink_test.py
deleted file mode 100644
index 6501d0a82..000000000
--- a/testsuite/operator-path-backup-symlink_test.py
+++ /dev/null
@@ -1,115 +0,0 @@
-#!/usr/bin/env python3
-# Non-daemon (local) --backup-dir parent-component symlink-race confinement, for
-# the case where the backed-up item is a symlink (do_symlink_at's operator path).
-#
-# High-frequency race variant: a native C flipper swaps the backup parent
-# component (backup/sub) with an attacker-owned symlink to an outside directory
-# under a live transfer.  The ownership walk must refuse the foreign-owned
-# component so no backup symlink is ever created outside the backup tree.
-
-import os
-import subprocess
-import time
-
-from rsyncfns import (
-    SCRATCHDIR, race_budget, find_attacker_uid, rmtree,
-    start_c_flipper, stop_flipper, test_fail, test_skipped,
-)
-
-if os.geteuid() != 0:
-    test_skipped("requires root to plant a backup-dir symlink owned by a non-self uid")
-
-ATT_UID = find_attacker_uid()
-if ATT_UID is None:
-    test_skipped("no untrusted-uid user available for cross-uid plant")
-
-# Many files widen rsync's per-file backup window so the background flipper has
-# more chances to land the parent swap during a backup operation.
-NFILES = 95
-base = SCRATCHDIR / 'bdir-race'
-src = base / 'src'
-dest = base / 'dest'
-backup = base / 'backup'
-outside = base / 'outside'
-sub = backup / 'sub'
-sublink = backup / '.sublink'
-
-
-def build():
-    """Reset the workspace.  Call only while the flipper is stopped."""
-    rmtree(base)
-    for d in (src / 'sub', dest / 'sub', backup, outside):
-        d.mkdir(parents=True, exist_ok=True)
-
-    # Distinct source and destination symlink values so each transfer overwrites
-    # the destination symlink and thus triggers a backup of the old one.
-    for i in range(NFILES):
-        (src / 'sub' / f'f{i}').symlink_to('test')
-        (dest / 'sub' / f'f{i}').symlink_to('test2')
-
-    # The attacker-owned parent-swap target: a symlink to the outside directory.
-    os.symlink(str(outside), sublink)
-    os.lchown(sublink, ATT_UID, ATT_UID)
-    sub.mkdir(parents=True, exist_ok=True)
-
-
-def push():
-    """Runs a blocking local rsync push invocation."""
-    return subprocess.run(
-        ['./rsync', '-a', '-b', f'--backup-dir={backup}',
-         f'{src}/', f'{dest}/'],
-        stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True,
-    )
-
-
-def escaped() -> bool:
-    """True if any symlink was created directly in the outside directory."""
-    with os.scandir(outside) as it:
-        for e in it:
-            if e.is_symlink():
-                return True
-    return False
-
-
-# Positive control: a clean run (no flipper) must back the old destination
-# symlink into the backup tree, proving this transfer shape exercises the backup
-# symlink path.  A broken fixture or an rsync that errors early fails here loudly
-# instead of passing the race vacuously.
-build()
-proc = push()
-if proc.returncode != 0:
-    test_fail(f"positive control: clean --backup-dir run failed (rc={proc.returncode}):\n{proc.stdout or ''}")
-if not (sub / 'f0').is_symlink() or os.readlink(sub / 'f0') != 'test2':
-    test_fail("positive control: the old destination symlink was not backed up into "
-              f"{sub}; the backup symlink path was not exercised")
-if escaped():
-    test_fail("positive control: a symlink appeared in outside/ during a no-flipper run")
-
-
-# ---- THE LIVE RACE ---------------------------------------------------------
-
-deadline = time.monotonic() + race_budget(10.0)
-flip = None
-
-try:
-    while time.monotonic() < deadline:
-        # Reset the workspace only while the flipper is quiet, so build()'s own
-        # rmtree/mkdir can't race the swapper and drop artifacts in outside/.
-        if flip is not None:
-            stop_flipper(flip)
-            flip = None
-        build()
-        flip = start_c_flipper(sub, sublink)
-        push()
-
-        if escaped():
-            test_fail(
-                "--backup-dir parent symlink race: a backup symlink escaped into "
-                f"{outside}; rsync followed the flipped attacker-owned backup/sub "
-                "component instead of refusing it."
-            )
-finally:
-    if flip is not None:
-        stop_flipper(flip)
-
-print("operator-path-backup-symlink: backup symlink confined under parent-swap race")
diff --git a/testsuite/operator-path-compare-dest_test.py b/testsuite/operator-path-compare-dest_test.py
deleted file mode 100644
index a1f29efaa..000000000
--- a/testsuite/operator-path-compare-dest_test.py
+++ /dev/null
@@ -1,36 +0,0 @@
-#!/usr/bin/env python3
-# --compare-dest symlink policy matrix.  A followed --compare-dest symlink lets
-# the basis lookup read an out-of-tree directory; a match there makes rsync treat
-# the file as already present and SKIP creating it in dest (out-of-tree read).
-# The ownership walk must follow only uid0/euid-owned symlinks; --insecure-links
-# is the local opt-out.
-
-import os
-import subprocess
-
-from rsyncfns import rsync_argv, run_symlink_matrix, plant_operator_symlink
-
-T = 1234567890
-
-
-def case(ctx):
-    src = ctx.base / 'src'
-    dest = ctx.base / 'dest'
-    src.mkdir()
-    dest.mkdir()
-    (src / 'f0').write_text("BASIS-MATCH\n")
-    opt, escape = plant_operator_symlink(ctx, dest)
-    escape.mkdir(parents=True, exist_ok=True)
-    (escape / 'f0').write_text("BASIS-MATCH\n")
-    os.utime(src / 'f0', (T, T))
-    os.utime(escape / 'f0', (T, T))
-    extra = ['--insecure-links'] if ctx.insecure else []
-    subprocess.run(
-        rsync_argv('-a', f'--compare-dest={opt}', *extra, 'src/', 'dest/'),
-        cwd=str(ctx.base), stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
-    # Followed == the out-of-tree basis matched, so f0 was skipped (not created).
-    return not (dest / 'f0').exists()
-
-
-run_symlink_matrix('--compare-dest', case)
-print("--compare-dest symlink policy matrix: enforced")
diff --git a/testsuite/operator-path-copy-dest_test.py b/testsuite/operator-path-copy-dest_test.py
deleted file mode 100644
index 148cdc862..000000000
--- a/testsuite/operator-path-copy-dest_test.py
+++ /dev/null
@@ -1,37 +0,0 @@
-#!/usr/bin/env python3
-# --copy-dest symlink policy matrix.  A followed --copy-dest symlink lets the
-# basis lookup read an out-of-tree directory and COPY a matching file from it
-# into dest.  The basis here has the same size+mtime but DISTINCT content, so a
-# followed symlink yields the basis content (proving the out-of-tree read); a
-# confined one transfers the real source content.  --insecure-links opts out.
-
-import os
-import subprocess
-
-from rsyncfns import rsync_argv, run_symlink_matrix, plant_operator_symlink
-
-T = 1234567890
-
-
-def case(ctx):
-    src = ctx.base / 'src'
-    dest = ctx.base / 'dest'
-    src.mkdir()
-    dest.mkdir()
-    (src / 'f0').write_text("SRC1234\n")
-    opt, escape = plant_operator_symlink(ctx, dest)
-    escape.mkdir(parents=True, exist_ok=True)
-    (escape / 'f0').write_text("OUT5678\n")   # same length, DISTINCT content
-    os.utime(src / 'f0', (T, T))
-    os.utime(escape / 'f0', (T, T))
-    extra = ['--insecure-links'] if ctx.insecure else []
-    subprocess.run(
-        rsync_argv('-a', f'--copy-dest={opt}', *extra, 'src/', 'dest/'),
-        cwd=str(ctx.base), stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
-    df = dest / 'f0'
-    # Followed == dest got the out-of-tree basis content (copied), not the source.
-    return df.exists() and df.read_text() == "OUT5678\n"
-
-
-run_symlink_matrix('--copy-dest', case)
-print("--copy-dest symlink policy matrix: enforced")
diff --git a/testsuite/operator-path-dir-daemon-leaf_test.py b/testsuite/operator-path-dir-daemon-leaf_test.py
deleted file mode 100644
index ef7af104d..000000000
--- a/testsuite/operator-path-dir-daemon-leaf_test.py
+++ /dev/null
@@ -1,59 +0,0 @@
-#!/usr/bin/env python3
-# A leaf-level module exclude (e.g. exclude = /public/f0, where the dir /public
-# is itself served) must not be bypassable by a peer-supplied --partial-dir/
-# --backup-dir symlink.  (Codex-review follow-up to Omar Elsayed's findings.)
-#
-# The parent dir is served (it has other, non-excluded files), so resolution is
-# allowed to descend into it; only the single leaf f0 is hidden.  An in-module
-# euid-owned symlink -> that served dir, used as the operator-path, targets the
-# hidden leaf -- which the parent-only ownership walk did not filter-check.  The
-# leaf must be filter-checked too, so the peer cannot delete/overwrite it.
-#
-# Runs unprivileged: the boundary is the module exclude, not a uid.
-
-import os
-import subprocess
-
-from rsyncfns import (
-    SCRATCHDIR, rmtree, rsync_argv, start_test_daemon, test_fail, write_daemon_conf,
-)
-
-SECRET = "LEAF-EXCLUDED-IN-A-SERVED-DIR\n"
-
-
-def run_case(label, opt, extra, port):
-    base = SCRATCHDIR / f'leaf-{label}'
-    rmtree(base)
-    base.mkdir()
-    mod = base / 'mod'
-    pub = mod / 'public'                 # served dir; only /public/f0 is excluded
-    pub.mkdir(parents=True)
-    (pub / 'f0').write_text(SECRET)
-    (pub / 'served.txt').write_text("served\n")   # sibling => 'public' is served
-    (mod / 'f0').write_text("OLD-DEST-CONTENT\n")
-    os.symlink('public', mod / 'blink')
-    src = base / 'src'
-    src.mkdir()
-    (src / 'f0').write_text("NEW\n")
-
-    conf = write_daemon_conf(
-        [('mod', {'path': str(mod), 'read only': 'no', 'exclude': '/public/f0'})],
-        {'pid file': str(SCRATCHDIR / f'rsyncd-leaf-{label}.pid')},
-        name=f'leaf-{label}.conf')
-    url = start_test_daemon(conf, port)
-    subprocess.run(
-        rsync_argv('-a', *extra, f'{opt}=/blink', f'{src}/', f'{url}mod/'),
-        stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
-    after = (pub / 'f0').read_text() if (pub / 'f0').exists() else None
-    if after == SECRET:
-        test_fail(
-            f"{label}: the daemon refused a {opt} symlink to a leaf-excluded file "
-            f"that stock rsync (3.2.7) reaches: public/f0 is unchanged ({after!r}). "
-            "The daemon exclude filter is name-based ('blink' is not excluded), not "
-            "a symlink boundary; it must not block this.")
-
-
-run_case('backup', '--backup-dir', ['--backup'], 12906)
-run_case('partial', '--partial-dir', [], 12907)
-print("daemon exclude is name-based: an operator-path symlink reaches a "
-      "leaf-excluded file in a served dir (3.2.7-equivalent)")
diff --git a/testsuite/operator-path-dir-daemon-outside_test.py b/testsuite/operator-path-dir-daemon-outside_test.py
deleted file mode 100644
index c9d343b55..000000000
--- a/testsuite/operator-path-dir-daemon-outside_test.py
+++ /dev/null
@@ -1,56 +0,0 @@
-#!/usr/bin/env python3
-# A daemon must not let a peer-supplied --partial-dir/--backup-dir symlink resolve
-# OUTSIDE the served module at all (not just into an excluded subtree).
-# (Companion to the exclude-bypass tests; reported via Omar Elsayed's findings.)
-#
-# An in-module symlink owned by the daemon euid whose target is ABSOLUTE (or
-# climbs out with ../) points to a sibling directory outside the module root.
-# An unprivileged peer overwrites a dest file with --backup/--partial-dir aimed
-# at that symlink, moving/staging the data OUTSIDE the served set -- modifying
-# files the module never exposed.  The module-confined resolver must refuse a
-# resolved path that leaves the module root.
-#
-# Runs unprivileged: the boundary under test is the module root, not a uid.
-
-import os
-import subprocess
-
-from rsyncfns import (
-    SCRATCHDIR, rmtree, rsync_argv, start_test_daemon, test_fail, write_daemon_conf,
-)
-
-def run_case(label, opt, extra, port):
-    base = SCRATCHDIR / f'outside-{label}'
-    rmtree(base)
-    base.mkdir()
-    mod = base / 'mod'
-    mod.mkdir()
-    outside = base / 'outside'           # sibling of the module -- NOT served
-    outside.mkdir()
-    (mod / 'f0').write_text("OLD-DEST-CONTENT\n")   # existing dest -> overwritten
-    src = base / 'src'
-    src.mkdir()
-    (src / 'f0').write_text("NEW\n")
-    # euid-owned symlink inside the module, absolute target outside the module.
-    os.symlink(str(outside), mod / 'elink')
-
-    conf = write_daemon_conf(
-        [('mod', {'path': str(mod), 'read only': 'no'})],
-        {'pid file': str(SCRATCHDIR / f'rsyncd-outside-{label}.pid')},
-        name=f'outside-{label}.conf')
-    url = start_test_daemon(conf, port)
-    subprocess.run(
-        rsync_argv('-a', *extra, f'{opt}=/elink', f'{src}/', f'{url}mod/'),
-        stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
-    leaked = [os.path.join(r, f) for r, _d, fs in os.walk(outside) for f in fs]
-    if leaked:
-        test_fail(
-            f"{label}: the daemon followed an in-module symlink whose target is "
-            f"OUTSIDE the module root and wrote there: {leaked} (a peer modified "
-            "files the module does not serve). The resolver must confine an "
-            "operator/peer path to the module root.")
-
-
-run_case('backup', '--backup-dir', ['--backup'], 12905)
-run_case('partial', '--partial-dir', [], 12909)
-print("daemon confines peer --partial-dir/--backup-dir symlinks to the module root")
diff --git a/testsuite/operator-path-files-from_test.py b/testsuite/operator-path-files-from_test.py
deleted file mode 100644
index d8366118d..000000000
--- a/testsuite/operator-path-files-from_test.py
+++ /dev/null
@@ -1,29 +0,0 @@
-#!/usr/bin/env python3
-# --files-from symlink policy matrix (also covers the shared open site used by
-# --include-from / --exclude-from / --filter merge in exclude.c / options.c).
-# Already refuses a foreign-owned symlink but does not honor --insecure-links --
-# RED on the insecure cells.
-
-import subprocess
-
-from rsyncfns import rsync_argv, run_symlink_matrix, plant_operator_symlink
-
-
-def case(ctx):
-    src = ctx.base / 'src'
-    dest = ctx.base / 'dest'
-    src.mkdir()
-    dest.mkdir()
-    (src / 'sentinel').write_text("X\n")
-    opt, victim = plant_operator_symlink(ctx, ctx.base, kind='file')
-    victim.write_text("sentinel\n")   # attacker-controlled transfer list
-    extra = ['--insecure-links'] if ctx.insecure else []
-    subprocess.run(
-        rsync_argv('-a', f'--files-from={opt}', *extra, 'src/', 'dest/'),
-        cwd=str(ctx.base), stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
-    # Followed == rsync read the out-of-tree list and transferred its named file.
-    return (dest / 'sentinel').exists()
-
-
-run_symlink_matrix('--files-from', case)
-print("--files-from symlink policy matrix: enforced")
diff --git a/testsuite/operator-path-inplace-backup-dir_test.py b/testsuite/operator-path-inplace-backup-dir_test.py
deleted file mode 100644
index 621b2dcae..000000000
--- a/testsuite/operator-path-inplace-backup-dir_test.py
+++ /dev/null
@@ -1,37 +0,0 @@
-#!/usr/bin/env python3
-# --inplace --backup-dir symlink policy matrix.
-#
-# With --inplace the generator makes the backup itself (it bypasses
-# make_backup(), creating/opening the backup file directly via copy_file() /
-# do_open_at() on the --backup-dir path), a separate code path from the plain
-# --backup case in operator-path-backup-dir.  The same operator-path policy must
-# hold: a --backup-dir symlink is followed only when owned by uid 0 or the euid,
-# an attacker's plant is refused -- absolute and relative, leaf and parent, with
-# --insecure-links as the local opt-out.
-
-import subprocess
-
-from rsyncfns import rsync_argv, run_symlink_matrix, plant_operator_symlink
-
-NFILES = 6
-
-
-def case(ctx):
-    src = ctx.base / 'src'
-    dest = ctx.base / 'dest'
-    src.mkdir()
-    dest.mkdir()
-    for i in range(NFILES):
-        (src / f'f{i}').write_text("NEW-PUSHED-CONTENT\n")  # distinct -> overwrite -> backup
-        (dest / f'f{i}').write_text("OLD\n")
-    opt, _escape = plant_operator_symlink(ctx, dest)  # rel --backup-dir anchors at dest
-    extra = ['--insecure-links'] if ctx.insecure else []
-    subprocess.run(
-        rsync_argv('-a', '--inplace', '--backup', f'--backup-dir={opt}', *extra,
-                   'src/', 'dest/'),
-        cwd=str(ctx.base), stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
-    return any(p.is_file() for p in ctx.outside.rglob('*'))  # backup escaped?
-
-
-run_symlink_matrix('--inplace --backup-dir', case)
-print("--inplace --backup-dir symlink policy matrix: enforced")
diff --git a/testsuite/operator-path-insecure-links-daemon_test.py b/testsuite/operator-path-insecure-links-daemon_test.py
deleted file mode 100644
index 66eb0b6da..000000000
--- a/testsuite/operator-path-insecure-links-daemon_test.py
+++ /dev/null
@@ -1,63 +0,0 @@
-#!/usr/bin/env python3
-# A daemon must NEVER honor a peer-forwarded --insecure-links: a client cannot be
-# allowed to switch off the daemon's symlink confinement (otherwise a malicious
-# client just always sends it).  rsync no longer forwards --insecure-links to the
-# server (it is a local-only opt-out), but a client can still inject it explicitly
-# with -M/--remote-option, so this guards that every daemon-side confinement gate
-# ignores it -- the opt-out predicate is am_daemon ? lp_insecure_links(module_id)
-# : insecure_links, which never reads the peer-controllable insecure_links on a
-# daemon.  (A daemon also hard-refuses an explicitly-injected --insecure-links via
-# the refused-options path; see operator-path-insecure-links-refused.)
-#
-# Exercised via the module-root chdir (change_dir): the daemon serves a module
-# whose configured `path =` is a foreign-owned symlink to an escape dir.  The
-# daemon's chdir must refuse it EVEN when the client forwards -M--insecure-links.
-# (change_dir's daemon branch is already always-confined; this locks that in and
-# guards the dir-sink/file-open fixes that add the opt-out gate.)
-#
-# Requires root for the cross-uid plant.
-
-import os
-import subprocess
-
-from rsyncfns import (
-    SCRATCHDIR, find_attacker_uid, rmtree, rsync_argv, start_test_daemon,
-    test_fail, test_skipped, write_daemon_conf,
-)
-
-DAEMON_PORT = 12901
-CANARY = "audit_daemon_optout_canary"
-
-if os.geteuid() != 0:
-    test_skipped("requires root to plant a symlink owned by a non-self uid")
-ATT = find_attacker_uid()
-if ATT is None:
-    test_skipped("no untrusted-uid user available for cross-uid plant")
-
-base = SCRATCHDIR / 'daemonoptout'
-rmtree(base)
-base.mkdir()
-escape_target = base / 'escape_target'
-escape_target.mkdir()
-(escape_target / CANARY).write_text("must-not-be-served\n")
-
-plant = base / 'plant'                       # the module-configured `path =`
-os.symlink(escape_target, plant)
-os.lchown(plant, ATT, ATT)                   # foreign-owned (attacker) symlink
-
-conf = write_daemon_conf([('mod', {'path': plant, 'read only': 'yes'})])
-url = start_test_daemon(conf, DAEMON_PORT)
-
-# The client forwards --insecure-links to the daemon (-M / --remote-option).
-proc = subprocess.run(
-    rsync_argv('-M--insecure-links', f'{url}mod/'),
-    stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True)
-
-if CANARY in proc.stdout:
-    test_fail(
-        "the daemon honored a peer-forwarded --insecure-links and disabled its "
-        f"module-chdir confinement: the foreign-owned symlink {plant} -> "
-        f"{escape_target} was followed (canary {CANARY!r} in the listing). A "
-        "daemon must never let a client switch off its symlink confinement; the "
-        "opt-out must be gated on !am_daemon, not bare insecure_links.")
-print("daemon ignores peer-forwarded --insecure-links: confinement held")
diff --git a/testsuite/operator-path-link-dest_test.py b/testsuite/operator-path-link-dest_test.py
deleted file mode 100644
index 94d83d1df..000000000
--- a/testsuite/operator-path-link-dest_test.py
+++ /dev/null
@@ -1,41 +0,0 @@
-#!/usr/bin/env python3
-# --link-dest symlink policy matrix.  A followed --link-dest symlink lets the
-# basis lookup read an out-of-tree directory and HARDLINK dest files to it.  The
-# operator-path ownership walk must follow only uid0/euid-owned symlinks (abs and
-# rel, leaf and parent); --insecure-links is the local opt-out.
-
-import os
-import subprocess
-
-from rsyncfns import rsync_argv, run_symlink_matrix, plant_operator_symlink
-
-T = 1234567890  # shared mtime so the quick check treats the basis as a match
-
-
-def case(ctx):
-    src = ctx.base / 'src'
-    dest = ctx.base / 'dest'
-    src.mkdir()
-    dest.mkdir()
-    (src / 'f0').write_text("BASIS-MATCH\n")
-    opt, escape = plant_operator_symlink(ctx, dest)  # rel --link-dest anchors at dest
-    escape.mkdir(parents=True, exist_ok=True)
-    (escape / 'f0').write_text("BASIS-MATCH\n")       # identical out-of-tree basis
-    os.utime(src / 'f0', (T, T))
-    os.utime(escape / 'f0', (T, T))
-    extra = ['--insecure-links'] if ctx.insecure else []
-    subprocess.run(
-        rsync_argv('-a', f'--link-dest={opt}', *extra, 'src/', 'dest/'),
-        cwd=str(ctx.base), stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
-    df = dest / 'f0'
-    if not df.exists():
-        return False
-    try:
-        # Followed == dest/f0 is a hardlink to the out-of-tree basis.
-        return os.stat(df).st_ino == os.stat(escape / 'f0').st_ino
-    except OSError:
-        return False
-
-
-run_symlink_matrix('--link-dest', case)
-print("--link-dest symlink policy matrix: enforced")
diff --git a/testsuite/operator-path-log-file_test.py b/testsuite/operator-path-log-file_test.py
deleted file mode 100644
index 13ff9c4f3..000000000
--- a/testsuite/operator-path-log-file_test.py
+++ /dev/null
@@ -1,28 +0,0 @@
-#!/usr/bin/env python3
-# --log-file symlink policy matrix.  --log-file already refuses a foreign-owned
-# symlink (it uses the ownership walk), but it does NOT honor --insecure-links --
-# so this matrix is RED on the insecure cells: the local opt-out must restore
-# legacy following uniformly across operator paths.
-
-import subprocess
-
-from rsyncfns import rsync_argv, run_symlink_matrix, plant_operator_symlink
-
-
-def case(ctx):
-    src = ctx.base / 'src'
-    dest = ctx.base / 'dest'
-    src.mkdir()
-    dest.mkdir()
-    (src / 'f0').write_text("data\n")
-    opt, victim = plant_operator_symlink(ctx, ctx.base, kind='file')
-    extra = ['--insecure-links'] if ctx.insecure else []
-    subprocess.run(
-        rsync_argv('-a', '-i', f'--log-file={opt}', *extra, 'src/', 'dest/'),
-        cwd=str(ctx.base), stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
-    # Followed == the log was written through the symlink to the out-of-tree file.
-    return victim.is_file() and victim.stat().st_size > 0
-
-
-run_symlink_matrix('--log-file', case)
-print("--log-file symlink policy matrix: enforced")
diff --git a/testsuite/operator-path-partial-dir-daemon_test.py b/testsuite/operator-path-partial-dir-daemon_test.py
deleted file mode 100644
index 0d2e97ce9..000000000
--- a/testsuite/operator-path-partial-dir-daemon_test.py
+++ /dev/null
@@ -1,77 +0,0 @@
-import os
-import subprocess
-
-from rsyncfns import (
-    SCRATCHDIR, forced_protocol, rmtree, rsync_argv, start_test_daemon,
-    test_fail, write_daemon_conf,
-)
-
-DAEMON_PORT = 12961
-SECRET = "PROTECTED-OUTSIDE-MODULE\n"
-PUSHED = "NEW\n"
-OLD_DEST = "OLD-DESTINATION-FILE-CONTENT\n"
-
-base = SCRATCHDIR / 'partialdirdaemon'
-rmtree(base)
-base.mkdir()
-
-mod = base / 'mod'
-secret = base / 'secret'
-if secret.exists():
-    rmtree(secret)
-secret.mkdir(parents=True)
-
-victim = secret / 'f0'
-victim.write_text(SECRET)                    # a file the partial must not clobber
-mod.mkdir()
-dest = mod / 'f0'
-dest.write_text(OLD_DEST)
-
-blink = mod / 'blink'                        # euid-owned symlink -> outside module
-os.symlink(f'{secret}', blink)
-
-src = base / 'src'
-src.mkdir()
-(src / 'f0').write_text(PUSHED)
-
-conf = write_daemon_conf(
-    [('mod', {'path': str(mod), 'read only': 'no'})])
-url = start_test_daemon(conf, DAEMON_PORT)
-
-proc = subprocess.run(
-    rsync_argv('-a', '--delay-updates', '--partial-dir=/blink',
-               f'{src}/', f'{url}mod/'),
-    stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
-
-# The security oracle -- the outside-module victim must never be clobbered --
-# holds at every protocol and is checked unconditionally below.  The stronger
-# "daemon actively rejects the forced --partial-dir operand" behavior only
-# applies at protocol 30+; at protocol 29 the operand is handled differently and
-# the transfer completes normally (dest replaced, victim still untouched), so
-# gate just that secondary check.
-proto = forced_protocol()
-dest_after = dest.read_text() if dest.exists() else None
-if proto is None or proto >= 30:
-    if proc.returncode == 0 or dest_after != OLD_DEST:
-        test_fail(
-            "the daemon did not reject the forced --partial-dir staging path: "
-            f"rsync exited {proc.returncode} and {dest} is now {dest_after!r}. "
-            "If the operand were ignored, the upload would replace the destination "
-            f"with {PUSHED!r}.")
-else:
-    # At protocol 29 the operand is handled differently: the transfer must still
-    # complete normally (no escape) rather than fail for an unrelated reason, so
-    # require the known-good outcome instead of skipping the check entirely.
-    if proc.returncode != 0 or dest_after != PUSHED:
-        test_fail(
-            "protocol-29 --partial-dir run did not complete normally: rsync exited "
-            f"{proc.returncode} and {dest} is {dest_after!r} (expected a clean "
-            f"transfer replacing it with {PUSHED!r})")
-
-after = victim.read_text() if victim.exists() else None
-if after != SECRET:
-    test_fail(
-        "the daemon followed a --partial-dir symlink outside the module: "
-        f"{victim} is now {after!r} (a peer backed up over a file the module "
-        "does not serve).")
-print("daemon confines a peer-supplied --partial-dir symlink to the served set")
diff --git a/testsuite/operator-path-partial-dir-exclude-daemon_test.py b/testsuite/operator-path-partial-dir-exclude-daemon_test.py
deleted file mode 100644
index 43f0549a1..000000000
--- a/testsuite/operator-path-partial-dir-exclude-daemon_test.py
+++ /dev/null
@@ -1,63 +0,0 @@
-#!/usr/bin/env python3
-# A daemon must not let a peer-supplied --partial-dir reach the module's EXCLUDED
-# subtree via a symlink.  (Reported by Omar Elsayed.)
-#
-# The module excludes a subtree (exclude = /secret/).  An in-module symlink owned
-# by the daemon's euid (in Omar's PoC the daemon is root and the symlink is
-# root-owned) points at that excluded subtree.  A peer transfers with
-# --partial-dir pointing at the symlink: the received file is staged through the
-# symlink into the excluded subtree and the existing file there is overwritten /
-# renamed away -- destroying a file the module does not serve.
-#
-# secure_relative_open() confines beneath the module root but FOLLOWS in-module
-# symlinks, so it does not stop this; only resolving with the module exclude
-# filter applied refuses landing in the excluded subtree.  The symlink is euid-
-# owned (the followed case) and the test runs unprivileged -- the boundary under
-# test is the module exclude, not a uid boundary.
-
-import os
-import subprocess
-
-from rsyncfns import (
-    SCRATCHDIR, rmtree, rsync_argv, start_test_daemon, test_fail, write_daemon_conf,
-)
-
-DAEMON_PORT = 12903
-SECRET = "PROTECTED-IN-EXCLUDED-SUBTREE\n"
-
-base = SCRATCHDIR / 'partialdirdaemon'
-rmtree(base)
-base.mkdir()
-
-mod = base / 'mod'
-secret = mod / 'secret'                      # excluded subtree (exclude = /secret/)
-secret.mkdir(parents=True)
-victim = secret / 'f0'
-victim.write_text(SECRET)                    # a file the staging must not destroy
-
-blink = mod / 'blink'                        # euid-owned symlink -> excluded subtree
-os.symlink('secret', blink)
-
-src = base / 'src'
-src.mkdir()
-(src / 'f0').write_text("NEW-PUSHED-CONTENT\n")   # same basename as the protected file
-
-conf = write_daemon_conf(
-    [('mod', {'path': str(mod), 'read only': 'no', 'exclude': '/secret/'})])
-url = start_test_daemon(conf, DAEMON_PORT)
-
-# partial_dir_fname() builds <partial-dir>/f0, which the basis/staging path opens
-# (through the symlink) and then renames/unlinks.
-subprocess.run(
-    rsync_argv('-a', '--partial-dir=/blink', f'{src}/', f'{url}mod/'),
-    stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
-
-after = victim.read_text() if victim.exists() else None
-if after == SECRET:
-    test_fail(
-        "the daemon refused a --partial-dir symlink that stock rsync (3.2.7) "
-        f"follows: {victim} is unchanged ({after!r}).  The daemon exclude filter "
-        "is name-based ('blink' is not excluded), not a symlink boundary; it must "
-        "not block this (use `munge symlinks` to defend a writable module).")
-print("daemon exclude is name-based: a --partial-dir symlink whose name is not "
-      "excluded is followed (3.2.7-equivalent)")
diff --git a/testsuite/operator-path-partial-dir_test.py b/testsuite/operator-path-partial-dir_test.py
deleted file mode 100644
index d80c94fbf..000000000
--- a/testsuite/operator-path-partial-dir_test.py
+++ /dev/null
@@ -1,80 +0,0 @@
-#!/usr/bin/env python3
-# --partial-dir symlink policy (absolute, parent-component), create and reuse.
-#
-# With --delay-updates the receiver stages every file in the --partial-dir before
-# the final rename, so handle_partial_dir() must resolve (and, on first use,
-# create) the partial dir for each file.  An ABSOLUTE --partial-dir whose parent
-# component is a symlink was followed by the bare do_*_at() path syscalls (an
-# absolute path is operator-trusted), so a foreign-owned parent symlink
-# redirected the staging dir -- and the staged file -- out of the tree.
-#
-# The fix routes handle_partial_dir() through the operator-path ownership walk:
-# it refuses a foreign-owned parent symlink for both the do_mkdir_at() that
-# creates the partial dir and the do_lstat_at() that reuses an existing one, so
-# nothing is staged out of tree.  --insecure-links opts out locally.  Restricted
-# to {abs} x {parent}: a relative partial dir is already confined by
-# robust_rename()'s strict resolver, and the leaf form is replaced by a real
-# in-tree dir (the leaf is opened O_NOFOLLOW), so neither models this escape.
-#
-# escape is the partial dir itself: opt's parent component (opd) is the planted
-# symlink, so opt=<plant>/opd/sub resolves to <outside>/sub.  Two cells, because
-# the gate guards two distinct syscalls on that path:
-#   create -- the partial dir does not exist yet, so the receiver must mkdir it
-#             through the parent symlink; followed == the out-of-tree leaf appears.
-#   reuse  -- the partial dir already exists (the common case for a reserved
-#             absolute partial-dir reused across runs), so the receiver lstats and
-#             stages into it; followed == the staged file advances the leaf's mtime.
-
-import os
-import subprocess
-
-from rsyncfns import rsync_argv, run_symlink_matrix, plant_operator_symlink
-
-PINNED = 1000000000   # 2001-09-09; any later mtime means it was touched
-
-
-def _setup(ctx):
-    src = ctx.base / 'src'
-    dest = ctx.base / 'dest'
-    src.mkdir()
-    dest.mkdir()
-    (src / 'f0').write_text("PAYLOAD-DATA\n")
-    return plant_operator_symlink(ctx, dest)
-
-
-def _run(ctx, opt):
-    extra = ['--insecure-links'] if ctx.insecure else []
-    subprocess.run(
-        rsync_argv('-a', '--delay-updates', f'--partial-dir={opt}', *extra,
-                   'src/', 'dest/'),
-        cwd=str(ctx.base), stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
-
-
-def case_create(ctx):
-    # Leaf absent: the receiver must mkdir the partial dir through the parent
-    # symlink.  Followed == that mkdir landed out of tree (an absolute partial-dir
-    # is not rmdir'd at the end, so the leaf survives to be observed).
-    opt, escape = _setup(ctx)
-    _run(ctx, opt)
-    return escape.exists()
-
-
-def case_reuse(ctx):
-    # Leaf present: the receiver lstats the existing partial dir and stages into
-    # it.  Followed == the staged file advances the out-of-tree leaf's mtime.
-    opt, escape = _setup(ctx)
-    escape.mkdir(parents=True, exist_ok=True)
-    # Pinned epoch rather than a sub-second delta: on a 1-second-granularity
-    # filesystem such as HFS+ a same-second change is invisible, and the delta
-    # test then reports a followed symlink as refused.
-    os.utime(escape, (PINNED, PINNED))
-    pinned = escape.stat().st_mtime   # what the fs actually stored
-    _run(ctx, opt)
-    return escape.stat().st_mtime != pinned
-
-
-run_symlink_matrix('--partial-dir', case_create, paths=('abs',), wheres=('parent',),
-                   label='create')
-run_symlink_matrix('--partial-dir', case_reuse, paths=('abs',), wheres=('parent',),
-                   label='reuse')
-print("--partial-dir symlink policy (abs, parent; create + reuse): enforced")
diff --git a/testsuite/operator-path-temp-dir_test.py b/testsuite/operator-path-temp-dir_test.py
deleted file mode 100644
index de6ac9065..000000000
--- a/testsuite/operator-path-temp-dir_test.py
+++ /dev/null
@@ -1,43 +0,0 @@
-#!/usr/bin/env python3
-# --temp-dir symlink policy matrix.  A followed --temp-dir symlink makes the
-# receiver create its scratch temp file in an out-of-tree directory (the data is
-# written there, then renamed to dest).  The temp is renamed away, so we detect
-# the escape by the target directory's mtime advancing (a file was created in
-# it).  The ownership walk must follow only uid0/euid-owned symlinks; a relative
-# --temp-dir anchors at the cwd.  --insecure-links is the local opt-out.
-
-import os
-import subprocess
-
-from rsyncfns import rsync_argv, run_symlink_matrix, plant_operator_symlink
-
-PINNED = 1000000000   # 2001-09-09; any later mtime means it was touched
-
-
-def case(ctx):
-    src = ctx.base / 'src'
-    dest = ctx.base / 'dest'
-    src.mkdir()
-    dest.mkdir()
-    (src / 'f0').write_text("PAYLOAD-DATA\n")
-    # A relative --temp-dir is resolved by the receiver, whose cwd is the
-    # destination directory -- so a relative plant anchors at dest, not the cwd.
-    opt, escape = plant_operator_symlink(ctx, dest)
-    escape.mkdir(parents=True, exist_ok=True)            # --temp-dir must exist
-    # Pin the mtime far in the past rather than sampling it and looking for a
-    # sub-second delta: HFS+ (and any filesystem with 1-second timestamps)
-    # cannot show a change that happens within the same second, so a delta test
-    # reads "not followed" for a symlink that WAS followed.  Against a pinned
-    # epoch, any update at all is visible at any resolution.
-    os.utime(escape, (PINNED, PINNED))
-    pinned = escape.stat().st_mtime   # what the fs actually stored
-    extra = ['--insecure-links'] if ctx.insecure else []
-    subprocess.run(
-        rsync_argv('-a', f'--temp-dir={opt}', *extra, 'src/', 'dest/'),
-        cwd=str(ctx.base), stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
-    # Followed == the receiver created its temp in the out-of-tree dir.
-    return escape.stat().st_mtime != pinned
-
-
-run_symlink_matrix('--temp-dir', case)
-print("--temp-dir symlink policy matrix: enforced")
diff --git a/testsuite/operator-path-traversal-backup-dir-daemon_test.py b/testsuite/operator-path-traversal-backup-dir-daemon_test.py
deleted file mode 100644
index 8af672385..000000000
--- a/testsuite/operator-path-traversal-backup-dir-daemon_test.py
+++ /dev/null
@@ -1,67 +0,0 @@
-#!/usr/bin/env python3
-# Daemon --backup-dir ".." traversal into the module's excluded subtree, on a
-# `path = /` module.  (Reported by Omar Elsayed.)  Overwriting an existing dest
-# file triggers a backup of the OLD file; the peer-supplied --backup-dir climbs
-# via ".." back into the excluded subtree, so the backup must not land there.
-# Sandbox-anchored under SCRATCHDIR (Omar's original wrote to the real /secret),
-# so it runs unprivileged; the module still serves "/".
-import os
-import subprocess
-
-from rsyncfns import (
-    SCRATCHDIR, rmtree, rsync_argv, start_test_daemon, test_fail, write_daemon_conf, test_skipped,
-)
-
-DAEMON_PORT = 12964
-
-# rsyncd.conf's "exclude" is a SPACE-SEPARATED pattern list, so a path with a
-# space in it cannot be expressed there at all -- the pattern silently matches
-# nothing and the traversal below then "escapes" for a reason that has nothing
-# to do with the protection under test.  ("filter" is space-safe and does hold;
-# verified by running this same case with a filter rule.)  Skip rather than
-# report a bogus escape.
-if ' ' in str(SCRATCHDIR):
-    test_skipped("scratch path contains a space; rsyncd.conf 'exclude' is a "
-                 "space-separated list and cannot express such a pattern")
-SECRET = "PROTECTED-IN-EXCLUDED-SUBTREE\n"
-
-base = SCRATCHDIR / 'traversal-backup-dir-daemon'
-rmtree(base)
-base.mkdir()
-
-backup = base / 'backup-dir-daemon'
-backup.mkdir()
-
-secret = base / 'secret'                          # excluded subtree
-secret.mkdir()
-victim = secret / 'f0'
-victim.write_text(SECRET)                          # the backup must not clobber it
-
-dest = backup / 'dest'
-dest.mkdir()
-(dest / 'f0').write_text("OLD-DESTINATION-FILE-CONTENT\n")   # existing -> backed up
-src = backup / 'src'
-src.mkdir()
-sub = src / 'sub'
-sub.mkdir()
-(src / 'f0').write_text("NEW-PUSHED-CONTENT\n")     # differs -> overwrite
-
-base_rel = str(base).lstrip('/')
-conf = write_daemon_conf(
-    [('everything', {'path': '/', 'read only': 'no', 'exclude': str(secret) + '/'})])
-url = start_test_daemon(conf, DAEMON_PORT)
-
-subprocess.run(
-    rsync_argv(
-        '-a', '--backup',
-        f'--backup-dir=/{base_rel}/backup-dir-daemon/src/sub/../../../secret/',
-        f'{src}/',
-        f'{url}everything/{base_rel}/backup-dir-daemon/dest',
-    ),
-    stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
-
-after = victim.read_text() if victim.exists() else None
-if after != SECRET:
-    test_fail("escaped: a --backup-dir '..' traversal reached the excluded subtree "
-              f"({victim} is now {after!r})")
-print("did not escape")
diff --git a/testsuite/operator-path-traversal-dest-dir-daemon_test.py b/testsuite/operator-path-traversal-dest-dir-daemon_test.py
deleted file mode 100644
index 594d3cc94..000000000
--- a/testsuite/operator-path-traversal-dest-dir-daemon_test.py
+++ /dev/null
@@ -1,62 +0,0 @@
-#!/usr/bin/env python3
-# Daemon destination ".." traversal into the module's excluded subtree, on a
-# `path = /` module.  (Reported by Omar Elsayed.)  The peer pushes to a dest that
-# climbs out of an in-module dir back into the excluded subtree via "..".
-# Sandbox-anchored under SCRATCHDIR (Omar's original wrote to the real /secret),
-# so it runs unprivileged; the module still serves "/" so the traversal is real.
-import os
-import subprocess
-
-from rsyncfns import (
-    SCRATCHDIR, rmtree, rsync_argv, start_test_daemon, test_fail, write_daemon_conf, test_skipped,
-)
-
-DAEMON_PORT = 12963
-
-# rsyncd.conf's "exclude" is a SPACE-SEPARATED pattern list, so a path with a
-# space in it cannot be expressed there at all -- the pattern silently matches
-# nothing and the traversal below then "escapes" for a reason that has nothing
-# to do with the protection under test.  ("filter" is space-safe and does hold;
-# verified by running this same case with a filter rule.)  Skip rather than
-# report a bogus escape.
-if ' ' in str(SCRATCHDIR):
-    test_skipped("scratch path contains a space; rsyncd.conf 'exclude' is a "
-                 "space-separated list and cannot express such a pattern")
-SECRET = "PROTECTED-IN-EXCLUDED-SUBTREE\n"
-
-base = SCRATCHDIR / 'traversal-dest-dir-daemon'
-rmtree(base)
-base.mkdir()
-
-dest = base / 'dest-dir-daemon'
-dest.mkdir()
-
-secret = base / 'secret'                          # excluded subtree
-secret.mkdir()
-victim = secret / 'f0'
-victim.write_text(SECRET)
-
-src = dest / 'src'
-src.mkdir()
-sub = src / 'sub'
-sub.mkdir()
-(src / 'f0').write_text("NEW-PUSHED-CONTENT\n")
-
-base_rel = str(base).lstrip('/')
-conf = write_daemon_conf(
-    [('everything', {'path': '/', 'read only': 'no', 'exclude': str(secret) + '/'})])
-url = start_test_daemon(conf, DAEMON_PORT)
-
-subprocess.run(
-    rsync_argv(
-        '-a',
-        f'{src}/',
-        f'{url}everything/{base_rel}/dest-dir-daemon/src/sub/../../../secret/',
-    ),
-    stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
-
-after = victim.read_text() if victim.exists() else None
-if after != SECRET:
-    test_fail("escaped: a dest '..' traversal reached the excluded subtree "
-              f"({victim} is now {after!r})")
-print("did not escape")
diff --git a/testsuite/operator-path-traversal-partial-dir-daemon_test.py b/testsuite/operator-path-traversal-partial-dir-daemon_test.py
deleted file mode 100644
index ea50ed403..000000000
--- a/testsuite/operator-path-traversal-partial-dir-daemon_test.py
+++ /dev/null
@@ -1,67 +0,0 @@
-#!/usr/bin/env python3
-# Daemon --partial-dir ".." traversal into the module's excluded subtree, on a
-# `path = /` module.  (Reported by Omar Elsayed.)  The peer-supplied --partial-dir
-# climbs via ".." back into the excluded subtree; a staged partial must not land
-# there.  Sandbox-anchored under SCRATCHDIR (Omar's original wrote to the real
-# /secret), so it runs unprivileged; the module still serves "/".
-import os
-import subprocess
-
-from rsyncfns import (
-    SCRATCHDIR, rmtree, rsync_argv, start_test_daemon, test_fail, write_daemon_conf, test_skipped,
-)
-
-DAEMON_PORT = 12965
-
-# rsyncd.conf's "exclude" is a SPACE-SEPARATED pattern list, so a path with a
-# space in it cannot be expressed there at all -- the pattern silently matches
-# nothing and the traversal below then "escapes" for a reason that has nothing
-# to do with the protection under test.  ("filter" is space-safe and does hold;
-# verified by running this same case with a filter rule.)  Skip rather than
-# report a bogus escape.
-if ' ' in str(SCRATCHDIR):
-    test_skipped("scratch path contains a space; rsyncd.conf 'exclude' is a "
-                 "space-separated list and cannot express such a pattern")
-SECRET = "PROTECTED-IN-EXCLUDED-SUBTREE\n"
-
-base = SCRATCHDIR / 'traversal-partial-dir-daemon'
-rmtree(base)
-base.mkdir()
-
-partial = base / 'partial-dir-daemon'
-partial.mkdir()
-
-secret = base / 'secret'                          # excluded subtree
-secret.mkdir()
-victim = secret / 'f0'
-victim.write_text(SECRET)
-
-dest = partial / 'dest'
-dest.mkdir()
-src = partial / 'src'
-src.mkdir()
-sub = src / 'sub'
-sub.mkdir()
-(src / 'f0').write_text("NEW-PUSHED-CONTENT\n")
-
-base_rel = str(base).lstrip('/')
-conf = write_daemon_conf(
-    [('everything', {'path': '/', 'read only': 'no', 'exclude': str(secret) + '/'})])
-url = start_test_daemon(conf, DAEMON_PORT)
-
-subprocess.run(
-    rsync_argv(
-        '-a',
-        f'--partial-dir=/{base_rel}/partial-dir-daemon/src/sub/../../../secret/',
-        f'{src}/',
-        f'{url}everything/{base_rel}/partial-dir-daemon/dest',
-    ),
-    stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
-
-after = victim.read_text() if victim.exists() else None
-if after is None:
-    test_fail("escaped: a --partial-dir '..' traversal DELETED the excluded victim")
-if after != SECRET:
-    test_fail("escaped: a --partial-dir '..' traversal OVERWROTE the excluded victim "
-              f"({victim} is now {after!r})")
-print("did not escape")
diff --git a/testsuite/operator-path-write-batch_test.py b/testsuite/operator-path-write-batch_test.py
deleted file mode 100644
index 63702d1ef..000000000
--- a/testsuite/operator-path-write-batch_test.py
+++ /dev/null
@@ -1,27 +0,0 @@
-#!/usr/bin/env python3
-# --write-batch symlink policy matrix (batch.c open site, shared with
-# --read-batch / --only-write-batch).  Already refuses a foreign-owned symlink
-# but does not honor --insecure-links -- RED on the insecure cells.
-
-import subprocess
-
-from rsyncfns import rsync_argv, run_symlink_matrix, plant_operator_symlink
-
-
-def case(ctx):
-    src = ctx.base / 'src'
-    dest = ctx.base / 'dest'
-    src.mkdir()
-    dest.mkdir()
-    (src / 'f0').write_text("data\n")
-    opt, victim = plant_operator_symlink(ctx, ctx.base, kind='file')
-    extra = ['--insecure-links'] if ctx.insecure else []
-    subprocess.run(
-        rsync_argv('-a', f'--write-batch={opt}', *extra, 'src/', 'dest/'),
-        cwd=str(ctx.base), stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
-    # Followed == the batch file was written through the symlink, out-of-tree.
-    return victim.is_file()
-
-
-run_symlink_matrix('--write-batch', case)
-print("--write-batch symlink policy matrix: enforced")
diff --git a/testsuite/partial-dir-abs-delta_test.py b/testsuite/partial-dir-abs-delta_test.py
deleted file mode 100644
index 344396fe2..000000000
--- a/testsuite/partial-dir-abs-delta_test.py
+++ /dev/null
@@ -1,76 +0,0 @@
-#!/usr/bin/env python3
-# Regression guard: a --no-whole-file delta whose basis is reached via an
-# ABSOLUTE --partial-dir must reconstruct correctly, not spuriously fail
-# verification and strand the data in the partial-dir.
-#
-# This locks in the fix for the "failed verification" family reported as #724
-# (and the FreeBSD lseek variant #725): an interrupted/delta transfer resumed
-# against an absolute --partial-dir looped on exit code 23
-# ("failed verification -- update put into partial-dir"), leaving the correct
-# data in the partial-dir and never populating the destination.
-#
-# Root cause (same as #897): the receiver opened the basis with
-# secure_relative_open(NULL, fnamecmp, ...), whose front door rejects an
-# ABSOLUTE relpath with EINVAL. An absolute --partial-dir makes fnamecmp
-# absolute, so the basis fd was -1, no basis was mapped, and the matched-block
-# sum_update() (guarded by `if (mapbuf)`) was skipped -- so the whole-file
-# verification checksum was computed over the literal data only and always
-# mismatched, even though the in-place bytes were correct. Fixed by
-# secure_basis_open() (commit 31fbb17d), which treats an operator-trusted
-# absolute basis as (trusted dir + O_NOFOLLOW leaf).
-#
-# Deterministic (the partial-dir file IS the delta basis, so matched blocks are
-# guaranteed) and portable: no daemon, no ZFS, any uid. Unlike the flaky
-# --copy-dest/--backup-dir manifestations of the same bug, this reproduces every
-# run. PASS on the fixed base; on a broken rsync (3.4.0..3.4.3) it FAILS with
-# rc=23 + "failed verification" and the destination file missing/wrong.
-
-import subprocess
-
-from rsyncfns import (
-    SCRATCHDIR, make_data_file, makepath, rmtree, rsync_argv, test_fail,
-)
-
-src = SCRATCHDIR / 'pdsrc'
-dst = SCRATCHDIR / 'pddst'
-partial = SCRATCHDIR / 'pdpartial'      # an ABSOLUTE --partial-dir
-for d in (src, dst, partial):
-    rmtree(d)
-makepath(src, dst, partial)
-
-# The file to transfer, and a near-copy in the partial-dir to serve as the
-# delta basis (a few changed bytes mid-file => a real delta with matched blocks).
-make_data_file(src / 'big.dat', 1200 * 1024)
-import shutil
-shutil.copy2(src / 'big.dat', partial / 'big.dat')
-with open(partial / 'big.dat', 'r+b') as fh:
-    fh.seek(600000)
-    fh.write(b'PARTIALDIR_BASIS_DELTA')
-
-# Absolute --partial-dir => the receiver's basis path (fnamecmp) is absolute.
-proc = subprocess.run(
-    rsync_argv('-a', '--no-whole-file', '--partial',
-               f'--partial-dir={partial}', f'{src}/', f'{dst}/'),
-    stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True)
-out = proc.stdout or ''
-print(out)
-
-if 'failed verification' in out or 'lseek returned' in out:
-    test_fail(
-        "#724/#725: absolute --partial-dir delta resume spuriously failed "
-        "verification (the receiver opened the absolute basis via "
-        "secure_relative_open(NULL, abs) -> EINVAL -> no basis mapped -> the "
-        "matched blocks were dropped from the verify checksum). Expected the "
-        "secure_basis_open() fix (31fbb17d) to reconstruct correctly:\n" + out)
-
-got = dst / 'big.dat'
-if proc.returncode != 0:
-    test_fail(f"absolute --partial-dir delta transfer failed (rc="
-              f"{proc.returncode}); the data was likely stranded in the "
-              f"partial-dir:\n{out}")
-if not got.is_file():
-    test_fail(f"destination file {got} was not created -- data stranded in the "
-              f"absolute --partial-dir (the #724/#725 symptom)")
-if not __import__('filecmp').cmp(str(src / 'big.dat'), str(got), shallow=False):
-    test_fail("destination content differs from source after an absolute "
-              "--partial-dir delta resume")
diff --git a/testsuite/password-file-symlink_test.py b/testsuite/password-file-symlink_test.py
deleted file mode 100644
index 596035f33..000000000
--- a/testsuite/password-file-symlink_test.py
+++ /dev/null
@@ -1,155 +0,0 @@
-#!/usr/bin/env python3
-# --password-file=PATH must not follow planted symlinks at attacker-
-# controlled path components.
-#
-# Threat: a privileged client runs
-# rsync with --password-file=PATH where PATH lives in an attacker-
-# influenceable directory. A planted symlink redirects the read to an
-# arbitrary file (e.g. /etc/shadow); rsync reads the symlinked content and
-# sends it as the daemon auth response. A malicious daemon (or simply
-# error/timing channels) observes the leaked content.
-#
-# The leak signal in this test is direct: the daemon is configured with a
-# known correct password, and the planted symlink points at a victim file
-# whose content IS that correct password. With the vulnerability rsync
-# reads the victim, sends the correct password, and the daemon accepts ->
-# transfer SUCCEEDS (returncode 0) -> LEAK observed. With the fix the
-# planted symlink is refused, rsync sends no password, and auth fails ->
-# transfer fails (returncode != 0).
-#
-# Both leaf and parent-component variants exercised (the parent case is
-# the /tmp/somedir/ class that plain O_NOFOLLOW does NOT defend).
-#
-# Requires root (to lchown the planted symlink to a non-self uid -- the
-# attacker simulation); skips otherwise.
-
-import os
-import pwd
-import subprocess
-
-from rsyncfns import (
-    FROMDIR, SCRATCHDIR, make_tree, makepath, rmtree, rsync_argv,
-    start_test_daemon, test_fail, test_skipped, write_daemon_conf,
-)
-
-DAEMON_PORT = 12902
-USER = 'tuser'
-CORRECT_PASSWORD = 'correctpass'
-
-
-if os.geteuid() != 0:
-    test_skipped("requires root to plant a symlink owned by a non-self uid "
-                 "(the attacker simulation)")
-
-NOBODY_UID = None
-for name in ('nobody', 'nfsnobody', 'daemon'):
-    try:
-        u = pwd.getpwnam(name).pw_uid
-        if u != 0 and u != os.geteuid():
-            NOBODY_UID = u
-            break
-    except KeyError:
-        continue
-if NOBODY_UID is None:
-    test_skipped("no untrusted-uid user available for cross-uid plant")
-
-# Match daemon-auth_test.py: prevent rsync's interactive getpass() fallback
-# if no password is read.
-os.environ['RSYNC_PASSWORD'] = 'env-fallback-wrong'
-
-# Daemon setup
-src = FROMDIR
-rmtree(src)
-make_tree(src, depth=1)
-
-authdir = SCRATCHDIR / 'authdest'
-secrets = SCRATCHDIR / 'rsyncd.secrets'
-secrets.write_text(f'{USER}:{CORRECT_PASSWORD}\n')
-secrets.chmod(0o600)
-
-conf = write_daemon_conf([
-    ('auth', {'path': authdir, 'read only': 'no',
-              'auth users': USER, 'secrets file': secrets}),
-])
-url = start_test_daemon(conf, DAEMON_PORT)
-userurl = url.replace('rsync://', f'rsync://{USER}@', 1)
-
-# Victim file the attacker wants rsync to read. Owned by us, mode 0600.
-# Crucially: content == the correct daemon password, so a SUCCESSFUL
-# transfer is the leak signal.
-victim = SCRATCHDIR / 'victim_password'
-victim.write_text(CORRECT_PASSWORD + '\n')
-victim.chmod(0o600)
-
-
-def push_with_pwfile(pwfile_path):
-    """Run an rsync push via the daemon with --password-file=pwfile_path."""
-    rmtree(authdir)
-    makepath(authdir)
-    return subprocess.run(
-        rsync_argv('-a', f'--password-file={pwfile_path}',
-                   f'{src}/', f'{userurl}auth/'),
-        stdout=subprocess.DEVNULL, stderr=subprocess.PIPE, text=True)
-
-
-# ---------------------------------------------------------------------------
-# Sanity: a real password file with the correct password authenticates.
-# Demonstrates the test machinery: success == leak when we later use a planted
-# symlink that resolves to this same content.
-# ---------------------------------------------------------------------------
-real_pwfile = SCRATCHDIR / 'real_pwfile'
-real_pwfile.write_text(CORRECT_PASSWORD + '\n')
-real_pwfile.chmod(0o600)
-
-sanity = push_with_pwfile(real_pwfile)
-if sanity.returncode != 0:
-    test_fail(
-        "sanity check failed: a non-symlinked password file with the correct "
-        f"password could not authenticate. stderr: {sanity.stderr!r}")
-
-
-# ---------------------------------------------------------------------------
-# LEAF plant.
-# ---------------------------------------------------------------------------
-plants = SCRATCHDIR / 'plants'
-rmtree(plants); plants.mkdir()
-leaf_plant = plants / 'pwfile_leaf'
-os.symlink(victim, leaf_plant)
-os.lchown(leaf_plant, NOBODY_UID, NOBODY_UID)
-
-leaf = push_with_pwfile(leaf_plant)
-if leaf.returncode == 0:
-    test_fail(
-        f"--password-file followed a planted LEAF symlink (owned by uid "
-        f"{NOBODY_UID}): rsync read {victim} via the symlink and sent its "
-        f"content as the auth password; the daemon accepted -> transfer "
-        f"succeeded. This is a content-disclosure primitive (the leaked "
-        f"bytes are sent on the wire). Fix: refuse planted symlinks at "
-        f"--password-file.")
-
-
-# ---------------------------------------------------------------------------
-# PARENT-component plant.
-# ---------------------------------------------------------------------------
-real_target = plants / 'parent_real_target'
-real_target.mkdir()
-(real_target / 'victim_in_target').write_text(CORRECT_PASSWORD + '\n')
-os.chmod(real_target / 'victim_in_target', 0o600)
-
-parent_plant = plants / 'parent_link'
-os.symlink(real_target, parent_plant)
-os.lchown(parent_plant, NOBODY_UID, NOBODY_UID)
-
-# --password-file=$parent_plant/victim_in_target. Parent is the symlink; the
-# kernel resolves the parent and reads victim_in_target inside. Plain O_NOFOLLOW
-# does NOT defend (leaf-only); only the path walk with parent-symlink
-# ownership checks defends here.
-parent = push_with_pwfile(parent_plant / 'victim_in_target')
-if parent.returncode == 0:
-    test_fail(
-        f"--password-file followed a planted PARENT-component symlink (owned "
-        f"by uid {NOBODY_UID}): {parent_plant} -> {real_target} was traversed "
-        f"and rsync read victim_in_target via the planted parent; the daemon "
-        f"accepted the leaked password -> transfer succeeded. This is the "
-        "/tmp/somedir/-class parent-flip case. Fix: per-component path walk "
-        "refusing parent symlinks owned by untrusted uids.")
diff --git a/testsuite/perftest.py b/testsuite/perftest.py
deleted file mode 100755
index d5ac6a2b5..000000000
--- a/testsuite/perftest.py
+++ /dev/null
@@ -1,506 +0,0 @@
-#!/usr/bin/env python3
-"""Compare the transfer performance of two rsync binaries (local <-> local).
-
-This is a standalone dev tool (run it directly, not via runtests.py) for
-spotting performance regressions between rsync releases.  Given two rsync
-binaries it builds one test tree, then runs the two binaries ALTERNATELY for a
-number of loops, timing each transfer, and reports the mean and standard
-deviation of the transfer time for each binary.
-
-Two transfers are timed each loop (see --mode):
-  * full  -- a fresh copy into an emptied destination (end-to-end read+write).
-  * noop  -- a re-run against an already-synced destination (rsync's own
-             scan / file-list / stat overhead, where many regressions hide).
-
-The first measured run of each binary is dropped (see --warmup) because it
-cold-loads the source into the page cache and is an outlier.
-
-The test tree's shape (heavy-tailed file sizes, a directory spine, symlinks,
-hard links and a spread of permission modes) follows the gentestdata.py
-generator; it is deterministic for a given --seed.
-
-Examples:
-    # Quick smoke run, same binary twice (means should match, no regression).
-    ./perftest.py --files 200 --total-size 5M -n 3 ./rsync ./rsync
-
-    # Compare a released binary against a fresh build over 8 loops.
-    ./perftest.py -n 8 ../old_versions/rsync_3.4.0 ./rsync
-
-    # Heavier tree, no-op (scan-overhead) timing only.
-    ./perftest.py --files 50000 --total-size 2G --mode noop OLD/rsync NEW/rsync
-"""
-
-import argparse
-import dataclasses
-import math
-import os
-import random
-import shlex
-import shutil
-import statistics
-import struct
-import subprocess
-import sys
-import tempfile
-import time
-
-# ---------------------------------------------------------------------------
-# Test-tree generation (ported from gentestdata.py, kept self-contained).
-# ---------------------------------------------------------------------------
-
-# Marker file at the tree root; safe_rmtree only deletes a tree carrying it.
-MARKER = ".perftest"
-
-# Permission modes drawn at random for regular files (execs + read-only).
-FILE_MODES = [0o644, 0o644, 0o600, 0o640, 0o664, 0o444, 0o755, 0o750, 0o700]
-# Directory modes; owner always keeps r-x so the tree stays traversable.
-DIR_MODES = [0o755, 0o755, 0o775, 0o750, 0o700, 0o555]
-
-SIZE_SIGMA = 1.8          # sigma of the underlying lognormal size distribution
-BASE_BUF_SIZE = 1 << 20   # 1 MiB shared random buffer for file content
-
-
-def parse_size(s):
-    """Parse a human size like 500M, 1.5GiB, 200KB, or a bare byte count."""
-    s = s.strip()
-    units = {
-        "": 1, "B": 1,
-        "K": 1024, "KIB": 1024, "KB": 1000,
-        "M": 1024**2, "MIB": 1024**2, "MB": 1000**2,
-        "G": 1024**3, "GIB": 1024**3, "GB": 1000**3,
-        "T": 1024**4, "TIB": 1024**4, "TB": 1000**4,
-    }
-    num, suffix = s, ""
-    while num and not (num[-1].isdigit() or num[-1] == "."):
-        suffix = num[-1] + suffix
-        num = num[:-1]
-    suffix = suffix.upper()
-    if suffix not in units:
-        raise argparse.ArgumentTypeError(f"unknown size suffix in {s!r}")
-    try:
-        value = float(num)
-    except ValueError:
-        raise argparse.ArgumentTypeError(f"invalid size {s!r}")
-    return int(value * units[suffix])
-
-
-def human(n):
-    """Format a byte count for the summary output."""
-    for unit in ("B", "KiB", "MiB", "GiB", "TiB"):
-        if abs(n) < 1024 or unit == "TiB":
-            return f"{n:.1f}{unit}" if unit != "B" else f"{n}B"
-        n /= 1024
-
-
-def gen_sizes(n, total, rng):
-    """Return n heavy-tailed file sizes (bytes) summing to exactly `total`."""
-    if n == 0:
-        return []
-    weights = [math.exp(rng.gauss(0.0, SIZE_SIGMA)) for _ in range(n)]
-    wsum = sum(weights)
-    sizes = [int(w / wsum * total) for w in weights]
-    drift = total - sum(sizes)
-    if drift and sizes:
-        i = max(range(n), key=lambda k: sizes[k])
-        sizes[i] += drift
-    return sizes
-
-
-def build_dirs(root, num_dirs, max_depth, rng):
-    """Create `num_dirs` dirs under root, up to `max_depth` deep; return them."""
-    os.makedirs(root)
-    dirs = [root]
-    depth_of = {root: 0}
-    candidates = [root] if max_depth > 0 else []
-    counter = 0
-
-    cur = root
-    for d in range(1, max_depth + 1):
-        cur = os.path.join(cur, f"d{d}")
-        os.mkdir(cur)
-        dirs.append(cur)
-        depth_of[cur] = d
-        if d < max_depth:
-            candidates.append(cur)
-
-    while len(dirs) < num_dirs and candidates:
-        parent = rng.choice(candidates)
-        counter += 1
-        child = os.path.join(parent, f"dir{counter}")
-        os.mkdir(child)
-        d = depth_of[parent] + 1
-        dirs.append(child)
-        depth_of[child] = d
-        if d < max_depth:
-            candidates.append(child)
-
-    return dirs
-
-
-def write_file(path, size, index, base):
-    """Write a regular file of exactly `size` bytes (index/size in first 16)."""
-    with open(path, "wb") as f:
-        remaining = size
-        if remaining >= 16:
-            f.write(struct.pack("<QQ", index, size))
-            remaining -= 16
-        blen = len(base)
-        while remaining > 0:
-            chunk = base if remaining >= blen else base[:remaining]
-            f.write(chunk)
-            remaining -= len(chunk)
-
-
-def rel_symlink(target, link_path):
-    """Create a relative symlink at link_path pointing at target."""
-    rel = os.path.relpath(target, os.path.dirname(link_path))
-    os.symlink(rel, link_path)
-
-
-def safe_rmtree(path):
-    """Remove a tree, even one containing read-only directories."""
-    for dirpath, _dirnames, _filenames in os.walk(path):
-        try:
-            os.chmod(dirpath, 0o700)
-        except OSError:
-            pass
-    shutil.rmtree(path)
-
-
-def generate_tree(root, args):
-    """Build the deterministic source tree at `root`; return a summary string."""
-    n = args.files
-    num_dirs = args.dirs if args.dirs is not None else max(args.depth, n // 20, 1)
-    n_sym = args.symlinks if args.symlinks is not None else (max(1, n // 20) if n else 0)
-    n_hard = args.hardlinks if args.hardlinks is not None else (max(1, n // 20) if n else 0)
-
-    rng = random.Random(args.seed)
-    base = rng.randbytes(BASE_BUF_SIZE)
-
-    dirs = build_dirs(root, num_dirs, args.depth, rng)
-    with open(os.path.join(root, MARKER), "w") as f:
-        f.write(f"generated by perftest.py seed={args.seed} files={n} "
-                f"total={args.total_size}\n")
-
-    sizes = gen_sizes(n, args.total_size, rng)
-    files = []
-    for i in range(n):
-        path = os.path.join(rng.choice(dirs), f"file{i}.dat")
-        write_file(path, sizes[i], i, base)
-        files.append(path)
-
-    hard_made = 0
-    if files:
-        for i in range(n_hard):
-            tgt = rng.choice(files)
-            link = os.path.join(rng.choice(dirs), f"hlink{i}_{os.path.basename(tgt)}")
-            try:
-                os.link(tgt, link)
-                hard_made += 1
-            except OSError:
-                pass
-
-    sym_made = 0
-    for i in range(n_sym):
-        link = os.path.join(rng.choice(dirs), f"sym{i}")
-        roll = rng.random()
-        try:
-            if roll < 0.15 or not files:
-                os.symlink(f"../broken-target-{i}", link)
-            elif roll < 0.30:
-                rel_symlink(rng.choice(dirs), link)
-            else:
-                rel_symlink(rng.choice(files), link)
-            sym_made += 1
-        except OSError:
-            pass
-
-    for path in files:
-        os.chmod(path, rng.choice(FILE_MODES))
-    for path in sorted((d for d in dirs if d != root),
-                       key=lambda p: p.count(os.sep), reverse=True):
-        os.chmod(path, rng.choice(DIR_MODES))
-
-    return (f"files={n} dirs={len(dirs)} symlinks={sym_made} hardlinks={hard_made} "
-            f"total={human(sum(sizes))} biggest={human(max(sizes) if sizes else 0)} "
-            f"seed={args.seed}")
-
-
-# ---------------------------------------------------------------------------
-# Benchmark.
-# ---------------------------------------------------------------------------
-
-@dataclasses.dataclass
-class Binary:
-    label: str          # "A" / "B"
-    path: str           # absolute path to the rsync binary
-    version: str        # first line of `rsync --version`
-
-
-def rsync_version(path):
-    """Return the first line of `<rsync> --version`, or a placeholder."""
-    try:
-        r = subprocess.run([path, "--version"], capture_output=True, text=True, timeout=15)
-        line = (r.stdout or r.stderr or "").splitlines()
-        return line[0].strip() if line else "(no --version output)"
-    except (OSError, subprocess.TimeoutExpired) as e:
-        return f"(version unavailable: {e})"
-
-
-def drop_caches():
-    """Best-effort: flush dirty pages and drop the page/dentry/inode caches.
-
-    Needs root to write /proc/sys/vm/drop_caches; returns True on success.
-    """
-    subprocess.run(["sync"], check=False)
-    try:
-        with open("/proc/sys/vm/drop_caches", "w") as f:
-            f.write("3\n")
-        return True
-    except OSError:
-        return False
-
-
-def time_transfer(binary, rsync_args, src, dest, timeout):
-    """Run one `rsync <args> src/ dest/` and return its wall-clock seconds.
-
-    Raises RuntimeError if rsync exits non-zero (a failed transfer can't be
-    timed meaningfully).
-    """
-    argv = [binary.path, *rsync_args, src + "/", dest + "/"]
-    t0 = time.monotonic()
-    r = subprocess.run(argv, capture_output=True, text=True, timeout=timeout)
-    elapsed = time.monotonic() - t0
-    if r.returncode != 0:
-        raise RuntimeError(
-            f"{binary.label} ({binary.path}) rsync exited {r.returncode}:\n"
-            f"  cmd: {shlex.join(argv)}\n"
-            f"  {(r.stderr or r.stdout).strip()}")
-    return elapsed
-
-
-def run_benchmark(binaries, args, src, dest_full, dest_noop):
-    """Run the alternating loops; return {label: {mode: [all samples]}}."""
-    do_full = args.mode in ("both", "full")
-    do_noop = args.mode in ("both", "noop")
-
-    # Pre-populate the shared no-op destination so every timed no-op run finds
-    # nothing to do.  Use binary A; its content is identical for B.
-    if do_noop:
-        time_transfer(binaries[0], args.rsync_args, src, dest_noop, args.timeout)
-
-    samples = {b.label: {m: [] for m in ("full", "noop")} for b in binaries}
-    total_loops = args.warmup + args.runs
-
-    for loop in range(total_loops):
-        tag = "warmup" if loop < args.warmup else f"run {loop - args.warmup + 1}/{args.runs}"
-        # Alternate which binary goes first to cancel first-mover/thermal drift.
-        order = binaries if loop % 2 == 0 else list(reversed(binaries))
-        for b in order:
-            if do_full:
-                safe_rmtree(dest_full) if os.path.exists(dest_full) else None
-                os.mkdir(dest_full)
-                if args.drop_caches:
-                    drop_caches()
-                t = time_transfer(b, args.rsync_args, src, dest_full, args.timeout)
-                samples[b.label]["full"].append(t)
-                _progress(b, "full", tag, t)
-            if do_noop:
-                if args.drop_caches:
-                    drop_caches()
-                t = time_transfer(b, args.rsync_args, src, dest_noop, args.timeout)
-                samples[b.label]["noop"].append(t)
-                _progress(b, "noop", tag, t)
-    return samples
-
-
-def _progress(binary, mode, tag, t):
-    excl = " (warmup, excluded)" if tag == "warmup" else ""
-    print(f"  [{tag:>10}] {binary.label} {mode:<4} {t:8.3f}s{excl}")
-
-
-# ---------------------------------------------------------------------------
-# Reporting.
-# ---------------------------------------------------------------------------
-
-def _stats(times):
-    """(n, mean, stddev, min, median) over the timing samples."""
-    n = len(times)
-    if n == 0:
-        return (0, 0.0, 0.0, 0.0, 0.0)
-    return (n, statistics.mean(times),
-            statistics.stdev(times) if n > 1 else 0.0,
-            min(times), statistics.median(times))
-
-
-def report(binaries, samples, args):
-    """Print the per-binary tables and the A-vs-B comparison; return exit code."""
-    print("\n" + "=" * 72)
-    for b in binaries:
-        print(f"{b.label}: {b.path}\n   {b.version}")
-    print(f"rsync args: {' '.join(args.rsync_args)}   "
-          f"(note: a full copy is not fsync'd unless you add --fsync)")
-    print("=" * 72)
-
-    modes = [m for m in ("full", "noop") if any(samples[b.label][m] for b in binaries)]
-    hdr = f"{'binary':<7}{'mode':<6}{'runs':>5}{'mean':>11}{'stddev':>11}{'min':>11}{'median':>11}"
-
-    for mode in modes:
-        print(f"\n{hdr}\n{'-' * len(hdr)}")
-        st = {}
-        for b in binaries:
-            # Drop the leading warm-up samples before computing statistics.
-            kept = samples[b.label][mode][args.warmup:]
-            st[b.label] = _stats(kept)
-            n, mean, sd, mn, md = st[b.label]
-            print(f"{b.label:<7}{mode:<6}{n:>5}{mean:>10.3f}s{sd:>10.3f}s"
-                  f"{mn:>10.3f}s{md:>10.3f}s")
-
-        a, c = binaries[0].label, binaries[1].label
-        (na, ma, sda, *_), (nc, mc, sdc, *_) = st[a], st[c]
-        if na and nc and ma > 0:
-            delta = mc - ma
-            pct = delta / ma * 100.0
-            noise = max(sda, sdc)
-            # Flag only when B is slower beyond the run-to-run noise and a small
-            # relative threshold, so jitter doesn't cry "regression".
-            if delta > noise and pct > args.threshold:
-                verdict = f"REGRESSION (slower): {c} is {pct:+.1f}% vs {a}"
-            elif delta < -noise and -pct > args.threshold:
-                verdict = f"faster: {c} is {pct:+.1f}% vs {a}"
-            else:
-                verdict = f"no significant change: {pct:+.1f}% (within noise)"
-            print(f"  {mode}: {a} {ma:.3f}s  vs  {c} {mc:.3f}s  ->  {verdict}")
-
-    if args.csv:
-        _write_csv(args.csv, binaries, samples)
-        print(f"\nraw per-run timings written to {args.csv}")
-    return 0
-
-
-def _write_csv(path, binaries, samples):
-    with open(path, "w") as f:
-        f.write("binary,path,mode,run,warmup,seconds\n")
-        for b in binaries:
-            for mode in ("full", "noop"):
-                for i, t in enumerate(samples[b.label][mode]):
-                    f.write(f"{b.label},{b.path},{mode},{i},{int(i == 0)},{t:.6f}\n")
-
-
-# ---------------------------------------------------------------------------
-# Main.
-# ---------------------------------------------------------------------------
-
-def main():
-    ap = argparse.ArgumentParser(
-        description=__doc__, formatter_class=argparse.RawDescriptionHelpFormatter)
-    ap.add_argument("rsync_a", help="path to the first rsync binary (labelled A)")
-    ap.add_argument("rsync_b", help="path to the second rsync binary (labelled B)")
-    ap.add_argument("-n", "--runs", type=int, default=10,
-                    help="measured loops per binary (default: 10)")
-    ap.add_argument("--warmup", type=int, default=1,
-                    help="leading runs per binary dropped from the stats to "
-                         "reduce cache impact (default: 1)")
-    ap.add_argument("--mode", choices=("both", "full", "noop"), default="both",
-                    help="full=clean-dest copy, noop=re-sync scan overhead, "
-                         "both (default)")
-    ap.add_argument("--rsync-args", default="-aH",
-                    help="rsync flags for the timed transfer (default: -aH)")
-    ap.add_argument("--threshold", type=float, default=2.0,
-                    help="percent slowdown above run-to-run noise before a "
-                         "regression is flagged (default: 2.0)")
-    # Tree-generation knobs (mirror gentestdata.py).
-    ap.add_argument("--src", default=None,
-                    help="benchmark this existing tree instead of generating one")
-    ap.add_argument("-f", "--files", type=int, default=10000,
-                    help="number of regular files to generate (default: 10000)")
-    ap.add_argument("-s", "--total-size", type=parse_size, default="500M",
-                    help="total size of all regular files (default: 500M)")
-    ap.add_argument("-d", "--depth", type=int, default=10,
-                    help="maximum directory tree depth (default: 10)")
-    ap.add_argument("--dirs", type=int, default=None,
-                    help="number of directories (default: max(depth, files/20))")
-    ap.add_argument("--symlinks", type=int, default=None,
-                    help="number of symlinks (default: files/20)")
-    ap.add_argument("--hardlinks", type=int, default=None,
-                    help="number of hard links (default: files/20)")
-    ap.add_argument("--seed", type=int, default=1,
-                    help="PRNG seed for a reproducible tree (default: 1)")
-    ap.add_argument("--workdir", default=None,
-                    help="scratch root for src/dest dirs (default: a tempdir)")
-    ap.add_argument("--drop-caches", action="store_true",
-                    help="sync + drop page/dentry/inode caches before each timed "
-                         "run (needs root; cold-cache measurement)")
-    ap.add_argument("--timeout", type=float, default=3600.0,
-                    help="seconds before a single rsync run is abandoned "
-                         "(default: 3600)")
-    ap.add_argument("--keep", action="store_true",
-                    help="keep the scratch tree on exit (default: remove it)")
-    ap.add_argument("--csv", default=None,
-                    help="write raw per-run timings to this CSV file")
-    args = ap.parse_args()
-
-    if args.runs < 2:
-        ap.error("--runs must be >= 2 (need >=2 samples for a stddev)")
-    args.rsync_args = shlex.split(args.rsync_args)
-
-    binaries = []
-    for label, p in (("A", args.rsync_a), ("B", args.rsync_b)):
-        path = os.path.abspath(p)
-        if not (os.path.isfile(path) and os.access(path, os.X_OK)):
-            ap.error(f"rsync {label} is not an executable file: {p}")
-        binaries.append(Binary(label, path, rsync_version(path)))
-
-    workdir = tempfile.mkdtemp(prefix="rsync-perftest-",
-                               dir=args.workdir) if not args.keep or not args.workdir \
-        else os.path.join(args.workdir, "rsync-perftest")
-    os.makedirs(workdir, exist_ok=True)
-    dest_full = os.path.join(workdir, "dest_full")
-    dest_noop = os.path.join(workdir, "dest_noop")
-    os.makedirs(dest_noop, exist_ok=True)
-
-    generated = None
-    if args.src:
-        src = os.path.abspath(args.src)
-        if not os.path.isdir(src):
-            ap.error(f"--src is not a directory: {args.src}")
-        print(f"using existing source tree {src}")
-    else:
-        src = os.path.join(workdir, "src")
-        print(f"generating source tree in {src} ...")
-        t0 = time.monotonic()
-        summary = generate_tree(src, args)
-        generated = src
-        print(f"  {summary}  ({time.monotonic() - t0:.1f}s)")
-
-    print(f"\nbenchmarking: warmup={args.warmup} runs={args.runs} mode={args.mode} "
-          f"drop_caches={args.drop_caches}\n")
-    rc = 1
-    try:
-        samples = run_benchmark(binaries, args, src, dest_full, dest_noop)
-        rc = report(binaries, samples, args)
-    except RuntimeError as e:
-        print(f"\nbenchmark aborted: {e}", file=sys.stderr)
-        rc = 2
-    except KeyboardInterrupt:
-        print("\ninterrupted", file=sys.stderr)
-        rc = 130
-    finally:
-        if args.keep:
-            print(f"\nkept scratch tree: {workdir}")
-        else:
-            for d in (dest_full, dest_noop, generated):
-                if d and os.path.exists(d):
-                    safe_rmtree(d)
-            # Remove the workdir itself if it is now empty (i.e. we made it).
-            try:
-                os.rmdir(workdir)
-            except OSError:
-                pass
-    sys.exit(rc)
-
-
-if __name__ == "__main__":
-    main()
-
-# vim: sw=4 et ft=python
diff --git a/testsuite/preallocate_test.py b/testsuite/preallocate_test.py
deleted file mode 100644
index bba87c7c0..000000000
--- a/testsuite/preallocate_test.py
+++ /dev/null
@@ -1,184 +0,0 @@
-#!/usr/bin/env python3
-"""Coverage of the file-allocation syscalls in syscall.c at depth:
-do_fallocate (--preallocate) and do_punch_hole (sparse writes).
-
-These are receiver-side file operations the resolver restructure also touches.
-Content must survive everywhere; in addition, where the filesystem stores holes,
---preallocate --sparse must end up sparse (st_blocks below the apparent size).
-That is a regression guard: do_fallocate() must report the preallocated length
-so write_sparse() punches holes in the reserved extent instead of lseek'ing over
-it -- a stray 0 there silently left the file fully allocated.
-"""
-
-import os
-
-from rsyncfns import (
-    FROMDIR, TODIR,
-    assert_same, make_data_file, makepath, rmtree, run_rsync, test_fail,
-    test_skipped,
-)
-
-src = FROMDIR
-deep = os.path.join('d1', 'd2', 'd3', 'f')
-
-
-def allocated(path):
-    return os.stat(path).st_blocks * 512
-
-# --preallocate needs fallocate/posix_fallocate, and do_punch_hole needs
-# FALLOC_FL_PUNCH_HOLE -- both Linux (and Cygwin) features. macOS, the *BSDs and
-# Solaris build without preallocation and reject the option outright ("prealloc-
-# ation is not supported"), so probe once with a trivial transfer and skip the
-# whole test where it's unavailable.
-rmtree(src)
-rmtree(TODIR)
-makepath(src)
-(src / 'probe').write_text("x\n")
-if run_rsync('-a', '--preallocate', f'{src}/', f'{TODIR}/',
-             check=False, capture_output=True).returncode != 0:
-    test_skipped("--preallocate not supported on this platform")
-
-def punch_frees(offset, length, size):
-    """True where punching [offset, offset+length) out of a `size`-byte file
-    really deallocates blocks -- the mechanism do_punch_hole uses for --sparse.
-
-    Two separate things can leave st_blocks untouched, so each assertion below
-    probes the exact shape it relies on.  A filesystem may report seek-based
-    sparseness yet still keep every block on a punch (e.g. where rsync's punch
-    falls back to writing zeros), which a whole-file probe catches.  And a punch
-    only frees storage in whole allocation units, which are not always 4 KiB: a
-    tmpfs frees whole pages, 16 KiB on loongarch/loong64 (and 64 KiB on a
-    64k-page ppc64el or arm64 kernel), and a filesystem may be formatted with a
-    block size above the page size.  An interior run spanning no whole unit is
-    zeroed rather than deallocated, so st_blocks does not move and an assertion
-    phrased in st_blocks would report a hole-punching regression that is really
-    just the filesystem's granularity.
-
-    fallocate64() rather than fallocate(): where off_t is 32 bits the latter
-    takes 32-bit offsets, so ctypes' 64-bit arguments do not line up with what
-    it reads (on i386 it takes the high half of `offset` as its `length`) and
-    every probe fails with EINVAL -- which is why every assertion below has
-    silently done nothing on all the 32-bit ports.  fallocate64() takes off64_t
-    everywhere and is a plain alias of fallocate() where off_t is already 64
-    bits wide.
-
-    The probe data has to be incompressible: a filesystem that compresses
-    (btrfs with compress=) stores a run of one repeated byte in almost no
-    blocks, leaving a successful punch with nothing to free."""
-    import ctypes
-    import ctypes.util
-    KEEP_SIZE, PUNCH_HOLE = 0x01, 0x02
-    p = src / 'punch-probe'
-    fd = -1
-    try:
-        libc = ctypes.CDLL(ctypes.util.find_library('c') or 'libc.so.6',
-                           use_errno=True)
-        libc.fallocate64.argtypes = [ctypes.c_int, ctypes.c_int,
-                                     ctypes.c_longlong, ctypes.c_longlong]
-        fd = os.open(p, os.O_CREAT | os.O_RDWR | os.O_TRUNC, 0o644)
-        os.write(fd, os.urandom(size))
-        before = os.fstat(fd).st_blocks
-        ret = libc.fallocate64(fd, PUNCH_HOLE | KEEP_SIZE, offset, length)
-        return ret == 0 and os.fstat(fd).st_blocks < before
-    except (OSError, AttributeError, ValueError):
-        return False
-    finally:
-        if fd >= 0:
-            os.close(fd)
-        try:
-            os.unlink(p)
-        except OSError:
-            pass
-
-
-can_punch = punch_frees(0, 65536, 65536)
-
-
-def seed_plain(size=1_000_000):
-    rmtree(src)
-    rmtree(TODIR)
-    makepath(src / 'd1' / 'd2' / 'd3')
-    make_data_file(src / deep, size)
-
-
-def seed_holey(head=4096, hole=2 * 1024 * 1024, tail=4096):
-    rmtree(src)
-    rmtree(TODIR)
-    makepath(src / 'd1' / 'd2' / 'd3')
-    with open(src / deep, 'wb') as f:
-        f.write(os.urandom(head))
-        f.write(b'\0' * hole)        # a real zero run for the sparse writer
-        f.write(os.urandom(tail))
-
-
-# --- --preallocate: do_fallocate on the receiver ----------------------------
-seed_plain()
-run_rsync('-a', '--preallocate', f'{src}/', f'{TODIR}/')
-assert_same(TODIR / deep, src / deep, label='--preallocate content')
-
-# --- --preallocate --sparse on a holey file: do_fallocate + do_punch_hole ---
-# rsync.1 promises sparse blocks for this combination where the FS supports
-# holes. Assert it: do_fallocate reserves the whole extent, then the zero run
-# must be punched back out (st_blocks well below the apparent size).
-seed_holey()
-run_rsync('-a', '--preallocate', '--sparse', f'{src}/', f'{TODIR}/')
-assert_same(TODIR / deep, src / deep, label='--preallocate --sparse content')
-if can_punch and allocated(TODIR / deep) >= os.path.getsize(TODIR / deep):
-    test_fail(f"--preallocate --sparse left the file fully allocated "
-              f"(allocated {allocated(TODIR / deep)} for a "
-              f"{os.path.getsize(TODIR / deep)}-byte file); the preallocated "
-              "extent's zero run was not punched into a hole")
-
-# --- --inplace --sparse update that introduces a zero run: do_punch_hole ----
-# (sparse_end's updating_basis_or_equiv branch punches the hole in place.)
-seed_plain()
-run_rsync('-a', f'{src}/', f'{TODIR}/')              # dest starts fully populated
-data = bytearray((src / deep).read_bytes())
-data[200_000:800_000] = b'\0' * 600_000              # same size, new zero run
-(src / deep).write_bytes(bytes(data))
-st = os.stat(src / deep)
-os.utime(src / deep, (st.st_atime, st.st_mtime + 100))   # force a delta update
-run_rsync('-a', '--inplace', '--sparse', '--no-whole-file', f'{src}/', f'{TODIR}/')
-assert_same(TODIR / deep, src / deep, label='--inplace --sparse content')
-if can_punch and allocated(TODIR / deep) >= os.path.getsize(TODIR / deep):
-    test_fail(f"--inplace --sparse did not punch the zero run: allocated "
-              f"{allocated(TODIR / deep)} for a {os.path.getsize(TODIR / deep)}"
-              "-byte file")
-
-# --- --inplace --sparse must punch interior holes in matched blocks ----------
-# Make source and destination byte-identical and densely allocated.  With
-# --block-size matching the pattern size, every block match is at the same
-# offset, so skip_matched() sends it through write_sparse(use_seek=1).  The
-# interior zero run must still be scanned and punched rather than merely
-# seeked over with the rest of the matching block.
-rmtree(src)
-rmtree(TODIR)
-makepath(src / 'd1' / 'd2' / 'd3', TODIR / 'd1' / 'd2' / 'd3')
-with open(src / deep, 'wb') as source, open(TODIR / deep, 'wb') as dest:
-    for _ in range(256):
-        block = os.urandom(4096) + b'\0' * 24576 + os.urandom(4096)
-        source.write(block)
-        dest.write(block)
-
-# Only assert the interior punch where the filesystem can free a 24 KiB run
-# sitting 4 KiB into a 32 KiB block -- the exact shape written just above.
-can_punch_interior = can_punch and punch_frees(4096, 24576, 32768)
-if can_punch and not can_punch_interior:
-    print("preallocate: interior-hole assertion skipped: this filesystem's "
-          "allocation unit cannot free a 24 KiB run inside a 32 KiB block")
-
-matched_size = os.path.getsize(TODIR / deep)
-matched_before = allocated(TODIR / deep)
-run_rsync('-a', '--ignore-times', '--inplace', '--sparse', '--no-whole-file',
-          '--block-size=32768', f'{src}/', f'{TODIR}/')
-assert_same(TODIR / deep, src / deep,
-            label='--inplace --sparse matched-block content')
-matched_after = allocated(TODIR / deep)
-if (can_punch_interior and matched_before >= matched_size
-        and matched_after * 2 >= matched_before):
-    test_fail(f"--inplace --sparse left matching interior zero runs allocated: "
-              f"{matched_after} of {matched_before} bytes remain allocated "
-              f"after a {matched_size}-byte matched-block update")
-
-print("preallocate: --preallocate (do_fallocate) + sparse hole-punching "
-      "(do_punch_hole) verified at depth")
diff --git a/testsuite/profiles/cygwin.json b/testsuite/profiles/cygwin.json
new file mode 100644
index 000000000..ea27eca4f
--- /dev/null
+++ b/testsuite/profiles/cygwin.json
@@ -0,0 +1,32 @@
+{
+  "unsupported": {
+    "acl": "no POSIX ACL tools",
+    "backup_metadata": "no backup metadata fixture",
+    "cross_uid": "no cross-UID fixture",
+    "dac_restriction": "no Unix DAC restriction",
+    "darwin": "not Darwin",
+    "darwin_interpose": "no dyld interposition",
+    "device_nodes": "no Unix device nodes",
+    "directory_sgid": "no directory setgid semantics",
+    "group_auth": "no group-auth fixture",
+    "interpose": "no native interposition",
+    "linux_acl": "no Linux ACL semantics",
+    "linux_interpose": "no Linux interposition",
+    "linux_nss_chroot": "no Linux NSS chroot",
+    "linux_xattr": "no Linux xattr semantics",
+    "native_build": "no reliable patched build",
+    "noatime": "no O_NOATIME",
+    "ownership": "no Unix ownership fixture",
+    "posix_detach": "no POSIX daemon detach",
+    "proc_fd": "no procfs descriptors",
+    "protected_regular": "no protected_regular sysctl",
+    "root_anchor": "no root-anchored source fixture",
+    "search_only": "no Linux search-only fixture",
+    "simd": "no SIMD test build",
+    "symlink_mode": "no symlink chmod",
+    "thread_count": "no process thread count",
+    "unix_listener": "no named Unix listener passing",
+    "unix_socketpair": "no Unix socketpair",
+    "user_namespace": "no user namespaces"
+  }
+}
diff --git a/testsuite/profiles/freebsd.json b/testsuite/profiles/freebsd.json
new file mode 100644
index 000000000..369580f11
--- /dev/null
+++ b/testsuite/profiles/freebsd.json
@@ -0,0 +1,23 @@
+{
+  "unsupported": {
+    "acl": "no usable ACL fixture",
+    "atomic_flipper": "no atomic rename exchange",
+    "crtimes": "no creation times",
+    "darwin": "not Darwin",
+    "darwin_interpose": "no dyld interposition",
+    "group_auth": "no Linux group-auth fixture",
+    "interpose": "no supported interposition fixture",
+    "linux_acl": "no Linux ACL semantics",
+    "linux_interpose": "no Linux interposition",
+    "linux_nss_chroot": "no Linux NSS chroot",
+    "linux_xattr": "no Linux xattr semantics",
+    "noatime": "no O_NOATIME",
+    "preallocate": "no preallocation support",
+    "proc_fd": "no procfs descriptors",
+    "protected_regular": "no protected_regular sysctl",
+    "search_only": "no Linux search-only fixture",
+    "symlink_xattr": "no symlink xattr fixture",
+    "user_namespace": "no user namespaces",
+    "xattr_runtime": "no user xattr fixture"
+  }
+}
diff --git a/testsuite/profiles/linux.json b/testsuite/profiles/linux.json
new file mode 100644
index 000000000..dde274438
--- /dev/null
+++ b/testsuite/profiles/linux.json
@@ -0,0 +1,8 @@
+{
+  "unsupported": {
+    "crtimes": "no creation times",
+    "darwin": "not Darwin",
+    "darwin_interpose": "no dyld interposition",
+    "symlink_mode": "no symlink chmod"
+  }
+}
diff --git a/testsuite/profiles/macos.json b/testsuite/profiles/macos.json
new file mode 100644
index 000000000..8be4a180d
--- /dev/null
+++ b/testsuite/profiles/macos.json
@@ -0,0 +1,25 @@
+{
+  "unsupported": {
+    "backup_metadata": "no backup metadata fixture",
+    "cross_device": "no writable cross-device fixture",
+    "directory_sgid": "no directory setgid semantics",
+    "group_auth": "no Linux group-auth fixture",
+    "linux_acl": "no Linux ACL semantics",
+    "linux_interpose": "no Linux interposition",
+    "linux_nss_chroot": "no Linux NSS chroot",
+    "linux_xattr": "no Linux xattr semantics",
+    "noatime": "no O_NOATIME",
+    "preallocate": "no preallocation support",
+    "proc_fd": "no procfs descriptors",
+    "protected_regular": "no protected_regular sysctl",
+    "raw_filename_bytes": "no raw filename bytes",
+    "root_anchor": "no root-anchored source fixture",
+    "search_only": "no Linux search-only fixture",
+    "setgid_semantics": "setgid differential unavailable",
+    "simd": "no SIMD test build",
+    "sparse": "no sparse-file fixture",
+    "symlink_xattr": "no symlink xattr fixture",
+    "ungrantable_group": "no ungrantable group",
+    "user_namespace": "no user namespaces"
+  }
+}
diff --git a/testsuite/profiles/netbsd.json b/testsuite/profiles/netbsd.json
new file mode 100644
index 000000000..b569afbc6
--- /dev/null
+++ b/testsuite/profiles/netbsd.json
@@ -0,0 +1,26 @@
+{
+  "unsupported": {
+    "acl": "no usable ACL fixture",
+    "atomic_flipper": "no atomic rename exchange",
+    "crtimes": "no creation times",
+    "darwin": "not Darwin",
+    "darwin_interpose": "no dyld interposition",
+    "directory_sgid": "no directory setgid semantics",
+    "group_auth": "no Linux group-auth fixture",
+    "interpose": "no supported interposition fixture",
+    "linux_acl": "no Linux ACL semantics",
+    "linux_interpose": "no Linux interposition",
+    "linux_nss_chroot": "no Linux NSS chroot",
+    "linux_xattr": "no Linux xattr semantics",
+    "noatime": "no O_NOATIME",
+    "preallocate": "no preallocation support",
+    "proc_fd": "no procfs descriptors",
+    "protected_regular": "no protected_regular sysctl",
+    "search_only": "no Linux search-only fixture",
+    "simd": "no SIMD test build",
+    "symlink_xattr": "no symlink xattr fixture",
+    "user_namespace": "no user namespaces",
+    "xattr_runtime": "no user xattr fixture",
+    "xattr_wire": "no xattr wire fixture"
+  }
+}
diff --git a/testsuite/profiles/no-idn.json b/testsuite/profiles/no-idn.json
new file mode 100644
index 000000000..4ef1b92f8
--- /dev/null
+++ b/testsuite/profiles/no-idn.json
@@ -0,0 +1,5 @@
+{
+  "unsupported": {
+    "idn": "no IDN support"
+  }
+}
diff --git a/testsuite/profiles/no-xxhash.json b/testsuite/profiles/no-xxhash.json
new file mode 100644
index 000000000..1bca24359
--- /dev/null
+++ b/testsuite/profiles/no-xxhash.json
@@ -0,0 +1,5 @@
+{
+  "unsupported": {
+    "xxhash": "no xxhash support"
+  }
+}
diff --git a/testsuite/profiles/no-zstd-threads.json b/testsuite/profiles/no-zstd-threads.json
new file mode 100644
index 000000000..8931a3aa5
--- /dev/null
+++ b/testsuite/profiles/no-zstd-threads.json
@@ -0,0 +1,5 @@
+{
+  "unsupported": {
+    "zstd_threads": "no Zstandard worker threads"
+  }
+}
diff --git a/testsuite/profiles/non-asan.json b/testsuite/profiles/non-asan.json
new file mode 100644
index 000000000..e1191c359
--- /dev/null
+++ b/testsuite/profiles/non-asan.json
@@ -0,0 +1,5 @@
+{
+  "unsupported": {
+    "asan": "no AddressSanitizer"
+  }
+}
diff --git a/testsuite/profiles/nonroot.json b/testsuite/profiles/nonroot.json
new file mode 100644
index 000000000..b408ca6fd
--- /dev/null
+++ b/testsuite/profiles/nonroot.json
@@ -0,0 +1,12 @@
+{
+  "unsupported": {
+    "chroot": "no usable chroot fixture",
+    "cross_uid": "no cross-UID fixture",
+    "device_nodes": "cannot create device nodes",
+    "group_auth": "no group-auth fixture",
+    "ownership": "no Unix ownership fixture",
+    "protected_regular": "no protected_regular sysctl",
+    "root": "running without root privileges",
+    "root_anchor": "no root-anchored source fixture"
+  }
+}
diff --git a/testsuite/profiles/openbsd.json b/testsuite/profiles/openbsd.json
new file mode 100644
index 000000000..9556b69b2
--- /dev/null
+++ b/testsuite/profiles/openbsd.json
@@ -0,0 +1,28 @@
+{
+  "unsupported": {
+    "acl": "no usable ACL fixture",
+    "atomic_flipper": "no atomic rename exchange",
+    "crtimes": "no creation times",
+    "darwin": "not Darwin",
+    "darwin_interpose": "no dyld interposition",
+    "directory_sgid": "no directory setgid semantics",
+    "group_auth": "no Linux group-auth fixture",
+    "high_fd": "no descriptors above FD_SETSIZE",
+    "iconv": "no working iconv support",
+    "interpose": "no supported interposition fixture",
+    "linux_acl": "no Linux ACL semantics",
+    "linux_interpose": "no Linux interposition",
+    "linux_nss_chroot": "no Linux NSS chroot",
+    "linux_xattr": "no Linux xattr semantics",
+    "noatime": "no O_NOATIME",
+    "preallocate": "no preallocation support",
+    "proc_fd": "no procfs descriptors",
+    "protected_regular": "no protected_regular sysctl",
+    "search_only": "no Linux search-only fixture",
+    "simd": "no SIMD test build",
+    "symlink_xattr": "no symlink xattr fixture",
+    "user_namespace": "no user namespaces",
+    "xattr_runtime": "no user xattr fixture",
+    "xattr_wire": "no xattr wire fixture"
+  }
+}
diff --git a/testsuite/profiles/peer-2.6.0.json b/testsuite/profiles/peer-2.6.0.json
new file mode 100644
index 000000000..f5e303745
--- /dev/null
+++ b/testsuite/profiles/peer-2.6.0.json
@@ -0,0 +1,24 @@
+{
+  "peer": "2.6.0",
+  "protocol": 27,
+  "xfail": {
+    "alt-dest": "peer-feature-gap",
+    "batch-mode": "peer-feature-gap",
+    "chmod-option": "peer-feature-gap",
+    "daemon-basics": "peer-feature-gap",
+    "daemon-access": "peer-feature-gap",
+    "daemon-config": "peer-feature-gap",
+    "daemon-exec": "peer-feature-gap",
+    "daemon-filter": "peer-feature-gap",
+    "daemon-gzip": "peer-feature-gap",
+    "daemon-munge": "peer-feature-gap",
+    "daemon-refuse": "peer-feature-gap",
+    "daemon-refuse-compress": "peer-feature-gap",
+    "exclude-lsh": "peer-feature-gap",
+    "files-from": "peer-feature-gap",
+    "smoke": "peer-feature-gap",
+    "symlink-dirlink-basis": "peer-feature-gap",
+    "variety": "peer-feature-gap",
+    "variety-symlink-traversal": "peer-feature-gap"
+  }
+}
diff --git a/testsuite/profiles/peer-3.0.0.json b/testsuite/profiles/peer-3.0.0.json
new file mode 100644
index 000000000..0f9f4ea87
--- /dev/null
+++ b/testsuite/profiles/peer-3.0.0.json
@@ -0,0 +1,13 @@
+{
+  "peer": "3.0.0",
+  "protocol": 30,
+  "xfail": {
+    "batch-mode": "peer-feature-gap",
+    "chmod-option": "peer-feature-gap",
+    "daemon-basics": "peer-feature-gap",
+    "daemon-config": "peer-feature-gap",
+    "daemon-filter": "peer-feature-gap",
+    "daemon-gzip": "peer-feature-gap",
+    "daemon-refuse": "peer-feature-gap"
+  }
+}
diff --git a/testsuite/profiles/peer-3.1.0.json b/testsuite/profiles/peer-3.1.0.json
new file mode 100644
index 000000000..c7651e93a
--- /dev/null
+++ b/testsuite/profiles/peer-3.1.0.json
@@ -0,0 +1,10 @@
+{
+  "peer": "3.1.0",
+  "protocol": 31,
+  "xfail": {
+    "daemon-basics": "peer-feature-gap",
+    "daemon-gzip": "peer-feature-gap",
+    "daemon-refuse": "peer-feature-gap",
+    "daemon-refuse-compress": "peer-feature-gap"
+  }
+}
diff --git a/testsuite/profiles/peer-3.1.3.json b/testsuite/profiles/peer-3.1.3.json
new file mode 100644
index 000000000..e3f77de44
--- /dev/null
+++ b/testsuite/profiles/peer-3.1.3.json
@@ -0,0 +1,9 @@
+{
+  "peer": "3.1.3",
+  "protocol": 31,
+  "xfail": {
+    "daemon-basics": "peer-feature-gap",
+    "daemon-refuse": "peer-feature-gap",
+    "daemon-refuse-compress": "peer-feature-gap"
+  }
+}
diff --git a/testsuite/profiles/peer-3.2.0.json b/testsuite/profiles/peer-3.2.0.json
new file mode 100644
index 000000000..5d1ca366f
--- /dev/null
+++ b/testsuite/profiles/peer-3.2.0.json
@@ -0,0 +1,9 @@
+{
+  "peer": "3.2.0",
+  "protocol": 31,
+  "xfail": {
+    "chmod-option": "peer-feature-gap",
+    "daemon-basics": "peer-feature-gap",
+    "daemon-refuse-compress": "peer-feature-gap"
+  }
+}
diff --git a/testsuite/profiles/peer-3.2.7.json b/testsuite/profiles/peer-3.2.7.json
new file mode 100644
index 000000000..43bba447b
--- /dev/null
+++ b/testsuite/profiles/peer-3.2.7.json
@@ -0,0 +1,4 @@
+{
+  "peer": "3.2.7",
+  "protocol": 31
+}
diff --git a/testsuite/profiles/peer-3.3.0.json b/testsuite/profiles/peer-3.3.0.json
new file mode 100644
index 000000000..a6779fbc7
--- /dev/null
+++ b/testsuite/profiles/peer-3.3.0.json
@@ -0,0 +1,4 @@
+{
+  "peer": "3.3.0",
+  "protocol": 31
+}
diff --git a/testsuite/profiles/peer-3.4.0.json b/testsuite/profiles/peer-3.4.0.json
new file mode 100644
index 000000000..0286ca26c
--- /dev/null
+++ b/testsuite/profiles/peer-3.4.0.json
@@ -0,0 +1,7 @@
+{
+  "peer": "3.4.0",
+  "protocol": 32,
+  "xfail": {
+    "symlink-dirlink-basis": "issue-715"
+  }
+}
diff --git a/testsuite/profiles/peer-3.4.1.json b/testsuite/profiles/peer-3.4.1.json
new file mode 100644
index 000000000..a31b8d6b4
--- /dev/null
+++ b/testsuite/profiles/peer-3.4.1.json
@@ -0,0 +1,7 @@
+{
+  "peer": "3.4.1",
+  "protocol": 32,
+  "xfail": {
+    "symlink-dirlink-basis": "issue-715"
+  }
+}
diff --git a/testsuite/profiles/pipe.json b/testsuite/profiles/pipe.json
new file mode 100644
index 000000000..82f195565
--- /dev/null
+++ b/testsuite/profiles/pipe.json
@@ -0,0 +1,5 @@
+{
+  "unsupported": {
+    "tcp": "pipe transport"
+  }
+}
diff --git a/testsuite/profiles/pre-3.4.3.json b/testsuite/profiles/pre-3.4.3.json
new file mode 100644
index 000000000..1c0176e5e
--- /dev/null
+++ b/testsuite/profiles/pre-3.4.3.json
@@ -0,0 +1,7 @@
+{
+  "xfail": {
+    "alt-dest-symlink-race": "pre-3.4.3",
+    "chdir-symlink-race": "pre-3.4.3",
+    "sender-flist-symlink-leak": "pre-3.4.3"
+  }
+}
diff --git a/testsuite/profiles/protocol-29.json b/testsuite/profiles/protocol-29.json
new file mode 100644
index 000000000..7c272276e
--- /dev/null
+++ b/testsuite/profiles/protocol-29.json
@@ -0,0 +1,7 @@
+{
+  "protocol": 29,
+  "unsupported": {
+    "protocol_30": "protocol below 30",
+    "protocol_33": "protocol below 33"
+  }
+}
diff --git a/testsuite/profiles/protocol-30.json b/testsuite/profiles/protocol-30.json
new file mode 100644
index 000000000..5f91feac6
--- /dev/null
+++ b/testsuite/profiles/protocol-30.json
@@ -0,0 +1,6 @@
+{
+  "protocol": 30,
+  "unsupported": {
+    "protocol_33": "protocol below 33"
+  }
+}
diff --git a/testsuite/profiles/root.json b/testsuite/profiles/root.json
new file mode 100644
index 000000000..948bdc7f6
--- /dev/null
+++ b/testsuite/profiles/root.json
@@ -0,0 +1,5 @@
+{
+  "unsupported": {
+    "nonroot": "running as root"
+  }
+}
diff --git a/testsuite/profiles/self-peer.json b/testsuite/profiles/self-peer.json
new file mode 100644
index 000000000..ce3306ac0
--- /dev/null
+++ b/testsuite/profiles/self-peer.json
@@ -0,0 +1,5 @@
+{
+  "unsupported": {
+    "legacy_peer": "no historical peer"
+  }
+}
diff --git a/testsuite/profiles/solaris.json b/testsuite/profiles/solaris.json
new file mode 100644
index 000000000..59c81609d
--- /dev/null
+++ b/testsuite/profiles/solaris.json
@@ -0,0 +1,24 @@
+{
+  "unsupported": {
+    "acl": "no usable ACL fixture",
+    "atomic_flipper": "no atomic rename exchange",
+    "crtimes": "no creation times",
+    "darwin": "not Darwin",
+    "darwin_interpose": "no dyld interposition",
+    "group_auth": "no Linux group-auth fixture",
+    "high_fd": "no descriptors above FD_SETSIZE",
+    "interpose": "no supported interposition fixture",
+    "linux_acl": "no Linux ACL semantics",
+    "linux_interpose": "no Linux interposition",
+    "linux_nss_chroot": "no Linux NSS chroot",
+    "linux_xattr": "no Linux xattr semantics",
+    "noatime": "no O_NOATIME",
+    "preallocate": "no preallocation support",
+    "proc_fd": "no procfs descriptors",
+    "protected_regular": "no protected_regular sysctl",
+    "search_only": "no Linux search-only fixture",
+    "simd": "no SIMD test build",
+    "symlink_xattr": "no symlink xattr fixture",
+    "user_namespace": "no user namespaces"
+  }
+}
diff --git a/testsuite/profiles/valgrind.json b/testsuite/profiles/valgrind.json
new file mode 100644
index 000000000..ba5f604cc
--- /dev/null
+++ b/testsuite/profiles/valgrind.json
@@ -0,0 +1,6 @@
+{
+  "unsupported": {
+    "chroot": "no usable chroot fixture",
+    "linux_interpose": "no interposition under Valgrind"
+  }
+}
diff --git a/testsuite/proto-cleared-dirflist_test.py b/testsuite/proto-cleared-dirflist_test.py
deleted file mode 100644
index fffd0f42d..000000000
--- a/testsuite/proto-cleared-dirflist_test.py
+++ /dev/null
@@ -1,85 +0,0 @@
-#!/usr/bin/env python3
-# Regression test for a receiver NULL-deref on a sub-flist whose dir index
-# targets a cleared dir_flist entry (flist.c recv_file_list).
-#
-# Under inc_recurse the receiver appends every received directory entry to
-# dir_flist before flist_sort_and_clean() runs. If the peer sends two top-level
-# directories with the SAME name, both are appended (dir_flist->used == 2), then
-# the dedup pass clear_file()s one -- but the cleared file_struct stays in
-# dir_flist->files[] at an index still < used. A sub-flist tagged with that
-# cleared dir index passes the >= used bounds check, and the dirname-validation
-# strcmp() then calls f_name() on the cleared entry (returns NULL) and
-# dereferences it. The fix refuses an inactive (!F_IS_ACTIVE) dir slot up front.
-#
-# This drives a real daemon receiver with the pure-Python sender in inc_recurse
-# mode: a top-level flist of two same-named dirs "d" plus an UNFINISHED regular
-# file (non-zero length, no data sent) so the receiver keeps first_flist alive
-# (otherwise the marker hits the separate "after final flist freed" guard); then
-# a sub-flist marker for the cleared dir index (1, deterministic) followed by a
-# child entry so the pre-fix path reaches the crashing strcmp.
-#
-# Oracle: fixed -> "refusing flist for cleared dir_ndx 1" (RERR_PROTOCOL). pre-fix
-# -> the receiver dereferences the NULL f_name() and crashes, so that message
-# never appears (the generator just reports the connection dropped). Normal-build
-# crash; only needs a real TCP daemon.
-
-import time
-
-from rsyncfns import (
-    SCRATCHDIR, claim_ports, require_tcp, start_rsyncd, test_fail,
-)
-import rsync_proto as rp
-
-PORT = 12959
-CLEARED_NDX = 1  # flist_sort_and_clean() deterministically clears the 2nd dup dir
-require_tcp("the pure-Python sender needs a real TCP daemon; run with --use-tcp")
-claim_ports(PORT)
-
-mod = SCRATCHDIR / 'cd-mod'
-mod.mkdir(parents=True, exist_ok=True)
-conf = SCRATCHDIR / 'cd.conf'
-log = SCRATCHDIR / 'cd.log'
-conf.write_text(f"""\
-pid file = {SCRATCHDIR}/cd-rsyncd.pid
-use chroot = no
-log file = {log}
-
-[mod]
-    path = {mod}
-    read only = no
-""")
-start_rsyncd(conf, PORT)
-
-before = log.read_text(errors='replace') if log.exists() else ''
-s = rp.DaemonSender('127.0.0.1', PORT)
-s.handshake('mod', ['--server', '-re.iLsfxCIu', '.', 'mod/'], greeting_version=30)
-# Two same-named top-level dirs (one gets clear_file()'d) + an unfinished file
-# (keeps first_flist alive so we reach the cleared-slot guard, not the freed one).
-d = rp.FileEntry('d', mode=rp.S_IFDIR | 0o755, length=0, extra_flags=rp.XMIT_TOP_DIR)
-f = rp.FileEntry('f', mode=rp.S_IFREG | 0o644, length=100)
-s.send_data(d.encode() + d.encode() + f.encode() + rp.end_of_flist(0, s.protocol))
-# Sub-flist marker for the cleared dir slot, then a child entry (so the pre-fix
-# receiver reaches the strcmp that dereferences the NULL f_name()).
-child = rp.FileEntry('x', mode=rp.S_IFREG | 0o644, length=0)
-s.send_data(s.w_ndx(rp.NDX_FLIST_OFFSET - CLEARED_NDX)
-            + child.encode() + rp.end_of_flist(0, s.protocol))
-s.drain(timeout=2.0)
-s.close()
-
-refused = False
-for _ in range(50):
-    new = log.read_text(errors='replace')[len(before):]
-    if 'refusing flist for cleared dir_ndx' in new:
-        refused = True
-        break
-    time.sleep(0.1)
-
-if not refused:
-    new = log.read_text(errors='replace')[len(before):]
-    test_fail(
-        "receiver did not refuse a sub-flist for a cleared (duplicate) dir slot "
-        "-- it dereferenced the NULL f_name() and crashed.\n"
-        f"daemon log:\n{new}")
-
-print("proto-cleared-dirflist: receiver refused a sub-flist for a cleared "
-      "dir_flist slot (no NULL-deref crash).")
diff --git a/testsuite/proto-cleared-ndx_test.py b/testsuite/proto-cleared-ndx_test.py
deleted file mode 100644
index 467753344..000000000
--- a/testsuite/proto-cleared-ndx_test.py
+++ /dev/null
@@ -1,77 +0,0 @@
-#!/usr/bin/env python3
-# Regression test for a receiver NULL-deref on a transfer-phase index that
-# targets a cleared file-list entry (receiver.c recv_files).
-#
-# A peer can send duplicate file-list entries; flist_sort_and_clean() then
-# clear_file()s one of them (basename and mode zeroed) but leaves its slot
-# indexable. If the transfer phase sends an ndx for that slot, recv_files()
-# resolves it to the cleared file_struct and f_name() returns NULL, which flows
-# into the daemon filter check / set_file_attrs() -> full_fname() and crashes
-# the receiver child (NULL deref). The fix refuses an inactive entry
-# (!F_IS_ACTIVE) at the ndx->file_struct resolution with a clean RERR_PROTOCOL.
-#
-# This drives a real daemon receiver with the pure-Python sender: push a file
-# list with the SAME name twice (so flist_sort_and_clean clears the second
-# slot, index 1), then send a transfer-phase ndx for that cleared slot.
-#
-# Oracle: fixed -> the receiver refuses with "refusing transfer of cleared file
-# index 1" and exits RERR_PROTOCOL. pre-fix -> the receiver SIGSEGVs before
-# logging anything, so that message never appears (the generator just reports
-# the connection dropped). This is a normal-build crash (no ASan needed); it
-# only needs a real TCP daemon.
-
-import time
-
-from rsyncfns import (
-    SCRATCHDIR, claim_ports, require_tcp, start_rsyncd, test_fail,
-)
-import rsync_proto as rp
-
-PORT = 12957
-CLEARED_NDX = 1  # flist_sort_and_clean() deterministically clears the 2nd dup
-require_tcp("the pure-Python sender needs a real TCP daemon; run with --use-tcp")
-claim_ports(PORT)
-
-mod = SCRATCHDIR / 'cn-mod'
-mod.mkdir(parents=True, exist_ok=True)
-conf = SCRATCHDIR / 'cn.conf'
-log = SCRATCHDIR / 'cn.log'
-conf.write_text(f"""\
-pid file = {SCRATCHDIR}/cn-rsyncd.pid
-use chroot = no
-log file = {log}
-
-[mod]
-    path = {mod}
-    read only = no
-""")
-start_rsyncd(conf, PORT)
-
-before = log.read_text(errors='replace') if log.exists() else ''
-s = rp.DaemonSender('127.0.0.1', PORT)
-s.handshake('mod', ['--server', '-e.LsfxCIu', '.', 'mod/'], greeting_version=30)
-# Same name twice -> the 2nd entry's slot is clear_file()'d.
-dup = rp.FileEntry('dup.txt', mode=rp.S_IFREG | 0o644, length=0)
-s.send_flat_flist([dup, dup])
-# Transfer-phase index for the cleared slot.
-s.send_transfer_ndx(CLEARED_NDX, iflags=0)
-s.drain(timeout=2.0)
-s.close()
-
-refused = False
-for _ in range(50):
-    new = log.read_text(errors='replace')[len(before):]
-    if 'refusing transfer of cleared file index' in new:
-        refused = True
-        break
-    time.sleep(0.1)
-
-if not refused:
-    new = log.read_text(errors='replace')[len(before):]
-    test_fail(
-        "receiver did not refuse a transfer ndx targeting a cleared (dup) "
-        "file-list entry -- it dereferenced the NULL f_name() and crashed.\n"
-        f"daemon log:\n{new}")
-
-print("proto-cleared-ndx: receiver refused a transfer ndx for a cleared "
-      "file-list slot (no NULL-deref crash).")
diff --git a/testsuite/proto-hlink-flag-oob_test.py b/testsuite/proto-hlink-flag-oob_test.py
deleted file mode 100644
index d6d510e95..000000000
--- a/testsuite/proto-hlink-flag-oob_test.py
+++ /dev/null
@@ -1,88 +0,0 @@
-#!/usr/bin/env python3
-# Regression test for the heap out-of-bounds WRITE in recv_file_entry()
-# (flist.c): a malicious sender that sets XMIT_HLINKED on a file even though
-# the receiver was not invoked with -H. recv_file_entry() reserves the
-# hard-link extras slots only under preserve_hard_links, but used to set
-# FLAG_HLINKED straight from the peer's xflags. HLINK_BUMP() then offsets
-# F_SUM() past the start of the pool_alloc()'d region, and the subsequent
-# read_buf(f, F_SUM(file), flist_csum_len) writes attacker-controlled checksum
-# bytes below the allocation. The fix gates FLAG_HLINKED on preserve_hard_links.
-#
-# The shift is HLINK_BUMP()*EXTRA_LEN = (inc_recurse+1)*EXTRA_LEN. With
-# inc_recurse OFF the 8-byte shift is absorbed by extra-slot rounding and the
-# write stays in bounds; with inc_recurse ON the shift is 16 bytes and the
-# write underflows the chunk for real. So this drives the daemon with -r and an
-# inc-recurse-capable -e string (the 'i' flag), no -H, and --checksum so the
-# receiver reaches the F_SUM read.
-#
-# The corruption stays inside one 32 KiB pool malloc, so vanilla ASan can't see
-# it; lib/pool_alloc.c fences each chunk with a poisoned redzone (under ASan).
-# This test therefore needs an ASan build and a real TCP daemon, and is skipped
-# otherwise.
-#
-# Entry: one regular file flagged XMIT_HLINKED|XMIT_HLINK_FIRST (HLINK_FIRST
-# makes recv_file_entry skip the gnum read, keeping the stream in sync) plus a
-# checksum trailer.
-#
-# Oracle: pre-fix -> the receiver aborts with an ASan use-after-poison report
-# (captured via ASAN_OPTIONS=log_path). fixed -> no report.
-
-import glob
-import os
-
-from rsyncfns import (
-    SCRATCHDIR, claim_ports, require_asan, require_tcp, start_rsyncd, test_fail,
-)
-import rsync_proto as rp
-
-PORT = 12953
-require_tcp("the pure-Python sender needs a real TCP daemon; run with --use-tcp")
-require_asan("the FLAG_HLINKED pool underflow is only observable under "
-            "AddressSanitizer + the lib/pool_alloc.c redzone")
-claim_ports(PORT)
-
-mod = SCRATCHDIR / 'hlink-oob-mod'
-mod.mkdir(parents=True, exist_ok=True)
-conf = SCRATCHDIR / 'hlink-oob.conf'
-conf.write_text(f"""\
-pid file = {SCRATCHDIR}/hlink-oob-rsyncd.pid
-use chroot = no
-
-[mod]
-    path = {mod}
-    read only = no
-""")
-
-# Route the daemon's ASan reports to files we can scan (start_rsyncd sends the
-# daemon's stderr to /dev/null). The daemon inherits this env.
-asan_log = SCRATCHDIR / 'hlink-oob-asan'
-for stale in glob.glob(f"{asan_log}.*"):
-    os.unlink(stale)
-prev = os.environ.get('ASAN_OPTIONS', '')
-os.environ['ASAN_OPTIONS'] = (
-    (prev + ':' if prev else '') + f'detect_leaks=0:abort_on_error=1:log_path={asan_log}')
-
-start_rsyncd(conf, PORT)
-
-s = rp.DaemonSender('127.0.0.1', PORT)
-# -r + 'i' => inc_recurse on the daemon (HLINK_BUMP == 2); --checksum =>
-# always_checksum; NO -H => preserve_hard_links off.
-s.handshake('mod', ['--server', '-re.iLsfxCIu', '--checksum', '.', 'mod/'],
-            greeting_version=30)
-evil = rp.FileEntry('h.txt', mode=rp.S_IFREG | 0o644, length=0,
-                    extra_flags=rp.XMIT_HLINKED | rp.XMIT_HLINK_FIRST,
-                    csum=b'\x41' * 64)
-s.send_flat_flist([evil])
-s.drain(timeout=3.0)
-s.close()
-
-reports = glob.glob(f"{asan_log}.*")
-text = ''.join(open(r, errors='replace').read() for r in reports)
-if 'AddressSanitizer' in text:
-    test_fail(
-        "receiver hit an AddressSanitizer error parsing an XMIT_HLINKED entry "
-        "sent without -H -- the FLAG_HLINKED pool underflow is unguarded:\n"
-        + text[:1500])
-
-print("proto-hlink-flag-oob: XMIT_HLINKED-without-H entry parsed with no "
-      "pool underflow (FLAG_HLINKED gated on preserve_hard_links).")
diff --git a/testsuite/proto-hlink-gnum_test.py b/testsuite/proto-hlink-gnum_test.py
deleted file mode 100644
index 5e5ddd63f..000000000
--- a/testsuite/proto-hlink-gnum_test.py
+++ /dev/null
@@ -1,85 +0,0 @@
-#!/usr/bin/env python3
-# Regression test for a peer-controlled assert() abort in match_gnums()
-# (hlink.c). With inc_recurse, a non-first hard-link entry carries
-# first_hlink_ndx as its gnum. recv_file_entry() only bounds it as
-# [0, ndx_start + used) but does not require that a value below ndx_start was
-# ever declared via XMIT_HLINK_FIRST in an earlier flist. Such a gnum is absent
-# from prior_hlinks, so the new-node branch in match_gnums() hit
-# assert(gnum >= hlink_flist->ndx_start) -- a remotely-reachable abort() of the
-# generator on default (assert-enabled) builds. The fix replaces the assert
-# with a clean RERR_PROTOCOL exit.
-#
-# A first-flist back-reference would use gnum 0, which the hashtable rejects as
-# an illegal key before the assert, so we put the hard-link entry in a SUB-flist
-# (ndx_start >= 2) with a small but non-zero gnum. This drives a real daemon
-# receiver with the pure-Python sender, -H + inc_recurse: a top-level content
-# dir "d" plus an unfinished file (keeps first_flist alive), then a sub-flist
-# for "d" containing a regular-file hard-link entry whose gnum (1) is below the
-# sub-flist's ndx_start and was never declared.
-#
-# Oracle: fixed -> "hard-link gnum 1 precedes flist start N" (RERR_PROTOCOL).
-# pre-fix -> the generator SIGABRTs on the assert, so that message never
-# appears. Asserts are compiled in on the default debug build, so this is a
-# normal-build RED/GREEN; only needs a real TCP daemon.
-
-import time
-
-from rsyncfns import (
-    SCRATCHDIR, claim_ports, require_tcp, start_rsyncd, test_fail,
-)
-import rsync_proto as rp
-
-PORT = 12960
-BACKREF_GNUM = 1
-require_tcp("the pure-Python sender needs a real TCP daemon; run with --use-tcp")
-claim_ports(PORT)
-
-mod = SCRATCHDIR / 'hg-mod'
-mod.mkdir(parents=True, exist_ok=True)
-conf = SCRATCHDIR / 'hg.conf'
-log = SCRATCHDIR / 'hg.log'
-conf.write_text(f"""\
-pid file = {SCRATCHDIR}/hg-rsyncd.pid
-use chroot = no
-log file = {log}
-
-[mod]
-    path = {mod}
-    read only = no
-""")
-start_rsyncd(conf, PORT)
-
-before = log.read_text(errors='replace') if log.exists() else ''
-s = rp.DaemonSender('127.0.0.1', PORT)
-s.handshake('mod', ['--server', '-rHe.iLsfxCIu', '.', 'mod/'], greeting_version=30)
-# Top flist: a content dir "d" + an unfinished file (used=2 -> the sub-flist's
-# ndx_start is > 1, so our small gnum is below it; the file keeps first_flist
-# alive so the sub-flist is received rather than refused as "after free").
-d = rp.FileEntry('d', mode=rp.S_IFDIR | 0o755, length=0, extra_flags=rp.XMIT_TOP_DIR)
-f = rp.FileEntry('f', mode=rp.S_IFREG | 0o644, length=100)
-s.send_data(d.encode() + f.encode() + rp.end_of_flist(0, s.protocol))
-# Sub-flist for dir 0 ("d") with a hard-link entry carrying a back-ref gnum that
-# was never declared XMIT_HLINK_FIRST.
-h = rp.FileEntry('d/h', mode=rp.S_IFREG | 0o644, length=0, hlink_ndx=BACKREF_GNUM)
-s.send_data(s.w_ndx(rp.NDX_FLIST_OFFSET - 0) + h.encode() + rp.end_of_flist(0, s.protocol))
-s.drain(timeout=2.0)
-s.close()
-
-refused = False
-needle = 'hard-link gnum %d precedes flist start' % BACKREF_GNUM
-for _ in range(50):
-    new = log.read_text(errors='replace')[len(before):]
-    if needle in new:
-        refused = True
-        break
-    time.sleep(0.1)
-
-if not refused:
-    new = log.read_text(errors='replace')[len(before):]
-    test_fail(
-        "generator did not reject an undeclared back-reference hard-link gnum "
-        "-- it hit the match_gnums() assert(gnum >= ndx_start) and aborted.\n"
-        f"daemon log:\n{new}")
-
-print("proto-hlink-gnum: generator rejected an undeclared back-reference "
-      "hard-link gnum (no assert abort).")
diff --git a/testsuite/proto-msg-info-assert_test.py b/testsuite/proto-msg-info-assert_test.py
deleted file mode 100644
index a3e0ff1ee..000000000
--- a/testsuite/proto-msg-info-assert_test.py
+++ /dev/null
@@ -1,80 +0,0 @@
-#!/usr/bin/env python3
-# Regression test for a remotely-reachable abort in rwrite() (log.c): a daemon
-# receiver child (am_server=1, am_generator=0, send_msgs_to_gen=1) that receives
-# a MSG_INFO/MSG_ERROR frame from the wire calls rwrite() with
-# is_utf8 = !am_generator = 1 (io.c read_a_msg). The send_msgs_to_gen branch
-# used to assert(!is_utf8), so a peer that sends such a message to the receiver
-# triggered a SIGABRT of the per-connection child. Legitimate senders never put
-# these tags on the wire. The fix drops the assert and forwards the bytes raw to
-# the generator, which logs them.
-#
-# This drives a real daemon receiver with the pure-Python sender: push a
-# one-entry file list (so the receiver enters recv_files and reads our stream),
-# then inject a MSG_INFO frame carrying a unique marker. In recv_files the
-# receiver's read_ndx_and_attrs() reads our stream and read_a_msg() dispatches
-# the MSG_INFO inline -> rwrite() with is_utf8=1.
-#
-# Oracle: fixed -> the receiver forwards the message to the generator, which
-# logs the marker (and echoes a MSG_INFO frame back to us). pre-fix -> the
-# receiver SIGABRTs on the assert *before* forwarding, so the marker never
-# appears and the generator reports the connection dropped.
-#
-# Asserts are compiled in on the default (debug) build, so this is a normal-
-# build RED/GREEN; it only needs a real TCP daemon (--use-tcp).
-
-import time
-
-from rsyncfns import (
-    SCRATCHDIR, claim_ports, require_tcp, start_rsyncd, test_fail,
-)
-import rsync_proto as rp
-
-PORT = 12955
-MARKER = b'SCANNER-0009-FORWARDED'
-require_tcp("the pure-Python sender needs a real TCP daemon; run with --use-tcp")
-claim_ports(PORT)
-
-mod = SCRATCHDIR / 'mi-mod'
-mod.mkdir(parents=True, exist_ok=True)
-conf = SCRATCHDIR / 'mi.conf'
-log = SCRATCHDIR / 'mi.log'
-conf.write_text(f"""\
-pid file = {SCRATCHDIR}/mi-rsyncd.pid
-use chroot = no
-log file = {log}
-
-[mod]
-    path = {mod}
-    read only = no
-""")
-start_rsyncd(conf, PORT)
-
-s = rp.DaemonSender('127.0.0.1', PORT)
-s.handshake('mod', ['--server', '-e.LsfxCIu', '.', 'mod/'], greeting_version=30)
-# One regular file so the receiver enters recv_files and reads our stream.
-s.send_flat_flist([rp.FileEntry('hello.txt', mode=rp.S_IFREG | 0o644, length=0)])
-# Inject a peer MSG_INFO -- the receiver child's read_a_msg() -> rwrite(is_utf8=1).
-s.send_message(rp.MSG_INFO, MARKER + b'\n')
-back = s.drain(timeout=3.0)
-s.close()
-
-# The forwarded message reaches us as an echoed MSG_INFO frame and/or the
-# generator's log. Either presence means the receiver did NOT abort.
-forwarded = MARKER in back
-for _ in range(50):
-    if log.exists() and MARKER.decode() in log.read_text(errors='replace'):
-        forwarded = True
-        break
-    if forwarded:
-        break
-    time.sleep(0.1)
-
-if not forwarded:
-    log_text = log.read_text(errors='replace') if log.exists() else '(no log)'
-    test_fail(
-        "daemon receiver did not forward a peer MSG_INFO -- it aborted on the "
-        "rwrite() assert(!is_utf8) (the marker never reached the generator).\n"
-        f"daemon log:\n{log_text}")
-
-print("proto-msg-info-assert: daemon receiver forwarded a peer MSG_INFO without "
-      "aborting (the rwrite assert is gone).")
diff --git a/testsuite/proto-parent-ndx-empty-dirflist_test.py b/testsuite/proto-parent-ndx-empty-dirflist_test.py
deleted file mode 100644
index e2f00f3a4..000000000
--- a/testsuite/proto-parent-ndx-empty-dirflist_test.py
+++ /dev/null
@@ -1,117 +0,0 @@
-#!/usr/bin/env python3
-# Regression test for a wild-pointer read via the first inc_recurse flist's
-# parent_ndx when dir_flist is empty (flist.c recv_file_list).
-#
-# Under inc_recurse the first flist (ndx_start == 1) has no parent entry of its
-# own: recv_file_list() trusts the peer's "." entry to be the transfer root and
-# leaves parent_ndx at the flist_new() default of 0, meaning dir_flist->files[0].
-# Only S_ISDIR entries are appended to dir_flist, so a peer that sends a "."
-# entry with a NON-directory mode keeps dir_flist->used at 0 while the basename
-# strcmp() still passes -- parent_ndx stays 0 and the consumers (generate_files,
-# recv_files, touch_up_dirs) index a never-written slot of the freshly allocated
-# dir_flist->files[], i.e. uninitialised heap, and dereference it.
-#
-# This drives a real daemon receiver with the pure-Python sender: an inc_recurse
-# push whose first (and only) flist is a "." REGULAR file plus a second regular
-# file "a" -- no directory anywhere, so dir_flist->used stays 0, and "." sorts
-# lowest so the basename test passes. ("a" is there so file_total != 1 and the
-# receiver doesn't divert into recv_additional_file_list.)
-#
-# The file list ALONE is what does it: the GENERATOR (the connection parent;
-# do_recv() forks the receiver as the child) crashes in generate_files() before
-# any transfer phase. The follow-on token for ndx 0 is sent only to exercise
-# recv_files()'s parent_ndx path on a build that survives the list; on a
-# vulnerable one the generator is already gone by then, so this test does not
-# demonstrate the receiver-side consumer.
-#
-# Three independent layers now stop this, in wire order: recv_file_entry()
-# refuses a non-directory transfer-root entry outright; recv_file_list() clears
-# parent_ndx to -1 when dir_flist is empty; and the parent_ndx consumers bounds-
-# check against dir_flist->used. Only the first fires on a current build, so
-# THIS TEST GATES THE ATTACK SHAPE, NOT THE parent_ndx CLAUSE: removing that one
-# clause alone leaves the test passing. Isolating it needs the other two layers
-# disabled as well (done once by hand: clause out = SIGSEGV, clause in =
-# orderly refusal), which is why the clause is still worth backporting alone.
-#
-# The dereferenced slot is not guaranteed to be NULL -- dir_flist->files[] comes
-# from realloc(), not calloc(). It reads as NULL in an ordinary run (si_addr
-# 0x14 = file->mode), but a peer that grooms the heap first (a large freed
-# filter list) can put its own bytes there. Either way the observed outcome is
-# a crash. Normal-build oracle; only needs a real TCP daemon.
-
-import time
-
-from rsyncfns import (
-    SCRATCHDIR, claim_ports, require_tcp, start_rsyncd, test_fail,
-)
-import rsync_proto as rp
-
-PORT = 12967
-require_tcp("the pure-Python sender needs a real TCP daemon; run with --use-tcp")
-claim_ports(PORT)
-
-mod = SCRATCHDIR / 'pn-mod'
-mod.mkdir(parents=True, exist_ok=True)
-conf = SCRATCHDIR / 'pn.conf'
-log = SCRATCHDIR / 'pn.log'
-conf.write_text(f"""\
-pid file = {SCRATCHDIR}/pn-rsyncd.pid
-use chroot = no
-log file = {log}
-
-[mod]
-    path = {mod}
-    read only = no
-""")
-start_rsyncd(conf, PORT)
-
-before = log.read_text(errors='replace') if log.exists() else ''
-s = rp.DaemonSender('127.0.0.1', PORT)
-s.handshake('mod', ['--server', '-re.iLsfxCIu', '.', 'mod/'], greeting_version=30)
-# The transfer root "." as a regular file: it never lands in dir_flist, so
-# dir_flist->used stays 0 while "." still sorts lowest.
-dot = rp.FileEntry('.', mode=rp.S_IFREG | 0o644, length=100)
-other = rp.FileEntry('a', mode=rp.S_IFREG | 0o644, length=100)
-s.send_data(dot.encode() + other.encode() + rp.end_of_flist(0, s.protocol))
-time.sleep(0.5)
-# ndx 0 == first_flist->ndx_start - 1.  A FIXED daemon has already refused the
-# file list and gone by now, so this send and the drain may hit a closed socket:
-# Linux and FreeBSD swallow it, other stacks raise EPIPE/ECONNRESET.  That is an
-# expected outcome, not a result -- the verdict comes from the daemon log below.
-try:
-    s.send_transfer_ndx(0, rp.ITEM_TRANSFER)
-    s.drain(timeout=3.0)
-except (OSError, rp.ProtocolError):
-    pass
-s.close()
-
-# Two things must both be true, and a bare "rsync error:" is NOT enough: any
-# later wire error would satisfy that, so the test would pass without the
-# crafted list ever reaching the parser (proved by sending a bogus file index
-# against a build where "." was a valid directory -- it "passed").
-#   * positive control: the daemon reached recv_file_list() at all; and
-#   * the refusal names THIS condition.
-reached = refused = False
-for _ in range(50):
-    new = log.read_text(errors='replace')[len(before):]
-    reached = 'receiving file list' in new
-    refused = 'rejecting non-directory transfer-root entry' in new
-    if reached and refused:
-        break
-    time.sleep(0.1)
-
-new = log.read_text(errors='replace')[len(before):]
-if not reached:
-    test_fail("the daemon never logged 'receiving file list', so the crafted "
-              "transfer root never reached recv_file_list() -- this run proves "
-              f"nothing either way.\ndaemon log:\n{new}")
-if not refused:
-    test_fail(
-        "the daemon did not refuse the non-directory transfer root of a first "
-        "inc_recurse flist.  Either it died dereferencing dir_flist->files[0] "
-        "from an empty dir_flist (no further log output), or it failed for some "
-        f"unrelated reason.\ndaemon log:\n{new}")
-
-print("proto-parent-ndx-empty-dirflist: a non-directory transfer root in the "
-      "first inc_recurse flist is refused, not turned into a dir_flist->files[0] "
-      "deref.")
diff --git a/testsuite/proto-subflist-freed_test.py b/testsuite/proto-subflist-freed_test.py
deleted file mode 100644
index 93eaf9f71..000000000
--- a/testsuite/proto-subflist-freed_test.py
+++ /dev/null
@@ -1,82 +0,0 @@
-#!/usr/bin/env python3
-# Regression test for a stale-dir_flist use-after-free on a sub-flist marker
-# sent after every flist has been freed (flist.c recv_file_list).
-#
-# In inc_recurse mode the receiver frees each flist as it finishes. When the
-# last goes, flist_free() sets first_flist = NULL and pool_destroy()s the shared
-# file pool, but the global dir_flist is left pointing into the destroyed pool.
-# A malicious sender that then sends an NDX_FLIST_OFFSET sub-flist marker made
-# recv_file_list() write FLAG_GOT_DIR_FLIST into the freed dir_flist entry (a
-# use-after-free) and re-create dir_flist, before the existing dirname !d guard
-# turned the follow-on uninitialised deref into a clean RERR_UNSUPPORTED exit.
-# The fix refuses the sub-flist up front when first_flist is NULL.
-#
-# This drives a real daemon receiver with the pure-Python sender, in
-# inc_recurse mode (-r + an -e string containing 'i'): push a tiny top-level
-# flist (two directories, so there is nothing to transfer and every flist is
-# freed promptly), then send a sub-flist marker.
-#
-# Oracle: fixed -> the receiver logs "refusing sub-flist after final flist was
-# freed" (RERR_PROTOCOL at the up-front guard). pre-fix -> that guard is absent;
-# the receiver instead performs the use-after-free and exits later via the !d
-# backstop ("requested action not supported"), so the refuse message never
-# appears (and under ASan the UAF is a hard report). Normal-build oracle; only
-# needs a real TCP daemon.
-
-import time
-
-from rsyncfns import (
-    SCRATCHDIR, claim_ports, require_tcp, start_rsyncd, test_fail,
-)
-import rsync_proto as rp
-
-PORT = 12958
-require_tcp("the pure-Python sender needs a real TCP daemon; run with --use-tcp")
-claim_ports(PORT)
-
-mod = SCRATCHDIR / 'sf-mod'
-mod.mkdir(parents=True, exist_ok=True)
-conf = SCRATCHDIR / 'sf.conf'
-log = SCRATCHDIR / 'sf.log'
-conf.write_text(f"""\
-pid file = {SCRATCHDIR}/sf-rsyncd.pid
-use chroot = no
-log file = {log}
-
-[mod]
-    path = {mod}
-    read only = no
-""")
-start_rsyncd(conf, PORT)
-
-before = log.read_text(errors='replace') if log.exists() else ''
-s = rp.DaemonSender('127.0.0.1', PORT)
-s.handshake('mod', ['--server', '-re.iLsfxCIu', '.', 'mod/'], greeting_version=30)
-# Two top-level directories: nothing to transfer.
-d = rp.FileEntry('d', mode=rp.S_IFDIR | 0o755, length=0, extra_flags=rp.XMIT_TOP_DIR)
-s.send_data(d.encode() + d.encode() + rp.end_of_flist(0, s.protocol))
-# One NDX_DONE frees the (single) top flist -> first_flist becomes NULL; then a
-# sub-flist marker hits the "after final flist freed" guard. (More than one
-# would advance phase past max_phase and break recv_files before the marker.)
-s.send_ndx_done()
-s.send_subflist_marker(0)
-s.drain(timeout=2.0)
-s.close()
-
-refused = False
-for _ in range(50):
-    new = log.read_text(errors='replace')[len(before):]
-    if 'refusing sub-flist after final flist was freed' in new:
-        refused = True
-        break
-    time.sleep(0.1)
-
-if not refused:
-    new = log.read_text(errors='replace')[len(before):]
-    test_fail(
-        "receiver did not refuse a sub-flist marker sent after all flists were "
-        "freed -- it used the stale dir_flist (use-after-free).\n"
-        f"daemon log:\n{new}")
-
-print("proto-subflist-freed: receiver refused a sub-flist after the final flist "
-      "was freed (no stale-dir_flist use-after-free).")
diff --git a/testsuite/proxy-connect-request-too-long_test.py b/testsuite/proxy-connect-request-too-long_test.py
deleted file mode 100644
index eaf88502f..000000000
--- a/testsuite/proxy-connect-request-too-long_test.py
+++ /dev/null
@@ -1,10 +0,0 @@
-#!/usr/bin/env python3
-from rsyncfns import claim_ports, require_tcp
-from rsyncfns import make_proxy_server, run_proxy_probe
-
-PORT = 12931
-require_tcp("fake-proxy listener needs a real TCP socket; run with --use-tcp")
-claim_ports(PORT)
-make_proxy_server(PORT, b"")
-run_proxy_probe(PORT, 'a' * 1500 + '.invalid', 'proxy CONNECT request too long')
-print("proxy-connect-request-too-long: oversized CONNECT request rejected before write")
diff --git a/testsuite/proxy-response-header-too-long_test.py b/testsuite/proxy-response-header-too-long_test.py
deleted file mode 100644
index 0b152be1f..000000000
--- a/testsuite/proxy-response-header-too-long_test.py
+++ /dev/null
@@ -1,10 +0,0 @@
-#!/usr/bin/env python3
-from rsyncfns import claim_ports, require_tcp
-from rsyncfns import make_proxy_server, run_proxy_probe
-
-PORT = 12932
-require_tcp("fake-proxy listener needs a real TCP socket; run with --use-tcp")
-claim_ports(PORT)
-make_proxy_server(PORT, b"HTTP/1.0 200 OK\r\n" + b"X" * 1023)
-run_proxy_probe(PORT, 'example.invalid', 'proxy response header line too long')
-print("proxy-response-header-too-long: oversized proxy header line rejected")
diff --git a/testsuite/proxy-response-line-too-long_test.py b/testsuite/proxy-response-line-too-long_test.py
deleted file mode 100644
index a1e7aa66c..000000000
--- a/testsuite/proxy-response-line-too-long_test.py
+++ /dev/null
@@ -1,102 +0,0 @@
-#!/usr/bin/env python3
-# Python rewrite of testsuite/proxy-response-line-too-long.test.
-#
-# Regression test for the off-by-one stack OOB write in
-# establish_proxy_connection() when a malicious or man-in-the-middle
-# HTTP proxy returned a first response line of 1023+ bytes without a
-# '\n' terminator. Post-fix, rsync must reject this with "proxy
-# response line too long" and exit non-zero without dying from a signal.
-
-import os
-import shutil
-import socket
-import subprocess
-import sys
-import threading
-import time
-
-from rsyncfns import (
-    SCRATCHDIR, claim_ports, require_tcp, rsync_argv, test_fail, test_skipped,
-)
-
-
-# This test has no stdio-pipe equivalent: it binds a real loopback socket to
-# stand in for a malicious HTTP proxy. Honour the secure default (no listening
-# sockets) by only running it under --use-tcp.
-require_tcp("fake-proxy listener needs a real TCP socket; run with --use-tcp")
-
-if shutil.which('python3') is None:
-    test_skipped("python3 not available")
-
-workdir = SCRATCHDIR / 'workdir'
-workdir.mkdir(parents=True, exist_ok=True)
-os.chdir(workdir)
-
-# Reserve our proxy port across any concurrent test processes; another
-# test asking for the same port blocks here until we exit.
-PROXY_PORT = 12873
-claim_ports(PROXY_PORT)
-
-# In-process listener: bind to the claimed port, accept one client, read
-# up to end-of-headers (or 64 KiB), reply with exactly 1023 'X' bytes and
-# no '\n', then close. A thread is simpler than spawning python3 again
-# and has the same effect on the rsync side.
-listener = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
-listener.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
-listener.bind(('127.0.0.1', PROXY_PORT))
-port = PROXY_PORT
-listener.listen(1)
-
-
-def _serve_one():
-    conn, _ = listener.accept()
-    conn.settimeout(5)
-    try:
-        data = b""
-        while b"\r\n\r\n" not in data and len(data) < 65536:
-            chunk = conn.recv(8192)
-            if not chunk:
-                break
-            data += chunk
-    except socket.timeout:
-        pass
-    conn.sendall(b"X" * 1023)
-    try:
-        conn.shutdown(socket.SHUT_RDWR)
-    except OSError:
-        pass
-    conn.close()
-
-
-t = threading.Thread(target=_serve_one)
-t.daemon = True
-t.start()
-
-# Run rsync against the malicious proxy. The proxy intercepts CONNECT
-# and never forwards, so the upstream URL is irrelevant.
-env = os.environ.copy()
-env['RSYNC_PROXY'] = f'127.0.0.1:{port}'
-proc = subprocess.run(
-    rsync_argv('rsync://example.invalid:873/whatever/', f'{workdir}/out/'),
-    capture_output=True, text=True, env=env,
-)
-
-t.join(timeout=15)
-listener.close()
-
-status = proc.returncode
-err = proc.stderr
-
-if status >= 128:
-    sys.stderr.write(err)
-    test_fail(f"rsync killed by signal (status={status}) -- possible stack OOB regression")
-
-if status == 0:
-    sys.stderr.write(err)
-    test_fail("rsync returned success despite malformed proxy response")
-
-if 'proxy response line too long' not in err:
-    sys.stderr.write(err)
-    test_fail("expected 'proxy response line too long' in rsync stderr")
-
-print("OK: over-long proxy response line rejected cleanly without crashing")
diff --git a/testsuite/recv-discard-nullderef_test.py b/testsuite/recv-discard-nullderef_test.py
deleted file mode 100755
index f7d0ee43d..000000000
--- a/testsuite/recv-discard-nullderef_test.py
+++ /dev/null
@@ -1,126 +0,0 @@
-#!/usr/bin/env python3
-# Regression test for a receiver NULL-deref on the delta DISCARD path.
-#
-# In receiver.c receive_data(), a block-MATCH token that arrives while the
-# receiver is DISCARDING a file (discard_receive_data() -> receive_data() with
-# fname==NULL, fd==-1, hence mapbuf==NULL) reached
-#     rprintf(FERROR, "...%s...", full_fname(fname), ...)
-# with fname==NULL. full_fname() dereferences its argument unconditionally
-# (util1.c: `if (*fn == '/')`), so the receiver SIGSEGVs. The faulty error
-# branch was added in 31fbb17d ("receiver: fix absolute --partial-dir delta
-# resume"); the fix discriminates on fd (not mapbuf) and, on the discard path
-# (fd==-1), absorbs the matched bytes benignly instead of erroring.
-#
-# This is a NORMAL-operation crash, not adversarial: a stock cooperating sender
-# triggers it. The generator sends real block sums (basis readable, delta mode);
-# the receiver then has to discard because its output mkstemp() fails -- here
-# because the destination directory is not writable. A block MATCH against the
-# shared leading block reaches the discard path and crashes the pre-fix binary.
-#
-# We drive a real sender<->receiver pair (client sender -> daemon receiver) so
-# the receiver actually takes the recv_files discard path; a local `rsync a b`
-# does not. In the default (pipe) daemon transport both ends are the binary
-# under test.
-#
-# Skipped (exit 77) when running as root (root bypasses DAC), or when the
-# directory mode is not enforced (e.g. a non-root process holding
-# CAP_DAC_OVERRIDE in an unprivileged container): in both cases the receiver's
-# mkstemp() would succeed despite chmod 0555, the discard path would not be
-# taken, and the test would silently pass against a buggy binary. The
-# post-chmod writability probe converts that silent false-pass into an honest
-# skip and subsumes the root check.
-
-import os
-import shlex
-import subprocess
-import tempfile
-
-from rsyncfns import (
-    SCRATCHDIR, RSYNC, TMPDIR,
-    get_testuid, get_rootuid, makepath, start_test_daemon, write_daemon_conf,
-    test_fail, test_skipped, split_rsync_cmd,
-)
-
-DAEMON_PORT = 12895
-
-if get_testuid() == get_rootuid():
-    test_skipped("root bypasses DAC: the unwritable dest dir wouldn't make "
-                 "the receiver's mkstemp fail, so the discard path (and the "
-                 "bug) is never reached")
-
-os.chdir(TMPDIR)
-
-MODDIR = SCRATCHDIR / 'recvdiscard-mod'   # daemon module root (writable)
-BASISDIR = MODDIR / 'd'                    # made read-only -> mkstemp fails
-SRCDIR_ = SCRATCHDIR / 'recvdiscard-src'   # client source tree
-makepath(MODDIR, BASISDIR, SRCDIR_)
-
-# Basis and source share a leading block (2000 'A's) so the generator emits
-# real sums and the receiver gets a block MATCH; the tails differ and the
-# source is larger so a delta (not a no-op) is sent.
-basis = BASISDIR / 'f'
-basis.write_bytes(b'A' * 2000 + b'C' * 1000)
-src = SRCDIR_ / 'f'
-src.write_bytes(b'A' * 2000 + b'B' * 3000)
-
-# A read/write daemon module rooted at MODDIR.
-conf = write_daemon_conf([('recvdiscard', {'path': str(MODDIR),
-                                           'read only': 'no'})])
-url = start_test_daemon(conf, DAEMON_PORT, rsync_cmd=RSYNC)
-
-# Make the destination directory unwritable so the receiver's output mkstemp()
-# fails and it falls back to discarding the delta stream. Restore in finally so
-# the per-test scratch tree can be cleaned up.
-os.chmod(BASISDIR, 0o555)
-
-# Probe that the chmod actually denies writes for *this* process.  A non-root
-# user holding CAP_DAC_OVERRIDE bypasses the directory write bit, so mkstemp
-# would succeed in the daemon receiver too, the discard path would never be
-# taken, and the test would silently pass on a buggy binary.  Better to skip
-# explicitly.  (Root takes this path too: its probe succeeds → skip, which
-# subsumes the uid==0 check.)
-try:
-    _fd, _probe = tempfile.mkstemp(dir=BASISDIR)
-    os.close(_fd)
-    os.unlink(_probe)
-    os.chmod(BASISDIR, 0o755)
-    test_skipped("destination dir is writable despite chmod 0555 "
-                 "(CAP_DAC_OVERRIDE?); cannot force the receiver discard path")
-except OSError:
-    pass  # EACCES -- good, the precondition is enforced
-
-try:
-    argv = split_rsync_cmd(RSYNC) + [
-        '--no-whole-file', '-a',
-        str(src), f'{url}recvdiscard/d/f',
-    ]
-    print('Running:', ' '.join(argv))
-    proc = subprocess.run(argv, stdout=subprocess.PIPE,
-                          stderr=subprocess.STDOUT, text=True)
-    print(proc.stdout, end='')
-finally:
-    os.chmod(BASISDIR, 0o755)
-
-rc = proc.returncode
-
-# A receiver SIGSEGV manifests to the client as a protocol error (the daemon's
-# receiver child crashes mid-stream and the connection drops): exit code 12.
-# With the fix the receiver drains the delta and, because the forced-unwritable
-# destination leaves the file untransferred, the run reports the benign "some
-# files were not transferred" -- exit code 23.
-#
-# 23 is the ONLY non-crash outcome here: the writability probe above guarantees
-# the receiver's mkstemp() fails, so the file is always discarded. An exit 0
-# would mean the file actually transferred -- the discard path was NOT exercised
-# and the run proves nothing -- so require exactly 23 (and call out 12 as the
-# pre-fix crash).
-if rc == 12:
-    test_fail(f"receiver crashed on the discard path (rsync exited {rc}: "
-              "error in rsync protocol data stream -- the receiver child "
-              "SIGSEGV'd in full_fname(NULL))")
-if rc != 23:
-    test_fail(f"expected rsync exit 23 (the forced discard leaves the file "
-              f"untransferred); got {rc} -- the discard path was not exercised, "
-              "so this run validates nothing (12 would be the pre-fix crash)")
-
-print(f"OK: receiver discarded the delta without crashing (rsync exit {rc})")
diff --git a/testsuite/relative-content_test.py b/testsuite/relative-content_test.py
deleted file mode 100644
index 688cd2f72..000000000
--- a/testsuite/relative-content_test.py
+++ /dev/null
@@ -1,42 +0,0 @@
-#!/usr/bin/env python3
-# rsync -aR (--relative) must transfer file CONTENT, not just the directory tree.
-#
-# Regression for a 3.5.0-dev sender bug: the symlink-race-confined content open
-# became secure_relative_open(NULL, fname, O_RDONLY|O_NOFOLLOW, 0), and
-# secure_relative_open() rejects an ABSOLUTE relpath with EINVAL before opening.
-# With --relative the sender keeps the full (absolute) source path as fname, so
-# every regular file failed to open: directories/symlinks still transferred, but
-# the files arrived empty/missing and the run exited 23 ("send_files failed to
-# open ...: Invalid argument (22)").  A near-silent data-loss bug for the very
-# common "rsync -aR /abs/path backup/" pattern.  3.4.x was unaffected.
-#
-# Plain transfer, no root or special features -- this must pass everywhere.
-
-from pathlib import Path
-
-from rsyncfns import SCRATCHDIR, makepath, rmtree, run_rsync, test_fail
-
-base = SCRATCHDIR / 'relcontent'
-src = base / 'src' / 'sub'
-dest = base / 'dest'
-rmtree(base)
-makepath(src, dest)
-
-payload = 'hello relative content\n'
-(src / 'file').write_text(payload)
-
-# --relative with an ABSOLUTE source path: fname on the sender is absolute, the
-# exact trigger.  check=True fails the test if rsync exits non-zero (the buggy
-# sender exits 23 here).
-abs_file = str((src / 'file').resolve())
-run_rsync('-aR', abs_file, str(dest) + '/')
-
-# -R mirrors the absolute source path under dest: dest/<abs_file without leading />.
-landed = dest / abs_file.lstrip('/')
-if not landed.is_file():
-    test_fail(f"rsync -aR did not create {landed} (only the tree, no file?)")
-got = landed.read_text()
-if got != payload:
-    test_fail(f"rsync -aR transferred empty/wrong content: {got!r} != {payload!r}")
-
-print("relative-content: rsync -aR transfers file content for an absolute source")
diff --git a/testsuite/relative-mkpath-dir-symlink_test.py b/testsuite/relative-mkpath-dir-symlink_test.py
deleted file mode 100644
index 9ee838e13..000000000
--- a/testsuite/relative-mkpath-dir-symlink_test.py
+++ /dev/null
@@ -1,64 +0,0 @@
-#!/usr/bin/env python3
-# --relative directory-entry creation escapes the tree via make_path().
-#
-# Companion to relative-mkpath-symlink_test.py for the SECOND make_path() call
-# site flagged in the May 2026 follow-up.  When the receiver creates a directory
-# entry under --relative and the leaf do_mkdir_at() fails with ENOENT (a parent
-# component is missing), generator.c falls back to:
-#   make_path(fname, MKP_DROP_NAME | MKP_SKIP_SLASH)   (recv_generator, the
-#                                                        directory-creation site)
-# and then retries do_mkdir_at().  make_path() builds the parent chain with a
-# PLAIN do_mkdir() on the full multi-component path, so a symlink planted at any
-# parent component is followed and the new directories are created at the
-# symlink's target, OUTSIDE the destination tree.
-#
-# Trigger: transfer a directory whose mid-level parent is absent under a planted
-# parent symlink, with --no-implied-dirs so the mid parent is not pre-created.
-# do_mkdir_at(dest/A/B/C) fails ENOENT (B missing under the dest/A symlink),
-# make_path() then creates dest/A/B == outside/B, escaping the tree.
-#
-# Deterministic static plant; any uid; platform-independent.  Fixed: the
-# do_mkdir_at() ENOENT fallback's make_path() now builds the parent chain through
-# the held-dirfd do_mkdir_at(), confining each component beneath the destination.
-# This is a regression guard -- it asserts nothing escapes and fails hard if that
-# confinement is ever lost.
-
-import subprocess
-
-from rsyncfns import SCRATCHDIR, rmtree, rsync_argv, test_fail
-
-
-srcroot = SCRATCHDIR / 'srcroot'
-dest = SCRATCHDIR / 'dest'
-outside = SCRATCHDIR / 'outside'
-for d in (srcroot, dest, outside):
-    rmtree(d)
-    d.mkdir(parents=True)
-
-# A directory three levels below the implied-dir boundary; 'B' (the mid parent)
-# is what make_path must create under the planted dest/A symlink.
-(srcroot / 'A' / 'B' / 'C').mkdir(parents=True)
-(srcroot / 'A' / 'B' / 'C' / 'file').write_text("PAYLOAD\n")
-
-# Attacker-planted parent symlink pointing OUTSIDE the destination tree.
-(dest / 'A').symlink_to(outside)
-
-# -R replicates A/B/C/ under dest; --no-implied-dirs leaves B uncreated, so the
-# dir-entry do_mkdir_at() fails ENOENT and the make_path() fallback runs.
-subprocess.run(
-    rsync_argv('-aR', '--no-implied-dirs', f'{srcroot}/./A/B/C/', f'{dest}/'),
-    stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL,
-)
-
-try:
-    leaked = sorted(p.name for p in outside.iterdir())
-except OSError:
-    leaked = []
-
-if leaked:
-    test_fail(
-        "--relative make_path() (dir-entry fallback) escaped the destination "
-        f"tree: parent creation landed in {outside} ({leaked}) by following a "
-        "planted dest/A -> outside symlink -- the do_mkdir_at() ENOENT fallback's "
-        "make_path() must stay routed through the held-dirfd do_mkdir_at().")
-# No escape -> the dir-entry make_path fallback was confined beneath the dest.
diff --git a/testsuite/relative-mkpath-symlink_test.py b/testsuite/relative-mkpath-symlink_test.py
deleted file mode 100644
index 437c4b5f4..000000000
--- a/testsuite/relative-mkpath-symlink_test.py
+++ /dev/null
@@ -1,74 +0,0 @@
-#!/usr/bin/env python3
-# --relative implied-parent creation escapes the tree via make_path().
-#
-# Receiver write escape (scenario 2), in a
-# code path the held-dirfd hardening does NOT cover.  Under --relative (-R) the
-# receiver re-creates the implied parent directories of each transferred path.
-# When a needed parent is missing it calls make_path() (util1.c), which creates
-# every missing component with a PLAIN do_mkdir() on the full multi-component
-# path -- no secure_relative_open, no held dirfd, no O_NOFOLLOW.  The per-entry
-# leaf mkdir was converted to the hardened do_mkdir_at(), but make_path()'s
-# parent-chain creation was not, so it still follows a symlink planted at any
-# parent component and creates directories at the symlink's target, OUTSIDE the
-# destination tree.
-#
-# Trigger (generator.c recv_generator, the relative_paths && !implied_dirs site):
-# pushing a file whose implied parent is absent makes the generator call
-#   make_path(fname, MKP_DROP_NAME | MKP_SKIP_SLASH)
-# to build the parent chain.  We use --no-implied-dirs so the parents are not
-# pre-created as their own (hardened do_mkdir_at) entries, forcing the make_path
-# fallback.  An attacker-planted parent symlink (dest/A -> outside) then makes
-# make_path create dest/A/B == outside/B and the file lands at outside/B/file.
-#
-# Deterministic (no race window): the escaping component is pre-planted, exactly
-# like nondaemon-symlink-race.  Runs at any uid; root (a nightly `rsync -aR`
-# backup over a tree with an attacker-writable component) is the high-severity
-# instance.  No RESOLVE_BENEATH gate: make_path() is unconfined on every
-# platform, so creating a brand-new directory has no legitimate reason to follow
-# a symlink component -- the fix should refuse the escape everywhere.
-#
-# Fixed: make_path()'s parent-chain creation now goes through the held-dirfd
-# do_mkdir_at(), which confines each component beneath the destination, so the
-# escape is refused.  This is a regression guard -- it asserts nothing escapes
-# and fails hard if that confinement is ever lost.
-
-import subprocess
-
-from rsyncfns import SCRATCHDIR, rmtree, rsync_argv, test_fail
-
-
-srcroot = SCRATCHDIR / 'srcroot'
-dest = SCRATCHDIR / 'dest'
-outside = SCRATCHDIR / 'outside'
-for d in (srcroot, dest, outside):
-    rmtree(d)
-    d.mkdir(parents=True)
-
-# A transferred file two levels below the implied-dir boundary (the '/./').
-(srcroot / 'A' / 'B').mkdir(parents=True)
-(srcroot / 'A' / 'B' / 'file').write_text("PAYLOAD\n")
-
-# The attacker-planted parent: dest/A is a symlink pointing OUTSIDE the tree.
-(dest / 'A').symlink_to(outside)
-
-# -R replicates the path after '/./' (A/B/file) under dest; --no-implied-dirs
-# forces the make_path() parent-chain fallback rather than per-dir entries.
-subprocess.run(
-    rsync_argv('-aR', '--no-implied-dirs', f'{srcroot}/./A/B/file', f'{dest}/'),
-    stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL,
-)
-
-# The escape: make_path() resolved dest/A/B through the planted dest/A symlink
-# and created the directory (and file) in the outside-the-tree directory.
-try:
-    leaked = sorted(p.name for p in outside.iterdir())
-except OSError:
-    leaked = []
-
-if leaked:
-    test_fail(
-        "--relative make_path() escaped the destination tree: implied-parent "
-        f"creation landed in {outside} ({leaked}) by following a planted "
-        "dest/A -> outside symlink -- make_path()'s parent-chain creation must "
-        "stay routed through the held-dirfd do_mkdir_at().")
-# No escape -> make_path confined the implied-parent creation beneath the dest.
diff --git a/testsuite/relative-symlinked-parent-dotdot_test.py b/testsuite/relative-symlinked-parent-dotdot_test.py
deleted file mode 100644
index d6605c106..000000000
--- a/testsuite/relative-symlinked-parent-dotdot_test.py
+++ /dev/null
@@ -1,37 +0,0 @@
-#!/usr/bin/env python3
-# rsync -aR through an in-tree symlinked parent whose target climbs with ".."
-# but stays BENEATH the transfer anchor must transfer the file.  This is the
-# RESOLVE_BENEATH rule: an in-tree ".." that does not rise above the root is
-# allowed (kernel paths follow it, and 3.4.x followed it).
-#
-# Companion to relative-symlinked-parent_test.py (whose symlink target has no
-# ".."): the portable per-component fallback (the BSDs / Solaris / Cygwin, or a
-# Linux build configured --disable-openat2) originally refused EVERY symlink,
-# then -- after the #715 fix -- still refused any symlink target containing
-# "..", even a safe internal climb.  Both are now followed via a dirfd stack
-# that pops ".." back to the pinned parent (never above the anchor), so this
-# passes everywhere while genuine escapes (../ above the anchor, absolute
-# targets) stay refused -- see secure-relpath-validation / the *-symlink-race
-# tests.  Plain transfer, no root.
-
-import os
-
-from rsyncfns import SCRATCHDIR, assert_same, makepath, rmtree, run_rsync, test_fail
-
-base = SCRATCHDIR / 'rsymparentdd'
-rmtree(base)
-# src/real/sub/file is the payload; src/deep/alias is an in-tree symlink whose
-# target "../real" climbs out of src/deep back to src/ (still beneath src/).
-makepath(base / 'src' / 'real' / 'sub', base / 'src' / 'deep', base / 'dest')
-(base / 'src' / 'real' / 'sub' / 'file').write_text('payload data\n')
-os.symlink('../real', base / 'src' / 'deep' / 'alias')   # in-tree ".." dir-symlink
-
-os.chdir(base)                                            # -R mirrors the path as given
-run_rsync('-aR', 'src/deep/alias/sub/file', 'dest/')     # check=True: fallback exits 23 if unfixed
-
-landed = base / 'dest' / 'src' / 'deep' / 'alias' / 'sub' / 'file'
-if not landed.is_file():
-    test_fail(f"-aR through an in-tree '..' symlinked parent dropped the file: {landed} missing")
-assert_same(base / 'src' / 'real' / 'sub' / 'file', landed, label='content')
-
-print("relative-symlinked-parent-dotdot: -aR follows an in-tree '..' symlinked parent beneath the anchor")
diff --git a/testsuite/relative-symlinked-parent_test.py b/testsuite/relative-symlinked-parent_test.py
deleted file mode 100644
index 259314dfb..000000000
--- a/testsuite/relative-symlinked-parent_test.py
+++ /dev/null
@@ -1,35 +0,0 @@
-#!/usr/bin/env python3
-# rsync -aR of a source file whose path goes through an IN-TREE symlinked parent
-# directory must transfer the file -- the symlink is part of the operator's own
-# source tree, which 3.4.x follows.
-#
-# A/B-discovered 3.5 regression (abdiff: 3.5 vs 3.4.4): an early per-component
-# O_NOFOLLOW resolver refused to traverse the in-tree symlinked parent that -R
-# keeps in the path, so the content open failed (exit 23, the file lost; a
-# near-silent partial copy).  The secure resolver now follows in-tree directory
-# symlinks on every platform -- it readlinks the symlink and walks its target off
-# held dirfds -- so this transfers uniformly.  3.4.x is unaffected everywhere.
-#
-# Related to the fixed `rsync -aR /abs` bug (sender content-open confinement),
-# but a distinct trigger: an in-tree symlinked *parent component* under -R.
-# Plain transfer, no root.
-
-import os
-
-from rsyncfns import SCRATCHDIR, assert_same, makepath, rmtree, run_rsync, test_fail
-
-base = SCRATCHDIR / 'rsymparent'
-rmtree(base)
-makepath(base / 'src' / 'real' / 'sub', base / 'dest')
-(base / 'src' / 'real' / 'sub' / 'file').write_text('payload data\n')
-os.symlink('real', base / 'src' / 'link')          # in-tree dir-symlink: link -> real
-
-os.chdir(base)                                       # -R mirrors the path as given
-run_rsync('-aR', 'src/link/sub/file', 'dest/')      # check=True: resolver follows the in-tree symlink
-
-landed = base / 'dest' / 'src' / 'link' / 'sub' / 'file'
-if not landed.is_file():
-    test_fail(f"-aR through an in-tree symlinked parent dropped the file: {landed} missing")
-assert_same(base / 'src' / 'real' / 'sub' / 'file', landed, label='content')
-
-print("relative-symlinked-parent: -aR transfers a file under an in-tree symlinked parent dir")
diff --git a/testsuite/remote-shell-newline-escaping_test.py b/testsuite/remote-shell-newline-escaping_test.py
deleted file mode 100644
index 89b281472..000000000
--- a/testsuite/remote-shell-newline-escaping_test.py
+++ /dev/null
@@ -1,38 +0,0 @@
-#!/usr/bin/env python3
-# Finding [27]: rsync's remote-shell argument quoting (SHELL_CHARS in options.c)
-# omitted the newline/CR command separators, so a newline in a remote path could
-# inject a separate command into the remote shell.  The test rsh support/lsh.sh
-# runs the remote command via `eval "${@}"`, so an UNescaped newline in the
-# destination splits off a second line that runs `touch <sentinel>`.  The fix
-# adds \n\r to SHELL_CHARS so such args are quoted and the newline stays literal.
-
-import os
-import subprocess
-
-from rsyncfns import SCRATCHDIR, SRCDIR, rmtree, rsync_argv, test_fail, rsh_cmd
-
-base = SCRATCHDIR / 'remote-shell-newline'
-rmtree(base)
-src = base / 'src'
-src.mkdir(parents=True)
-(src / 'f').write_text('payload\n')
-sentinel = base / 'pwned'
-
-env = os.environ.copy()
-env['RSYNC_RSH'] = rsh_cmd(None, '--no-cd')
-dest = f"lh:{base}/dest\ntouch {sentinel}\n#"
-subprocess.run(rsync_argv('-a', f'{src}/', dest),
-               stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, env=env)
-
-# Without the fix, lsh.sh's eval splits on the newline: the first line runs the
-# server into base/dest and the second runs `touch <sentinel>`.  With the newline
-# quoted the whole string is one literal (invalid) destination, so neither effect
-# happens.  Both checks are filesystem-independent -- they don't depend on whether
-# a newline-bearing path is creatable, which differs across Linux/macOS/BSD.
-if sentinel.exists():
-    test_fail("remote-shell newline injection executed the sentinel command")
-if (base / 'dest').exists():
-    test_fail("remote-shell newline split the destination "
-              "(eval ran the server into base/dest as a separate command)")
-
-print("remote-shell-newline-escaping: newline in a remote arg is quoted, not executed")
diff --git a/testsuite/rename-fullpath-symlink-race_test.py b/testsuite/rename-fullpath-symlink-race_test.py
deleted file mode 100644
index f835c2290..000000000
--- a/testsuite/rename-fullpath-symlink-race_test.py
+++ /dev/null
@@ -1,116 +0,0 @@
-#!/usr/bin/env python3
-# Receiver write-escape via a symlink race on finish_transfer()'s tmp->final
-# rename when an absolute --temp-dir (or --partial-dir) is in use.
-#
-# do_rename_at() (syscall.c) confines a rename relative to held dirfds, but it
-# bailed out to the unconfined path-based do_rename() whenever EITHER path was
-# absolute.  With an absolute --temp-dir the receiver's temp file is an absolute
-# path, so the tmp->final rename took that bail and re-resolved the destination
-# from the path -- following a `dest/sub` component flipped from a directory to a
-# symlink mid-transfer, landing the transferred file OUTSIDE the destination
-# tree (an arbitrary write / LPE for a local attacker who can flip a dest parent).
-#
-# RED before the fix (files escape to outside/); GREEN once do_rename_at confines
-# the relative destination even when the source temp path is absolute.
-#
-# Found by Omar Elsayed; this is the framework version of that demonstration,
-# with no rsync.c instrumentation -- a separate-process flipper wins the race.
-
-import os
-import subprocess
-import time
-
-from rsyncfns import race_budget, SCRATCHDIR, rmtree, rsync_argv, test_fail
-
-# Unique per-invocation base: this test's rename storm can corrupt the `dest`
-# directory on some filesystems (OpenBSD FFS leaves an un-removable dir), and a
-# fixed name would let that wreck block a later pass's setup.  See _move_aside().
-base = SCRATCHDIR / f'rename-fullpath-{os.getpid()}'
-src = base / 'src'
-dest = base / 'dest'
-outside = base / 'outside'
-tmpd = base / 'tmpd'            # absolute --temp-dir, OUTSIDE the destination
-rmtree(base)
-(src / 'sub').mkdir(parents=True)
-for i in range(40):
-    (src / 'sub' / f'f{i}').write_text('payload\n')
-dest.mkdir()
-outside.mkdir()
-tmpd.mkdir()
-
-sub = dest / 'sub'            # the parent the attacker flips
-link = dest / '.sublink'     # a symlink -> outside, swapped in for `sub`
-link.symlink_to(outside)
-
-
-def push():
-    # --temp-dir must precede the paths: runtests runs with POSIXLY_CORRECT, which
-    # disables getopt permutation, so an option after the paths is treated as a path.
-    subprocess.run(
-        rsync_argv('-a', f'--temp-dir={tmpd}', f'{src}/', f'{dest}/'),
-        stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL,
-    )
-
-
-# Positive control: a normal push lands the files in dest/sub, so the temp+rename
-# write path is genuinely exercised and the race below isn't vacuous.
-rmtree(sub)
-sub.mkdir()
-push()
-if not (sub / 'f0').is_file():
-    test_fail("positive control: a normal --temp-dir push did not write files "
-              "into dest/sub, so the rename race window would be vacuous")
-for f in outside.iterdir():
-    f.unlink()
-
-# Separate-process flipper: keep `sub` flipping between a real directory and the
-# symlink->outside (an atomic 3-rename swap with `link`).  A separate process is
-# needed to flip fast enough to win the rename window.  It self-terminates when
-# the test process goes away (getppid changes) and after a hard deadline, so a
-# killed test can't leak an orphan that poisons later tests (see start_path_flipper).
-flip_code = (
-    "import os, sys, time\n"
-    "sub, link = sys.argv[1], sys.argv[2]\n"
-    "scratch = sub + '.flip'\n"
-    "parent = os.getppid()\n"
-    "deadline = time.time() + 120\n"
-    "while time.time() < deadline and os.getppid() == parent:\n"
-    "    try:\n"
-    "        os.makedirs(sub, exist_ok=True)\n"
-    "        os.rename(sub, scratch); os.rename(link, sub); os.rename(scratch, link)\n"
-    "        os.rename(sub, scratch); os.rename(link, sub); os.rename(scratch, link)\n"
-    "    except OSError:\n"
-    "        pass\n"
-)
-flip = subprocess.Popen(['python3', '-c', flip_code, str(sub), str(link)])
-try:
-    deadline = time.monotonic() + race_budget(10.0)
-    while time.monotonic() < deadline:
-        # Start each round from a real (absent->mkdir'd) dest/sub so rsync sees a
-        # directory at flist time; the flip then happens during the file writes.
-        rmtree(sub)
-        try:
-            sub.unlink()
-        except OSError:
-            pass
-        push()
-        # Count only escaped regular files (the transferred payload); the
-        # flipper/reset churn can momentarily leave a dir or symlink in outside,
-        # which is harness noise, not a write escape.
-        escaped = sorted(p.name for p in outside.iterdir()
-                         if p.is_file() and not p.is_symlink())
-        if escaped:
-            test_fail(
-                "rename-fullpath symlink race: files were written OUTSIDE the "
-                f"destination tree ({escaped}) -- finish_transfer's tmp->final "
-                "rename followed a flipped dest/sub symlink because an absolute "
-                "--temp-dir made do_rename_at fall back to the unconfined "
-                "do_rename().")
-finally:
-    flip.terminate()
-    try:
-        flip.wait(timeout=5)
-    except subprocess.TimeoutExpired:
-        flip.kill()
-
-# No escape within the race budget.
diff --git a/testsuite/rename-mixed-parent-transfer_test.py b/testsuite/rename-mixed-parent-transfer_test.py
deleted file mode 100644
index a766ab17c..000000000
--- a/testsuite/rename-mixed-parent-transfer_test.py
+++ /dev/null
@@ -1,151 +0,0 @@
-#!/usr/bin/env python3
-# Python rewrite of testsuite/rename-mixed-parent-transfer.test.
-#
-# End-to-end (real daemon transfer) companion to the unit-level
-# rename-mixed-parent-symlink-race / rename-mixed-parent-escape-poc tests.
-#
-# Those tests exercise do_rename_at() directly. This one drives the escape
-# through an actual rsync transfer against a no-chroot daemon, to prove the
-# 3.4.3 do_rename_at() mixed-parent fallback is reachable and exploitable
-# from the wire, not just at the function boundary.
-#
-# Background: do_rename_at() in 3.4.3 only confined parent resolution under
-# secure_relative_open() when *both* the source and destination contained a
-# slash:
-#
-#     if (!old_slash || !new_slash)
-#             return do_rename(old_path, new_path);  /* plain rename() */
-#
-# So a rename where one side is a bare top-of-module name (resolved in the
-# module-root CWD, which is safe) and the other side is slashed (whose parent
-# the kernel resolves freely) fell back to plain rename() -- letting an
-# attacker-planted parent symlink on the slashed side escape the module.
-#
-# Trigger: --backup --backup-dir=bdir. When the daemon overwrites an existing
-# top-of-module file "foo", it backs it up via make_backup() -> link_or_rename(),
-# ending in do_rename_at("foo", "bdir/foo"): source bare, destination slashed.
-# With "bdir" planted as a symlink pointing outside the module, the 3.4.3
-# fallback renames the in-module file out through the symlink. With the
-# per-side fix, the slashed destination parent is opened under
-# secure_relative_open(), the symlink is refused, and the file stays inside.
-# (do_link_at() is tried first but already has the per-side hardening, so it
-# refuses the symlinked backup dir and falls through to do_rename_at().)
-#
-# The vulnerable code path is the same on every platform (including the
-# per-component fallback on systems without RESOLVE_BENEATH), so this test is
-# not platform-gated.
-
-import os
-import subprocess
-
-from rsyncfns import (
-    SCRATCHDIR, find_attacker_uid,
-    rmtree, rsync_argv, start_test_daemon, test_fail, test_skipped, write_daemon_conf,
-)
-
-# Operator paths follow a uid0/euid-owned symlink and refuse a foreign-owned one,
-# so the escape vector is an ATTACKER-owned backup-dir symlink and a root daemon.
-if os.geteuid() != 0:
-    test_skipped("requires root to plant a backup-dir symlink owned by a non-self uid")
-ATT_UID = find_attacker_uid()
-if ATT_UID is None:
-    test_skipped("no untrusted-uid user available for cross-uid plant")
-
-
-DAEMON_PORT = 12903
-OLD = "INSIDE_MODULE_DATA\n"
-NEW = "NEW_PUSHED_DATA\n"
-
-mod = SCRATCHDIR / 'module'
-outside = SCRATCHDIR / 'outside'
-# NB: 'src' is reserved by runtests.py (a symlink to the source tree), so use
-# a distinct name for our push source.
-src = SCRATCHDIR / 'src_files'
-for d in (mod, outside, src):
-    rmtree(d)
-    d.mkdir(parents=True)
-
-# The existing in-module file the daemon will overwrite (and thus back up).
-# Its content is what an attacker would relocate outside the module.
-(mod / 'foo').write_text(OLD)
-
-# A different source so the push genuinely overwrites foo and triggers backup.
-(src / 'foo').write_text(NEW)
-
-# Serve the module as root so the daemon euid differs from the attacker uid; the
-# ownership walk must then refuse the foreign-owned backup-dir symlink.  Use
-# numeric uid/gid 0, not the name "root": the root *group* is "wheel" on the BSDs
-# and macOS, so `gid = root` is rejected there.
-conf = write_daemon_conf([
-    ('upload', {'path': str(mod), 'use chroot': 'no', 'read only': 'no',
-                'uid': '0', 'gid': '0'}),
-])
-daemon_url = start_test_daemon(conf, DAEMON_PORT).rstrip('/')
-
-
-def push_with_backup():
-    return subprocess.run(
-        rsync_argv('-t', '--backup', '--backup-dir=bdir',
-                   f'{src}/foo', f'{daemon_url}/upload/'),
-        stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True)
-
-
-# Positive control: a real backup-dir must receive the original file, proving
-# this transfer shape exercises --backup-dir and the mixed-parent backup rename.
-(mod / 'bdir').mkdir()
-proc = push_with_backup()
-if proc.returncode != 0:
-    test_fail("positive control: daemon --backup-dir transfer failed "
-              f"(rc={proc.returncode}):\n{proc.stdout or ''}")
-backup = mod / 'bdir' / 'foo'
-if not backup.is_file():
-    test_fail("positive control: --backup-dir=bdir did not create "
-              f"{backup}; the test would not exercise the backup rename path")
-if backup.read_text() != OLD:
-    test_fail("positive control: backup content differs from the original "
-              f"module/foo content: {backup.read_text()!r}")
-if (mod / 'foo').read_text() != NEW:
-    test_fail("positive control: module/foo was not overwritten by the "
-              "daemon transfer")
-
-rmtree(mod / 'bdir')
-(mod / 'foo').write_text(OLD)
-
-# The attacker-planted backup-dir symlink, pointing outside the module, owned by
-# the attacker uid (not root, the uid the module is served as).
-os.symlink(str(outside), mod / 'bdir')
-os.lchown(mod / 'bdir', ATT_UID, ATT_UID)
-
-# Push the changed file straight into the module root with backups enabled and
-# a backup-dir relative to the module root. The transfer may report an error on
-# the fixed binary (the secure backup rename is refused), so the security oracle
-# is where the files end up.
-proc = push_with_backup()
-attack_out = proc.stdout or ''
-
-# The escape: the original in-module file was renamed out through the bdir
-# symlink into the outside-the-module directory.
-if os.path.lexists(outside / 'foo'):
-    try:
-        got = (outside / 'foo').read_text().strip()
-    except OSError:
-        got = '<unreadable>'
-    test_fail("mixed-parent rename escaped the module: backup of module/foo "
-              f"landed in {outside}/foo (content: {got}); do_rename_at "
-              "followed the planted backup-dir symlink")
-
-# Sanity: nothing else should have leaked outside the module either.
-leaked = os.listdir(outside)
-if leaked:
-    test_fail(f"unexpected files escaped the module into {outside}: {leaked}")
-
-try:
-    final = (mod / 'foo').read_text()
-except (OSError, UnicodeError) as exc:
-    test_fail("foreign-owned --backup-dir symlink transfer left module/foo "
-              f"unreadable ({exc!r}; rc={proc.returncode}):\n{attack_out}")
-if final == NEW:
-    test_fail("foreign-owned --backup-dir symlink transfer overwrote module/foo "
-              "without taking or refusing the backup through bdir; the "
-              f"--backup-dir path may not have been exercised "
-              f"(rc={proc.returncode}):\n{attack_out}")
diff --git a/testsuite/reverse-daemon-delta_test.py b/testsuite/reverse-daemon-delta_test.py
deleted file mode 100644
index a2d57c7f8..000000000
--- a/testsuite/reverse-daemon-delta_test.py
+++ /dev/null
@@ -1,127 +0,0 @@
-#!/usr/bin/env python3
-# Reverse-direction version-mixing smoke test: OLD client <-> CURRENT daemon.
-#
-# Every other two-sided test drives with the current binary and uses the old
-# binary only as the server/daemon. That covers new-client -> old-server but
-# NOT the more important backward-compat direction: a current daemon/server
-# must keep working for the large installed base of OLD clients. This test
-# fills that gap by starting the daemon with the CURRENT build (RSYNC) and
-# running the OLD binary (RSYNC_PEER) as the client.
-#
-# It exercises, in BOTH transfer directions and with and without compression:
-#   * push (old client = sender,   current daemon = receiver) -> old->new delta
-#   * pull (current daemon = sender, old client  = receiver) -> new->old delta
-# In each case the receiving side already holds an older version of the file,
-# so the rsync delta algorithm actually runs (block matching + token stream)
-# rather than a whole-file copy -- verified by asserting the bytes moved over
-# the wire are far smaller than the file (a whole-file transfer of this random,
-# incompressible data would be ~filesize even with -z).
-#
-# When no second binary was selected (RSYNC_PEER == RSYNC) this still runs as a
-# current<->current smoke test of delta + compression over a daemon.
-
-import filecmp
-import os
-import re
-import shlex
-import subprocess
-
-from rsyncfns import (
-    FROMDIR, RSYNC, RSYNC_PEER, TMPDIR,
-    build_rsyncd_conf, makepath, make_data_file, start_test_daemon, test_fail, split_rsync_cmd,
-)
-
-DAEMON_PORT = 12894
-FILESIZE = 512 * 1024          # big enough that delta savings are unambiguous
-# Old rsync (2.6.x era) prints "wrote N bytes  read M bytes"; 3.0+ prints
-# "sent N bytes  received M bytes". Accept both so old clients parse too.
-_SUMMARY = re.compile(r'(?:sent|wrote) ([\d,]+) bytes\s+(?:received|read) ([\d,]+) bytes')
-
-TODIR = TMPDIR / 'to'
-
-
-def make_versions(path_old, path_new):
-    """Write an 'old' file and a 'new' file derived from it: same head, a
-    changed middle block, and an appended tail. The shared blocks give the
-    delta algorithm something to match; the changes give it real literal data
-    to send."""
-    make_data_file(path_old, FILESIZE)
-    data = bytearray(open(path_old, 'rb').read())
-    data[100000:100050] = bytes(((b + 1) & 0xFF) for b in data[100000:100050])
-    data += b'reverse-delta appended tail\n' * 64
-    with open(path_new, 'wb') as f:
-        f.write(data)
-
-
-def peer_client(args, label):
-    """Run the OLD client (RSYNC_PEER) and return (sent, received) wire bytes
-    parsed from rsync's summary line. Fails the test on non-zero exit."""
-    argv = split_rsync_cmd(RSYNC_PEER) + args
-    # Force C locale: rsync groups the "sent/received N bytes" numbers per the
-    # locale (e.g. de_DE uses '.' for thousands), which would break parsing.
-    proc = subprocess.run(argv, stdout=subprocess.PIPE,
-                          stderr=subprocess.STDOUT, text=True,
-                          env={**os.environ, 'LC_ALL': 'C'})
-    print(proc.stdout, end='')
-    if proc.returncode != 0:
-        test_fail(f"{label}: old client exited {proc.returncode}")
-    m = _SUMMARY.search(proc.stdout)
-    if not m:
-        test_fail(f"{label}: could not parse sent/received from client output")
-    return int(m.group(1).replace(',', '')), int(m.group(2).replace(',', ''))
-
-
-def assert_delta(label, moved):
-    """A delta transfer of FILESIZE moves far less than the whole file; a
-    whole-file copy (delta failed to engage) would move ~FILESIZE."""
-    if moved >= FILESIZE // 2:
-        test_fail(f"{label}: {moved} bytes crossed the wire -- delta did not "
-                  f"engage (file is {FILESIZE} bytes)")
-
-
-def run_push(compress):
-    """old client (sender) -> current daemon (receiver), receiver holds the old
-    version as the basis. Exercises old->new delta encoding."""
-    tag = "push+z" if compress else "push"
-    basis = TODIR / f'{tag}.dat'    # daemon-side basis (old)
-    source = src / f'{tag}.dat'     # client source (new)
-    make_versions(basis, source)
-    opts = ['-a', '-v'] + (['-z'] if compress else [])
-    sent, _ = peer_client(opts + [str(source), f'{url}test-to/'], tag)
-    if not filecmp.cmp(source, basis, shallow=False):
-        test_fail(f"{tag}: daemon-side file does not match source after push")
-    assert_delta(tag, sent)
-    print(f"{tag}: OK (sent {sent} bytes for a {FILESIZE}-byte file)")
-
-
-def run_pull(compress):
-    """current daemon (sender) -> old client (receiver), client holds the old
-    version as the basis. Exercises new->old delta encoding."""
-    tag = "pull+z" if compress else "pull"
-    served = FROMDIR / f'{tag}.dat'   # daemon module file (new)
-    local = dst / f'{tag}.dat'        # client basis (old)
-    make_versions(local, served)
-    opts = ['-a', '-v'] + (['-z'] if compress else [])
-    _, received = peer_client(
-        opts + [f'{url}test-from/{tag}.dat', str(dst) + '/'], tag)
-    if not filecmp.cmp(served, local, shallow=False):
-        test_fail(f"{tag}: client file does not match daemon source after pull")
-    assert_delta(tag, received)
-    print(f"{tag}: OK (received {received} bytes for a {FILESIZE}-byte file)")
-
-
-os.chdir(TMPDIR)
-makepath(FROMDIR, TODIR)
-
-# Current build is the daemon; old binary is the client.
-conf = build_rsyncd_conf()
-url = start_test_daemon(conf, DAEMON_PORT, rsync_cmd=RSYNC)
-
-src = TMPDIR / 'client-src'
-dst = TMPDIR / 'client-dst'
-makepath(src, dst)
-
-run_push(compress=False)
-run_push(compress=True)
-run_pull(compress=False)
-run_pull(compress=True)
diff --git a/testsuite/rrsync-alt-dest-inband-pivot_test.py b/testsuite/rrsync-alt-dest-inband-pivot_test.py
deleted file mode 100644
index ad60128d4..000000000
--- a/testsuite/rrsync-alt-dest-inband-pivot_test.py
+++ /dev/null
@@ -1,144 +0,0 @@
-#!/usr/bin/env python3
-"""An in-band symlink at an alt-dest name must not read outside the restricted dir.
-
---link-dest/--compare-dest/--copy-dest name a basis directory rsync only reads
-through.  A missing one is the ordinary first-run case, so it cannot simply be
-refused -- but leaving the name for rsync to resolve lets the same transfer
-plant a symlink there and have the basis lookup read out of the tree.  With
---copy-dest a matching basis file is copied into the destination, so the
-out-of-tree content lands where it can be read back.
-"""
-
-import os
-import shlex
-import signal
-import subprocess
-import sys
-
-signal.signal(signal.SIGUSR1, signal.SIG_IGN)
-signal.signal(signal.SIGUSR2, signal.SIG_IGN)
-if '--shell' in sys.argv:
-    index = sys.argv.index('--shell') + 2
-    env = {**os.environ, 'SSH_ORIGINAL_COMMAND': ' '.join(sys.argv[index:])}
-    signal.signal(signal.SIGUSR1, signal.SIG_DFL)
-    signal.signal(signal.SIGUSR2, signal.SIG_DFL)
-    wrapper, root = env['RRSYNC_WRAPPER'], env['RRSYNC_ROOT']
-    os.execve(wrapper, [wrapper, '-wo', root], env)
-
-from rsyncfns import (RSYNC, SCRATCHDIR, makepath, patched_rrsync,
-                      proc_self_fd_pins, rmtree, rsync_argv, rsync_path_arg,
-)
-
-T = 1234567890
-
-base = SCRATCHDIR / 'rrsync-alt-dest-inband-pivot'
-rmtree(base)
-src = base / 'src'
-root = base / 'restricted'
-outside = base / 'outside'
-makepath(src, root, outside)
-
-# Same length and mtime as the source file, so rsync's quick check calls the
-# basis a match and --copy-dest copies it instead of transferring.
-(outside / 'f0').write_bytes(b'ADMIN-SECRET\n')
-(src / 'f0').write_bytes(b'CLIENT-DATA0\n')
-# The pivot has to be INSTALLED before the generator does f0's basis lookup,
-# and the generator runs ahead of the receiver -- sorting 'basis' first is not
-# enough on its own, and a run where the generator wins would pass vacuously.
-# Put a few thousand files in between: the receiver has only the symlink to
-# write while the generator has to work through all of them, so by the time it
-# reaches f0 the symlink is long since in place.  The assertion after the run
-# checks that it really was, rather than trusting the ordering.
-os.symlink('../outside', src / 'basis')
-filler = src / 'c'
-filler.mkdir()
-for i in range(3000):
-    (filler / ('%04d' % i)).write_bytes(b'.')
-os.utime(src / 'f0', (T, T))
-os.utime(outside / 'f0', (T, T))
-
-# RSYNC may be a multi-word command (the runner's --protocol=N, or valgrind)
-# while rrsync hands its RSYNC to execlp() as a single executable name, so it
-# has to be wrapped before patched_rrsync() sees it.
-shim = base / 'rsync-shim'
-shim.write_text('#!/bin/sh\nexec ' + rsync_path_arg(RSYNC) + ' "$@"\n')
-shim.chmod(0o755)
-wrapper = patched_rrsync(base, rsync_path=str(shim))
-rsh = f'{shlex.quote(sys.executable)} {shlex.quote(os.path.abspath(__file__))} --shell'
-env = {**os.environ, 'RRSYNC_WRAPPER': str(wrapper), 'RRSYNC_ROOT': str(root)}
-
-got = subprocess.run(
-    rsync_argv('-rlt', '--copy-dest=basis', '-e', rsh, f'{src}/', 'ignored:'),
-    env=env, capture_output=True, text=True, timeout=60)
-
-landed = (root / 'f0').read_bytes() if (root / 'f0').exists() else None
-pivot = os.readlink(root / 'basis') if (root / 'basis').is_symlink() else None
-print(f'rc={got.returncode}, landed={landed!r}, pivot={pivot!r}, '
-      f'stderr={got.stderr!r}', flush=True)
-assert landed != b'ADMIN-SECRET\n', (
-    'rrsync let a --copy-dest symlink created by the same transfer read a file '
-    'outside the restricted directory and deliver it to the client')
-
-if proc_self_fd_pins():
-    # rrsync stands in an empty unlinked directory: the basis lookup finds
-    # nothing, so the file transfers normally and first-run alt-dest keeps
-    # working.  That it SUCCEEDS is the point -- refusing would have been the
-    # easy answer and would break every first-run --link-dest.
-    assert pivot == '../outside', (
-        'the transfer did not install the pivot symlink, so nothing was in '
-        f'place for the basis lookup to follow and this run proves nothing: '
-        f'pivot={pivot!r}')
-    assert got.returncode == 0, (
-        f'the transfer failed instead of finding an empty basis: '
-        f'rc={got.returncode}, stderr={got.stderr!r}')
-    assert landed == b'CLIENT-DATA0\n', (
-        f'the source file did not transfer: landed={landed!r}')
-else:
-    # Without the /proc/self/fd primitive there is no way to hand rsync an
-    # inode instead of a name, so the option is refused BEFORE rsync runs --
-    # which is why there is no pivot to find here.
-    assert got.returncode != 0 and 'receiver option path does not exist' in got.stderr, (
-        f'a missing alt-dest was neither pinned nor refused: '
-        f'rc={got.returncode}, stderr={got.stderr!r}')
-    assert pivot is None and landed is None, (
-        f'the refusal did not stop the transfer: pivot={pivot!r}, '
-        f'landed={landed!r}')
-
-# A basis directory that really exists must still be usable as one.
-makepath(root / 'real-basis')
-(root / 'real-basis' / 'f1').write_bytes(b'BASIS-MATCH\n')
-(src / 'f1').write_bytes(b'BASIS-MATCH\n')
-os.utime(src / 'f1', (T, T))
-os.utime(root / 'real-basis' / 'f1', (T, T))
-ok = subprocess.run(
-    rsync_argv('-rlt', '--copy-dest=real-basis', '-e', rsh,
-               f'{src}/f1', 'ignored:'),
-    env=env, capture_output=True, text=True, timeout=20)
-assert ok.returncode == 0 and (root / 'f1').read_bytes() == b'BASIS-MATCH\n', (
-    f'an existing --copy-dest basis stopped working: rc={ok.returncode}, '
-    f'stderr={ok.stderr!r}')
-
-# --compare-dest takes the same route and must be covered too: a match there
-# makes rsync skip the file entirely rather than copy it, so the tell is the
-# file going MISSING from the destination.
-rmtree(root)
-makepath(root)
-got = subprocess.run(
-    rsync_argv('-rlt', '--compare-dest=basis', '-e', rsh, f'{src}/', 'ignored:'),
-    env=env, capture_output=True, text=True, timeout=60)
-landed = (root / 'f0').read_bytes() if (root / 'f0').exists() else None
-pivot = os.readlink(root / 'basis') if (root / 'basis').is_symlink() else None
-if proc_self_fd_pins():
-    assert pivot == '../outside' and got.returncode == 0, (
-        'the --compare-dest run did not install the pivot or did not complete, '
-        f'so it proves nothing: pivot={pivot!r}, rc={got.returncode}, '
-        f'stderr={got.stderr!r}')
-    assert landed == b'CLIENT-DATA0\n', (
-        'the out-of-tree basis was consulted through the --compare-dest '
-        f'symlink, so rsync skipped transferring the file: landed={landed!r}, '
-        f'stderr={got.stderr!r}')
-else:
-    assert got.returncode != 0 and 'receiver option path does not exist' in got.stderr, (
-        f'a missing --compare-dest was neither pinned nor refused: '
-        f'rc={got.returncode}, stderr={got.stderr!r}')
-    assert pivot is None, f'the refusal did not stop the transfer: pivot={pivot!r}'
diff --git a/testsuite/rrsync-archive-mode_test.py b/testsuite/rrsync-archive-mode_test.py
deleted file mode 100644
index efa4d238e..000000000
--- a/testsuite/rrsync-archive-mode_test.py
+++ /dev/null
@@ -1,47 +0,0 @@
-#!/usr/bin/env python3
-# A subdir-restricted rrsync must accept a normal `rsync -a` transfer.
-#
-# A/B-discovered regression (abdiff: 3.5 rrsync vs 3.4.4 rrsync).  3.5 added 'D'
-# to rrsync's short_disabled_subdir ('KLk' -> 'DKLk') to deny device/special
-# CREATION in a restricted upload dir.  But `-a` is `-rlptgoD`: the client always
-# sends a bundled short-option string containing 'D' (e.g. -logDtpre.iLsfxCIvu),
-# so a subdir-restricted rrsync now REJECTS plain `rsync -a` outright:
-#     <rrsync> error: option -D has been disabled on this server.   (exit 1)
-# -- in BOTH directions (push and pull).  3.4.4's rrsync accepted it.  This
-# breaks the canonical "rsync -a ... rrsync-host:dir/" backup for every restricted
-# (non-"/") rrsync, on every platform.  The deny should strip device/special
-# semantics (e.g. force --no-D), not reject the whole transfer.
-#
-# Stub test (RSYNC -> true): we only check rrsync's option ACCEPTANCE, not a real
-# transfer.  Runs anywhere python3 + true exist; no root.
-
-import os
-import shutil
-import subprocess
-
-from rsyncfns import SCRATCHDIR, patched_rrsync, test_fail, test_skipped
-
-true = shutil.which('true') or '/usr/bin/true'
-if not os.path.exists(true):
-    test_skipped("no true(1) to stub rsync")
-
-base = SCRATCHDIR / 'rrsync_a'
-restricted = base / 'restricted'
-restricted.mkdir(parents=True, exist_ok=True)
-# The pull (--sender) command reads `inbox/`; rrsync inode-pins an existing
-# --sender source before exec (a non-existent one is treated as a race and
-# refused), so the source must exist for this option-acceptance check.
-(restricted / 'inbox').mkdir(exist_ok=True)
-rrsync = patched_rrsync(base, rsync_path=true)
-
-# What a stock `rsync -a` sends as the server command (bundled short opts incl D):
-for direction, cmd in (("push", 'rsync --server -logDtpre.iLsfxCIvu . inbox/'),
-                       ("pull", 'rsync --server --sender -logDtpre.iLsfxCIvu . inbox/')):
-    env = {**os.environ, 'SSH_ORIGINAL_COMMAND': cmd}
-    r = subprocess.run([str(rrsync), str(restricted)], env=env,
-                       capture_output=True, text=True)
-    if r.returncode != 0:
-        test_fail(f"subdir-restricted rrsync rejected `rsync -a` ({direction}, "
-                  f"exit {r.returncode}): {r.stderr.strip()}")
-
-print("rrsync-archive-mode: subdir-restricted rrsync accepts `rsync -a` (push & pull)")
diff --git a/testsuite/rrsync-backup-dir-inband-pivot_test.py b/testsuite/rrsync-backup-dir-inband-pivot_test.py
deleted file mode 100644
index 3a2a15a47..000000000
--- a/testsuite/rrsync-backup-dir-inband-pivot_test.py
+++ /dev/null
@@ -1,224 +0,0 @@
-#!/usr/bin/env python3
-"""rrsync must not let one transfer create and consume an option-path symlink."""
-
-import os
-import shlex
-import signal
-import subprocess
-import sys
-
-signal.signal(signal.SIGUSR1, signal.SIG_IGN)
-signal.signal(signal.SIGUSR2, signal.SIG_IGN)
-if '--shell' in sys.argv:
-    index = sys.argv.index('--shell') + 2
-    env = {**os.environ, 'SSH_ORIGINAL_COMMAND': ' '.join(sys.argv[index:])}
-    signal.signal(signal.SIGUSR1, signal.SIG_DFL)
-    signal.signal(signal.SIGUSR2, signal.SIG_DFL)
-    wrapper = env['RRSYNC_WRAPPER']
-    root = env['RRSYNC_ROOT']
-    os.execve(wrapper, [wrapper, '-wo', root], env)
-
-from rsyncfns import (RSYNC, SCRATCHDIR, makepath, patched_rrsync,
-                      proc_self_fd_pins, rmtree, rsync_argv, rsync_path_arg,
-)
-
-# Handing rsync an inode instead of a name needs the /proc/self/fd primitive.
-# Where it is missing there is no safe way to pass a peer-suppliable option
-# path, so rrsync refuses it outright -- the escape is blocked either way, but
-# only the pinning answer also keeps first use working.
-PINS = proc_self_fd_pins()
-
-base = SCRATCHDIR / 'rrsync-backup-dir-inband-pivot'
-rmtree(base)
-stage = base / 'attacker-stage'
-src = base / 'attacker-next'
-root = base / 'restricted'
-outside = base / 'outside'
-makepath(stage, src, root, outside)
-
-(stage / 'authorized_keys').write_bytes(b'ATTACKER-SSH-KEY\n')
-(src / 'authorized_keys').write_bytes(b'NEW-IN-TREE-CONTENT\n')
-os.symlink('../outside', src / 'a')
-(outside / 'authorized_keys').write_bytes(b'ADMIN-SSH-KEY\n')
-
-# RSYNC may be a multi-word command (the runner's --protocol=N, or valgrind)
-# while rrsync hands its RSYNC to execlp() as a single executable name, so it
-# has to be wrapped before patched_rrsync() sees it.
-shim = base / 'rsync-shim'
-shim.write_text('#!/bin/sh\nexec ' + rsync_path_arg(RSYNC) + ' "$@"\n')
-shim.chmod(0o755)
-wrapper = patched_rrsync(base, rsync_path=str(shim))
-rsh = f'{shlex.quote(sys.executable)} {shlex.quote(os.path.abspath(__file__))} --shell'
-env = {**os.environ, 'RRSYNC_WRAPPER': str(wrapper), 'RRSYNC_ROOT': str(root)}
-
-seed = subprocess.run(
-    rsync_argv('-rlI', '-e', rsh, f'{stage}/authorized_keys', 'ignored:'),
-    env=env, capture_output=True, text=True, timeout=20)
-assert seed.returncode == 0
-assert (root / 'authorized_keys').read_bytes() == b'ATTACKER-SSH-KEY\n'
-assert not (root / 'a').exists()
-
-os.symlink('../outside', root / 'a')
-blocked = subprocess.run(
-    rsync_argv('-rlbI', '--backup-dir=a', '-e', rsh,
-               f'{src}/', 'ignored:'),
-    env=env, capture_output=True, text=True, timeout=20)
-assert blocked.returncode != 0
-assert (outside / 'authorized_keys').read_bytes() == b'ADMIN-SSH-KEY\n'
-(root / 'a').unlink()
-
-seed = subprocess.run(
-    rsync_argv('-rlI', '-e', rsh, f'{stage}/authorized_keys', 'ignored:'),
-    env=env, capture_output=True, text=True, timeout=20)
-assert seed.returncode == 0
-
-got = subprocess.run(
-    rsync_argv('-rlbI', '--backup-dir=a', '-e', rsh,
-               f'{src}/', 'ignored:'),
-    env=env, capture_output=True, text=True, timeout=20)
-
-escaped = outside / 'authorized_keys'
-pivot = os.readlink(root / 'a') if (root / 'a').is_symlink() else None
-print(f'seed_rc={seed.returncode}, rc={got.returncode}, pivot={pivot!r}, '
-      f'escaped={escaped.read_bytes()!r}, stderr={got.stderr!r}', flush=True)
-assert escaped.read_bytes() == b'ADMIN-SSH-KEY\n', (
-    'rrsync followed a backup-dir symlink created by the same transfer and '
-    'replaced an existing file outside its restricted directory')
-# ...and it has to be blocked by THIS policy.  "the outside file is unchanged"
-# is also satisfied by any unrelated failure, so require a nonzero status plus
-# the evidence of the mechanism that produced it.
-assert got.returncode != 0, (
-    f'the pivot did not overwrite the outside file, but the transfer also did '
-    f'not fail, so nothing stopped it: rc={got.returncode}, '
-    f'stderr={got.stderr!r}')
-if PINS:
-    # rrsync created the backup dir itself before exec, so the transfer's own
-    # symlink could only unlink that name, not redirect the held inode -- which
-    # is why the backup fails instead of escaping.  The symlink must actually
-    # have been planted, or the pivot was never attempted.
-    assert pivot == '../outside', (
-        f'the transfer did not plant the pivot symlink, so the run proves '
-        f'nothing: pivot={pivot!r}')
-    assert '/proc/self/fd/' in got.stderr, (
-        'the transfer failed, but not through the pinned backup dir: an '
-        f'unrelated failure would satisfy the check above: stderr={got.stderr!r}')
-else:
-    assert 'receiver option path does not exist' in got.stderr, (
-        'the transfer failed, but not with the missing-option-path refusal: '
-        f'an unrelated failure would satisfy the check above: '
-        f'stderr={got.stderr!r}')
-
-# --temp-dir: rsync does not create it, so a missing one is refused on every
-# platform rather than being conjured up.
-tmpdir = subprocess.run(
-    rsync_argv('-rlI', '--temp-dir=no-such-tmp', '-e', rsh,
-               f'{src}/authorized_keys', 'ignored:'),
-    env=env, capture_output=True, text=True, timeout=20)
-assert tmpdir.returncode != 0 and 'receiver option path does not exist' in tmpdir.stderr, (
-    f'a missing --temp-dir was not refused: rc={tmpdir.returncode}, '
-    f'stderr={tmpdir.stderr!r}')
-assert not (root / 'no-such-tmp').exists(), (
-    'a missing --temp-dir must not be created either')
-
-if not PINS:
-    # Without the pin primitive every peer-suppliable option path whose leaf is
-    # missing is refused, so the first-use cases below cannot apply.  Check the
-    # refusal itself and stop: the escape was already shown blocked above.
-    for opt in ('--backup-dir=fresh-backup', '--partial-dir=.rsync-partial',
-                '--link-dest=no-such-basis'):
-        r = subprocess.run(
-            rsync_argv('-rlbI', opt, '-e', rsh, f'{src}/authorized_keys', 'ignored:'),
-            env=env, capture_output=True, text=True, timeout=20)
-        assert r.returncode != 0 and 'receiver option path does not exist' in r.stderr, (
-            f'{opt} was neither pinned nor refused without /proc/self/fd: '
-            f'rc={r.returncode}, stderr={r.stderr!r}')
-    sys.exit(0)
-
-# Controls come after the security assertions on purpose: an environment where
-# a control fails for an unrelated reason must not be able to mask the escape
-# check above by aborting first.
-def reseed():
-    r = subprocess.run(
-        rsync_argv('-rlI', '-e', rsh, f'{stage}/authorized_keys', 'ignored:'),
-        env=env, capture_output=True, text=True, timeout=20)
-    assert r.returncode == 0, f'reseed failed: stderr={r.stderr!r}'
-    assert (root / 'authorized_keys').read_bytes() == b'ATTACKER-SSH-KEY\n'
-
-
-reseed()
-
-# An ordinary in-tree backup into a directory that already exists.
-(root / 'backup').mkdir()
-normal = subprocess.run(
-    rsync_argv('-rlbI', '--backup-dir=backup', '-e', rsh,
-               f'{src}/authorized_keys', 'ignored:'),
-    env=env, capture_output=True, text=True, timeout=20)
-assert normal.returncode == 0, f"ordinary in-tree backup failed: stderr={normal.stderr!r}"
-assert (root / 'backup' / 'authorized_keys').read_bytes() == b'ATTACKER-SSH-KEY\n'
-
-# A first-use --backup-dir must still WORK: rrsync creates the missing leaf
-# under the pinned parent rather than refusing it, so dated/rotating backup
-# directory names keep working through a restricted account.
-reseed()
-firstuse = subprocess.run(
-    rsync_argv('-rlbI', '--backup-dir=fresh-backup', '-e', rsh,
-               f'{src}/authorized_keys', 'ignored:'),
-    env=env, capture_output=True, text=True, timeout=20)
-assert firstuse.returncode == 0, (
-    f'a first-use --backup-dir was refused: rc={firstuse.returncode}, '
-    f'stderr={firstuse.stderr!r}')
-fresh = root / 'fresh-backup'
-assert fresh.is_dir() and not fresh.is_symlink(), (
-    f'first-use --backup-dir did not leave a real directory: {fresh}')
-assert (fresh / 'authorized_keys').read_bytes() == b'ATTACKER-SSH-KEY\n', (
-    'the backup did not land in the created backup dir, so the run above '
-    'proves nothing about --backup-dir working')
-
-# A first-use --backup-dir may also name a whole missing hierarchy: rsync
-# builds one itself (make_bak_dir()), so rrsync has to as well rather than
-# stopping at "the immediate parent must exist".
-reseed()
-nested = subprocess.run(
-    rsync_argv('-rlbI', '--backup-dir=bak/2026/07', '-e', rsh,
-               f'{src}/authorized_keys', 'ignored:'),
-    env=env, capture_output=True, text=True, timeout=20)
-assert nested.returncode == 0, (
-    f'a nested first-use --backup-dir was refused: rc={nested.returncode}, '
-    f'stderr={nested.stderr!r}')
-assert (root / 'bak' / '2026' / '07' / 'authorized_keys').exists(), (
-    'the nested backup dir was accepted but the backup did not land in it')
-
-# Same for a first-use --partial-dir, the resumable-upload idiom -- and it must
-# be created 0700 as rsync creates it (util1.c), not 0777&~umask: a partial
-# file is an incomplete copy of the peer's data and is not for the rest of the
-# machine to read.
-partial = subprocess.run(
-    rsync_argv('-rlI', '--partial', '--partial-dir=.rsync-partial', '-e', rsh,
-               f'{src}/authorized_keys', 'ignored:'),
-    env=env, capture_output=True, text=True, timeout=20)
-assert partial.returncode == 0, (
-    f'a first-use --partial-dir was refused: rc={partial.returncode}, '
-    f'stderr={partial.stderr!r}')
-pdir = root / '.rsync-partial'
-assert pdir.is_dir() and not pdir.is_symlink(), (
-    f'first-use --partial-dir did not leave a real directory: {pdir}')
-mode = pdir.stat().st_mode & 0o777
-assert mode == 0o700, (
-    f'the partial dir was created {mode:04o}, not 0700: partial files would be '
-    'readable by other users on the server')
-
-# A missing alt-dest is neither created nor refused: naming a basis directory
-# that does not exist yet is the ordinary first-run case.  rrsync stands in an
-# empty unlinked directory, so the lookup finds nothing and no name is left for
-# an in-band symlink to take over (see rrsync-alt-dest-inband-pivot).
-altdest = subprocess.run(
-    rsync_argv('-rlI', '--link-dest=no-such-basis', '-e', rsh,
-               f'{src}/authorized_keys', 'ignored:'),
-    env=env, capture_output=True, text=True, timeout=20)
-assert altdest.returncode == 0, (
-    f'a first-run --link-dest was refused: rc={altdest.returncode}, '
-    f'stderr={altdest.stderr!r}')
-assert not (root / 'no-such-basis').exists(), (
-    'a missing --link-dest must not be created')
-assert not list(root.glob('.rrsync-empty-basis*')), (
-    'the basis placeholder was left behind in the restricted dir')
diff --git a/testsuite/rrsync-debug-denied_test.py b/testsuite/rrsync-debug-denied_test.py
deleted file mode 100644
index ebc2cd24c..000000000
--- a/testsuite/rrsync-debug-denied_test.py
+++ /dev/null
@@ -1,78 +0,0 @@
-#!/usr/bin/env python3
-"""rrsync must not let a peer turn on the server's --debug output.
-
-Defence in depth, not the fix: what actually stops a merge file's contents
-coming back is the redaction in exclude.c (see filter-merge-content-echo).
-
-This closes ONE spelling of the control -- an explicit -M--debug -- and no
-more.  It does not close the FILTER trace family: options.c maps verbosity
-onto the debug flags, so -vvv still raises a restricted server to FILTER2 and
-forwards it, and the trace metadata (merge-file openability, the server's
-absolute paths, mergelist bookkeeping) comes back with it.  Rule TEXT stays
-redacted at every verbosity, which is the property that matters and which
-filter-merge-content-echo pins.  Do not read this test as sealing -vvv.
-
-It costs nothing: server_options() forwards --info but never --debug, so no
-stock client sends one, and the only way it reaches a server is a peer asking
-for it by name with -M.
-"""
-
-import os
-import signal
-import subprocess
-import sys
-
-signal.signal(signal.SIGUSR1, signal.SIG_IGN)
-signal.signal(signal.SIGUSR2, signal.SIG_IGN)
-if '--shell' in sys.argv:
-    index = sys.argv.index('--shell') + 2
-    env = {**os.environ, 'SSH_ORIGINAL_COMMAND': ' '.join(sys.argv[index:])}
-    signal.signal(signal.SIGUSR1, signal.SIG_DFL)
-    signal.signal(signal.SIGUSR2, signal.SIG_DFL)
-    wrapper, root = env['RRSYNC_WRAPPER'], env['RRSYNC_ROOT']
-    os.execve(wrapper, [wrapper, '-wo', root], env)
-
-from rsyncfns import RSYNC, SCRATCHDIR, makepath, patched_rrsync, rmtree, rsync_argv
-
-base = SCRATCHDIR / 'rrsync-debug-denied'
-rmtree(base)
-src = base / 'src'
-root = base / 'root'
-makepath(src, root)
-(src / 'f').write_bytes(b'hi\n')
-
-# RSYNC may be a multi-word command (the runner's --protocol=N, or valgrind)
-# while rrsync hands its RSYNC to execlp() as a single executable name, so it
-# has to be wrapped before patched_rrsync() sees it.
-shim = base / 'rsync-shim'
-shim.write_text('#!/bin/sh\nexec ' + RSYNC + ' "$@"\n')
-shim.chmod(0o755)
-wrapper = patched_rrsync(base, rsync_path=str(shim))
-rsh = f'{sys.executable} {os.path.abspath(__file__)} --shell'
-env = {**os.environ, 'RRSYNC_WRAPPER': str(wrapper), 'RRSYNC_ROOT': str(root)}
-
-for spelling in ('-M--debug=FILTER2', '--remote-option=--debug=ALL3'):
-    got = subprocess.run(
-        rsync_argv('-r', spelling, '-e', rsh, f'{src}/', 'ignored:'),
-        env=env, capture_output=True, text=True, timeout=20)
-    out = got.stdout + got.stderr
-    assert got.returncode != 0 and 'option --debug has been disabled' in out, (
-        f'rrsync accepted a peer-selected {spelling}: rc={got.returncode}, '
-        f'out={out!r}')
-
-# The option table is generated by the cull-options script, so the entry this
-# relies on can come back on a regeneration.  Check the value, not just the
-# behaviour, so that is unambiguous when it happens.
-assert "'debug': -1," in wrapper.read_text(), (
-    "support/rrsync no longer disables 'debug' -- a cull-options regeneration "
-    'probably restored it')
-
-# Ordinary transfers must be unaffected -- including -vvv, which reaches
-# FILTER2 by verbosity alone and so must NOT be caught by the refusal above.
-for extra in ([], ['-vv'], ['-vvv']):
-    ok = subprocess.run(
-        rsync_argv('-r', *extra, '-e', rsh, f'{src}/', 'ignored:'),
-        env=env, capture_output=True, text=True, timeout=20)
-    assert ok.returncode == 0 and (root / 'f').read_bytes() == b'hi\n', (
-        f'an ordinary transfer broke with {extra}: rc={ok.returncode}, '
-        f'stderr={ok.stderr!r}')
diff --git a/testsuite/rrsync-files-from-stdin_test.py b/testsuite/rrsync-files-from-stdin_test.py
deleted file mode 100644
index 24eabeaea..000000000
--- a/testsuite/rrsync-files-from-stdin_test.py
+++ /dev/null
@@ -1,120 +0,0 @@
-#!/usr/bin/env python3
-"""A pull with a local --files-from must work through rrsync.
-
-`rsync -a --files-from=LIST host:. dest/` does not send the list file to the
-server.  It sends the literal `--files-from=-` and streams the names down the
-protocol connection, so `-` reaches rrsync as an option value meaning "read the
-list from stdin" -- it is a sentinel, not a pathname.
-
-88cee089 started inode-pinning every checked option value, and `--files-from`
-is checked (long_opts['files-from'] == 3).  Pinning `-` means realpath()ing and
-opening a file named "-" in the restricted dir, which does not exist, so rrsync
-kills the connection before rsync ever runs:
-
-    rrsync error: post-realpath open failed (race detected): - No such file...
-
-That breaks every --files-from pull through a restricted account.  v3.4.4
-delivers the file.
-
-A list file that really is a pathname must still be validated and pinned, so
-the second half checks that an out-of-tree --files-from is still refused.
-"""
-
-import os
-import shlex
-import subprocess
-
-from rsyncfns import (
-    RSYNC, SCRATCHDIR, makepath, patched_rrsync, rmtree, rsync_argv, test_fail, rsync_path_arg,
-)
-
-DATA = 'FILES-FROM-CONTENT\n'
-
-base = SCRATCHDIR / 'rrsync-files-from'
-rmtree(base)
-restricted = base / 'restricted'
-dest = base / 'dest'
-outside = base / 'outside'
-makepath(restricted, dest, outside)
-
-(restricted / 'f1').write_text(DATA)
-(restricted / 'f2').write_text(DATA)
-(outside / 'list').write_text('f1\n')
-
-listfile = base / 'list'
-listfile.write_text('f1\nf2\n')
-
-# $RSYNC may carry a wrapper (valgrind, --protocol=N); rrsync wants a single
-# executable, so hand it a shim that re-expands the whole command line.
-shim = base / 'rsync-shim'
-shim.write_text('#!/bin/sh\nexec ' + rsync_path_arg(RSYNC) + ' "$@"\n')
-shim.chmod(0o755)
-
-rrsync = patched_rrsync(base, rsync_path=str(shim))
-
-rsh = base / 'fake-rsh'
-rsh.write_text(
-    '#!/bin/sh\n'
-    'shift\n'
-    'SSH_ORIGINAL_COMMAND="$*"\n'
-    'export SSH_ORIGINAL_COMMAND\n'
-    'exec %s %s\n' % (shlex.quote(str(rrsync)), shlex.quote(str(restricted))))
-rsh.chmod(0o755)
-
-
-def transfer(*args):
-    return subprocess.run(rsync_argv('-a', '-e', str(rsh), *args),
-                          stdout=subprocess.PIPE, stderr=subprocess.STDOUT,
-                          text=True)
-
-
-# --- the regression: a local --files-from sends "--files-from=-" -------------
-proc = transfer('--files-from=' + str(listfile), 'dummy:.', str(dest) + '/')
-ctx = f'rc={proc.returncode}, output={proc.stdout.strip()[:300]!r}'
-
-for name in ('f1', 'f2'):
-    got = dest / name
-    if not got.is_file():
-        test_fail(f'--files-from pull did not deliver {name} ({ctx})')
-    if got.read_text() != DATA:
-        test_fail(f'--files-from pull delivered wrong content for {name} ({ctx})')
-if proc.returncode != 0:
-    test_fail(f'--files-from pull delivered the files but failed ({ctx})')
-
-# --- control: a --files-from that IS a pathname stays confined ---------------
-# The sentinel exemption must be for the exact string "-" only, not a general
-# hole in the checking of this option.
-def rrsync_direct(files_from):
-    # rrsync insists on the "--sender ..." shape sshd hands it; get that right
-    # or it dies at the syntax check without ever looking at the option value,
-    # which would make this control pass no matter what.
-    return subprocess.run(
-        [str(rrsync), '-ro', '-no-lock', str(restricted)],
-        env={**os.environ,
-             'SSH_ORIGINAL_COMMAND':
-                 'rsync --server --sender -logDtpre.iLsfxC '
-                 '--files-from=%s . .' % files_from},
-        stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True)
-
-
-# Prove the command shape itself is accepted, so a rejection below is really
-# about the pathname.
-proc = rrsync_direct(restricted / 'f1')
-for wrong in ('invalid rsync-command syntax', 'does not run rsync'):
-    if wrong in proc.stdout:
-        test_fail('the control command shape is wrong, so it never reaches the '
-                  f'--files-from check ({wrong!r}): '
-                  f'output={proc.stdout.strip()[:300]!r}')
-
-proc = rrsync_direct(outside / 'list')
-if proc.returncode == 0:
-    test_fail('an out-of-tree --files-from pathname was accepted: '
-              f'output={proc.stdout.strip()[:300]!r}')
-for wrong in ('invalid rsync-command syntax', 'does not run rsync'):
-    if wrong in proc.stdout:
-        test_fail('the out-of-tree --files-from was rejected for the wrong '
-                  f'reason ({wrong!r}, not the pathname): '
-                  f'{proc.stdout.strip()[:300]!r}')
-
-print('rrsync passes the --files-from stdin sentinel through; '
-      'a real out-of-tree list file is still refused')
diff --git a/testsuite/rrsync-merge-file-confine_test.py b/testsuite/rrsync-merge-file-confine_test.py
deleted file mode 100644
index ccede3535..000000000
--- a/testsuite/rrsync-merge-file-confine_test.py
+++ /dev/null
@@ -1,139 +0,0 @@
-#!/usr/bin/env python3
-"""An rrsync restricted dir must bound the merge files the peer can name.
-
-Filter rules travel over the protocol rather than in the argv rrsync validates,
-so a dir-merge rule can name a file outside the restricted dir and have the
-server read it in as rules.  Redacting the resulting diagnostics is not enough:
-an exclude-only merge (the "-" modifier) turns every line into a pattern, so
-nothing fails to parse and the client reads the file's contents off its own
-file list instead -- no error, no verbosity, and on a pull no --delete either.
-"""
-
-import os
-import shlex
-import signal
-import subprocess
-import sys
-
-signal.signal(signal.SIGUSR1, signal.SIG_IGN)
-signal.signal(signal.SIGUSR2, signal.SIG_IGN)
-if '--shell' in sys.argv:
-    i = sys.argv.index('--shell') + 2
-    env = {**os.environ, 'SSH_ORIGINAL_COMMAND': ' '.join(sys.argv[i:])}
-    signal.signal(signal.SIGUSR1, signal.SIG_DFL)
-    signal.signal(signal.SIGUSR2, signal.SIG_DFL)
-    wrapper, root = env['RRSYNC_WRAPPER'], env['RRSYNC_ROOT']
-    os.execve(wrapper, [wrapper, '-ro', '-no-lock', root], env)
-
-from rsyncfns import RSYNC, SCRATCHDIR, makepath, patched_rrsync, rmtree, rsync_argv, rsync_path_arg
-
-base = SCRATCHDIR / 'rrsync-merge-file-confine'
-rmtree(base)
-root = base / 'root'
-sub = root / 'sub'
-dest = base / 'dest'
-makepath(sub, dest)
-
-# The secret sits BESIDE the restricted dir, so "../" reaches it from the root.
-# Its line is the name of a file inside the root: if the server reads it as an
-# exclude list, that file silently vanishes from the transfer and the client has
-# confirmed the content without ever seeing it.
-(base / 'outside-secret').write_text('secretword\n')
-(root / 'secretword').write_bytes(b'X')
-(root / 'keep').write_bytes(b'X')
-# An ordinary in-tree merge file, for the control below.
-(sub / 'intree-dropped').write_bytes(b'X')
-(sub / 'intree-kept').write_bytes(b'X')
-(sub / '.rsync-filter').write_text('intree-dropped\n')
-
-# RSYNC may be a multi-word command (the runner's --protocol=N, or valgrind)
-# while rrsync hands its RSYNC to execlp() as a single executable name, so it
-# has to be wrapped before patched_rrsync() sees it.
-shim = base / 'rsync-shim'
-shim.write_text('#!/bin/sh\nexec ' + rsync_path_arg(RSYNC) + ' "$@"\n')
-shim.chmod(0o755)
-wrapper = patched_rrsync(base, rsync_path=str(shim))
-rsh = f'{shlex.quote(sys.executable)} {shlex.quote(os.path.abspath(__file__))} --shell'
-env = {**os.environ, 'RRSYNC_WRAPPER': str(wrapper), 'RRSYNC_ROOT': str(root)}
-
-
-def pull(filt, into):
-    into.mkdir(parents=True, exist_ok=True)
-    return subprocess.run(
-        rsync_argv('-r', f'--filter={filt}', '-e', rsh, 'ignored:.', f'{into}/'),
-        env=env, capture_output=True, text=True, timeout=20)
-
-
-# The escape: an exclude-only dir-merge naming a file outside the restricted
-# dir.  No --delete and no -v are involved -- the answer is the file list.
-esc = dest / 'escape'
-got = pull(':-s ../outside-secret', esc)
-assert got.returncode == 0, (
-    'confining the merge open must not cost the transfer: refusing outright '
-    f'would hand the peer a denial of service. rc={got.returncode}, '
-    f'stderr={got.stderr!r}')
-assert (esc / 'secretword').exists(), (
-    'the server read a merge file outside the restricted dir: "secretword" was '
-    f'excluded, so its presence in that file is confirmed to the client. '
-    f'rc={got.returncode}, stdout={got.stdout!r}, stderr={got.stderr!r}')
-assert 'secretword' not in got.stderr, (
-    f'the out-of-root merge file\'s text reached the peer: stderr={got.stderr!r}')
-
-# Control: an ordinary in-tree .rsync-filter must still be read and obeyed.
-# Without this, refusing every merge file would pass the assertion above.
-ctl = dest / 'control'
-got = pull(':-s .rsync-filter', ctl)
-assert got.returncode == 0, (
-    f'the in-tree dir-merge failed the transfer: rc={got.returncode}, '
-    f'stderr={got.stderr!r}')
-assert (ctl / 'sub' / 'intree-kept').exists(), (
-    f'the in-tree dir-merge broke the transfer: rc={got.returncode}, '
-    f'stdout={got.stdout!r}, stderr={got.stderr!r}')
-assert not (ctl / 'sub' / 'intree-dropped').exists(), (
-    'the in-tree .rsync-filter was not applied, so this control does not show '
-    f'that merge files still work: stdout={got.stdout!r}, stderr={got.stderr!r}')
-
-# --confine-root direct, no wrapper: a source argument reached through a symlink
-# makes rsync's tracked cwd deeper than the kernel's, so a merge file's own
-# relative symlink resolves from one directory while the confinement check walks
-# from another.  Seeded lexically, a ".." that really escapes looks like it
-# landed back inside the root.  rrsync happens to reject the argument shapes
-# that reach this, so it is driven directly rather than through the wrapper.
-alias_root = base / 'aliased'
-makepath(alias_root)
-(base / 'aliased-secret').write_text('aliased-word\n')
-(alias_root / 'aliased-word').write_bytes(b'X')
-(alias_root / 'plain').write_bytes(b'X')
-os.symlink('.', alias_root / 'self-alias')
-os.symlink('../aliased-secret', alias_root / 'outside-link')
-(alias_root / 'intree-list').write_text('plain\n')
-
-
-def confined_pull(filter_text, into):
-    (alias_root / '.rsync-filter').write_text(filter_text + '\n')
-    rmtree(into)
-    into.mkdir(parents=True, exist_ok=True)
-    return subprocess.run(
-        rsync_argv('-r', f'--confine-root={alias_root}',
-                   '--filter=:s .rsync-filter',
-                   f'{alias_root}/self-alias/', f'{into}/'),
-        capture_output=True, text=True, timeout=20)
-
-
-esc2 = dest / 'aliased-escape'
-got = confined_pull('merge,- outside-link', esc2)
-assert not (got.returncode == 0 and not (esc2 / 'aliased-word').exists()), (
-    'a merge file outside the root was read through a symlinked source arg, so '
-    f'"aliased-word" was excluded: rc={got.returncode}, stderr={got.stderr!r}')
-
-# Control: the same symlinked source arg with an IN-TREE merge target must still
-# work, or the assertion above would also pass if confinement simply broke every
-# transfer that reaches a directory through a symlink.
-ctl2 = dest / 'aliased-control'
-got = confined_pull('merge,- intree-list', ctl2)
-assert got.returncode == 0 and (ctl2 / 'aliased-word').exists(), (
-    'a symlinked source arg with an in-tree merge file broke the transfer: '
-    f'rc={got.returncode}, stderr={got.stderr!r}')
-assert not (ctl2 / 'plain').exists(), (
-    'the in-tree merge file was not applied through the symlinked source arg, '
-    f'so the escape check above proves nothing: stderr={got.stderr!r}')
diff --git a/testsuite/rrsync-no-overwrite-backup-collision_test.py b/testsuite/rrsync-no-overwrite-backup-collision_test.py
deleted file mode 100644
index c3009a8f2..000000000
--- a/testsuite/rrsync-no-overwrite-backup-collision_test.py
+++ /dev/null
@@ -1,99 +0,0 @@
-#!/usr/bin/env python3
-"""rrsync -no-overwrite must not let backup publication overwrite a protected file.
-
---ignore-existing protects the live destination, but a backup published onto a
-name that already exists deletes what is there (backup.c make_backup()), and
-deleting a file backs it up first (delete.c).  So a --delete of an unrelated
-file can land on a protected name that the source itself also carries.
-"""
-
-import os
-import shlex
-import signal
-import subprocess
-import sys
-
-signal.signal(signal.SIGUSR1, signal.SIG_IGN)
-signal.signal(signal.SIGUSR2, signal.SIG_IGN)
-if '--shell' in sys.argv:
-    i = sys.argv.index('--shell') + 2
-    env = {**os.environ, 'SSH_ORIGINAL_COMMAND': ' '.join(sys.argv[i:])}
-    signal.signal(signal.SIGUSR1, signal.SIG_DFL)
-    signal.signal(signal.SIGUSR2, signal.SIG_DFL)
-    wrapper, root = env['RRSYNC_WRAPPER'], env['RRSYNC_ROOT']
-    flags = env.get('RRSYNC_FLAGS', '-wo -no-overwrite -no-lock').split()
-    os.execve(wrapper, [wrapper, *flags, root], env)
-
-from rsyncfns import RSYNC, SCRATCHDIR, makepath, patched_rrsync, rmtree, rsync_argv, rsync_path_arg
-
-base = SCRATCHDIR / 'rrsync-no-overwrite-backup-collision'
-rmtree(base)
-src = base / 'src'
-makepath(src)
-# In the source too, so --ignore-existing is what is supposed to protect it.
-(src / 'victim.bak').write_bytes(b'SOURCE')
-
-
-def plant(root):
-    makepath(root)
-    (root / 'victim').write_bytes(b'OLD-LIVE')     # absent from src: --delete removes it
-    (root / 'victim.bak').write_bytes(b'POLICY')   # the protected file
-
-
-root = base / 'root'
-plant(root)
-
-# RSYNC may be a multi-word command (the runner's --protocol=N, or valgrind)
-# while rrsync hands its RSYNC to execlp() as a single executable name, so it
-# has to be wrapped before patched_rrsync() sees it.
-shim = base / 'rsync-shim'
-shim.write_text('#!/bin/sh\nexec ' + rsync_path_arg(RSYNC) + ' "$@"\n')
-shim.chmod(0o755)
-wrapper = patched_rrsync(base, rsync_path=str(shim))
-rsh = f'{shlex.quote(sys.executable)} {shlex.quote(os.path.abspath(__file__))} --shell'
-env = {**os.environ, 'RRSYNC_WRAPPER': str(wrapper), 'RRSYNC_ROOT': str(root)}
-
-# The stock client sends -b inside the remote short-option bundle, so the
-# refusal has to come from short_disabled, not the long-option table.
-argv = rsync_argv('-r', '--delete', '--backup', '--suffix=.bak', '-e', rsh, f'{src}/', 'ignored:')
-got = subprocess.run(argv, env=env, capture_output=True, text=True, timeout=20)
-
-state = (root / 'victim.bak').read_bytes() if (root / 'victim.bak').exists() else None
-assert got.returncode != 0 and 'option -b has been disabled' in got.stderr, (
-    f'rrsync -no-overwrite accepted backup mode: rc={got.returncode}, '
-    f'stdout={got.stdout!r}, stderr={got.stderr!r}')
-assert state == b'POLICY', (
-    f'backup publication overwrote a protected file: state={state!r}, '
-    f'stderr={got.stderr!r}')
-
-# An ordinary upload must still work.
-(src / 'new').write_bytes(b'NEW')
-safe = subprocess.run(
-    rsync_argv('-rI', '-e', rsh, f'{src}/new', 'ignored:'),
-    env=env, capture_output=True, text=True, timeout=20)
-assert safe.returncode == 0 and (root / 'new').read_bytes() == b'NEW', (
-    f'ordinary upload failed: rc={safe.returncode}, stderr={safe.stderr!r}')
-
-# The refusal must be CONDITIONAL on -no-overwrite -- and the identical run
-# through a wrapper without it also demonstrates that the destructive primitive
-# is real, which the assertions above cannot show once the refusal aborts the
-# transfer.  --ignore-existing is passed by hand here: it is what -no-overwrite
-# forces, so this shows the collision defeating that protection rather than the
-# transfer simply writing its own victim.bak.  A fresh root keeps this from
-# disturbing the checks above.
-plain_root = base / 'root-plain'
-rmtree(plain_root)
-plant(plain_root)
-plain_env = {**env, 'RRSYNC_ROOT': str(plain_root), 'RRSYNC_FLAGS': '-wo -no-lock'}
-plain_argv = rsync_argv('-r', '--delete', '--backup', '--suffix=.bak',
-                        '--ignore-existing', '-e', rsh, f'{src}/', 'ignored:')
-plain = subprocess.run(plain_argv, env=plain_env, capture_output=True, text=True, timeout=20)
-plain_state = (plain_root / 'victim.bak').read_bytes() if (plain_root / 'victim.bak').exists() else None
-assert plain.returncode == 0, (
-    'without -no-overwrite the same options must be accepted, or the refusal '
-    'above is unconditional and says nothing about the policy: '
-    f'rc={plain.returncode}, stderr={plain.stderr!r}')
-assert plain_state == b'OLD-LIVE', (
-    'the backup collision did not overwrite the protected file even without '
-    '-no-overwrite, so this test no longer exercises the primitive it claims '
-    f'to: state={plain_state!r}, stderr={plain.stderr!r}')
diff --git a/testsuite/rrsync-no-overwrite-delay-updates_test.py b/testsuite/rrsync-no-overwrite-delay-updates_test.py
deleted file mode 100644
index 0cd53f094..000000000
--- a/testsuite/rrsync-no-overwrite-delay-updates_test.py
+++ /dev/null
@@ -1,67 +0,0 @@
-#!/usr/bin/env python3
-"""rrsync -no-overwrite must protect implicit delay-update partial files."""
-
-import os
-import shlex
-import signal
-import subprocess
-import sys
-
-signal.signal(signal.SIGUSR1, signal.SIG_IGN)
-signal.signal(signal.SIGUSR2, signal.SIG_IGN)
-if '--shell' in sys.argv:
-    i = sys.argv.index('--shell') + 2
-    env = {**os.environ, 'SSH_ORIGINAL_COMMAND': ' '.join(sys.argv[i:])}
-    signal.signal(signal.SIGUSR1, signal.SIG_DFL)
-    signal.signal(signal.SIGUSR2, signal.SIG_DFL)
-    wrapper, root = env['RRSYNC_WRAPPER'], env['RRSYNC_ROOT']
-    flags = env.get('RRSYNC_FLAGS', '-wo -no-overwrite -no-lock').split()
-    os.execve(wrapper, [wrapper, *flags, root], env)
-
-from rsyncfns import RSYNC, SCRATCHDIR, makepath, patched_rrsync, rmtree, rsync_argv, rsync_path_arg
-
-base = SCRATCHDIR / 'rrsync-no-overwrite-delay-updates'
-rmtree(base)
-src = base / 'src'
-root = base / 'root'
-makepath(src, root / '.~tmp~')
-(src / 'victim').write_bytes(b'NEW')
-protected = root / '.~tmp~' / 'victim'
-protected.write_bytes(b'POLICY')
-
-# RSYNC may be a multi-word command (the runner's --protocol=N, or valgrind)
-# while rrsync hands its RSYNC to execlp() as a single executable name, so it
-# has to be wrapped before patched_rrsync() sees it.
-shim = base / 'rsync-shim'
-shim.write_text('#!/bin/sh\nexec ' + rsync_path_arg(RSYNC) + ' "$@"\n')
-shim.chmod(0o755)
-wrapper = patched_rrsync(base, rsync_path=str(shim))
-rsh = f'{shlex.quote(sys.executable)} {shlex.quote(os.path.abspath(__file__))} --shell'
-env = {**os.environ, 'RRSYNC_WRAPPER': str(wrapper), 'RRSYNC_ROOT': str(root)}
-got = subprocess.run(
-    rsync_argv('-rI', '--delay-updates', '-e', rsh,
-               f'{src}/victim', 'ignored:'),
-    env=env, capture_output=True, text=True, timeout=20)
-
-state = protected.read_bytes() if protected.exists() else None
-assert got.returncode != 0 and 'option --delay-updates has been disabled' in got.stderr, (
-    f'rrsync -no-overwrite accepted --delay-updates: rc={got.returncode}, '
-    f'stdout={got.stdout!r}, stderr={got.stderr!r}')
-assert state == b'POLICY', f'delay-updates consumed an existing file: state={state!r}'
-
-# The refusal must be CONDITIONAL on -no-overwrite.  Run the identical option
-# through a wrapper without it: if that is refused too, the option is simply
-# disabled for every rrsync deployment and the assertion above proves nothing
-# about the policy.  A fresh root keeps this from disturbing the checks above.
-plain_root = base / 'root-plain'
-rmtree(plain_root)
-makepath(plain_root / '.~tmp~')
-(plain_root / '.~tmp~' / 'victim').write_bytes(b'POLICY')
-plain_env = {**env, 'RRSYNC_ROOT': str(plain_root), 'RRSYNC_FLAGS': '-wo -no-lock'}
-plain = subprocess.run(
-    rsync_argv('-rI', '--delay-updates', '-e', rsh, f'{src}/victim', 'ignored:'),
-    env=plain_env, capture_output=True, text=True, timeout=20)
-assert plain.returncode == 0, (
-    'without -no-overwrite the same option must be accepted, or the refusal '
-    'above is unconditional and says nothing about the policy: '
-    f'rc={plain.returncode}, stderr={plain.stderr!r}')
diff --git a/testsuite/rrsync-no-overwrite-logfile_test.py b/testsuite/rrsync-no-overwrite-logfile_test.py
deleted file mode 100644
index 89d6b6e30..000000000
--- a/testsuite/rrsync-no-overwrite-logfile_test.py
+++ /dev/null
@@ -1,73 +0,0 @@
-#!/usr/bin/env python3
-"""rrsync -no-overwrite must not let the peer append to an existing file."""
-
-import os
-import shlex
-import signal
-import subprocess
-import sys
-
-signal.signal(signal.SIGUSR1, signal.SIG_IGN)
-signal.signal(signal.SIGUSR2, signal.SIG_IGN)
-if '--shell' in sys.argv:
-    i = sys.argv.index('--shell') + 2
-    env = {**os.environ, 'SSH_ORIGINAL_COMMAND': ' '.join(sys.argv[i:])}
-    signal.signal(signal.SIGUSR1, signal.SIG_DFL)
-    signal.signal(signal.SIGUSR2, signal.SIG_DFL)
-    wrapper, root = env['RRSYNC_WRAPPER'], env['RRSYNC_ROOT']
-    flags = env.get('RRSYNC_FLAGS', '-wo -no-overwrite -no-lock').split()
-    os.execve(wrapper, [wrapper, *flags, root], env)
-
-from rsyncfns import RSYNC, SCRATCHDIR, makepath, patched_rrsync, rmtree, rsync_argv, rsync_path_arg
-
-base = SCRATCHDIR / 'rrsync-no-overwrite-logfile'
-rmtree(base)
-src = base / 'src'
-root = base / 'root'
-makepath(src, root)
-(src / 'new').write_bytes(b'NEW')
-protected = root / 'protected'
-protected.write_bytes(b'POLICY\n')
-
-# RSYNC may be a multi-word command (the runner's --protocol=N, or valgrind)
-# while rrsync hands its RSYNC to execlp() as a single executable name, so it
-# has to be wrapped before patched_rrsync() sees it.
-shim = base / 'rsync-shim'
-shim.write_text('#!/bin/sh\nexec ' + rsync_path_arg(RSYNC) + ' "$@"\n')
-shim.chmod(0o755)
-wrapper = patched_rrsync(base, rsync_path=str(shim))
-rsh = f'{shlex.quote(sys.executable)} {shlex.quote(os.path.abspath(__file__))} --shell'
-env = {**os.environ, 'RRSYNC_WRAPPER': str(wrapper), 'RRSYNC_ROOT': str(root)}
-got = subprocess.run(
-    rsync_argv('-rI', '-M--log-file=protected',
-               '-M--log-format=ATTACKER-CONTROLLED',
-               '-e', rsh, f'{src}/new', 'ignored:'),
-    env=env, capture_output=True, text=True, timeout=20)
-
-assert got.returncode != 0 and 'option --log-file has been disabled' in got.stderr, (
-    f'rrsync -no-overwrite accepted --log-file: rc={got.returncode}, '
-    f'stdout={got.stdout!r}, stderr={got.stderr!r}')
-assert protected.read_bytes() == b'POLICY\n'
-
-safe = subprocess.run(
-    rsync_argv('-rI', '-e', rsh, f'{src}/new', 'ignored:'),
-    env=env, capture_output=True, text=True, timeout=20)
-assert safe.returncode == 0 and (root / 'new').read_bytes() == b'NEW', (
-    f'ordinary upload failed: rc={safe.returncode}, stderr={safe.stderr!r}')
-
-# The refusal must be CONDITIONAL on -no-overwrite.  Run the identical option
-# through a wrapper without it: if that is refused too, the option is simply
-# disabled for every rrsync deployment and the assertion above proves nothing
-# about the policy.  A fresh root keeps this from disturbing the checks above.
-plain_root = base / 'root-plain'
-rmtree(plain_root)
-makepath(plain_root)
-(plain_root / 'protected').write_bytes(b'POLICY\n')
-plain_env = {**env, 'RRSYNC_ROOT': str(plain_root), 'RRSYNC_FLAGS': '-wo -no-lock'}
-plain = subprocess.run(
-    rsync_argv('-rI', '-M--log-file=protected', '-M--log-format=X', '-e', rsh, f'{src}/new', 'ignored:'),
-    env=plain_env, capture_output=True, text=True, timeout=20)
-assert plain.returncode == 0, (
-    'without -no-overwrite the same option must be accepted, or the refusal '
-    'above is unconditional and says nothing about the policy: '
-    f'rc={plain.returncode}, stderr={plain.stderr!r}')
diff --git a/testsuite/rrsync-no-overwrite-partial-dir_test.py b/testsuite/rrsync-no-overwrite-partial-dir_test.py
deleted file mode 100644
index 5b5a15e4d..000000000
--- a/testsuite/rrsync-no-overwrite-partial-dir_test.py
+++ /dev/null
@@ -1,75 +0,0 @@
-#!/usr/bin/env python3
-"""rrsync -no-overwrite must protect existing partial-dir files too."""
-
-import os
-import shlex
-import signal
-import subprocess
-import sys
-
-signal.signal(signal.SIGUSR1, signal.SIG_IGN)
-signal.signal(signal.SIGUSR2, signal.SIG_IGN)
-if '--shell' in sys.argv:
-    i = sys.argv.index('--shell') + 2
-    env = {**os.environ, 'SSH_ORIGINAL_COMMAND': ' '.join(sys.argv[i:])}
-    signal.signal(signal.SIGUSR1, signal.SIG_DFL)
-    signal.signal(signal.SIGUSR2, signal.SIG_DFL)
-    wrapper, root = env['RRSYNC_WRAPPER'], env['RRSYNC_ROOT']
-    flags = env.get('RRSYNC_FLAGS', '-wo -no-overwrite -no-lock').split()
-    os.execve(wrapper, [wrapper, *flags, root], env)
-
-from rsyncfns import RSYNC, SCRATCHDIR, makepath, patched_rrsync, rmtree, rsync_argv, rsync_path_arg
-
-base = SCRATCHDIR / 'rrsync-no-overwrite-partial-dir'
-rmtree(base)
-src = base / 'src'
-root = base / 'root'
-makepath(src, root / 'protected')
-(src / 'victim').write_bytes(b'NEW')
-protected = root / 'protected' / 'victim'
-protected.write_bytes(b'POLICY')
-
-# RSYNC may be a multi-word command (the runner's --protocol=N, or valgrind)
-# while rrsync hands its RSYNC to execlp() as a single executable name, so it
-# has to be wrapped before patched_rrsync() sees it.
-shim = base / 'rsync-shim'
-shim.write_text('#!/bin/sh\nexec ' + rsync_path_arg(RSYNC) + ' "$@"\n')
-shim.chmod(0o755)
-wrapper = patched_rrsync(base, rsync_path=str(shim))
-rsh = f'{shlex.quote(sys.executable)} {shlex.quote(os.path.abspath(__file__))} --shell'
-env = {**os.environ, 'RRSYNC_WRAPPER': str(wrapper), 'RRSYNC_ROOT': str(root)}
-got = subprocess.run(
-    rsync_argv('-rI', '--partial', '--partial-dir=protected',
-               '-e', rsh, f'{src}/victim', 'ignored:'),
-    env=env, capture_output=True, text=True, timeout=20)
-
-state = protected.read_bytes() if protected.exists() else None
-assert got.returncode != 0 and 'option --partial-dir has been disabled' in got.stderr, (
-    f'rrsync -no-overwrite accepted --partial-dir: rc={got.returncode}, '
-    f'stdout={got.stdout!r}, stderr={got.stderr!r}')
-assert state == b'POLICY', (
-    f'rrsync consumed an existing partial file: rc={got.returncode}, '
-    f'state={state!r}, stderr={got.stderr!r}')
-
-safe = subprocess.run(
-    rsync_argv('-rI', '-e', rsh, f'{src}/victim', 'ignored:'),
-    env=env, capture_output=True, text=True, timeout=20)
-assert safe.returncode == 0 and (root / 'victim').read_bytes() == b'NEW', (
-    f'ordinary upload failed: rc={safe.returncode}, stderr={safe.stderr!r}')
-
-# The refusal must be CONDITIONAL on -no-overwrite.  Run the identical option
-# through a wrapper without it: if that is refused too, the option is simply
-# disabled for every rrsync deployment and the assertion above proves nothing
-# about the policy.  A fresh root keeps this from disturbing the checks above.
-plain_root = base / 'root-plain'
-rmtree(plain_root)
-makepath(plain_root / 'protected')
-(plain_root / 'protected' / 'victim').write_bytes(b'POLICY')
-plain_env = {**env, 'RRSYNC_ROOT': str(plain_root), 'RRSYNC_FLAGS': '-wo -no-lock'}
-plain = subprocess.run(
-    rsync_argv('-rI', '--partial', '--partial-dir=protected', '-e', rsh, f'{src}/victim', 'ignored:'),
-    env=plain_env, capture_output=True, text=True, timeout=20)
-assert plain.returncode == 0, (
-    'without -no-overwrite the same option must be accepted, or the refusal '
-    'above is unconditional and says nothing about the policy: '
-    f'rc={plain.returncode}, stderr={plain.stderr!r}')
diff --git a/testsuite/rrsync-symlink_test.py b/testsuite/rrsync-symlink_test.py
deleted file mode 100644
index e69d295df..000000000
--- a/testsuite/rrsync-symlink_test.py
+++ /dev/null
@@ -1,151 +0,0 @@
-#!/usr/bin/env python3
-# rrsync (the SSH-restricted-rsync wrapper) must close its realpath-vs-exec
-# TOCTOU window so an attacker cannot flip a path component after rrsync's
-# validation but before the spawned rsync resolves it.
-#
-# Threat: support/rrsync does
-#       real_arg = os.path.realpath(arg)
-#       if arg != real_arg and not real_arg.startswith(args.dir_slash):
-#           die('unsafe arg:', ...)
-# and then runs rsync against the same arg string. Between realpath() and the
-# spawned rsync's resolution of the path, an attacker can flip a component from
-# a real entry (which passes realpath) to a symlink escaping the restricted
-# dir. rsync then transfers data from / to outside the restricted dir.
-#
-# This is a TOCTOU race; static plants are caught by realpath. The fix pins the
-# validated inode with os.open(O_RDONLY|O_NOFOLLOW) + os.fstat() during
-# validation and hands rsync a name rooted at that pinned fd, so the resolution
-# is atomic with the check.
-#
-# WHAT THIS TEST FLIPS, AND WHY IT IS A DIRECTORY COMPONENT
-#
-# rrsync pins every component ABOVE the argument's last one, in both
-# directions, and that is what this exercises: an intermediate directory is
-# swapped for a symlink pointing outside the tree.
-#
-# It deliberately does not flip the LAST component, because rrsync does not
-# always pin that one and the stub below could not judge it if it did:
-#   * a receiver destination that does not exist yet has no inode to pin, so
-#     the leaf is necessarily still resolved by name -- that is what creating a
-#     file means;
-#   * a sender source cannot be handed a /proc/self/fd magic link at all: rsync
-#     lstat()s a source argument, sees S_IFLNK, and sends a symlink instead of
-#     the file (see rrsync-pull-delivers-content).
-# Leaf behaviour is therefore asserted against the real binary in
-# rrsync-sender-leaf-flip, which can observe what rsync actually does with a
-# raced leaf rather than what this stub assumes.
-#
-# Sender direction only. The receiver has a residual window this cannot yet
-# assert: when the destination leaf does not exist -- including the instant
-# between the flipper's two renames -- rrsync falls back to pinning the parent,
-# and if THAT open also loses the race it passes the argument through unpinned.
-# Measured over a 5s race, this stub's "rsync" reached the outside marker 8
-# times as a sender and 11 as a receiver against a pristine 3.4.4 rrsync; with
-# the inode pin it is 0 as a sender and still 2 as a receiver, on the branch
-# base as well as with the sender fix. The receiver fallback predates this
-# change and is tracked separately.
-#
-# Test machinery:
-#   * The system rrsync hardcodes RSYNC = '/usr/bin/rsync'; we copy it
-#     to scratch and patch RSYNC to a tiny "fake rsync" stub whose only
-#     job is to open its last argv (the validated path) and emit its
-#     content. The race signal is whether the fake rsync ever emits the
-#     attacker's outside-the-tree secret. For an intermediate component the
-#     stub is a faithful model: whatever rsync does with the final name, it
-#     must not be able to reach it through a flipped parent.
-#   * A flipper subprocess (rsyncfns.start_path_flipper) swaps the
-#     restricted dir's 'dir' name between (a) a real directory and (b) a
-#     symlink to the outside tree. The flip is rename-based and atomic.
-#   * We loop rrsync invocations for up to RACE_TIMEOUT seconds; observing
-#     the secret marker in ANY iteration's stdout is the leak signal.
-#
-# Runs at any uid (the race is timing-only, not ownership-based).
-
-import os
-import subprocess
-import time
-
-from rsyncfns import (
-    race_budget, SCRATCHDIR, patched_rrsync, proc_self_fd_pins, rmtree,
-    start_path_flipper, stop_flipper, test_fail, test_skipped,
-)
-
-# rrsync closes this realpath-vs-exec TOCTOU by inode-pinning through
-# /proc/self/fd (Linux-only).  Where that primitive is absent (the BSDs, Solaris,
-# macOS, Cygwin) rrsync falls through unpinned by design, so the race is not
-# closed and this test cannot pass -- skip rather than report the intended gap.
-if not proc_self_fd_pins():
-    test_skipped("rrsync's realpath-vs-exec inode-pin needs /proc/self/fd "
-                 "(Linux); unhardened fallback elsewhere by design")
-
-
-MARKER = b"AUDIT_RRSYNC_RACE_LEAK_MARKER_DO_NOT_DISCLOSE"
-
-base = SCRATCHDIR / 'rrsync_race'
-restricted = base / 'restricted'
-outside = base / 'outside'
-rmtree(base)
-restricted.mkdir(parents=True)
-outside.mkdir(parents=True)
-
-# Same leaf name on both sides, so the ONLY thing that decides which file the
-# spawned rsync reaches is which inode the 'dir' component resolved to.
-(outside / 'target').write_bytes(MARKER)
-
-# Two sibling names in the restricted dir that the flipper swaps, so the 'dir'
-# component alternates between a real directory and a symlink escaping the
-# tree.  We use distinct setup names that the flipper then rotates -- the same
-# shape symlink-race-source/dest use.
-real_dir = restricted / 'dir'
-real_dir.mkdir()
-(real_dir / 'target').write_bytes(b"benign_in_tree_content\n")
-evil_path = restricted / 'evil'
-os.symlink(str(outside), evil_path)
-
-# Fake rsync stub: prints the bytes at its last argv (the path rrsync passed).
-fake_rsync = base / 'fake_rsync'
-fake_rsync.write_text(
-    "#!/usr/bin/env python3\n"
-    "import sys\n"
-    "try:\n"
-    "    with open(sys.argv[-1], 'rb') as f:\n"
-    "        sys.stdout.buffer.write(f.read())\n"
-    "except OSError:\n"
-    "    pass\n"
-)
-fake_rsync.chmod(0o755)
-
-# Patched rrsync: RSYNC → fake_rsync (via the shared, path-robust helper).
-test_rrsync = patched_rrsync(base, rsync_path=str(fake_rsync))
-
-
-def race(rrsync_flags, ssh_cmd):
-    """Run rrsync in a loop against the flipping tree; True if the secret leaked."""
-    env = {**os.environ, 'SSH_ORIGINAL_COMMAND': ssh_cmd}
-    deadline = time.monotonic() + race_budget()
-    while time.monotonic() < deadline:
-        proc = subprocess.run(
-            [str(test_rrsync), *rrsync_flags, '-no-lock', str(restricted)],
-            stdout=subprocess.PIPE, stderr=subprocess.DEVNULL, env=env)
-        if MARKER in proc.stdout:
-            return True
-    return False
-
-
-flip = start_path_flipper(real_dir, evil_path)
-try:
-    leaked = race(['-ro'], "rsync --server --sender -lt . dir/target")
-finally:
-    stop_flipper(flip)
-
-if leaked:
-    test_fail(
-        "rrsync realpath-vs-exec TOCTOU: an intermediate path component "
-        "(real directory -> symlink to the outside tree) was followed by the "
-        f"spawned rsync; the secret marker {MARKER!r} was emitted, proving "
-        "the path was resolved AFTER rrsync's realpath check validated it. "
-        "Fix: pin the validated inode with os.open(O_RDONLY|O_NOFOLLOW) + "
-        "os.fstat() during validation, then root the argument handed to rsync "
-        "at that pinned fd.")
-
-print('rrsync pins intermediate sender path components against the realpath-vs-exec race')
diff --git a/testsuite/rsync-ssl-hostname-validation_test.py b/testsuite/rsync-ssl-hostname-validation_test.py
deleted file mode 100644
index 619b188e2..000000000
--- a/testsuite/rsync-ssl-hostname-validation_test.py
+++ /dev/null
@@ -1,59 +0,0 @@
-#!/usr/bin/env python3
-# Finding [20] (CWE-88 argument injection): rsync-ssl expands an untrusted SSL
-# hostspec into the openssl/gnutls command line unquoted (rsync-ssl:146) and into
-# the stunnel heredoc config (rsync-ssl:154) with no character policy.  A hostname
-# containing whitespace / newline / control characters therefore injects extra
-# TLS options or stunnel directives -- a forced connection target, a verification
-# bypass, or stunnel config injection.  Fix: validate_ssl_hostname rejects such
-# hostnames before any helper is invoked (rsync-ssl:138).
-#
-# Part 1 demonstrates the injection against an UNFIXED copy of rsync-ssl plus a
-# fake openssl that records its argv: the crafted host's payload lands as a
-# separate openssl argument.  Part 2 is the fix: the shipped rsync-ssl rejects the
-# host string before exec'ing the helper.
-
-import os
-import shlex
-import re
-import subprocess
-
-from rsyncfns import SCRATCHDIR, SRCDIR, rmtree, test_fail
-
-base = SCRATCHDIR / 'rsync-ssl-hostname'
-rmtree(base)
-base.mkdir(parents=True)
-
-argv_capture = base / 'openssl_argv'
-fake_openssl = base / 'fake_openssl'
-fake_openssl.write_text(f"#!/bin/sh\nprintf '%s\\n' \"$@\" > {shlex.quote(str(argv_capture))}\nexit 0\n")
-fake_openssl.chmod(0o755)
-
-# An unfixed rsync-ssl: drop the validate_ssl_hostname guard so the host string
-# reaches the helper command line as it did before the fix.
-unfixed = base / 'rsync-ssl-unfixed'
-unfixed.write_text(re.sub(r'(?m)^(\s*)validate_ssl_hostname .*$',
-                          r'\1: # hostname guard removed for this regression test',
-                          (SRCDIR / 'rsync-ssl').read_text()))
-unfixed.chmod(0o755)
-
-EVIL_HOST = 'localhost INJECTED_OPENSSL_ARG'
-env = {**os.environ, 'RSYNC_SSL_TYPE': 'openssl',
-       'RSYNC_SSL_OPENSSL': str(fake_openssl), 'RSYNC_SSL_CA_CERT': '/dev/null'}
-helper = ['--HELPER', EVIL_HOST, 'rsync', '--server', '--daemon', '.']
-
-# --- Part 1: the unfixed helper injects the payload into the openssl argv.
-subprocess.run(['bash', str(unfixed)] + helper, env=env,
-               stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
-captured = argv_capture.read_text().splitlines() if argv_capture.exists() else []
-if 'INJECTED_OPENSSL_ARG' not in captured:
-    test_fail("premise: the crafted hostname did not inject a separate openssl "
-              f"argument (captured argv: {captured})")
-
-# --- Part 2: the shipped rsync-ssl rejects the injecting host string.
-proc = subprocess.run(['bash', str(SRCDIR / 'rsync-ssl')] + helper, env=env,
-                      stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True)
-if proc.returncode == 0 or 'invalid rsync-ssl hostname' not in proc.stdout:
-    test_fail("rsync-ssl did NOT reject the argument-injecting hostname:\n" + proc.stdout)
-
-print("rsync-ssl-hostname-validation: a control-char hostspec injects helper "
-      "arguments; rsync-ssl rejects it")
diff --git a/testsuite/rsync-ssl-openssl-hostname-check_test.py b/testsuite/rsync-ssl-openssl-hostname-check_test.py
deleted file mode 100644
index 18dac5bbc..000000000
--- a/testsuite/rsync-ssl-openssl-hostname-check_test.py
+++ /dev/null
@@ -1,58 +0,0 @@
-#!/usr/bin/env python3
-# Companion to rsync-ssl-stunnel-hostname-check for the openssl backend.  The
-# openssl arm has always passed -verify_hostname $hostname (3.4.x onward), so the
-# hostname identity is bound by default.  This test locks that in AND checks the
-# new RSYNC_SSL_SKIP_HOSTNAME_CHECK=1 opt-out: chain verification ($caopt) and SNI
-# (-servername) stay, only -verify_hostname is dropped.
-#
-# A fake openssl echoes its argv to a capture file via RSYNC_SSL_OPENSSL.
-
-import os
-import shlex
-import subprocess
-
-from rsyncfns import SCRATCHDIR, SRCDIR, rmtree, test_fail
-
-base = SCRATCHDIR / 'rsync-ssl-openssl-host'
-rmtree(base)
-base.mkdir(parents=True)
-
-args_capture = base / 'openssl_args'
-fake_openssl = base / 'fake_openssl'
-fake_openssl.write_text(f'#!/bin/sh\necho "$@" > {shlex.quote(str(args_capture))}\nexit 0\n')
-fake_openssl.chmod(0o755)
-ca = base / 'ca.pem'
-ca.write_text("dummy-ca\n")
-
-helper = ['--HELPER', 'localhost', 'rsync', '--server', '--daemon', '.']
-base_env = {**os.environ, 'RSYNC_SSL_TYPE': 'openssl',
-            'RSYNC_SSL_OPENSSL': str(fake_openssl), 'RSYNC_SSL_CA_CERT': str(ca)}
-base_env.pop('RSYNC_SSL_SKIP_HOSTNAME_CHECK', None)
-
-
-def run(env):
-    if args_capture.exists():
-        args_capture.unlink()
-    subprocess.run(['bash', str(SRCDIR / 'rsync-ssl')] + helper, env=env,
-                   stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
-    return args_capture.read_text() if args_capture.exists() else ''
-
-
-# --- Default: the openssl client verifies the hostname.
-args = run(base_env)
-if '-connect localhost:' not in args:
-    test_fail(f"premise: fake openssl did not capture argv:\n{args!r}")
-if '-verify_hostname localhost' not in args:
-    test_fail(f"openssl backend is missing -verify_hostname localhost:\n{args}")
-
-# --- Chain-only opt-out: drop -verify_hostname, keep SNI + chain verification.
-args = run({**base_env, 'RSYNC_SSL_SKIP_HOSTNAME_CHECK': '1'})
-if '-verify_hostname' in args:
-    test_fail("RSYNC_SSL_SKIP_HOSTNAME_CHECK=1 must drop -verify_hostname from "
-              f"the openssl backend:\n{args}")
-if '-servername localhost' not in args or '-CAfile' not in args:
-    test_fail("SKIP_HOSTNAME_CHECK must keep SNI (-servername) and chain "
-              f"verification (-CAfile):\n{args}")
-
-print("rsync-ssl-openssl-hostname-check: openssl binds the cert to the host by "
-      "default, and SKIP_HOSTNAME_CHECK opts back to chain-only")
diff --git a/testsuite/rsync-ssl-stunnel-ca-required_test.py b/testsuite/rsync-ssl-stunnel-ca-required_test.py
deleted file mode 100644
index 540e01823..000000000
--- a/testsuite/rsync-ssl-stunnel-ca-required_test.py
+++ /dev/null
@@ -1,56 +0,0 @@
-#!/usr/bin/env python3
-# Finding [12] (CWE-295 improper certificate validation): in stunnel mode
-# rsync-ssl builds the stunnel client config with NO CA / verify directives when
-# RSYNC_SSL_CA_CERT is unset (rsync-ssl:88-99 leaves verify=""), so the TLS
-# session validates no server certificate.  An active network attacker can then
-# MITM the rsync-over-SSL connection -- reading and modifying transferred file
-# data and the daemon auth challenge/response.  Fix: rsync-ssl refuses stunnel
-# mode without a CA unless RSYNC_SSL_ALLOW_INSECURE_STUNNEL=1 (rsync-ssl:140).
-#
-# Part 1 demonstrates the danger: with the explicit insecure opt-out and no CA, a
-# fake stunnel captures the generated config and it carries no certificate
-# verification at all -- the MITM-able config the old default produced.  Part 2 is
-# the fix: without the opt-out and without a CA, rsync-ssl refuses to run.
-
-import os
-import subprocess
-
-from rsyncfns import SCRATCHDIR, SRCDIR, rmtree, test_fail
-
-base = SCRATCHDIR / 'rsync-ssl-stunnel'
-rmtree(base)
-base.mkdir(parents=True)
-
-config_capture = base / 'stunnel_config'
-fake_stunnel = base / 'fake_stunnel'
-# rsync-ssl feeds the generated stunnel config on fd 10 (exec ... -fd 10 ...);
-# bash, not /bin/sh, since dash cannot redirect from fd >9 -- and via env, since
-# the BSDs keep bash in /usr/local/bin, not /bin.
-fake_stunnel.write_text(f"#!/usr/bin/env bash\ncat <&10 > {config_capture} 2>/dev/null\nexit 0\n")
-fake_stunnel.chmod(0o755)
-
-helper = ['--HELPER', 'localhost', 'rsync', '--server', '--daemon', '.']
-env = {**os.environ, 'RSYNC_SSL_TYPE': 'stunnel', 'RSYNC_SSL_STUNNEL': str(fake_stunnel)}
-env.pop('RSYNC_SSL_CA_CERT', None)
-
-# --- Part 1: with the explicit insecure opt-out and no CA, the generated config
-# has no certificate verification -- the MITM-able connection.
-env1 = {**env, 'RSYNC_SSL_ALLOW_INSECURE_STUNNEL': '1'}
-subprocess.run(['bash', str(SRCDIR / 'rsync-ssl')] + helper, env=env1,
-               stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
-cfg = config_capture.read_text() if config_capture.exists() else ''
-if 'connect = localhost' not in cfg:
-    test_fail(f"premise: fake stunnel did not capture a config:\n{cfg!r}")
-if 'verifyChain' in cfg or 'CAfile' in cfg:
-    test_fail("premise: expected NO certificate-verification directives in the "
-              f"no-CA stunnel config:\n{cfg}")
-
-# --- Part 2: without the opt-out and without a CA, rsync-ssl refuses to run, so
-# the unverified connection shown in part 1 cannot happen by accident.
-proc = subprocess.run(['bash', str(SRCDIR / 'rsync-ssl')] + helper, env=env,
-                      stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True)
-if proc.returncode == 0 or 'stunnel requires RSYNC_SSL_CA_CERT' not in proc.stdout:
-    test_fail("rsync-ssl did NOT refuse insecure stunnel mode without a CA:\n" + proc.stdout)
-
-print("rsync-ssl-stunnel-ca-required: stunnel without a CA yields an unverified "
-      "(MITM-able) config; rsync-ssl refuses it unless explicitly opted out")
diff --git a/testsuite/rsync-ssl-stunnel-hostname-check_test.py b/testsuite/rsync-ssl-stunnel-hostname-check_test.py
deleted file mode 100644
index 7a8c53cc1..000000000
--- a/testsuite/rsync-ssl-stunnel-hostname-check_test.py
+++ /dev/null
@@ -1,73 +0,0 @@
-#!/usr/bin/env python3
-# Finding (codex scan, CWE-295 improper certificate validation): in stunnel mode
-# rsync-ssl emitted "verifyChain = yes" + "CAfile" but NO "checkHost" directive,
-# so the TLS session validated the certificate CHAIN but not its HOSTNAME.  An
-# active network attacker holding a cert that chains to the configured CA but is
-# issued for a DIFFERENT name could MITM the rsync-over-SSL connection.  Fix:
-# emit "checkHost = $hostname" whenever the chain is verified, mirroring the
-# openssl backend's -verify_hostname.  RSYNC_SSL_SKIP_HOSTNAME_CHECK=1 keeps chain
-# verification but skips the identity check (restores 3.4.x stunnel behaviour).
-#
-# rsync-ssl feeds the generated stunnel config on fd 10; a fake stunnel captures
-# it and we inspect the directives.
-
-import os
-import subprocess
-
-from rsyncfns import SCRATCHDIR, SRCDIR, rmtree, test_fail
-
-base = SCRATCHDIR / 'rsync-ssl-stunnel-host'
-rmtree(base)
-base.mkdir(parents=True)
-
-config_capture = base / 'stunnel_config'
-fake_stunnel = base / 'fake_stunnel'
-# bash, not /bin/sh: dash cannot redirect from fd >9; via env for the BSDs' bash.
-fake_stunnel.write_text(f"#!/usr/bin/env bash\ncat <&10 > {config_capture} 2>/dev/null\nexit 0\n")
-fake_stunnel.chmod(0o755)
-ca = base / 'ca.pem'
-ca.write_text("dummy-ca\n")
-
-helper = ['--HELPER', 'localhost', 'rsync', '--server', '--daemon', '.']
-base_env = {**os.environ, 'RSYNC_SSL_TYPE': 'stunnel',
-            'RSYNC_SSL_STUNNEL': str(fake_stunnel)}
-for v in ('RSYNC_SSL_CA_CERT', 'RSYNC_SSL_ALLOW_INSECURE_STUNNEL',
-          'RSYNC_SSL_SKIP_HOSTNAME_CHECK'):
-    base_env.pop(v, None)
-
-
-def run(env):
-    if config_capture.exists():
-        config_capture.unlink()
-    subprocess.run(['bash', str(SRCDIR / 'rsync-ssl')] + helper, env=env,
-                   stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
-    return config_capture.read_text() if config_capture.exists() else ''
-
-
-# --- Part 1: CA configured, default -> chain AND hostname are verified.
-cfg = run({**base_env, 'RSYNC_SSL_CA_CERT': str(ca)})
-if 'connect = localhost' not in cfg:
-    test_fail(f"premise: fake stunnel did not capture a config:\n{cfg!r}")
-if 'verifyChain = yes' not in cfg:
-    test_fail(f"a CA-configured stunnel config must verify the chain:\n{cfg}")
-if 'checkHost = localhost' not in cfg:
-    test_fail("CA-configured stunnel config is missing the hostname binding "
-              f"(checkHost = localhost):\n{cfg}")
-
-# --- Part 2: explicit insecure opt-out, no CA -> no verification at all.
-cfg = run({**base_env, 'RSYNC_SSL_CA_CERT': '',
-           'RSYNC_SSL_ALLOW_INSECURE_STUNNEL': '1'})
-if 'checkHost' in cfg:
-    test_fail(f"insecure (no-CA) stunnel config must not emit checkHost:\n{cfg}")
-
-# --- Part 3: chain-only opt-out -> chain verified, hostname check skipped.
-cfg = run({**base_env, 'RSYNC_SSL_CA_CERT': str(ca),
-           'RSYNC_SSL_SKIP_HOSTNAME_CHECK': '1'})
-if 'verifyChain = yes' not in cfg:
-    test_fail(f"SKIP_HOSTNAME_CHECK must keep chain verification:\n{cfg}")
-if 'checkHost' in cfg:
-    test_fail("RSYNC_SSL_SKIP_HOSTNAME_CHECK=1 must drop the hostname binding "
-              f"(no checkHost):\n{cfg}")
-
-print("rsync-ssl-stunnel-hostname-check: stunnel binds the cert to the host when "
-      "verifying a chain, and SKIP_HOSTNAME_CHECK opts back to chain-only")
diff --git a/testsuite/rsync-ssl-type-option_test.py b/testsuite/rsync-ssl-type-option_test.py
deleted file mode 100644
index ae4a7e7b1..000000000
--- a/testsuite/rsync-ssl-type-option_test.py
+++ /dev/null
@@ -1,95 +0,0 @@
-#!/usr/bin/env python3
-# rsync-ssl only recognized --type=SSL_TYPE as the FIRST argument, so
-# "rsync-ssl --dry-run --type=stunnel host::mod" passed the option through to
-# the underlying rsync, which rejected it with "--type=stunnel: unknown option".
-# Fix: scan the whole argument list for --type=..., export RSYNC_SSL_TYPE, and
-# drop the option before handing the remaining args to rsync.
-# A `--` arg stops the wrapper-option scan: `--` and everything after it are
-# passed through to rsync verbatim, so an operand such as `--type=stunnel`
-# that was protected from option parsing is not consumed by the wrapper.
-#
-# A fake rsync in PATH records the args it receives and the RSYNC_SSL_TYPE it
-# observes; rsync-ssl is run in its normal (non-HELPER) mode with --type= in
-# various positions.  The recorded args must contain every other option but
-# never a --type= token, RSYNC_SSL_TYPE must match what the wrapper consumed,
-# and rsync-ssl must exit successfully.
-
-import os
-import subprocess
-
-from rsyncfns import SCRATCHDIR, SRCDIR, rmtree, test_fail
-
-base = SCRATCHDIR / 'rsync-ssl-type-opt'
-rmtree(base)
-base.mkdir(parents=True)
-
-args_capture = base / 'rsync_args'
-type_capture = base / 'rsync_ssl_type'
-fakebin = base / 'bin'
-fakebin.mkdir(parents=True)
-fake_rsync = fakebin / 'rsync'
-fake_rsync.write_text(
-    f"#!/usr/bin/env bash\n"
-    f"printf '%s\\n' \"$@\" > {args_capture}\n"
-    f"printf '%s\\n' \"${{RSYNC_SSL_TYPE-UNSET}}\" > {type_capture}\n"
-    f"exit 0\n")
-fake_rsync.chmod(0o755)
-
-env = {**os.environ, 'PATH': str(fakebin) + os.pathsep + os.environ.get('PATH', '')}
-for v in ('RSYNC_SSL_TYPE', 'RSYNC_SSL_OPENSSL', 'RSYNC_SSL_STUNNEL'):
-    env.pop(v, None)
-
-
-def run(args, expect_type):
-    for capture in (args_capture, type_capture):
-        if capture.exists():
-            capture.unlink()
-    proc = subprocess.run(['bash', str(SRCDIR / 'rsync-ssl')] + args, env=env,
-                          stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True)
-    if proc.returncode != 0:
-        test_fail(f"rsync-ssl exited {proc.returncode} for args {args!r}:\n{proc.stdout}")
-    got_args = args_capture.read_text().splitlines() if args_capture.exists() else []
-    got_type = type_capture.read_text().strip() if type_capture.exists() else 'UNSET'
-    if got_type != expect_type:
-        test_fail(f"RSYNC_SSL_TYPE is {got_type!r}, expected {expect_type!r} "
-                  f"for args {args!r}:\n{proc.stdout}")
-    return got_args
-
-
-# --- The reported failure: --type= in the middle of the rsync args.
-got = run(['--dry-run', '--type=stunnel', 'host::mod'], 'stunnel')
-if any(a.startswith('--type=') for a in got):
-    test_fail(f"--type= was passed through to rsync instead of being consumed:\n{got}")
-for want in ('--dry-run', 'host::mod'):
-    if want not in got:
-        test_fail(f"missing rsync arg {want!r} after --type= handling:\n{got}")
-if not any(a.startswith('--rsh=') for a in got):
-    test_fail(f"missing the --rsh= helper option:\n{got}")
-
-# --- First, last, and no --type= keep working.
-for pos_args, expect_type in ((['--type=stunnel', '--dry-run', 'host::mod'], 'stunnel'),
-                              (['-av', 'host::mod', '--type=openssl'], 'openssl'),
-                              (['-av', 'host::mod'], 'UNSET')):
-    got = run(pos_args, expect_type)
-    if any(a.startswith('--type=') for a in got):
-        test_fail(f"--type= was passed through for args {pos_args!r}:\n{got}")
-    for want in pos_args:
-        if want.startswith('--type='):
-            continue
-        if want not in got:
-            test_fail(f"missing rsync arg {want!r} for args {pos_args!r}:\n{got}")
-
-# --- `--` stops the wrapper-option scan: the protected operand is preserved.
-rsh_arg = "--rsh='{}' --HELPER".format(SRCDIR / 'rsync-ssl')
-got = run(['--', '--type=stunnel', 'host::mod'], 'UNSET')
-if got != [rsh_arg, '--', '--type=stunnel', 'host::mod']:
-    test_fail(f"args after -- must be preserved verbatim (no --type= consumed):\n{got}")
-
-# --- A wrapper option before `--` is still consumed; the protected one is not.
-got = run(['--type=openssl', '--', '--type=stunnel', 'host::mod'], 'openssl')
-if got != [rsh_arg, '--', '--type=stunnel', 'host::mod']:
-    test_fail(f"--type= before -- is consumed, args after -- are preserved:\n{got}")
-
-print("rsync-ssl-type-option: --type=SSL_TYPE is consumed in any argument "
-      "position (until a -- stops the wrapper-option scan), exported as "
-      "RSYNC_SSL_TYPE, and rsync-ssl exits successfully")
diff --git a/testsuite/rsyncfns.py b/testsuite/rsyncfns.py
deleted file mode 100644
index 7524cfff0..000000000
--- a/testsuite/rsyncfns.py
+++ /dev/null
@@ -1,2906 +0,0 @@
-"""Shared helpers for rsync's Python test scripts.
-
-This is the Python counterpart of testsuite/rsync.fns. It exposes only what
-the Python-rewritten tests actually need; grow it as more shell tests are
-ported.
-
-Conventions matching the shell harness:
-  * Exit codes (see the Exit enum): 0=pass, 1=fail, 2=error, 77=skip, 78=xfail.
-  * The runner sets these environment variables before invoking each test:
-      scratchdir   per-test scratch directory
-      srcdir       rsync source directory
-      TOOLDIR      build directory (holds the rsync binary and helpers)
-      RSYNC        the rsync command line (may include valgrind / --protocol=N)
-      TLS_ARGS     extra arguments to pass to the 'tls' helper
-      suitedir     this directory (testsuite/)
-"""
-
-from __future__ import annotations
-
-import atexit
-import fcntl
-import filecmp
-import errno
-import math
-import os
-import platform
-import re
-import shlex
-import shutil
-import signal
-import socket as _socket
-import stat
-import struct
-import subprocess
-import sys
-import tempfile
-import time
-from pathlib import Path
-
-from exitcodes import Exit   # re-exported: tests may `from rsyncfns import Exit`
-
-
-# --- environment -----------------------------------------------------------
-
-def _required(name: str) -> str:
-    v = os.environ.get(name)
-    if not v:
-        sys.stderr.write(
-            f"rsyncfns: required environment variable {name} is not set; "
-            "run this test via runtests.py rather than directly.\n"
-        )
-        sys.exit(Exit.ERROR)
-    return v
-
-
-SCRATCHDIR = Path(_required('scratchdir'))
-SRCDIR = Path(_required('srcdir'))
-TOOLDIR = Path(_required('TOOLDIR'))
-SUITEDIR = Path(os.environ.get('suitedir', SRCDIR / 'testsuite'))
-
-# rsync.fns set `umask 022` for every shell test, so the suite's expected
-# file/dir modes are computed against that baseline. Mirror it here so the
-# Python tests are deterministic regardless of the caller's ambient umask
-# (e.g. a CI runner with umask 077) -- several permission tests depend on
-# newly-created dirs being 0755. Individual tests may still narrow it (e.g.
-# chmod-option uses 002 for its --chmod comparison).
-os.umask(0o022)
-
-# rsync.fns overrides HOME to $scratchdir; tests that exercise ssh-style
-# transfers with no path component (e.g. localhost: at end of args) rely on
-# HOME pointing at the per-test scratch dir.
-os.environ['HOME'] = str(SCRATCHDIR)
-RSYNC = _required('RSYNC')         # full command line, possibly with valgrind/protocol
-
-# The "peer" rsync command -- used for the SERVER side of two-sided transfers
-# (the daemon process; the remote-shell --rsync-path target). The runner sets
-# RSYNC_PEER to a second binary when invoked with --rsync-bin2, letting a run
-# mix two rsync versions over the wire. When no second binary was selected,
-# RSYNC_PEER == RSYNC, so every consumer below behaves exactly as before and
-# single-binary runs are unchanged. Use .get (not _required) so a test invoked
-# by hand without the runner still works.
-RSYNC_PEER = os.environ.get('RSYNC_PEER', RSYNC)
-
-
-def split_rsync_cmd(cmd: str) -> list:
-    """Split an rsync command string into argv, tolerating spaces in the path.
-
-    RSYNC may be a wrapper command ('valgrind --tool=memcheck /build/rsync'),
-    which has to be split, or a plain path to the binary, which must not be if
-    it contains a space -- shlex.split() would turn '/ws test/rsync' into two
-    nonexistent programs.  A path that exists is one word by definition, so
-    check that first and only fall back to splitting for a real command line.
-
-    Call this at use time, never once at import: tests such as chown-fake
-    append ' --fake-super' to rsyncfns.RSYNC part-way through, and a cached
-    split would keep handing back the pre-mutation command.
-    """
-    if os.path.isfile(cmd):
-        return [cmd]
-    # The path may be followed by options -- chown-fake and friends append
-    # ' --fake-super' to RSYNC -- so the whole string is no longer a filename.
-    # Take the longest leading run that names an existing file as the program
-    # and split only what follows.
-    for m in reversed(list(re.finditer(r'\s+', cmd))):
-        head = cmd[:m.start()]
-        if os.path.isfile(head):
-            return [head] + shlex.split(cmd[m.start():])
-    return shlex.split(cmd)
-
-
-def _under_valgrind():
-    """True when the runner wrapped rsync in valgrind (runtests.py --valgrind).
-
-    Match the wrapper's program name (first token of RSYNC or RSYNC_PEER), not a
-    bare 'valgrind' substring, so an rsync path that merely contains the word
-    does not false-trigger.
-    """
-    for cmd in (RSYNC, RSYNC_PEER):
-        if os.path.basename(shlex.split(cmd)[0]) == 'valgrind':
-            return True
-    return False
-
-# TLS_ARGS controls how the 'tls' helper formats listings (e.g. --atimes,
-# -l, -L). Tests that exercise non-default rsync features (atimes, etc.)
-# assign to rsyncfns.TLS_ARGS before calling checkit / rsync_ls_lR.
-TLS_ARGS = os.environ.get('TLS_ARGS', '')
-
-# Daemon-mode transport. The DEFAULT is the secure stdio-pipe mechanism
-# (RSYNC_CONNECT_PROG), which opens no listening socket at all. The runner
-# sets RSYNC_TEST_USE_TCP=1 only when invoked with --use-tcp, which switches
-# daemon tests to a real rsyncd bound to loopback (see start_test_daemon).
-USE_TCP = os.environ.get('RSYNC_TEST_USE_TCP') == '1'
-
-# Budget (seconds) a TOCTOU symlink-race test may spend trying to win its race
-# before giving up. Set by runtests.py --race-timeout; when the operator did not
-# pass it, each test keeps its own default (see race_budget).
-_RACE_TIMEOUT_SET = 'race_timeout' in os.environ
-try:
-    RACE_TIMEOUT = float(os.environ.get('race_timeout', '5'))
-except ValueError:
-    # A malformed value counts as NOT set, so every test keeps its own default.
-    # Falling back to the 5s baseline while still counting as "set" would
-    # silently cut a 10s or 15s oracle in half -- weakening a security test
-    # that nobody asked to shorten, which is the exact failure this knob's
-    # validation exists to prevent.
-    RACE_TIMEOUT = 5.0
-    _RACE_TIMEOUT_SET = False
-
-
-def race_budget(default: float = 5.0) -> float:
-    """Seconds this race test may spend trying to provoke an escape.
-
-    A race test is a NEGATIVE oracle: it passes by *failing* to break in before
-    the budget runs out, so it always spends the whole budget. The budget is
-    therefore the test's runtime -- these are the suite's slowest tests, which
-    is exactly why the knob has to work.
-
-    Tests needing longer than the 5s baseline to be a credible oracle pass their
-    own `default`. An explicit --race-timeout overrides every default, in both
-    directions: the old `max(RACE_TIMEOUT, 10.0)` idiom ignored the option below
-    10s, so the documented knob did nothing for most of these tests.
-
-    Lowering the budget weakens the oracle (fewer flips observed = less chance
-    of catching a regression), so the defaults here are deliberately generous.
-
-    A non-positive or non-finite budget is never a legitimate request: the race
-    loop would run zero times and the test would report PASS without testing
-    anything. runtests.py rejects that at the command line; ignoring it here too
-    keeps the guarantee when race_timeout arrives straight from the environment.
-    """
-    if _RACE_TIMEOUT_SET and math.isfinite(RACE_TIMEOUT) and RACE_TIMEOUT > 0:
-        return RACE_TIMEOUT
-    return default
-
-# Mnemonics for rsync's itemize-changes (-i / -ii) format:
-#   all_plus   ->  +++++++++   every attribute changed (an additive create)
-#   allspace   ->             every attribute unchanged
-#   dots       ->  .....       trailing dots after the change columns
-all_plus = '+++++++++'
-allspace = '         '
-dots = '.....'
-
-# The "$tmpdir/from", "$tmpdir/to", "$tmpdir/chk" layout from rsync.fns.
-TMPDIR = SCRATCHDIR
-FROMDIR = SCRATCHDIR / 'from'
-TODIR = SCRATCHDIR / 'to'
-CHKDIR = SCRATCHDIR / 'chk'
-CHKFILE = SCRATCHDIR / 'rsync.chk'
-OUTFILE = SCRATCHDIR / 'rsync.out'
-
-
-# --- result reporting ------------------------------------------------------
-
-def test_fail(msg: str) -> 'None':
-    sys.stderr.write(msg.rstrip() + '\n')
-    sys.exit(Exit.FAIL)
-
-
-def test_skipped(msg: str) -> 'None':
-    sys.stderr.write(msg.rstrip() + '\n')
-    (TMPDIR / 'whyskipped').write_text(msg.rstrip() + '\n')
-    sys.exit(Exit.SKIP)
-
-
-def test_xfail(msg: str) -> 'None':
-    sys.stderr.write(msg.rstrip() + '\n')
-    sys.exit(Exit.XFAIL)
-
-
-# --- rsync invocation ------------------------------------------------------
-
-# --- TCP port coordination across parallel tests ---------------------------
-
-_PORT_LOCK_PATH = '/tmp/rsync_test.lck'
-_port_lock_fd = None
-_reaped_stale = False
-
-# The lock file doubles as a registry of the rsyncd pid bound to each port, so a
-# later run that wins the (orphan-released) lock can find and reap a daemon a
-# SIGKILLed run stranded. The byte-range LOCKS sit at offsets 0..65535 (one byte
-# per port number); the pid RECORDS sit in a separate region past them, one
-# native-endian int32 (a pid_t) per port, written/read only while holding that
-# port's lock so they're never raced. The file is host-local, so native endian is
-# fine; an all-zero record (a sparse/older lock file) reads back as pid 0.
-_PORT_PID_BASE = 1 << 16      # past every possible port lock byte (port < 65536)
-_PORT_PID_REC = 8             # two native-endian int32 per port: (pgid, pid)
-
-# Bytes 0..3 hold a magic identifying the lock-file layout. A fresh (all-zero)
-# file gets it written under the byte-0 lock; a non-zero value that doesn't match
-# means a stale file from an incompatible testsuite layout -- we error rather
-# than misread the (pgid, pid) records. Bytes 0..3 also sit in the port-lock byte
-# region, but ports 0..3 are never test ports so the overlap is harmless. Fixed
-# arbitrary value; bump it on any on-disk layout change.
-_LOCK_MAGIC = 0x9d4f2b8a
-
-
-def _open_lock_file() -> int:
-    """Open (or create) the host-wide port-lock file, defending against a
-    local attacker who pre-plants the well-known /tmp path. CI runs some
-    tests under sudo, so we must never let root open/chmod an attacker-
-    controlled target.
-
-    Strategy:
-      * Try an O_EXCL|O_CREAT create. If we win, the file is brand-new,
-        regular, owned by us and nlink==1 -- the ONLY case where we widen
-        the mode to 0o666 (so a second user sharing the lock can open it
-        RDWR; the create mode is otherwise narrowed by umask).
-      * If it already exists, open it WITHOUT O_CREAT, WITHOUT chmod, and
-        with O_NOFOLLOW so a planted symlink fails (ELOOP) rather than
-        being followed. Then require a pristine regular file with nlink==1,
-        rejecting a hard link to some other (e.g. root-owned 0600) file --
-        O_NOFOLLOW alone does not catch hard links.
-    """
-    nofollow = getattr(os, 'O_NOFOLLOW', 0)
-
-    # Path 1: we create it ourselves, exclusively.
-    try:
-        fd = os.open(_PORT_LOCK_PATH,
-                     os.O_CREAT | os.O_EXCL | os.O_RDWR | nofollow, 0o666)
-    except FileExistsError:
-        fd = None
-    if fd is not None:
-        try:
-            os.fchmod(fd, 0o666)  # we own this fresh file; undo umask
-        except OSError:
-            pass
-        _check_or_write_magic(fd)
-        return fd
-
-    # Path 2: it already exists -- open without creating or chmod'ing.
-    try:
-        fd = os.open(_PORT_LOCK_PATH, os.O_RDWR | nofollow)
-    except OSError as e:
-        test_fail(f"cannot open lock file {_PORT_LOCK_PATH}: {e} "
-                  "(refusing to follow a symlink -- possible tampering)")
-    st = os.fstat(fd)
-    if not stat.S_ISREG(st.st_mode) or st.st_nlink != 1:
-        os.close(fd)
-        test_fail(f"lock file {_PORT_LOCK_PATH} is not a pristine regular "
-                  f"file (type/nlink check failed -- possible tampering)")
-    _check_or_write_magic(fd)
-    return fd
-
-
-def _check_or_write_magic(fd: int) -> 'None':
-    """Validate (or stamp) the layout-version magic in bytes 0..3.
-
-    Serialise on the byte-0 lock (also port 0's lock byte, never a test port) so
-    two starting runs don't race the stamp. An all-zero header is a fresh file --
-    write the magic. A non-zero header that doesn't match means a stale lock file
-    from an incompatible testsuite layout (e.g. the old 4-byte pid records); error
-    out so we never misread its records as (pgid, pid)."""
-    fcntl.lockf(fd, fcntl.LOCK_EX, 4, 0)
-    try:
-        rec = os.pread(fd, 4, 0)
-        cur = struct.unpack('=I', rec)[0] if len(rec) == 4 else 0
-        if cur == 0:
-            os.pwrite(fd, struct.pack('=I', _LOCK_MAGIC), 0)
-        elif cur != _LOCK_MAGIC:
-            os.close(fd)
-            test_fail(f"lock file {_PORT_LOCK_PATH} has layout magic "
-                      f"{cur:#010x}, expected {_LOCK_MAGIC:#010x} -- a stale file "
-                      "from an incompatible testsuite. Remove it and retry.")
-    except (OSError, struct.error):
-        pass
-    finally:
-        try:
-            fcntl.lockf(fd, fcntl.LOCK_UN, 4, 0)
-        except OSError:
-            pass
-
-
-def _record_port_proc(port: int, pgid: int, pid: int) -> 'None':
-    """Record (or clear, with pgid==pid==0) the test process group and rsyncd pid
-    bound to `port`. The caller holds the port's lock. The pgid reaps the whole
-    test (daemon + clients + flipper) with one killpg; the pid is the recycle
-    guard (_pid_is_rsync) so we only kill a group still running our rsync."""
-    if _port_lock_fd is None:
-        return
-    try:
-        os.pwrite(_port_lock_fd, struct.pack('=ii', pgid, pid),
-                  _PORT_PID_BASE + port * _PORT_PID_REC)
-    except (OSError, struct.error):
-        pass
-
-
-def _read_port_proc(port: int) -> 'tuple':
-    """Read the recorded (pgid, pid) for `port`, or (0, 0) if none. Caller holds
-    the lock.
-
-    Normalises a pid <= 1 to (0, 0): a record holding 0 / negative / garbage must
-    NEVER be treated as a real pid (os.kill/os.killpg of 0 or -N would signal a
-    whole process group). Only pid > 1 is a candidate, and _pid_is_rsync() still
-    verifies it before any kill."""
-    if _port_lock_fd is None:
-        return (0, 0)
-    try:
-        rec = os.pread(_port_lock_fd, _PORT_PID_REC,
-                       _PORT_PID_BASE + port * _PORT_PID_REC)
-        if len(rec) != _PORT_PID_REC:
-            return (0, 0)
-        pgid, pid = struct.unpack('=ii', rec)
-    except (OSError, struct.error):
-        return (0, 0)
-    return (pgid, pid) if pid > 1 else (0, 0)
-
-
-def _pid_is_rsync(pid: int) -> bool:
-    """True if `pid` is a live process whose command is rsync. Guards against a
-    recycled pid before we kill it. Tries `ps -p N -o comm=` (precise, Linux/BSD/
-    Solaris/macOS) and falls back to plain `ps -p N` (Cygwin's ps rejects -o but
-    still prints the command). If neither confirms it, return False (leave the
-    process alone)."""
-    if pid <= 1:
-        return False   # 0/-N would make os.kill signal a whole process group
-    if pid == os.getpid():
-        return False   # never signal ourselves
-    try:
-        os.kill(pid, 0)
-    except OSError:
-        return False
-    for argv in (['ps', '-p', str(pid), '-o', 'comm='], ['ps', '-p', str(pid)]):
-        try:
-            r = subprocess.run(argv, stdout=subprocess.PIPE,
-                               stderr=subprocess.DEVNULL, text=True, timeout=5)
-        except (OSError, subprocess.SubprocessError):
-            return False
-        if r.returncode == 0:          # ps understood the form -> answer is definitive
-            return 'rsync' in r.stdout
-    return False                       # no ps form worked -> don't kill
-
-
-def _wait_pid_gone(pid: int, timeout: float) -> bool:
-    """Poll up to `timeout` seconds for `pid` to stop being a live rsync.
-
-    SIGKILL is asynchronous: the process may still be visible for a moment
-    after it is signalled, so a single immediate check would call a dying
-    process "still alive"."""
-    deadline = time.monotonic() + timeout
-    while True:
-        if not _pid_is_rsync(pid):
-            return True
-        if time.monotonic() >= deadline:
-            return False
-        time.sleep(0.1)
-
-
-def _reap_group(pgid: int, pid: int) -> bool:
-    """Kill the test's whole process group (daemon + its clients + flipper) when
-    `pid` is still a live rsync -- the portable recycle guard, so we only ever
-    signal a group still running our rsync.  killpg(pgid) sweeps the group in one
-    shot (the test driver runs in its own session, so the group is exactly that
-    test's tree); if the pgid is unusable, fall back to killing the daemon pid
-    alone.
-
-    Returns True only when the daemon is CONFIRMED GONE, not merely when a
-    signal was accepted.  The caller clears the port's registry entry on a True
-    return, and that entry is the only handle anyone has on the process; on
-    Cygwin a signal is routinely accepted by a process that then ignores it, so
-    trusting the accept would discard the record while the port stays squatted
-    -- leaving an occupant nothing can identify or reap.
-
-    The confirmation is a bounded poll, not a single immediate check: SIGKILL is
-    asynchronous, so a process still winding down is normal and answering
-    "not gone" for it would make _probe_bindable() skip its retry and fail the
-    test for a port that was about to free itself."""
-    if not _pid_is_rsync(pid):
-        return False
-    try:
-        if pgid > 1 and pgid != os.getpgrp():
-            os.killpg(pgid, signal.SIGKILL)
-        else:
-            os.kill(pid, signal.SIGKILL)
-    except OSError:
-        try:
-            os.kill(pid, signal.SIGKILL)
-        except OSError:
-            pass
-    if _wait_pid_gone(pid, 2.0):
-        return True
-    # Survived SIGKILL: on Cygwin that means it is stuck in a Windows call,
-    # where only Windows can end it.
-    _win_force_kill(pid)
-    return _wait_pid_gone(pid, 2.0)
-
-
-def _reap_orphan_daemon(port: int) -> bool:
-    """Kill an orphaned test process group squatting `port`, if we can identify it.
-
-    We hold the claim_ports() exclusive lock for `port`, so nothing we coordinate
-    with owns it -- a still-bound port is an orphan a SIGKILLed run stranded (off
-    Linux there's no PR_SET_PDEATHSIG backstop, so its --no-detach rsyncd outlives
-    the test). start_rsyncd recorded that test's (pgid, pid); if the pid is still a
-    live rsync, killpg the group. Returns True if it signalled something (caller
-    re-probes the bind). Pure os/ps calls -> every platform."""
-    pgid, pid = _read_port_proc(port)
-    if not _reap_group(pgid, pid):
-        return False
-    _record_port_proc(port, 0, 0)
-    time.sleep(0.2)   # let the kernel release the socket before the re-probe
-    return True
-
-
-def _reap_stale_daemons() -> 'None':
-    """Intra-run sweep: kill every orphaned test rsyncd recorded in the lock file
-    whose port-lock is free (no live test owns it), and clear its record.
-
-    _reap_orphan_daemon() only fires when a NEW test claims the *same* port an
-    orphan still squats; a daemon a SIGKILLed/timed-out test stranded on a port
-    nothing else re-claims would otherwise linger for the whole run (off Linux
-    there's no PR_SET_PDEATHSIG backstop), accumulating and exhausting ports until
-    a later race test wedges.  This sweeps the whole pid registry so each test
-    process reaps the leaks left by earlier ones.
-
-    Run once per test process at the first claim_ports(), BEFORE this process has
-    recorded any daemon of its own, so it never kills our own rsyncd.  A port a
-    live concurrent test holds keeps its byte-lock, so LOCK_NB skips it; only a
-    free-locked port with a recorded live rsync pid is a genuine orphan."""
-    if _port_lock_fd is None:
-        return
-    try:
-        size = os.fstat(_port_lock_fd).st_size
-    except OSError:
-        return
-    if size <= _PORT_PID_BASE:
-        return
-    try:
-        region = os.pread(_port_lock_fd, size - _PORT_PID_BASE, _PORT_PID_BASE)
-    except OSError:
-        return
-    for port in range(min(len(region) // _PORT_PID_REC, 65536)):
-        pgid, pid = struct.unpack('=ii', region[port*_PORT_PID_REC:(port+1)*_PORT_PID_REC])
-        if pid <= 1:
-            continue
-        # Grab the port's byte-lock non-blocking: success => no live test owns it.
-        try:
-            fcntl.lockf(_port_lock_fd, fcntl.LOCK_EX | fcntl.LOCK_NB, 1, port)
-        except OSError:
-            continue   # a live test holds it -- not an orphan, leave it alone
-        try:
-            if _reap_group(pgid, pid):
-                _record_port_proc(port, 0, 0)
-        finally:
-            try:
-                fcntl.lockf(_port_lock_fd, fcntl.LOCK_UN, 1, port)
-            except OSError:
-                pass
-
-
-def _probe_bindable(port: int, _reaped: bool = False, fatal: bool = True) -> bool:
-    """Confirm `port` is actually free once we hold its claim_ports() lock.
-
-    The byte-range lock only coordinates *live* test drivers, and the kernel
-    releases it the instant the holding process dies -- even if that driver left
-    an orphaned daemon still bound to the port. That happens when a run is
-    SIGKILLed (or its ssh drops) on a platform with no parent-death backstop:
-    rsyncfns only arms PR_SET_PDEATHSIG, which is Linux-only, so on the
-    BSDs/Solaris/macOS a killed fleettest run can strand its rsyncd, which then
-    squats the fixed test port. Because we recorded that rsyncd's pid in the lock
-    file (and hold the lock now, proving it's not a live run), we can reap it and
-    retry rather than failing -- see _reap_orphan_daemon.
-
-    So actually try to bind it. SO_REUSEADDR is used so a port merely in
-    TIME_WAIT (recently and cleanly closed) is NOT a false positive; only a
-    live bound/listening socket -- a real squatter -- makes the bind fail. The
-    probe socket is closed immediately, freeing the port for the daemon that is
-    about to bind it.
-    """
-    s = _socket.socket(_socket.AF_INET, _socket.SOCK_STREAM)
-    s.setsockopt(_socket.SOL_SOCKET, _socket.SO_REUSEADDR, 1)
-    try:
-        s.bind(('127.0.0.1', port))
-        return True
-    except OSError as e:
-        err = e
-    finally:
-        s.close()
-    # Bound by a squatter. If it's our own stranded orphan, kill it and retry once.
-    if not _reaped and _reap_orphan_daemon(port):
-        return _probe_bindable(port, _reaped=True, fatal=fatal)
-    if not fatal:
-        return False
-    test_fail(
-        f"port {port} was claimed for this run but something is still bound "
-        f"to 127.0.0.1:{port} ({err.strerror}). The claim_ports() lock only "
-        "serializes live test runs, so a still-bound port almost always "
-        "means an orphaned 'rsync --daemon' from a previously killed run "
-        f"(find it with `fstat | grep {port}` / `netstat -an | grep {port}` "
-        "and kill it, or run `fleettest.py --cleanup`), then retry.")
-    return False
-
-
-def claim_ports(*ports: int) -> 'None':
-    """Reserve the given TCP port numbers for the rest of this process.
-
-    Uses POSIX byte-range locks on /tmp/rsync_test.lck (one byte per port,
-    offset = port number) so that any number of tests can run in parallel
-    without colliding on a port: if another test has already claimed any of
-    the requested ports the call blocks until that test exits. The kernel
-    drops POSIX advisory locks automatically when the holding process
-    terminates, so a crashed test releases its ports without manual
-    cleanup.
-
-    Ports are claimed in sorted order, so two callers that ask for the same
-    set in different orders can't deadlock against each other.
-
-    Call once near the top of any test that binds to a specific TCP port,
-    BEFORE the bind:
-
-        from rsyncfns import claim_ports
-        claim_ports(12873)
-        listener = socket.socket(...)
-        listener.bind(('127.0.0.1', 12873))
-
-    The lock file lives in /tmp so it's shared across all rsync test
-    processes on the host. Ports outside the claim_ports() ecosystem are
-    not protected -- nothing stops an unrelated process from binding the
-    port. For the rsync testsuite that's fine; we just need to avoid
-    collisions between concurrent test scripts.
-    """
-    global _port_lock_fd, _reaped_stale
-    if _port_lock_fd is None:
-        _port_lock_fd = _open_lock_file()
-    if not _reaped_stale:
-        # Intra-run cleanup: reap any daemon an earlier test in this run stranded,
-        # BEFORE we record one of our own.  Once per process is enough.
-        _reaped_stale = True
-        _reap_stale_daemons()
-    for port in sorted(ports):
-        # F_SETLKW via fcntl.lockf(LOCK_EX, length, start): exclusive
-        # byte-range lock on byte `port`, blocking until acquired.
-        fcntl.lockf(_port_lock_fd, fcntl.LOCK_EX, 1, port)
-        # The lock only proves no other live test run owns the port; an orphaned
-        # daemon from a killed run can still squat it (see _probe_bindable).
-        _probe_bindable(port)
-
-
-def claim_free_port(preferred: int) -> int:
-    """Claim `preferred`, or a nearby port if something else is squatting it.
-
-    claim_ports() fails loudly on an occupied port, which is right for a test
-    that binds the port itself: it must not silently drift away from the number
-    it is about to bind.  start_test_daemon() owns both the bind and the URL it
-    hands back, so it can simply move instead -- and needs to, because a fixed
-    test port can be permanently held by unrelated software on a shared CI box
-    (a vendor service was found sitting on 13010 on the Windows/Cygwin target),
-    which no amount of orphan reaping will free.
-
-    Returns the port actually claimed.
-    """
-    global _port_lock_fd, _reaped_stale
-    if _port_lock_fd is None:
-        _port_lock_fd = _open_lock_file()
-    if not _reaped_stale:
-        _reaped_stale = True
-        _reap_stale_daemons()
-    candidates = [preferred] + [preferred + off for off in (1000, 2000, 3000, 4000)]
-    for port in candidates:
-        if not 1024 < port < 65536:
-            continue
-        fcntl.lockf(_port_lock_fd, fcntl.LOCK_EX, 1, port)
-        if _probe_bindable(port, fatal=False):
-            return port
-    test_fail(
-        f"no usable TCP port near {preferred}: every candidate "
-        f"({', '.join(str(p) for p in candidates)}) is bound by something "
-        "outside the testsuite.  Check with `netstat -an` and free one, or "
-        "run `fleettest.py --cleanup` if they are stranded test daemons.")
-    return preferred
-
-
-# --- standalone rsyncd helpers ---------------------------------------------
-
-def _set_pdeathsig() -> 'None':
-    """Linux: ask the kernel to send SIGTERM to us if our parent dies.
-    A no-op on every other platform. Used as preexec_fn so a kill -9 of
-    the test process doesn't strand the rsyncd we spawned.
-
-    The daemon deliberately stays in the TEST's process group: runtests.py
-    killpg's that group when a test times out, and that is what keeps a
-    timed-out test from stranding its daemon. Giving the daemon a group of
-    its own would put it out of reach of that sweep; its per-connection
-    children are handled by _daemon_children() instead."""
-    if not sys.platform.startswith('linux'):
-        return
-    try:
-        import ctypes
-        libc = ctypes.CDLL('libc.so.6', use_errno=True)
-        PR_SET_PDEATHSIG = 1
-        libc.prctl(PR_SET_PDEATHSIG, 15, 0, 0, 0)  # 15 == SIGTERM
-    except OSError:
-        pass
-
-
-def _win_force_kill(pid: int) -> 'None':
-    """Cygwin last resort: terminate `pid` through Windows.
-
-    Cygwin signals are cooperative -- delivered via a helper thread in the
-    target -- so a process sitting in a Windows call ignores even SIGKILL.
-    Such a process keeps its listening socket and cannot be reaped by any
-    amount of kill/killpg/pkill. Map the cygwin pid to its Windows pid (the
-    4th column of `ps -W`) and let Windows do it. A no-op elsewhere."""
-    if not sys.platform.startswith('cygwin'):
-        return
-    try:
-        r = subprocess.run(['ps', '-W'], capture_output=True, text=True, timeout=10)
-    except (OSError, subprocess.SubprocessError):
-        return
-    for line in r.stdout.splitlines():
-        f = line.split()
-        if len(f) >= 4 and f[0] == str(pid):
-            try:
-                subprocess.run(['taskkill', '/F', '/PID', f[3]],
-                               capture_output=True, timeout=10)
-            except (OSError, subprocess.SubprocessError):
-                pass
-            return
-
-
-def _daemon_children(pid: int) -> list:
-    """PIDs whose parent is `pid` -- the connection handlers rsyncd forked.
-
-    Cygwin's ps understands neither -A nor -o, but `ps -W` prints
-    PID PPID PGID WINPID as its first four columns; everywhere else POSIX
-    `ps -A -o pid=,ppid=` does the job. Returns [] if neither works: the
-    caller then just kills the parent, which is the old behaviour."""
-    argv = (['ps', '-W'] if sys.platform.startswith('cygwin')
-            else ['ps', '-A', '-o', 'pid=,ppid='])
-    try:
-        r = subprocess.run(argv, capture_output=True, text=True, timeout=10)
-    except (OSError, subprocess.SubprocessError):
-        return []
-    kids = []
-    for line in r.stdout.splitlines():
-        f = line.split()
-        if len(f) >= 2 and f[1] == str(pid):
-            try:
-                kids.append(int(f[0]))
-            except ValueError:
-                pass
-    return kids
-
-
-def _kill_pid(pid: int) -> 'None':
-    """SIGTERM, then SIGKILL, then -- on Cygwin -- Windows.
-
-    Gated on _pid_is_rsync at every step: these pids were snapshotted before the
-    parent was killed, so between the snapshot and the signal a child can exit
-    and the kernel can hand its pid to something else. Re-checking that the pid
-    is STILL a live rsync before each signal keeps a recycled pid from getting
-    the harness to kill an unrelated process.
-
-    KNOWN LIMITATION: check-then-signal is inherently a TOCTOU, so the window is
-    narrowed to microseconds rather than closed -- the pid would have to be
-    recycled onto ANOTHER rsync in that gap to matter. Closing it properly needs
-    a stable process reference (pidfd, or a retained Windows handle), which is
-    per-platform machinery this suite has to run on seven of; the same guard is
-    what _reap_group() has always used."""
-    for sig in (signal.SIGTERM, signal.SIGKILL):
-        if not _pid_is_rsync(pid):
-            return          # gone, or the pid now belongs to someone else
-        try:
-            os.kill(pid, sig)
-        except OSError:
-            return          # already gone
-        time.sleep(0.3)
-    if _pid_is_rsync(pid):
-        _win_force_kill(pid)
-
-
-def _stop_rsyncd(proc) -> 'None':
-    """Stop the test daemon AND the connection handlers it forked.
-
-    Killing proc alone -- the only pid the Popen handle knows -- is what left
-    the orphan: rsyncd forks a child per connection, and one still winding up
-    or down when the test ends outlives the parent, inherits the listening
-    socket and squats the port. Snapshot the children BEFORE killing the
-    parent, because once it is gone they are reparented to init and no longer
-    identifiable as ours.
-
-    KNOWN LIMITATION: that is also why nothing is collected when the parent has
-    ALREADY exited on its own (it crashed, say) while a child still holds the
-    port -- by then the parent-child link this relies on is gone. The runner's
-    per-test-timeout killpg covers the common case, since the daemon stays in
-    the test's process group; `fleettest.py --cleanup` sweeps the rest."""
-    if proc.poll() is not None:
-        return
-    kids = _daemon_children(proc.pid)
-    try:
-        proc.terminate()
-        proc.wait(timeout=2)
-    except subprocess.TimeoutExpired:
-        try:
-            proc.kill()
-            proc.wait(timeout=1)
-        except (subprocess.TimeoutExpired, OSError):
-            pass
-        _win_force_kill(proc.pid)
-    except OSError:
-        pass
-    for kid in kids:
-        _kill_pid(kid)
-
-
-def _cleanup_rsyncd(proc, port: int) -> 'None':
-    """atexit handler: stop the daemon and clear its pid slot. A clean exit thus
-    leaves no orphan to reap; only a SIGKILL (which skips atexit) leaves the slot
-    set -- exactly the case _reap_orphan_daemon() needs it for.
-
-    The slot is kept only while it still NAMES something reapable -- i.e. our
-    daemon pid is somehow still a live rsync, which on Cygwin means it ignored
-    the kill. That is the only case where the record buys a later run anything.
-
-    Keying this on the port being busy instead looks safer but is worse: a port
-    sits in TIME_WAIT after a passing test, so a plain bind fails and a record
-    naming an already-dead pid is retained forever. Nothing ever clears such a
-    record, and if that pid is later recycled onto an unrelated rsync the stale
-    sweep would signal it. A record naming a dead process cannot help anyone --
-    every reaper rejects it at the _pid_is_rsync guard -- so clearing it is
-    strictly better.
-
-    KNOWN LIMITATION: if the daemon parent died on its own while a connection
-    child still held the port, that child is unreachable either way -- the
-    record only ever named the parent. `fleettest.py --cleanup` sweeps it."""
-    _stop_rsyncd(proc)
-    if not _pid_is_rsync(proc.pid):
-        _record_port_proc(port, 0, 0)
-
-
-def start_rsyncd(conf_path, port: int, rsync_cmd: str = None,
-                 stdin=subprocess.DEVNULL) -> 'subprocess.Popen':
-    """Spawn `rsync --daemon --no-detach --address=127.0.0.1 --port=N
-    --config=conf` and return the Popen handle after the port is accepting
-    connections.
-
-    The daemon is bound to LOOPBACK ONLY (--address=127.0.0.1): without it,
-    rsync --daemon binds 0.0.0.0 and the test modules would be reachable from
-    the whole LAN. The daemon is killed automatically when this Python
-    process exits (atexit). On Linux, the kernel also signals SIGTERM to the
-    daemon if the parent dies abruptly (PR_SET_PDEATHSIG), so a SIGKILL on
-    the test process doesn't strand the daemon either. The caller is expected
-    to have already claim_ports()'d `port`.
-
-    rsync_cmd selects the binary to run as the daemon; it defaults to
-    RSYNC_PEER (the peer side of a two-sided run), so ordinary daemon tests
-    get current-client <-> peer-daemon. The reverse-direction test passes
-    rsync_cmd=RSYNC to put the current build on the daemon side and drive with
-    the old client. stdin may override the default /dev/null input when a test
-    needs to exercise daemon launch detection.
-
-    This is only ever reached from start_test_daemon() in --use-tcp mode; the
-    default (pipe) mode never starts a listening daemon.
-    """
-    argv = shlex.split(rsync_cmd or RSYNC_PEER) + [
-        '--daemon', '--no-detach',
-        '--address=127.0.0.1',
-        f'--port={port}',
-        f'--config={conf_path}',
-    ]
-    proc = subprocess.Popen(
-        argv,
-        stdin=stdin,
-        stdout=subprocess.DEVNULL,
-        stderr=subprocess.DEVNULL,
-        preexec_fn=_set_pdeathsig,
-    )
-    # Record this test's process group (os.getpgrp() -- the daemon and its clients
-    # and flipper all live in the per-test session runtests.py started) together
-    # with this --no-detach rsyncd's pid, while we still hold the port's lock, so a
-    # later test/run can killpg the whole stranded tree (see _reap_orphan_daemon).
-    _record_port_proc(port, os.getpgrp(), proc.pid)
-    atexit.register(_cleanup_rsyncd, proc, port)
-
-    deadline = time.monotonic() + 10
-    last_err = None
-    while time.monotonic() < deadline:
-        if proc.poll() is not None:
-            test_fail(
-                f"rsyncd exited before listening on port {port} "
-                f"(status={proc.returncode})"
-            )
-        try:
-            with _socket.create_connection(('127.0.0.1', port), timeout=0.5):
-                return proc
-        except OSError as e:
-            last_err = e
-            time.sleep(0.05)
-
-    _stop_rsyncd(proc)
-    test_fail(f"rsyncd never listened on 127.0.0.1:{port}: {last_err}")
-
-
-def start_test_daemon(conf_path, port: int, rsync_cmd: str = None) -> str:
-    """Bring up the test daemon and return a URL prefix for client commands.
-
-    rsync_cmd selects the daemon-side binary (default RSYNC_PEER); pass
-    rsync_cmd=RSYNC for the reverse-direction test (current daemon, old client).
-
-    This is the single seam every daemon test uses. The transport depends on
-    the mode the runner selected:
-
-      * DEFAULT (secure) -- no TCP socket at all. Sets RSYNC_CONNECT_PROG so
-        the rsync client forks the daemon over a private stdio pipe. Returns
-        'rsync://localhost/'. Another local user can't reach it; nothing is
-        listening.
-
-      * --use-tcp -- starts a real rsyncd bound to 127.0.0.1 on the given
-        claim_ports()-reserved port. Returns 'rsync://localhost:PORT/'. Bound
-        to loopback so off-host/LAN access is impossible; a same-host user
-        could still connect during the test window, which is the documented,
-        accepted cost of explicitly opting into TCP.
-
-    Build URLs as f"{prefix}module/path". `port` is only used (and claimed)
-    in --use-tcp mode.
-    """
-    daemon_cmd = rsync_cmd or RSYNC_PEER
-    if USE_TCP:
-        port = claim_free_port(port)
-        start_rsyncd(conf_path, port, daemon_cmd)
-        return f'rsync://localhost:{port}/'
-    # RSYNC_CONNECT_PROG is run by a shell, so every word has to survive
-    # re-parsing: a build path with a space would otherwise exec its prefix.
-    os.environ['RSYNC_CONNECT_PROG'] = (
-        f'{rsync_path_arg(daemon_cmd)} --config={shlex.quote(str(conf_path))} --daemon')
-    return 'rsync://localhost/'
-
-
-def require_tcp(reason: str) -> 'None':
-    """Skip the test (exit 77) unless we're in --use-tcp mode. For tests that
-    fundamentally need a real listening socket / TCP peer and have no secure
-    pipe equivalent (the fake-proxy listener; the reverse-DNS hostname-ACL
-    daemon test)."""
-    if not USE_TCP:
-        test_skipped(reason)
-
-
-def require_asan(reason: str, which: str = None) -> 'None':
-    """Skip the test (exit 77) unless the rsync binary is AddressSanitizer-
-    instrumented. `which` defaults to the daemon/peer command (RSYNC_PEER);
-    pass RSYNC to check the client side. Detection runs the binary with
-    ASAN_OPTIONS=help=1, which makes an instrumented binary print the ASan
-    flag help banner to stderr."""
-    cmd = split_rsync_cmd(which or RSYNC_PEER)
-    try:
-        r = subprocess.run(cmd + ['--version'],
-                           env={**os.environ, 'ASAN_OPTIONS': 'help=1'},
-                           stdout=subprocess.DEVNULL, stderr=subprocess.PIPE,
-                           timeout=15)
-    except Exception:
-        test_skipped(reason)
-        return
-    if b'AddressSanitizer' not in r.stderr:
-        test_skipped(reason)
-
-
-def rsh_cmd(cmd: str = None, *opts: str) -> str:
-    """Build an RSYNC_RSH / --rsh value, quoted for rsync's own tokenizer.
-
-    rsync splits this string on spaces itself -- honouring ' and ", see do_cmd()
-    in main.c -- so a remote-shell path containing a space must be quoted or
-    rsync execs only the first word.  The testsuite's srcdir can contain one.
-    """
-    if cmd is None:
-        cmd = str(SRCDIR / 'support' / 'lsh.sh')
-    return ' '.join([shlex.quote(cmd), *opts])
-
-
-def rsync_path_arg(cmd: str = None) -> str:
-    """Value for --rsync-path, quoted for the shell that will re-parse it.
-
-    --rsync-path is a command line run by the remote shell, not a filename, so
-    rsync hands it over unquoted and the far side word-splits it.  A build path
-    containing a space therefore needs quoting here, while a wrapper command
-    ('valgrind ... /build/rsync') must stay several words.  Splitting and
-    re-joining with shlex gives both: each word is quoted only if it needs it.
-    """
-    return shlex.join(split_rsync_cmd(RSYNC_PEER if cmd is None else cmd))
-
-
-def rsync_argv(*args: str) -> list:
-    """Return the argv for invoking rsync with the given extra arguments.
-
-    RSYNC may be a multi-word command (e.g. 'valgrind ... /build/rsync'); we
-    shlex-split it so subprocess sees a proper argv list. Each *args entry
-    is appended verbatim, so callers should pass tokens already split (no
-    embedded option/value joined by spaces).
-    """
-    return split_rsync_cmd(RSYNC) + list(args)
-
-
-import functools as _functools
-
-
-@_functools.lru_cache(maxsize=64)
-def rsync_supports(flag: str) -> bool:
-    """Does the configured rsync binary accept ``flag``?
-
-    Probes by invoking ``rsync <flag> --version`` and checking the exit code +
-    stderr.  C rsync accepts every flag we'd care about and exits 0 before
-    --version prints; other implementations (gokrazy/rsync, openrsync) reject
-    unsupported flags with "unknown option" / "unrecognized option" /
-    "no such option" and a non-zero exit.
-
-    Used by tests that want to *optionally* pass a hardening flag like
-    `--no-inc-recursive` (only meaningful where the implementation has
-    incremental recursion to disable).  When the probe is inconclusive (e.g.
-    timeout) the helper returns True so tests fall back to today's C-rsync
-    behaviour.
-    """
-    try:
-        r = subprocess.run(rsync_argv(flag, '--version'),
-                           capture_output=True, text=True, timeout=5)
-    except (subprocess.TimeoutExpired, OSError):
-        return True
-    if r.returncode == 0:
-        return True
-    stderr = (r.stderr or '').lower()
-    for marker in ('unknown option', 'unrecognized option', 'no such option'):
-        if marker in stderr:
-            return False
-    # Non-zero exit but no recognizable "unknown" marker -- assume supported.
-    return True
-
-
-def forced_protocol():
-    """The protocol version pinned via --protocol=N in the RSYNC command, or
-    None when the run isn't pinning one (so the binary negotiates its newest).
-    Protocol-sensitive tests use this to gate sub-cases -- e.g. the split
-    between --append and --append-verify only exists at protocol >= 30; at
-    protocol 29 plain --append behaves like the old verifying append."""
-    import re
-    m = re.search(r'--protocol[ =](\d+)', RSYNC)
-    return int(m.group(1)) if m else None
-
-
-def run_rsync(*args: str, check: bool = True,
-              capture_output: bool = False) -> subprocess.CompletedProcess:
-    """Run rsync with the given arguments.
-
-    By default, stdout/stderr inherit (so the runner captures them in the
-    per-test log). Set capture_output=True if the test needs to inspect the
-    output. If check is True (the default), a non-zero exit calls
-    test_fail() with the rsync command line.
-    """
-    argv = rsync_argv(*args)
-    if capture_output:
-        proc = subprocess.run(argv, capture_output=True, text=True)
-    else:
-        proc = subprocess.run(argv)
-    if check and proc.returncode != 0:
-        test_fail(f"rsync exited {proc.returncode}: {' '.join(argv)}")
-    return proc
-
-
-# --- filesystem helpers ----------------------------------------------------
-
-def makepath(*paths) -> 'None':
-    """Equivalent of rsync.fns makepath: mkdir -p, but for multiple paths."""
-    for p in paths:
-        os.makedirs(p, exist_ok=True)
-
-
-def rmtree(path) -> 'None':
-    """Remove a tree if it exists, ignoring missing entries."""
-    p = Path(path)
-    if p.exists() or p.is_symlink():
-        shutil.rmtree(p, ignore_errors=True)
-
-
-def is_a_link(path) -> bool:
-    """True if 'path' is a symbolic link (dangling or not)."""
-    return os.path.islink(path)
-
-
-def start_path_flipper(name_a, name_b):
-    """Spawn a separate PROCESS that repeatedly swaps two sibling paths
-    name_a <-> name_b in a tight rename loop, for TOCTOU symlink-race tests:
-    point one at a real directory and the other at a symlink so the shared name
-    keeps flipping between a directory and a symlink under a running rsync.
-
-    A separate process (not a thread) is used deliberately: a Python thread
-    contends with the test's own loop for the GIL and flips far too slowly to
-    win the race.  The swap is three renames via a scratch name in the same
-    directory, so the shared name is absent only for the brief instant between
-    two renames (rsync just gets ENOENT and retries).
-
-    The caller should stop it with stop_flipper(), but the flipper also
-    self-terminates: it exits when its parent (the test process) goes away --
-    os.getppid() changes once the test is reaped -- and after a hard deadline as a
-    backstop.  Without this, a test killed before its stop_flipper() finally (a
-    timeout, a crash) would leak an orphan that keeps renaming paths in the shared
-    scratch and poisons later tests on the same box.  os.getppid() is POSIX, so
-    this is portable across the fleet.
-
-    Returns a subprocess.Popen; the caller must stop it with stop_flipper()."""
-    code = (
-        "import os, sys, time\n"
-        "a, b = sys.argv[1], sys.argv[2]\n"
-        "tmp = a + '.flip'\n"
-        "parent = os.getppid()\n"
-        "deadline = time.monotonic() + 300\n"
-        "while os.getppid() == parent and time.monotonic() < deadline:\n"
-        "    try:\n"
-        "        os.rename(a, tmp); os.rename(b, a); os.rename(tmp, b)\n"
-        "    except OSError:\n"
-        "        pass\n"
-    )
-    return subprocess.Popen([sys.executable, '-c', code, str(name_a), str(name_b)])
-
-
-def stop_flipper(proc):
-    """Stop a start_path_flipper()/start_c_flipper() process."""
-    proc.terminate()
-    try:
-        proc.wait(timeout=2)
-    except subprocess.TimeoutExpired:
-        proc.kill()
-        proc.wait()
-
-
-# A compiled flipper wins TOCTOU races far more reliably than the Python one:
-# on a journaled disk fs it does ~2x the swaps/sec with a plain rename loop and
-# ~7x with renameat2(RENAME_EXCHANGE) -- which is also denser, as EXCHANGE is a
-# single atomic syscall with no transient missing-name window.  Compiled on
-# demand against the build's config.h so the renameat2/portability guards match
-# the target; falls back to the Python flipper where no compiler is available.
-_C_FLIPPER_SRC = r'''
-/* testsuite flipper: repeatedly swap two sibling names a<->b so a shared path
- * keeps flipping (typically real-dir <-> symlink) under a running rsync.
- * Prefers atomic renameat2(RENAME_EXCHANGE); falls back to a 3-rename dance.
- * Self-terminates when its parent (the test) goes away, plus a deadline
- * backstop, so a killed test never leaks an orphan that poisons later tests.
- * Built on demand by rsyncfns.compile_c_flipper(); not linked into rsync. */
-#define _GNU_SOURCE 1
-#include "config.h"
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <unistd.h>
-#include <fcntl.h>
-#include <errno.h>
-#include <time.h>
-#include <sys/stat.h>
-#if defined(__linux__)
-# include <sys/syscall.h>
-# ifndef RENAME_EXCHANGE
-#  define RENAME_EXCHANGE (1 << 1)
-# endif
-#endif
-
-static double mono(void) {
-    struct timespec t;
-    clock_gettime(CLOCK_MONOTONIC, &t);
-    return t.tv_sec + t.tv_nsec / 1e9;
-}
-
-static int use_exchange = 1;
-
-static void flip(const char *a, const char *b) {
-#if defined(__linux__) && defined(SYS_renameat2)
-    if (use_exchange) {
-        if (syscall(SYS_renameat2, AT_FDCWD, a, AT_FDCWD, b, RENAME_EXCHANGE) == 0)
-            return;
-        if (errno == ENOSYS || errno == EINVAL || errno == EOPNOTSUPP)
-            use_exchange = 0;   /* kernel or filesystem lacks EXCHANGE */
-        else
-            return;             /* transient race error (e.g. ENOENT): retry */
-    }
-#endif
-    {
-        char tmp[4096];
-        if (snprintf(tmp, sizeof tmp, "%s.flip", a) >= (int)sizeof tmp)
-            return;                 /* too long: don't act on a truncated name */
-        rmdir(tmp); unlink(tmp);    /* clear a stale scratch from a wedged half-swap */
-        if (rename(a, tmp) != 0) {
-            mkdir(a, 0700);         /* a was consumed: recreate so the next loop swaps */
-            return;
-        }
-        if (rename(b, a) != 0)
-            rename(tmp, a);         /* b gone: restore a, retry next loop */
-        else
-            rename(tmp, b);         /* complete the swap */
-    }
-}
-
-int main(int argc, char **argv) {
-    if (argc < 3) {
-        fprintf(stderr, "usage: %s PATH_A PATH_B\n", argv[0]);
-        return 2;
-    }
-    const char *a = argv[1], *b = argv[2];
-    pid_t parent = getppid();
-    double deadline = mono() + 300.0;   /* backstop if never reaped */
-    while (getppid() == parent && mono() < deadline)
-        flip(a, b);
-    return 0;
-}
-'''
-
-_c_flipper_bin = None  # None=untried, ''=unavailable, else path
-
-
-def _detect_cc():
-    """The C compiler the tree was built with (so the flipper matches the
-    target), falling back to a plain cc/gcc/clang on PATH."""
-    cc = os.environ.get('CC')
-    if cc:
-        return cc
-    import re
-    # The generated Makefile lives in the BUILD dir (TOOLDIR); for a VPATH build
-    # that is not SRCDIR.  Prefer TOOLDIR, fall back to SRCDIR for an in-tree build.
-    for d in (TOOLDIR, SRCDIR):
-        mk = d / 'Makefile'
-        if mk.is_file():
-            m = re.search(r'(?m)^CC\s*=\s*(.+?)\s*$', mk.read_text())
-            if m and m.group(1):
-                return m.group(1)
-    for c in ('cc', 'gcc', 'clang'):
-        if shutil.which(c):
-            return c
-    return None
-
-
-def compile_c_flipper():
-    """Build (once, cached) the C flipper against the build's config.h.  Returns
-    its path, or None if no compiler is available (caller uses the Python flipper)."""
-    global _c_flipper_bin
-    if _c_flipper_bin is not None:
-        return _c_flipper_bin or None
-    cc = _detect_cc()
-    src = SCRATCHDIR / 't_flipper.c'
-    out = SCRATCHDIR / ('t_flipper' + ('.exe' if os.name == 'nt' else ''))
-    if not cc:
-        _c_flipper_bin = ''
-        return None
-    src.write_text(_C_FLIPPER_SRC)
-    # config.h is generated into the BUILD dir (TOOLDIR); the Makefile compiles
-    # with `-I. -I$(srcdir)`, so mirror that (TOOLDIR first, then SRCDIR).
-    cmd = (shlex.split(cc)
-           + ['-O2', f'-I{TOOLDIR}', f'-I{SRCDIR}', '-o', str(out), str(src)])
-    proc = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.STDOUT,
-                          text=True)
-    if proc.returncode != 0 or not os.access(out, os.X_OK):
-        _c_flipper_bin = ''
-        return None
-    _c_flipper_bin = str(out)
-    return _c_flipper_bin
-
-
-def start_c_flipper(name_a, name_b):
-    """Like start_path_flipper() but execs the compiled flipper for a far higher
-    flip rate (a stronger RED oracle on slow filesystems).  Transparently falls
-    back to the Python flipper where no compiler is available.  Returns a Popen;
-    stop with stop_flipper()."""
-    binpath = compile_c_flipper()
-    if binpath:
-        return subprocess.Popen([binpath, str(name_a), str(name_b)])
-    return start_path_flipper(name_a, name_b)
-
-
-def cp_p(src, dst) -> 'None':
-    """Equivalent of rsync.fns cp_p: copy preserving mode + timestamps."""
-    shutil.copy2(src, dst)
-
-
-def make_data_file(path, size: int) -> 'None':
-    """Equivalent of rsync.fns make_data_file: create `path` with `size`
-    bytes of non-trivial content suitable for rsync's delta algorithm.
-
-    Prefers /dev/urandom for speed. Falls back to a deterministic LCG
-    seeded from PID and the destination path so successive calls produce
-    distinct content -- matching the shell helper.
-    """
-    path = str(path)
-    if os.path.exists('/dev/urandom'):
-        try:
-            with open('/dev/urandom', 'rb') as src, open(path, 'wb') as dst:
-                remaining = size
-                while remaining:
-                    chunk = src.read(min(remaining, 1 << 16))
-                    if not chunk:
-                        break
-                    dst.write(chunk)
-                    remaining -= len(chunk)
-            if remaining == 0:
-                return
-        except OSError:
-            pass
-
-    # Fallback: BSD-LCG to printable-ASCII (33..126), so output stays
-    # exactly `size` bytes regardless of awk/utf8 quirks the shell
-    # version worked around.
-    path_seed = int.from_bytes(path.encode(), 'big') & 0xFFFFFFFF
-    state = (os.getpid() + path_seed) % 2147483648
-    with open(path, 'wb') as f:
-        out = bytearray(size)
-        for i in range(size):
-            state = (state * 1103515245 + 12345) % 2147483648
-            out[i] = ((state >> 16) % 94) + 33
-        f.write(bytes(out))
-
-
-def make_text_file(path, lines: int = 100) -> 'None':
-    """Write a predictable, self-contained text file of `lines` lines.
-
-    This replaces the old habit of capturing `ls -l /etc` / `ls -l /bin`
-    (falling back to `ls /`) into the test tree. Those tied the fixtures
-    to the host filesystem layout: the directories are absent or
-    unreadable on Android/Termux and other minimal environments, where
-    `ls /` fails outright, and the captured content was never
-    reproducible. The output here is deterministic and depends on nothing
-    outside the suite, so every platform builds the identical fixture.
-    """
-    content = ''.join(
-        "line %06d  the quick brown fox jumps over the lazy dog  %d %d\n"
-        % (i, (i * 31) % 97, (i * 131) % 89)
-        for i in range(1, lines + 1)
-    )
-    with open(str(path), 'w') as f:
-        f.write(content)
-
-
-def get_testuid() -> int:
-    return os.getuid()
-
-
-def get_rootuid() -> int:
-    return 0
-
-
-def get_rootgid() -> int:
-    return 0
-
-
-def build_rsyncd_conf() -> 'Path':
-    """Equivalent of rsync.fns build_rsyncd_conf.
-
-    Writes $scratchdir/test-rsyncd.conf with the four standard modules
-    (test-from, test-to, test-scratch, test-hidden) and a $scratchdir/
-    ignore23 wrapper that propagates rsync's exit status except for
-    code 23 (vanished/missing source files), which it eats so that the
-    surrounding test can tolerate the partial-transfer case.
-
-    Returns the path to the config file. Tests typically follow up by
-    setting RSYNC_CONNECT_PROG so rsync forks an in-tree daemon instead
-    of contacting one over the network.
-    """
-    conf = SCRATCHDIR / 'test-rsyncd.conf'
-    pidfile = SCRATCHDIR / 'rsyncd.pid'
-    logfile = SCRATCHDIR / 'rsyncd.log'
-
-    my_uid = get_testuid()
-    root_uid = get_rootuid()
-    root_gid = get_rootgid()
-
-    if my_uid != root_uid:
-        # Non-root cannot specify uid/gid in rsyncd.conf.
-        uid_line = f"#uid = {root_uid}"
-        gid_line = f"#gid = {root_gid}"
-    else:
-        uid_line = f"uid = {root_uid}"
-        gid_line = f"gid = {root_gid}"
-
-    conf.write_text(f"""\
-# rsyncd configuration file autogenerated by rsyncfns.build_rsyncd_conf
-
-pid file = {pidfile}
-use chroot = no
-munge symlinks = no
-# Loopback only. In --use-tcp mode the daemon is also bound to 127.0.0.1
-# (start_rsyncd passes --address), so this is belt-and-suspenders; in the
-# default pipe mode there is no socket to guard at all.
-hosts allow = localhost 127.0.0.0/8
-log file = {logfile}
-transfer logging = yes
-# We don't define log format here so the test-hidden module defaults
-# to the internal static string (since we had a crash trying to tweak it).
-exclude = ? foobar.baz
-max verbosity = 4
-{uid_line}
-{gid_line}
-
-[test-from]
-\tpath = {FROMDIR}
-\tlog format = %i %h [%a] %m (%u) %l %f%L
-\tread only = yes
-\tcomment = r/o
-
-[test-to]
-\tpath = {TODIR}
-\tlog format = %i %h [%a] %m (%u) %l %f%L
-\tread only = no
-\tcomment = r/w
-
-[test-scratch]
-\tpath = {SCRATCHDIR}
-\tlog format = %i %h [%a] %m (%u) %l %f%L
-\tread only = no
-
-[test-hidden]
-\tpath = {FROMDIR}
-\tlist = no
-""")
-
-    ignore23 = SCRATCHDIR / 'ignore23'
-    ignore23.write_text(
-        '#!/bin/sh\n'
-        'if "${@}"; then exit; fi\n'
-        'ret=$?\n'
-        'if test $ret = 23; then exit; fi\n'
-        'exit $ret\n'
-    )
-    ignore23.chmod(0o755)
-
-    return conf
-
-
-def rsync_getgroups() -> list:
-    """List of group ids the test user is a member of, via the getgroups
-    test helper binary. Mirrors rsync.fns rsync_getgroups."""
-    out = subprocess.check_output([str(TOOLDIR / 'getgroups')], text=True)
-    return out.split()
-
-
-# --- extended attributes (per-OS surface) ----------------------------------
-# Mirrors the per-OS xset/xls/RSYNC_PREFIX/RUSR logic from the old
-# testsuite/rsync.fns + xattrs.test so the xattr / fake-super tests run on
-# Linux, macOS and FreeBSD (not just Linux). Test attributes use literal
-# names ("user.foo" etc., exactly as the shell did on every platform); only
-# rsync's own fake-super attribute name (RSYNC_PREFIX, used for the
-# "%stat" attr) and the special "equal" attr (RUSR) vary by OS.
-
-_SYSTEM = platform.system()
-
-# Cygwin reports "CYGWIN_NT-10.0-..." and uses Linux-style user.* xattrs
-# (rsync builds there with HAVE_LINUX_XATTRS), but CPython on Cygwin lacks
-# os.*xattr, so we drive the getfattr/setfattr CLIs there instead.
-_CYGWIN = _SYSTEM.startswith('CYGWIN')
-
-# Platforms whose user xattrs live in the "user." namespace encoded in the
-# attribute name (Linux and Cygwin). macOS/FreeBSD carry the namespace out
-# of band and a literal "user." prefix is actually rejected there.
-_LINUX_NS = _SYSTEM == 'Linux' or _CYGWIN
-
-# Test attribute names are LOGICAL (un-prefixed, e.g. "foo", "rsync.%stat");
-# _xattr_full() adds the "user." prefix on the Linux-namespace platforms.
-# RSYNC_PREFIX is the logical name of rsync's own fake-super attr ("rsync"
-# -> "rsync.%stat", and "user.rsync.%stat" on Linux/Cygwin). RUSR is the
-# prefix for the test's "equal" attr; macOS and Solaris use "rsync.nonuser"
-# to stay clear of rsync's reserved "rsync.*" space.
-RSYNC_PREFIX = 'rsync'
-RUSR = 'rsync.nonuser' if _SYSTEM in ('Darwin', 'SunOS') else 'rsync'
-
-
-def _xattr_full(name: str) -> str:
-    """Map a logical user-xattr name to the on-disk name for this OS."""
-    return ('user.' + name) if _LINUX_NS else name
-
-
-def xattrs_supported() -> bool:
-    """True if this rsync was built with xattr support AND this platform has
-    a way for the tests to set/list user xattrs."""
-    vv = run_rsync('-VV', check=True, capture_output=True).stdout
-    if '"xattrs": true' not in vv:
-        return False
-    if _SYSTEM == 'Linux':
-        return hasattr(os, 'setxattr')
-    if _CYGWIN:
-        return shutil.which('setfattr') is not None
-    if _SYSTEM == 'Darwin':
-        return shutil.which('xattr') is not None
-    if _SYSTEM == 'FreeBSD':
-        return shutil.which('setextattr') is not None
-    if _SYSTEM == 'SunOS':
-        return shutil.which('runat') is not None
-    return False  # NetBSD/etc.: not yet ported
-
-
-class XattrError(OSError):
-    """An xattr CLI refused an operation.
-
-    Deliberately an OSError: on Linux xattr_set() calls os.setxattr(), where a
-    refusal IS an OSError, so callers write `except OSError`.  Every other
-    platform shells out, and a bare CalledProcessError -- not an OSError --
-    sails straight past that handler.  A refusal the suite tolerates on Linux
-    would then be fatal everywhere else.
-
-    .errno is set only when the tool named one.  Most of these tools report a
-    message rather than a number, and guessing an errno from localised
-    strerror text would be worse than admitting we do not know, so a caller
-    that switches on .errno must cope with None.
-    """
-
-
-def _tool_errno(tool: str, msg: str) -> 'int | None':
-    """The errno a tool named for itself, or None if it named none.
-
-    Only macOS's xattr(1) reports one, as "xattr: [Errno 13] Permission
-    denied: '/some/path'".  Match that tool's own prefix, and only on the
-    first line: the rest of the line is a filename, and a file can perfectly
-    well be called "[Errno 5]" -- searching the whole message would let the
-    file being operated on dictate the errno we report.
-    """
-    if tool != 'xattr' or not msg:
-        return None
-    import re
-    m = re.match(r'xattr: \[Errno (\d+)\]', msg.splitlines()[0])
-    return int(m.group(1)) if m else None
-
-
-def _xattr_run(argv, **kwargs) -> 'None':
-    """Run an xattr CLI, raising XattrError rather than CalledProcessError."""
-    proc = subprocess.run(argv, capture_output=True, text=True, **kwargs)
-    if proc.returncode == 0:
-        return
-    msg = (proc.stderr or proc.stdout or '').strip()
-    err = XattrError(f'{argv[0]} exited {proc.returncode}'
-                     + (f': {msg}' if msg else ''))
-    err.errno = _tool_errno(argv[0], msg)
-    raise err
-
-
-def xattr_set(name: str, value: str, *paths) -> 'None':
-    """Set the user-namespace xattr `name` (logical) = `value` on each path.
-
-    Raises OSError (see XattrError) on every platform if the set is refused."""
-    full = _xattr_full(name)
-    for p in paths:
-        p = str(p)
-        if _SYSTEM == 'Linux':
-            os.setxattr(p, full.encode(), value.encode())
-        elif _CYGWIN:
-            _xattr_run(['setfattr', '-n', full, '-v', value, p])
-        elif _SYSTEM == 'Darwin':
-            _xattr_run(['xattr', '-w', full, value, p])
-        elif _SYSTEM == 'FreeBSD':
-            _xattr_run(['setextattr', '-h', 'user', full, value, p])
-        elif _SYSTEM == 'SunOS':
-            # Solaris extended attributes are a per-file namespace; runat
-            # cd's into it and runs a shell that reads the script on stdin
-            # (the -c form mangles args). Pass name/value via the environment
-            # to dodge quoting; printf writes the value with no trailing
-            # newline, matching the byte-exact value other platforms store.
-            _xattr_run(
-                ['runat', p, '/bin/sh'],
-                input='printf %s "$XVAL" > "$XNAME"\n',
-                env={**os.environ, 'XNAME': full, 'XVAL': value})
-        else:
-            raise NotImplementedError(f"xattr_set on {_SYSTEM}")
-
-
-def xattr_dump(*paths) -> str:
-    """Return a deterministic name=value dump of the user xattrs on `paths`,
-    for comparing a source tree against its rsync'd copy. The format only
-    needs to be self-consistent on a given OS (we never compare across OSes),
-    mirroring the per-OS xls() in the old xattrs.test."""
-    if _SYSTEM == 'Linux':
-        # Read xattrs natively (symmetric with the os.setxattr used in
-        # xattr_set) so the suite needs no external getfattr. The attr
-        # package's CLI tools are frequently absent -- on Android/Termux
-        # and minimal CI images -- even when the filesystem itself supports
-        # user xattrs, in which case shelling out to getfattr would crash
-        # the test instead of exercising it. The output mimics "getfattr
-        # -d": a "# file:" header then sorted name="value" lines, files
-        # with no user xattrs omitted.
-        out = []
-        for p in paths:
-            sp = str(p)
-            names = sorted(n for n in os.listxattr(sp) if n.startswith('user.'))
-            if not names:
-                continue
-            out.append(f'# file: {sp}\n')
-            for n in names:
-                v = os.getxattr(sp, n).decode('utf-8', 'surrogateescape')
-                out.append(f'{n}="{v}"\n')
-            out.append('\n')
-        return ''.join(out)
-    if _CYGWIN:
-        # Python on Cygwin lacks os.*xattr, so use the CLI there.
-        return subprocess.check_output(
-            ['getfattr', '-d', *(str(p) for p in paths)], text=True)
-    if _SYSTEM == 'Darwin':
-        out = []
-        for p in paths:
-            t = subprocess.check_output(['xattr', '-l', str(p)], text=True)
-            out.append('\n'.join(ln.lstrip(' \t') for ln in t.splitlines()))
-            out.append('\n')
-        return ''.join(out)
-    if _SYSTEM == 'FreeBSD':
-        out = []
-        for p in paths:
-            names = subprocess.check_output(
-                ['lsextattr', '-q', '-h', 'user', str(p)], text=True).split()
-            for n in sorted(names):
-                out.append(subprocess.check_output(
-                    ['getextattr', '-h', 'user', n, str(p)], text=True))
-        return ''.join(out)
-    if _SYSTEM == 'SunOS':
-        # List the file's extended-attribute namespace via runat (script on
-        # stdin), skipping the always-present SUNWattr_* system attrs, and
-        # dump name=value (sorted glob order; $(cat) drops a trailing newline).
-        script = ('for x in *; do case "$x" in SUNWattr_*) continue;; esac; '
-                  'printf "%s=%s\\n" "$x" "$(cat "$x")"; done\n')
-        out = []
-        for p in paths:
-            out.append(subprocess.run(
-                ['runat', str(p), '/bin/sh'], input=script,
-                capture_output=True, text=True, check=True).stdout)
-        return ''.join(out)
-    raise NotImplementedError(f"xattr_dump on {_SYSTEM}")
-
-
-def runtest(label: str, fn, *args, **kwargs):
-    """Run a sub-test step with an echoed label, like rsync.fns runtest.
-
-    The shell helper does `Test $1: $2 ... done.` -- this prints a similar
-    banner and propagates exceptions (which surface as a failing test).
-    """
-    print(f"Test {label}: ", end="", flush=True)
-    fn(*args, **kwargs)
-    print("done.")
-
-
-def cp_touch(src, dst) -> 'None':
-    """Equivalent of rsync.fns cp_touch: copy preserving timestamps, then
-    forcibly re-touch both source and destination to identical times.
-
-    On some filesystems cp rounds microsecond timestamps on the destination;
-    rsync.fns works around this by then `touch -r dst src dst`. Here we set
-    both src and dst to dst's mtime/atime after the copy, so a diff of the
-    tls output (which prints times) sees identical entries on both sides.
-    """
-    shutil.copy2(src, dst)
-    if os.path.isdir(dst):
-        dst = os.path.join(dst, os.path.basename(src))
-    st = os.stat(dst, follow_symlinks=False)
-    os.utime(src, ns=(st.st_atime_ns, st.st_mtime_ns), follow_symlinks=False)
-    os.utime(dst, ns=(st.st_atime_ns, st.st_mtime_ns), follow_symlinks=False)
-
-
-def build_symlinks() -> 'None':
-    """Equivalent of rsync.fns build_symlinks: a set of canonical relative,
-    absolute, dangling and unsafe symlinks under FROMDIR for symlink tests.
-    """
-    FROMDIR.mkdir(parents=True, exist_ok=True)
-    (FROMDIR / 'referent').write_text(
-        subprocess.check_output(['date'], text=True)
-    )
-    os.symlink('referent', FROMDIR / 'relative')
-    os.symlink(str(FROMDIR / 'referent'), FROMDIR / 'absolute')
-    os.symlink('nonexistent', FROMDIR / 'dangling')
-    os.symlink(str(SRCDIR / 'rsync.c'), FROMDIR / 'unsafe')
-
-
-def hands_setup() -> 'None':
-    """Populate FROMDIR with a varied tree of files and directories for the
-    canonical 'hands' transfer test.
-
-    All content is generated from within the suite (srcdir contents plus
-    make_text_file output) so the fixture is self-contained and
-    reproducible on every platform.
-    """
-    rmtree(FROMDIR)
-    rmtree(TODIR)
-    TMPDIR.mkdir(parents=True, exist_ok=True)
-    FROMDIR.mkdir(parents=True, exist_ok=True)
-    TODIR.mkdir(parents=True, exist_ok=True)
-
-    (FROMDIR / 'empty').touch()
-    (FROMDIR / 'emptydir').mkdir(exist_ok=True)
-
-    # File list of srcdir contents, generated through the tls helper so it
-    # matches the format the rest of the suite uses.
-    (FROMDIR / 'filelist').write_text(rsync_ls_lR(SRCDIR))
-
-    # The shell test uses `echo -n` semantics; write_text without a trailing
-    # newline is the cleanest equivalent.
-    (FROMDIR / 'nolf').write_text("This file has no trailing lf")
-
-    old_umask = os.umask(0)
-    try:
-        os.symlink('nolf', FROMDIR / 'nolf-symlink')
-    finally:
-        os.umask(old_umask)
-
-    # Concatenate all *.c files in srcdir into a single 'text' file.
-    text = bytearray()
-    for c in sorted(SRCDIR.glob('*.c')):
-        text.extend(c.read_bytes())
-    (FROMDIR / 'text').write_bytes(bytes(text))
-
-    (FROMDIR / 'dir').mkdir(exist_ok=True)
-    shutil.copy(FROMDIR / 'text', FROMDIR / 'dir')
-    (FROMDIR / 'dir' / 'subdir').mkdir(exist_ok=True)
-    (FROMDIR / 'dir' / 'subdir' / 'foobar.baz').write_text("some data\n")
-    (FROMDIR / 'dir' / 'subdir' / 'subsubdir').mkdir(exist_ok=True)
-    # Predictable, self-contained fixture files (the names etc-ltr-list /
-    # bin-lt-list are kept because other tests reference them by name).
-    make_text_file(FROMDIR / 'dir' / 'subdir' / 'subsubdir' / 'etc-ltr-list', 120)
-
-    (FROMDIR / 'dir' / 'subdir' / 'subsubdir2').mkdir(exist_ok=True)
-    make_text_file(FROMDIR / 'dir' / 'subdir' / 'subsubdir2' / 'bin-lt-list', 200)
-
-
-# --- listing / verification ------------------------------------------------
-
-def rsync_ls_lR(directory) -> str:
-    """Equivalent of rsync.fns rsync_ls_lR: print a sorted ls-style listing
-    of `directory`, pruning .git / auto-build-save / testtmp subtrees, using
-    the project's `tls` helper so the output format matches the rest of the
-    suite.
-    """
-    cmd = (
-        "find . -name .git -prune -o -name auto-build-save -prune "
-        "-o -name testtmp -prune -o -print | sort | sed 's/ /\\\\ /g' | "
-        f"xargs '{TOOLDIR}/tls' {TLS_ARGS}"
-    )
-    # tls can emit bytes that are not valid UTF-8 (a filename or symlink target
-    # with high bytes); decode with backslashreplace so Python 3.14's strict
-    # UTF-8 text mode doesn't raise UnicodeDecodeError.  Unlike surrogateescape
-    # this yields a clean str (bad bytes shown as \xNN) that callers can safely
-    # write_text()/print() without re-raising, and it is deterministic so the
-    # listing still compares consistently.
-    proc = subprocess.run(['sh', '-c', cmd], capture_output=True,
-                          encoding='utf-8', errors='backslashreplace',
-                          cwd=str(directory))
-    return proc.stdout
-
-
-def checkit(args, expected_dir, actual_dir, skip_file_diff: bool = False,
-            allowed_codes=(0,)) -> 'None':
-    """Run rsync with `args` (a list of extra rsync arguments) and then
-    verify two things:
-
-      1. The tls-formatted listings of `expected_dir` and `actual_dir`
-         are identical.
-      2. (Unless skip_file_diff) diff -r against the two trees reports
-         no differences.
-
-    `allowed_codes` is the tuple of exit codes treated as success.
-    Pass (0, 23) for daemon-mode transfers that may report partial-
-    transfer codes even when the listings still match.
-
-    Calls test_fail() on any mismatch. Mirrors the rsync.fns checkit shell
-    helper; callers pass rsync arguments as a Python list rather than as a
-    pre-quoted command string, which avoids the shell-quoting gymnastics
-    that the shell version needed.
-    """
-    expected_dir = str(expected_dir)
-    actual_dir = str(actual_dir)
-
-    failed = []
-
-    # If TLS_ARGS asks for atimes, the listing must be captured BEFORE the
-    # rsync run because diff'ing files afterwards updates their atimes.
-    ls_from = None
-    if '--atimes' in TLS_ARGS:
-        ls_from = rsync_ls_lR(expected_dir)
-
-    print(f"Running: rsync {' '.join(args)}")
-    proc = subprocess.run(rsync_argv(*args))
-    if proc.returncode not in allowed_codes:
-        failed.append(f"status={proc.returncode}")
-
-    if ls_from is None:
-        ls_from = rsync_ls_lR(expected_dir)
-    ls_to = rsync_ls_lR(actual_dir)
-
-    print("-------------")
-    print("check how the directory listings compare with diff:")
-    print()
-    if ls_from != ls_to:
-        ls_from_path = TMPDIR / 'ls-from'
-        ls_to_path = TMPDIR / 'ls-to'
-        ls_from_path.write_text(ls_from)
-        ls_to_path.write_text(ls_to)
-        diff = subprocess.run(
-            ['diff', '-u', str(ls_from_path), str(ls_to_path)],
-            capture_output=True, text=True,
-        )
-        sys.stdout.write(diff.stdout)
-        failed.append("dir-diff")
-
-    print("-------------")
-    print("check how the files compare with diff:")
-    print()
-    if skip_file_diff:
-        print("  === Skipping (as directed) ===")
-    else:
-        diff = subprocess.run(['diff', '-r', '-u', expected_dir, actual_dir])
-        if diff.returncode != 0:
-            failed.append("file-diff")
-
-    print("-------------")
-    if failed:
-        test_fail("Failed: " + " ".join(failed))
-
-
-def verify_dirs(expected_dir, actual_dir, skip_file_diff: bool = False,
-                label: str = '') -> 'None':
-    """Verify two directory trees match: identical tls listings and
-    (unless skip_file_diff) identical file contents. Same comparison
-    logic as checkit() but with no rsync invocation -- useful when the
-    rsync that produced `actual_dir` had to be driven manually so that
-    its output could be captured for inspection."""
-    expected_dir = str(expected_dir)
-    actual_dir = str(actual_dir)
-    tag = f"{label}: " if label else ""
-
-    ls_expected = rsync_ls_lR(expected_dir)
-    ls_actual = rsync_ls_lR(actual_dir)
-    if ls_expected != ls_actual:
-        ls_expected_path = TMPDIR / 'ls-from'
-        ls_actual_path = TMPDIR / 'ls-to'
-        ls_expected_path.write_text(ls_expected)
-        ls_actual_path.write_text(ls_actual)
-        diff = subprocess.run(
-            ['diff', '-u', str(ls_expected_path), str(ls_actual_path)],
-            capture_output=True, text=True,
-        )
-        sys.stdout.write(diff.stdout)
-        test_fail(f"{tag}directory listings differ between "
-                  f"{expected_dir} and {actual_dir}")
-
-    if not skip_file_diff:
-        diff = subprocess.run(['diff', '-r', '-u', expected_dir, actual_dir])
-        if diff.returncode != 0:
-            test_fail(f"{tag}file content differs between "
-                      f"{expected_dir} and {actual_dir}")
-
-
-def v_filt(text: str) -> str:
-    """Strip the boilerplate lines rsync emits at -v / -vv so callers can
-    diff only the file/directory change lines. Mirrors rsync.fns v_filt:
-    delete the build/progress banners, then everything from the first
-    blank line to end-of-text."""
-    out = []
-    skip_prefix = (
-        'building file list ',
-        'sending incremental file list',
-        'created directory ',
-        'total: ',
-        'client charset: ',
-        'server charset: ',
-    )
-    for line in text.splitlines():
-        if line == '':
-            break
-        if line.startswith(skip_prefix):
-            continue
-        if line == 'done':
-            continue
-        if line.endswith(' --whole-file'):
-            continue
-        out.append(line)
-    return '\n'.join(out) + ('\n' if out else '')
-
-
-def checkdiff(args, expected: str, *, filter=None, allowed_codes=(0,),
-              direct: bool = False) -> 'None':
-    """Run a command, capture its stdout, optionally pipe through `filter`,
-    then compare to `expected`. Mirrors rsync.fns checkdiff/checkdiff2.
-
-    args is normally a list of rsync arguments -- the rsync binary is
-    prepended via rsync_argv. Pass direct=True to run `args` as a literal
-    command (used by tests that drive a wrapper such as BATCH.sh).
-    """
-    if direct:
-        argv = list(args)
-        label = ' '.join(argv)
-    else:
-        argv = rsync_argv(*args)
-        label = 'rsync ' + ' '.join(args)
-    print(f"Running: {label}")
-    proc = subprocess.run(argv, capture_output=True, text=True)
-    stdout = proc.stdout
-    if proc.stderr:
-        sys.stderr.write(proc.stderr)
-    sys.stdout.write(stdout)
-
-    failed = []
-    if proc.returncode not in allowed_codes:
-        failed.append(f"status={proc.returncode}")
-
-    if filter is not None:
-        stdout = filter(stdout)
-
-    if stdout != expected:
-        from difflib import unified_diff
-        diff = unified_diff(
-            expected.splitlines(keepends=True),
-            stdout.splitlines(keepends=True),
-            fromfile='expected', tofile='got',
-        )
-        sys.stdout.write(''.join(diff))
-        failed.append("output differs")
-
-    if failed:
-        test_fail("Failed: " + " ".join(failed))
-
-
-def check_perms(path, expected: str) -> 'None':
-    """Verify that the 9-char rwx permission string of `path` matches
-    `expected` (e.g. 'rwx------'). Calls test_fail() on mismatch."""
-    mode = os.stat(path, follow_symlinks=False).st_mode
-    bits = [
-        (0o400, 'r'), (0o200, 'w'), (0o100, 'x'),
-        (0o040, 'r'), (0o020, 'w'), (0o010, 'x'),
-        (0o004, 'r'), (0o002, 'w'), (0o001, 'x'),
-    ]
-    chars = [c if mode & bit else '-' for bit, c in bits]
-    # Layer the setuid/setgid/sticky bits over x as the long-listing format does.
-    if mode & 0o4000:
-        chars[2] = 's' if mode & 0o100 else 'S'
-    if mode & 0o2000:
-        chars[5] = 's' if mode & 0o010 else 'S'
-    if mode & 0o1000:
-        chars[8] = 't' if mode & 0o001 else 'T'
-    perms = ''.join(chars)
-    if perms != expected:
-        print(f"permissions: {perms} on {path}")
-        print(f"should be:   {expected}")
-        test_fail(f"check_perms failed for {path}")
-
-
-# --- depth / cross-dir coverage helpers ------------------------------------
-# Added for the option-coverage expansion (see testsuite/COVERAGE.md).
-# The path-handling restructure changes how parent components resolve, so its
-# bugs surface only at DEPTH and across directory boundaries -- these helpers
-# build trees with an entry at every level and assert the concrete property an
-# option controls (not just dest == src).
-
-def make_tree(root, depth: int = 3, *, data: bool = False,
-              content_lines: int = 20, data_size: int = 4096,
-              dirname: str = 'd', leaf: str = 'f'):
-    """Create a layered directory tree with one regular file at every level.
-
-    For depth=3 under `root`:
-        root/f0
-        root/d1/f1
-        root/d1/d2/f2
-        root/d1/d2/d3/f3
-    so an option's effect can be checked at the tree root AND >=3 levels deep
-    (the parent-component resolution the path restructure rewrites).
-
-    Returns (dirs, files): `dirs` the created subdirectories outermost-first,
-    `files` the regular files shallow-first. Content is deterministic
-    (make_text_file) unless data=True (make_data_file, delta-friendly).
-    """
-    root = Path(root)
-    root.mkdir(parents=True, exist_ok=True)
-    dirs = []
-    files = []
-    cur = root
-    for level in range(depth + 1):
-        f = cur / f'{leaf}{level}'
-        if data:
-            make_data_file(f, data_size)
-        else:
-            make_text_file(f, content_lines)
-        files.append(f)
-        if level < depth:
-            cur = cur / f'{dirname}{level + 1}'
-            cur.mkdir(exist_ok=True)
-            dirs.append(cur)
-    return dirs, files
-
-
-def walk_files(root) -> list:
-    """Every regular (non-symlink) file under `root`, sorted, recursively.
-    For asserting a per-entry property holds at every depth."""
-    root = Path(root)
-    return sorted(p for p in root.rglob('*')
-                  if p.is_file() and not p.is_symlink())
-
-
-def walk_dirs(root) -> list:
-    """Every subdirectory under `root`, sorted, recursively."""
-    root = Path(root)
-    return sorted(p for p in root.rglob('*')
-                  if p.is_dir() and not p.is_symlink())
-
-
-def _tag(label: str) -> str:
-    return f"{label}: " if label else ""
-
-
-def assert_same(a, b, label: str = '') -> 'None':
-    """Fail unless files `a` and `b` have byte-identical content."""
-    if not filecmp.cmp(str(a), str(b), shallow=False):
-        test_fail(f"{_tag(label)}content differs between {a} and {b}")
-
-
-def assert_mode(path, expected_octal: int, label: str = '') -> 'None':
-    """Fail unless the permission bits (low 12) of `path` equal expected_octal
-    (pass an int like 0o644). Does not follow symlinks."""
-    mode = stat.S_IMODE(os.stat(path, follow_symlinks=False).st_mode)
-    if mode != expected_octal:
-        test_fail(f"{_tag(label)}mode {mode:04o} != expected "
-                  f"{expected_octal:04o} on {path}")
-
-
-def assert_mtime_close(a, b, tol: float = 1.0, label: str = '') -> 'None':
-    """Fail unless the mtimes of `a` and `b` are within `tol` seconds.
-    `b` may be a number (an explicit epoch mtime) instead of a path."""
-    ma = os.stat(a, follow_symlinks=False).st_mtime
-    mb = b if isinstance(b, (int, float)) else os.stat(
-        b, follow_symlinks=False).st_mtime
-    if abs(ma - mb) > tol:
-        test_fail(f"{_tag(label)}mtime {ma} vs {mb} differ by > {tol}s "
-                  f"(checking {a})")
-
-
-def assert_is_symlink(path, target: str = None, label: str = '') -> 'None':
-    """Fail unless `path` is a symlink (optionally pointing exactly at
-    `target`)."""
-    if not os.path.islink(path):
-        test_fail(f"{_tag(label)}{path} is not a symlink")
-    if target is not None:
-        actual = os.readlink(path)
-        if actual != target:
-            test_fail(f"{_tag(label)}{path} -> {actual!r}, "
-                      f"expected {target!r}")
-
-
-def assert_hardlinked(a, b, label: str = '') -> 'None':
-    """Fail unless `a` and `b` are the same inode (a hard link / --link-dest
-    result)."""
-    sa = os.stat(a, follow_symlinks=False)
-    sb = os.stat(b, follow_symlinks=False)
-    if (sa.st_dev, sa.st_ino) != (sb.st_dev, sb.st_ino):
-        test_fail(f"{_tag(label)}{a} and {b} are not hard-linked "
-                  f"(ino {sa.st_ino} vs {sb.st_ino})")
-
-
-def assert_not_hardlinked(a, b, label: str = '') -> 'None':
-    """Fail if `a` and `b` share an inode (e.g. --copy-dest must copy, not
-    link)."""
-    sa = os.stat(a, follow_symlinks=False)
-    sb = os.stat(b, follow_symlinks=False)
-    if (sa.st_dev, sa.st_ino) == (sb.st_dev, sb.st_ino):
-        test_fail(f"{_tag(label)}{a} and {b} unexpectedly share "
-                  f"inode {sa.st_ino}")
-
-
-def assert_exists(path, label: str = '') -> 'None':
-    """Fail unless `path` exists (a symlink counts even if dangling)."""
-    if not os.path.lexists(path):
-        test_fail(f"{_tag(label)}{path} does not exist")
-
-
-def assert_not_exists(path, label: str = '') -> 'None':
-    """Fail if `path` exists (a dangling symlink counts as existing)."""
-    if os.path.lexists(path):
-        test_fail(f"{_tag(label)}{path} exists but should not")
-
-
-_psf_cache = None
-
-
-def proc_self_fd_pins() -> bool:
-    """True iff /proc/self/fd/N is a Linux-style magic symlink whose readlink
-    yields the open file's real path -- the primitive rrsync's realpath-vs-exec
-    inode-pin relies on.  macOS/BSD lack the directory; Solaris HAS /proc/self/fd
-    but its entries are not such symlinks.  Mirrors rrsync's own HAVE_PROC_SELF_FD
-    probe so the rrsync race test runs only where the protection actually exists
-    (it falls through unpinned, by design, elsewhere).  Cached.
-
-    A correct readlink does not prove the fd pins anything, and two platforms
-    get this wrong in opposite directions: NetBSD makes the entry a symlink for
-    directories only (readlink of a regular file's entry fails with EINVAL),
-    while Cygwin's readlink is right but opening the magic link RE-RESOLVES the
-    path, so a rename under a held fd reaches the replacement. Only Linux gives
-    the inode-bound magic link, so require that and keep the probes as a guard
-    for Linux-like environments without /proc."""
-    global _psf_cache
-    if _psf_cache is not None:
-        return _psf_cache
-    if not sys.platform.startswith(('linux', 'android')):
-        _psf_cache = False
-        return _psf_cache
-
-    def resolves(path):
-        try:
-            fd = os.open(path, os.O_RDONLY)
-        except OSError:
-            return False
-        try:
-            return os.readlink('/proc/self/fd/%d' % fd) == os.path.realpath(path)
-        except OSError:
-            return False
-        finally:
-            os.close(fd)
-
-    _psf_cache = resolves('/') and resolves(os.path.realpath(__file__))
-    return _psf_cache
-
-
-def write_daemon_conf(modules, globals=None, *,
-                      name: str = 'test-rsyncd.conf') -> 'Path':
-    """Write a custom rsyncd.conf for daemon-parameter tests.
-
-    `modules` is a list of (module_name, {param: value}) pairs; `globals` an
-    optional dict of global parameters that override the minimal defaults
-    (pid file / use chroot=no / hosts allow / log file / max verbosity).
-    Mirrors build_rsyncd_conf()'s root-aware uid/gid handling (only emitted
-    when running as root) and writes the same `ignore23` wrapper, but lets a
-    test set arbitrary parameters/modules beyond the fixed four. Returns the
-    config path; pair with start_test_daemon().
-    """
-    conf = SCRATCHDIR / name
-    pidfile = SCRATCHDIR / 'rsyncd.pid'
-    logfile = SCRATCHDIR / 'rsyncd.log'
-
-    g = {
-        'pid file': str(pidfile),
-        'use chroot': 'no',
-        'hosts allow': 'localhost 127.0.0.0/8',
-        'log file': str(logfile),
-        'max verbosity': '4',
-    }
-    if globals:
-        g.update(globals)
-    if get_testuid() == get_rootuid():
-        g.setdefault('uid', str(get_rootuid()))
-        g.setdefault('gid', str(get_rootgid()))
-    else:
-        # Non-root cannot set uid/gid in rsyncd.conf.
-        g.pop('uid', None)
-        g.pop('gid', None)
-
-    lines = ['# autogenerated by rsyncfns.write_daemon_conf', '']
-    lines += [f'{k} = {v}' for k, v in g.items()]
-    lines.append('')
-    for mod_name, params in modules:
-        lines.append(f'[{mod_name}]')
-        lines += [f'\t{k} = {v}' for k, v in params.items()]
-        lines.append('')
-    conf.write_text('\n'.join(lines) + '\n')
-
-    ignore23 = SCRATCHDIR / 'ignore23'
-    if not ignore23.exists():
-        ignore23.write_text(
-            '#!/bin/sh\n'
-            'if "${@}"; then exit; fi\n'
-            'ret=$?\n'
-            'if test $ret = 23; then exit; fi\n'
-            'exit $ret\n'
-        )
-        ignore23.chmod(0o755)
-
-    return conf
-
-
-# --- security regression helpers -------------------------------------------
-
-def expect_fail(argv, text, env=None, cwd=None):
-    proc = subprocess.run(argv, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
-                          text=True, env=env, cwd=cwd)
-    out = (proc.stdout or '') + (proc.stderr or '')
-    if proc.returncode == 0:
-        test_fail(f"command unexpectedly succeeded: {argv!r}\n{out}")
-    if text not in out:
-        test_fail(f"expected {text!r} in command output:\n{out}")
-    return proc
-
-
-def patched_rrsync(workdir, rsync_path=None):
-    # The stub rsync just has to exec successfully; the BSDs keep true(1) in
-    # /usr/bin, not /bin, so resolve it on PATH rather than hard-coding /bin/true.
-    import re
-    if rsync_path is None:
-        rsync_path = shutil.which('true') or '/usr/bin/true'
-    src = SRCDIR / 'support' / 'rrsync'
-    dst = Path(workdir) / 'rrsync-under-test'
-    # Rewrite rrsync's hardcoded RSYNC path to our stub by matching the assignment
-    # line, not its value: a distro/port (e.g. FreeBSD's net/rsync) may ship a
-    # different path (/usr/local/bin/rsync), and a value-specific str.replace()
-    # would silently no-op and leave rrsync exec'ing the real rsync -- a
-    # server-mode hang.  A callable replacement avoids re backslash-escaping.
-    text, n = re.subn(r"(?m)^RSYNC\s*=.*$",
-                      lambda _m: f"RSYNC = {rsync_path!r}",
-                      src.read_text())
-    if n != 1:
-        test_fail(f"patched_rrsync: expected exactly one 'RSYNC =' line in {src}, found {n}")
-    dst.write_text(text)
-    dst.chmod(0o755)
-    return dst
-
-
-def run_rrsync_denied(command, expected):
-    base = SCRATCHDIR / expected.replace(' ', '_').replace('/', '_')
-    base.mkdir(parents=True, exist_ok=True)
-    restricted = base / 'restricted'
-    restricted.mkdir(exist_ok=True)
-    rrsync = patched_rrsync(base)
-    env = {**os.environ, 'SSH_ORIGINAL_COMMAND': command}
-    expect_fail([str(rrsync), '-ro', '-no-lock', str(restricted)], expected, env=env)
-
-
-def make_proxy_server(port, response):
-    listener = _socket.socket(_socket.AF_INET, _socket.SOCK_STREAM)
-    listener.setsockopt(_socket.SOL_SOCKET, _socket.SO_REUSEADDR, 1)
-    listener.bind(('127.0.0.1', port))
-    listener.listen(1)
-
-    def serve():
-        conn, _ = listener.accept()
-        try:
-            conn.recv(65536)
-            conn.sendall(response)
-        finally:
-            try:
-                conn.close()
-            finally:
-                listener.close()
-
-    import threading
-    t = threading.Thread(target=serve)
-    t.daemon = True
-    t.start()
-    return t
-
-
-def run_proxy_probe(port, host, expected):
-    env = {**os.environ, 'RSYNC_PROXY': f'127.0.0.1:{port}'}
-    proc = subprocess.run(
-        rsync_argv(f'rsync://{host}/mod/', str(SCRATCHDIR / 'proxy-out')),
-        stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, env=env)
-    out = (proc.stdout or '') + (proc.stderr or '')
-    if proc.returncode == 0:
-        test_fail(f"proxy probe unexpectedly succeeded:\n{out}")
-    if expected not in out:
-        test_fail(f"expected {expected!r} in proxy probe output:\n{out}")
-    return proc
-
-
-def setup_chroot_inner(name):
-    if get_testuid() != get_rootuid():
-        test_skipped("chroot /./ module regression requires root")
-    if _under_valgrind():
-        # The daemon's per-connection child chroots into the module, after
-        # which valgrind can no longer create its absolute --log-file %p path
-        # and the child dies (the transfer then resets) -- skip under valgrind.
-        test_skipped("daemon chroot prevents valgrind from writing its per-process log")
-    base = SCRATCHDIR / name
-    outer = base / 'outer'
-    inner = outer / 'inner'
-    outside = outer / 'outside'
-    src = base / 'src'
-    rmtree(base)
-    makepath(inner, outside, src)
-    os.symlink('../outside', inner / 'linkparent')
-    conf = write_daemon_conf([
-        ('mod', {'path': str(outer) + '/./inner', 'read only': 'no',
-                 'use chroot': 'yes', 'munge symlinks': 'no'}),
-    ], name=f'{name}.conf')
-    url = start_test_daemon(conf, 12940 + (abs(hash(name)) % 200))
-    return base, inner, outside, src, url
-
-
-def run_checked(argv):
-    proc = subprocess.run(argv, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True)
-    return proc, (proc.stdout or '') + (proc.stderr or '')
-
-
-def build_patched_rsync(name, replacements, append_cflags=None):
-    # Cygwin can't reliably rebuild a single patched unit from the copied tree:
-    # make leaves the copied object in place (coarse NTFS mtimes) so the patch is
-    # silently absent, and forcing the rebuild trips gcc-13's -fno-common link
-    # errors against the prebuilt objects.  The malicious-peer behaviour these
-    # tests simulate is platform-independent and is exercised on every POSIX
-    # target, so skip the unbuildable simulation here rather than misreport it.
-    if sys.platform == 'cygwin' or platform.system().startswith('CYGWIN'):
-        test_skipped(f"{name}: build_patched_rsync is unreliable on Cygwin "
-                     "(prebuilt-object staleness / -fno-common relink); the "
-                     "patched-peer fix is validated on the POSIX targets")
-    if not (SRCDIR / 'Makefile').is_file():
-        test_skipped(f"{name}: needs a configured rsync source tree with a Makefile")
-    if not shutil.which('make'):
-        test_skipped(f"{name}: make(1) not on PATH")
-    if not shutil.which('gcc') and not shutil.which('cc'):
-        test_skipped(f"{name}: no C compiler on PATH")
-
-    work = SCRATCHDIR / name
-    rmtree(work)
-    shutil.copytree(
-        SRCDIR, work, symlinks=True,
-        ignore=shutil.ignore_patterns(
-            'testtmp', '.git', 'auto-build-save', 'autom4te.cache', '__pycache__'))
-
-    for relpath, old, new in replacements:
-        path = work / relpath
-        text = path.read_text()
-        if old not in text:
-            test_skipped(f"{name}: could not find patch target in {relpath}: {old!r}")
-        path.write_text(text.replace(old, new, 1))
-        # Drop the copied object for this unit.  copytree() preserves mtimes, so
-        # on a target whose clock lags the host that pushed the tree -- or one
-        # with coarse mtime granularity -- the prebuilt .o can look NEWER than
-        # the just-patched .c, make reuses it, and the patch is silently absent.
-        # The test then exercises an unmodified peer and reports a vacuous
-        # result instead of a real one.
-        obj = (work / relpath).with_suffix('.o')
-        if obj.exists():
-            obj.unlink()
-
-    # Same hazard at the link step: a prebuilt binary with a future mtime looks
-    # up to date even once its objects have been rebuilt.
-    for stale in (work / 'rsync', work / 'rsync.exe'):
-        if stale.exists():
-            stale.unlink()
-
-    # Optionally append compiler flags (e.g. -fwrapv) to the already-configured
-    # CFLAGS line in the copied Makefile.  This preserves the platform's
-    # configure-chosen flags and just adds to them, unlike a `make CFLAGS=...`
-    # override which would drop them.
-    if append_cflags:
-        import re
-        mkpath = work / 'Makefile'
-        mk = mkpath.read_text()
-        mk2 = re.sub(r'(?m)^(CFLAGS=.*)$', r'\1 ' + append_cflags, mk, count=1)
-        if mk2 == mk:
-            test_skipped(f"{name}: could not append {append_cflags!r} to CFLAGS in the Makefile")
-        mkpath.write_text(mk2)
-        # The copied tree carries prebuilt objects compiled with the ORIGINAL
-        # flags; since the sources aren't newer, make would reuse them and the
-        # appended flag would silently apply to nothing.  Drop them so every
-        # unit recompiles with the new CFLAGS.
-        for obj in work.rglob('*.o'):
-            obj.unlink()
-
-    env = {**os.environ, 'CCACHE_DISABLE': '1'}
-    build = subprocess.run(['make', '-j2', 'rsync'], cwd=str(work), env=env,
-                           stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True)
-    rsync = work / 'rsync'
-    if build.returncode != 0 or not rsync.is_file() or not os.access(rsync, os.X_OK):
-        test_skipped(
-            f"{name}: patched rsync build failed (rc={build.returncode}). "
-            "Tail of build output:\n" + '\n'.join(build.stdout.splitlines()[-20:]))
-    return rsync
-
-
-# --- operator-supplied-path symlink policy matrix --------------------------
-#
-# Policy: an operator-supplied path follows a symlink at any component iff that
-# symlink is owned by uid 0 or the running euid, and refuses one owned by any
-# other uid -- for absolute and relative paths alike.  --insecure-links is a
-# LOCAL opt-out that restores legacy following (a daemon never honours it; that
-# is covered by a separate daemon test).  run_symlink_matrix() drives one
-# path-taking option through {cross-uid vs same-uid} x {absolute vs relative} x
-# {symlink-at-leaf vs symlink-in-a-parent-component} x {--insecure-links off/on}
-# and asserts each cell against the policy:  FOLLOW iff (insecure or same-uid).
-
-def find_attacker_uid():
-    """An untrusted uid (not 0, not the euid) for a cross-uid plant, else None."""
-    import pwd
-    for nm in ('nobody', 'nfsnobody', 'daemon'):
-        try:
-            u = pwd.getpwnam(nm).pw_uid
-        except KeyError:
-            continue
-        if u != 0 and u != os.geteuid():
-            return u
-    return None
-
-
-def run_symlink_matrix(option, case, *, paths=('abs', 'rel'),
-                       wheres=('leaf', 'parent'), label=''):
-    """Run `case(ctx)` over the operator-path symlink matrix; assert the policy.
-
-    `case(ctx)` plants the option's path symlink (per ctx.where/ctx.abspath),
-    runs rsync (honouring ctx.insecure), and returns True if the symlink was
-    FOLLOWED (the op escaped to ctx.outside / read an out-of-tree object).
-    ctx carries: base, outside, plant (fresh Paths); owner ('cross'|'self');
-    att_uid; abspath ('abs'|'rel'); where ('leaf'|'parent'); insecure (bool);
-    and plant_link(at, target) which symlinks target->at and lchowns it to the
-    attacker uid when owner=='cross' (otherwise it stays euid-owned).
-
-    Cross-uid cells need root (to own a symlink by a foreign uid) and are
-    skipped otherwise; same-uid cells run at any uid.
-    """
-    import re
-    import types
-    tag = option + (f' [{label}]' if label else '')
-    euid = os.geteuid()
-    att = find_attacker_uid() if euid == 0 else None
-    slug = re.sub(r'[^a-z0-9]+', '-', tag.lower()).strip('-')
-
-    for abspath in paths:
-        for where in wheres:
-            for insecure in (False, True):
-                owners = ('self', 'cross') if att is not None else ('self',)
-                for owner in owners:
-                    base = SCRATCHDIR / (f"{slug}-{owner}-{abspath}-{where}-"
-                                         + ('ins' if insecure else 'safe'))
-                    rmtree(base)
-                    base.mkdir(parents=True)
-                    ctx = types.SimpleNamespace(
-                        base=base, outside=base / 'outside', plant=base / 'plant',
-                        owner=owner, att_uid=att, abspath=abspath, where=where,
-                        insecure=insecure)
-                    ctx.outside.mkdir()
-                    ctx.plant.mkdir()
-
-                    def plant_link(at, target, _c=ctx):
-                        os.symlink(target, at)
-                        if _c.owner == 'cross':
-                            os.lchown(at, _c.att_uid, _c.att_uid)
-                    ctx.plant_link = plant_link
-
-                    followed = bool(case(ctx))
-                    expect = insecure or owner == 'self'
-                    cell = f"{abspath} {where} {'insecure' if insecure else 'safe'}"
-                    if followed and not expect:
-                        test_fail(
-                            f"{tag}: CROSS-UID {cell}: the planted symlink was "
-                            "FOLLOWED (op escaped to outside/). An operator path "
-                            "must refuse a symlink not owned by uid 0 or the euid.")
-                    if not followed and expect:
-                        why = ("--insecure-links did not restore symlink following"
-                               if insecure else
-                               "the operator's OWN (euid-owned) symlink was refused")
-                        test_fail(f"{tag}: {('CROSS' if owner=='cross' else 'SAME')}"
-                                  f"-UID {cell}: {why}.")
-    if att is None and euid != 0:
-        print(f"{tag}: same-uid cells confirmed; cross-uid cells need root (skipped)")
-
-
-def plant_operator_symlink(ctx, rel_anchor, kind='dir'):
-    """Plant this cell's option-path symlink and return (option_value, escape).
-
-    option_value is what to feed the option: an absolute path, or a name
-    relative to rel_anchor (the directory the option resolves a relative value
-    against -- e.g. the destination dir for --backup-dir/--link-dest, or the cwd
-    for --temp-dir).  escape is the out-of-tree object the operation acts on IF
-    the symlink is followed.
-
-    kind='dir'  (a directory option, e.g. --backup-dir/--temp-dir/--link-dest):
-        leaf   -> the symlink itself is the dir; escape = ctx.outside.
-        parent -> a parent component is the symlink; escape = ctx.outside/'sub'.
-    kind='file' (a file option, e.g. --log-file/--files-from/--write-batch):
-        leaf   -> the symlink targets the out-of-tree victim file directly.
-        parent -> a parent component is the symlink; the leaf name is appended.
-        escape = ctx.outside/'victim' either way.
-    """
-    base = ctx.plant if ctx.abspath == 'abs' else rel_anchor
-    if kind == 'file':
-        victim = ctx.outside / 'victim'
-        if ctx.where == 'leaf':
-            link = base / 'osl'
-            ctx.plant_link(link, victim)
-            return (str(link) if ctx.abspath == 'abs' else 'osl'), victim
-        link = base / 'opd'
-        ctx.plant_link(link, ctx.outside)
-        return ((str(link / 'victim') if ctx.abspath == 'abs' else 'opd/victim'),
-                victim)
-    if ctx.where == 'leaf':
-        link = base / 'osl'
-        ctx.plant_link(link, ctx.outside)
-        return (str(link) if ctx.abspath == 'abs' else 'osl'), ctx.outside
-    link = base / 'opd'
-    ctx.plant_link(link, ctx.outside)
-    return ((str(link / 'sub') if ctx.abspath == 'abs' else 'opd/sub'),
-            ctx.outside / 'sub')
-
-
-# --- variety tree (cross-version regression coverage) ----------------------
-# A "variety tree" exercises every inode type rsync handles (dirs, regular
-# files, symlinks, fifos, sockets, char/block devices) with a spread of
-# permissions, xattrs, ACLs and (as root) ownership, plus heavy symlink
-# coverage: links to each type, links that escape a transfer root via ../..,
-# absolute links, and links whose intermediate components transit outside the
-# tree. It is the source for differential tests that assert the current binary
-# produces the same destination tree as an old release (see variety_test.py).
-
-def acls_supported() -> bool:
-    """True if this rsync was built with ACL support AND this platform has a
-    usable setfacl/getfacl (or macOS chmod +a). Mirrors xattrs_supported()."""
-    vv = run_rsync('-VV', check=True, capture_output=True).stdout
-    if '"ACLs": true' not in vv:
-        return False
-    if _SYSTEM in ('Linux', 'FreeBSD') or _CYGWIN:
-        return (shutil.which('setfacl') is not None
-                and shutil.which('getfacl') is not None)
-    if _SYSTEM == 'Darwin':
-        return shutil.which('chmod') is not None
-    return False
-
-
-@_functools.lru_cache(maxsize=1)
-def devices_supported() -> bool:
-    """True if device nodes can be created here.
-
-    euid==0 is necessary but not sufficient: a user-namespaced container
-    (rootless podman/docker, buildd chroots) reports euid==0 yet lacks
-    CAP_MKNOD, so os.mknod() of a device fails EPERM.  Probe once."""
-    if os.geteuid() != 0 or not hasattr(os, 'mknod'):
-        return False
-    with tempfile.TemporaryDirectory(prefix='rsync-devprobe.') as d:
-        try:
-            os.mknod(os.path.join(d, 'p'), 0o600 | stat.S_IFCHR, os.makedev(1, 3))
-        except (PermissionError, OSError):
-            return False
-    return True
-
-
-def hardlink_symlinks_supported(where=None) -> bool:
-    """True if THIS FILESYSTEM can hard-link a symlink.
-
-    rsync's own "hardlink_symlinks" capability is a build-time answer and says
-    nothing about the filesystem underneath: HFS+ returns ENOTSUP for
-    link()-ing a symlink where APFS and Linux succeed.  Probe where the test
-    data will actually live, not where the source tree is."""
-    d = tempfile.mkdtemp(prefix='rsync-hlsym.', dir=str(where) if where else None)
-    try:
-        link, hard = os.path.join(d, 's'), os.path.join(d, 'h')
-        os.symlink('target-need-not-exist', link)
-        try:
-            os.link(link, hard, follow_symlinks=False)
-        except NotImplementedError:
-            return False
-        except OSError as e:
-            # Only "the filesystem cannot do this" answers the question.  EPERM,
-            # ENOSPC, EMLINK, EIO or a quota refusal would otherwise be reported
-            # as a capability difference and quietly reshape the caller's
-            # expectations, so let those propagate.
-            if e.errno in (errno.ENOTSUP, getattr(errno, 'EOPNOTSUPP', errno.ENOTSUP)):
-                return False
-            raise
-        return True
-    finally:
-        shutil.rmtree(d, ignore_errors=True)
-
-
-def owners_supported() -> bool:
-    """True if the builder may assign mixed uid/gid (euid==0)."""
-    return os.geteuid() == 0
-
-
-def make_fifo(path) -> 'None':
-    """Create a FIFO (named pipe) at `path`."""
-    os.mkfifo(str(path))
-
-
-def make_socket(path) -> 'None':
-    """Create a UNIX-domain socket inode at `path`.
-
-    The AF_UNIX sun_path is capped at ~108 bytes, which a depth-8 absolute path
-    can overflow, so we chdir to the parent and bind the bare (short) basename,
-    restoring the cwd in a finally. The bound inode persists as an S_IFSOCK on
-    disk after the socket is closed."""
-    path = Path(path)
-    old = os.getcwd()
-    s = _socket.socket(_socket.AF_UNIX, _socket.SOCK_STREAM)
-    try:
-        os.chdir(path.parent)
-        s.bind(path.name)
-    finally:
-        s.close()
-        os.chdir(old)
-
-
-def make_device(path, kind: str, major: int, minor: int,
-                mode: int = 0o644) -> 'None':
-    """Create a char ('c') or block ('b') device node. Caller must gate on
-    devices_supported() -- unprivileged this raises PermissionError."""
-    fmt = stat.S_IFCHR if kind == 'c' else stat.S_IFBLK
-    os.mknod(str(path), mode | fmt, os.makedev(major, minor))
-
-
-def _acl_env() -> dict:
-    """Environment for getfacl/setfacl: scrub POSIXLY_CORRECT (which alters
-    some getfacl builds' flag/header semantics) and pin LC_ALL=C."""
-    env = dict(os.environ)
-    env.pop('POSIXLY_CORRECT', None)
-    env['LC_ALL'] = 'C'
-    return env
-
-
-def acl_set(spec: str, path) -> bool:
-    """Apply one ACL entry `spec` (e.g. 'u:0:rwx', 'g:0:r-x', 'd:u:0:rwx' for a
-    directory default entry) to `path` via setfacl. Returns True on success,
-    False if the filesystem rejects ACLs (EOPNOTSUPP) so the caller degrades
-    gracefully. macOS is not driven here (returns False)."""
-    if not (_SYSTEM in ('Linux', 'FreeBSD') or _CYGWIN):
-        return False
-    proc = subprocess.run(['setfacl', '-m', spec, str(path)],
-                          capture_output=True, text=True, env=_acl_env())
-    return proc.returncode == 0
-
-
-def _acl_sig(path) -> str:
-    """Path-free signature of a node's ACL entries, for comparing two trees.
-    Strips getfacl's comment header (which embeds the path/owner) and sorts the
-    entries so the result depends only on the access/default ACL, not on where
-    the file lives. Empty when ACLs aren't readable here."""
-    if not (_SYSTEM in ('Linux', 'FreeBSD') or _CYGWIN):
-        return ''
-    try:
-        out = subprocess.run(['getfacl', str(path)], capture_output=True,
-                             text=True, env=_acl_env()).stdout
-    except OSError:
-        return ''
-    return ';'.join(sorted(l for l in out.splitlines()
-                           if l.strip() and not l.startswith('#')))
-
-
-def _xattr_sig(path) -> str:
-    """Path-free signature of a node's user xattrs, for comparing two trees.
-    Native on Linux (symmetric with xattr_set); getfattr with the '# file:'
-    header stripped on Cygwin. Returns '' elsewhere -- xattr fidelity is gated
-    on the Linux CI run, and tls still compares structure on every platform."""
-    p = str(path)
-    if _SYSTEM == 'Linux':
-        try:
-            names = sorted(n for n in os.listxattr(p, follow_symlinks=False)
-                           if n.startswith('user.'))
-        except OSError:
-            return ''
-        out = []
-        for n in names:
-            try:
-                v = os.getxattr(p, n, follow_symlinks=False)
-            except OSError:
-                continue
-            out.append(n + '=' + v.decode('utf-8', 'surrogateescape'))
-        return ';'.join(out)
-    if _CYGWIN:
-        try:
-            d = subprocess.check_output(
-                ['getfattr', '--no-dereference', '-d', p],
-                text=True, stderr=subprocess.DEVNULL)
-        except (subprocess.CalledProcessError, OSError):
-            return ''
-        return ';'.join(sorted(l for l in d.splitlines()
-                               if l and not l.startswith('# file:')))
-    return ''
-
-
-def _variety_fill(path, size: int, key: str) -> 'None':
-    """Write `size` bytes of deterministic, non-trivial content derived from
-    `key`, so a variety tree is byte-reproducible across separate builds."""
-    import hashlib
-    buf = bytearray()
-    i = 0
-    while len(buf) < size:
-        buf += hashlib.sha256(f'{key}:{i}'.encode()).digest()
-        i += 1
-    with open(str(path), 'wb') as f:
-        f.write(bytes(buf[:size]))
-
-
-def _all_entries(root) -> list:
-    """Every entry under `root` (the root dir, real subdirs, files, specials,
-    and symlinks themselves) visited exactly once and WITHOUT following any
-    symlink. For chown/utime finalisation that must not escape the tree."""
-    root = Path(root)
-    res = []
-    for dp, dns, fns in os.walk(root):       # followlinks=False
-        d = Path(dp)
-        res.append(d)
-        for n in fns:
-            res.append(d / n)
-        for n in dns:
-            sub = d / n
-            if sub.is_symlink():             # os.walk won't recurse into it
-                res.append(sub)
-    return res
-
-
-def make_variety_tree(root, *, depth: int = 8, with_acls=None, with_xattrs=None,
-                      with_devices=None, with_owners=None,
-                      seed: int = 0x5A17) -> dict:
-    """Build a deterministic 'variety tree' rooted at `root`.
-
-    Capability args default to None => auto-detect (xattrs_supported() etc.).
-    Tests pass EXPLICIT bools so the current- and old-binary source trees are
-    built with identical capabilities, keeping the differential comparison
-    apples-to-apples. Re-runnable: rmtree(root) first; `seed` drives only fixed
-    choices (no time/pid randomness) so two calls yield identical trees.
-
-    Layout (caller transfers root/transfer_root/):
-      root/above/        real nodes ABOVE the transfer root (escape targets)
-      root/transfer_root d0..d{depth-1} backbone; at each level a bouquet of
-                         every type + a symlink to every type; plus abs_links/
-                         (absolute links) and escape/ (../.. links that leave
-                         the transfer root, one per above-root type).
-
-    Returns {'transfer_root': Path, 'above_targets': {type: Path},
-             'counts': {type: n}}.
-    """
-    root = Path(root)
-    rmtree(root)
-    if with_xattrs is None:
-        with_xattrs = xattrs_supported()
-    if with_acls is None:
-        with_acls = acls_supported()
-    if with_devices is None:
-        with_devices = devices_supported()
-    if with_owners is None:
-        with_owners = owners_supported()
-
-    root.mkdir(parents=True)
-    above = root / 'above'
-    above.mkdir()
-    troot = root / 'transfer_root'
-    troot.mkdir()
-
-    counts = {}
-    def bump(t):
-        counts[t] = counts.get(t, 0) + 1
-
-    perm_cycle = [0o400, 0o640, 0o644, 0o600, 0o755]
-
-    def reg(p, size, mode=0o644):
-        _variety_fill(p, size, f'{seed:x}:{os.path.relpath(p, root)}')
-        os.chmod(p, mode)
-        bump('file')
-        return p
-
-    def mkdir1(p, mode=None):
-        p.mkdir()
-        if mode is not None:
-            os.chmod(p, mode)
-        bump('dir')
-        return p
-
-    def lnk(target, p):
-        os.symlink(target, p)
-        bump('symlink')
-        return p
-
-    # --- above-root real targets (escape/ links point here) ---
-    above_targets = {}
-    above_targets['dir'] = mkdir1(above / 'a_dir')
-    reg(above / 'a_dir' / 'inner', 256)
-    above_targets['file'] = reg(above / 'a_file', 8192)
-    above_targets['fifo'] = above / 'a_fifo'; make_fifo(above_targets['fifo']); bump('fifo')
-    above_targets['sock'] = above / 'a_sock'; make_socket(above_targets['sock']); bump('socket')
-    if with_devices:
-        above_targets['dev'] = above / 'a_dev_c'
-        make_device(above_targets['dev'], 'c', 1, 3); bump('device')
-        make_device(above / 'a_dev_b', 'b', 7, 0); bump('device')
-    above_targets['link'] = lnk('a_file', above / 'a_link')
-
-    # --- depth backbone with a bouquet at each level ---
-    cur = troot
-    for n in range(depth):
-        reg(cur / f'f{n}', 1024 * (n + 1))
-        if n % 2 == 0:                           # hard-link coverage for -H
-            os.link(cur / f'f{n}', cur / f'hl{n}')
-            bump('hardlink')
-        reg(cur / f'perm{n}', 700, perm_cycle[(seed + n) % len(perm_cycle)])
-        reg(cur / f'setuid{n}', 512, 0o4755)
-        mkdir1(cur / f'setgid{n}', 0o2775)
-        mkdir1(cur / f'sticky{n}', 0o1777)
-        for k in range(3):                       # widen toward ~200 entries
-            reg(cur / f'g{n}_{k}', 300)
-        make_fifo(cur / f'fifo{n}'); bump('fifo')
-        make_socket(cur / f'sk{n}'); bump('socket')
-        if with_devices:
-            make_device(cur / f'cdev{n}', 'c', 1, 5); bump('device')
-            make_device(cur / f'bdev{n}', 'b', 7, n); bump('device')
-        # symlink bouquet: one link to each type present at this level
-        lnk(f'f{n}', cur / f'ln2file{n}')
-        lnk(f'fifo{n}', cur / f'ln2fifo{n}')
-        lnk(f'sk{n}', cur / f'ln2sock{n}')
-        if with_devices:
-            lnk(f'cdev{n}', cur / f'ln2dev{n}')
-        lnk(f'ln2file{n}', cur / f'ln2ln{n}')     # link to a symlink
-        lnk(f'nonexistent_{n}', cur / f'dangling{n}')
-        if n < depth - 1:
-            nxt = mkdir1(cur / f'd{n + 1}')
-            lnk(f'd{n + 1}', cur / f'ln2dir{n}')  # link to a directory
-            cur = nxt
-
-    # --- absolute-path links (targets encode the source scratch path) ---
-    absd = mkdir1(troot / 'abs_links')
-    lnk(str((troot / 'f0').resolve()), absd / 'abs_file')
-    lnk(str(above_targets['file'].resolve()), absd / 'abs_above')
-
-    # --- escaping (unsafe) links: inside the transfer root, target outside ---
-    escd = mkdir1(troot / 'escape')
-    lnk('../../above/a_dir', escd / 'esc_dir')
-    lnk('../../above/a_file', escd / 'esc_file')
-    lnk('../../above/a_fifo', escd / 'esc_fifo')
-    lnk('../../above/a_sock', escd / 'esc_sock')
-    if with_devices:
-        lnk('../../above/a_dev_c', escd / 'esc_dev')
-    lnk('../../above/a_link', escd / 'esc_link')
-    # intermediate component transits OUTSIDE the whole tree, then back in
-    lnk(f'../../../{root.name}/above/a_file', escd / 'esc_deep')
-
-    # --- xattrs on dirs + regular files (symlink xattrs are unsupported on
-    #     Linux, so skip them) ---
-    if with_xattrs:
-        for p in walk_dirs(troot) + walk_files(troot):
-            try:
-                xattr_set('variety', os.path.basename(str(p)), p)
-            except OSError:
-                pass
-
-    # --- ACLs on a deterministic subset ---
-    if with_acls:
-        dirs = walk_dirs(troot)
-        files = walk_files(troot)
-        for i, d in enumerate(dirs):
-            if i % 3 == 0:
-                acl_set('u:0:rwx', d)
-            if i % 5 == 0:
-                acl_set('d:u:0:rwx', d)      # directory default entry
-        for i, f in enumerate(files):
-            if i % 4 == 0:
-                acl_set('g:0:r-x', f)
-
-    entries = sorted(_all_entries(root), key=lambda x: str(x))
-
-    # --- mixed ownership (root only), including symlinks ---
-    if with_owners:
-        idset = [(0, 0), (1, 1), (2, 2)]
-        for i, p in enumerate(entries):
-            uid, gid = idset[(seed + i) % len(idset)]
-            try:
-                os.chown(str(p), uid, gid, follow_symlinks=False)
-            except OSError:
-                pass
-
-    # --- deterministic, varied mtimes (last, so nothing resets them); makes
-    #     the tls listing reproducible across separate builds ---
-    base = 1_000_000_000
-    for i, p in enumerate(entries):
-        t = base + (i * 7) % 1_000_000
-        try:
-            os.utime(str(p), (t, t), follow_symlinks=False)
-        except (OSError, NotImplementedError, ValueError):
-            if not os.path.islink(str(p)):
-                try:
-                    os.utime(str(p), (t, t))
-                except OSError:
-                    pass
-
-    return {'transfer_root': troot, 'above_targets': above_targets,
-            'counts': counts}
-
-
-def _rel_nonlink_entries(root) -> list:
-    """Relative paths of every non-symlink entry (real dirs + non-symlink
-    files/specials) under `root`, sorted. Used to compare per-entry metadata
-    without following or descending into symlinks."""
-    root = Path(root)
-    res = []
-    for dirpath, _dirnames, filenames in os.walk(root):  # followlinks=False
-        d = Path(dirpath)
-        if d != root:
-            res.append(d.relative_to(root))
-        for fn in filenames:
-            fp = d / fn
-            if not fp.is_symlink():
-                res.append(fp.relative_to(root))
-    return sorted(res, key=lambda p: str(p))
-
-
-def _safe_walk_files(root) -> list:
-    """walk_files() variant that tolerates unreadable directories (skips them
-    instead of raising), for comparing trees whose mixed/foreign ownership can
-    leave some entries inaccessible to the current user."""
-    root = Path(root)
-    res = []
-    for dp, _dns, fns in os.walk(root):   # onerror=None -> unreadable dirs skipped
-        d = Path(dp)
-        for n in fns:
-            p = d / n
-            try:
-                if p.is_file() and not p.is_symlink():
-                    res.append(p)
-            except OSError:
-                continue
-    return sorted(res, key=lambda x: str(x))
-
-
-def compare_trees(a, b, label: str = '', *,
-                          with_acls: bool = True,
-                          with_xattrs: bool = True) -> list:
-    """Compare two trees WITHOUT ever opening a fifo/socket/device as a
-    stream. Returns a list of human-readable difference strings ([] == match);
-    the caller decides whether a difference is a fail or an xfail.
-
-    Checks: (1) the tls listings (type+mode+owner+size+mtime+symlink target for
-    every inode); (2) byte-equality of regular files by relative path; (3) user
-    xattrs; (4) POSIX ACLs. Never uses `diff -r` (it blocks on specials)."""
-    a = Path(a)
-    b = Path(b)
-    pre = f"{label}: " if label else ""
-    diffs = []
-
-    la = rsync_ls_lR(a)
-    lb = rsync_ls_lR(b)
-    if la != lb:
-        import difflib
-        ud = ''.join(difflib.unified_diff(
-            la.splitlines(keepends=True), lb.splitlines(keepends=True),
-            fromfile=f'{a} (tls)', tofile=f'{b} (tls)'))
-        diffs.append(f"{pre}tls listings differ:\n{ud}")
-
-    files_a = sorted(p.relative_to(a) for p in _safe_walk_files(a))
-    files_b = sorted(p.relative_to(b) for p in _safe_walk_files(b))
-    set_b = set(files_b)
-    if set(files_a) != set_b:
-        only_a = sorted(str(p) for p in set(files_a) - set_b)
-        only_b = sorted(str(p) for p in set_b - set(files_a))
-        diffs.append(f"{pre}regular-file set differs: "
-                     f"only in a={only_a} only in b={only_b}")
-    for rel in files_a:
-        if rel not in set_b:
-            continue
-        try:
-            same = filecmp.cmp(str(a / rel), str(b / rel), shallow=False)
-        except OSError as e:
-            diffs.append(f"{pre}cannot compare contents of {rel} "
-                         f"(permission denied?): {e}")
-            continue
-        if not same:
-            diffs.append(f"{pre}content differs: {rel}")
-
-    # hard-link grouping (catches an -H divergence the tls listing can't show)
-    def _hl_groups(rootp):
-        from collections import defaultdict
-        ino = defaultdict(list)
-        for p in _safe_walk_files(rootp):
-            try:
-                st = p.stat()
-            except OSError:
-                continue
-            if st.st_nlink > 1:
-                ino[(st.st_dev, st.st_ino)].append(str(p.relative_to(rootp)))
-        return sorted(tuple(sorted(v)) for v in ino.values() if len(v) > 1)
-    ga, gb = _hl_groups(a), _hl_groups(b)
-    if ga != gb:
-        diffs.append(f"{pre}hard-link grouping differs: a={ga} b={gb}")
-
-    if with_xattrs or with_acls:
-        for rel in _rel_nonlink_entries(a):
-            pa = a / rel
-            pb = b / rel
-            if not pb.exists():
-                continue
-            if with_xattrs:
-                xa, xb = _xattr_sig(pa), _xattr_sig(pb)
-                if xa != xb:
-                    diffs.append(f"{pre}xattr differs: {rel} "
-                                 f"(a={xa!r} b={xb!r})")
-            if with_acls:
-                aa, ab = _acl_sig(pa), _acl_sig(pb)
-                if aa != ab:
-                    diffs.append(f"{pre}ACL differs: {rel} "
-                                 f"(a={aa!r} b={ab!r})")
-
-    return diffs
-
-
-def assert_trees_equal(a, b, label: str = '', **kwargs) -> 'None':
-    """compare_trees(); test_fail() on any difference."""
-    diffs = compare_trees(a, b, label, **kwargs)
-    if diffs:
-        test_fail('\n'.join(diffs))
diff --git a/testsuite/runtests.py b/testsuite/runtests.py
new file mode 100755
index 000000000..ba650b676
--- /dev/null
+++ b/testsuite/runtests.py
@@ -0,0 +1,6 @@
+#!/usr/bin/env python3
+
+from harness.runner import main
+
+if __name__ == '__main__':
+    main()
diff --git a/testsuite/safe-links-absolute-intree_test.py b/testsuite/safe-links-absolute-intree_test.py
deleted file mode 100644
index f7475304b..000000000
--- a/testsuite/safe-links-absolute-intree_test.py
+++ /dev/null
@@ -1,86 +0,0 @@
-#!/usr/bin/env python3
-# Absolute symlink that *resolves inside* the copied tree, under --safe-links.
-#
-# This is the case that surprises users: a symlink and its referent live in
-# the same source directory, so the link "obviously" stays inside the transfer
-# -- yet --safe-links still drops it.  The reason is that rsync classifies a
-# link's safety from the *literal text* of its target, never by resolving it.
-# An absolute target (one starting with '/') is unconditionally "unsafe",
-# regardless of where it actually points.  See unsafe_symlink() in util1.c
-# ("all absolute and null symlinks are unsafe") and the SYMBOLIC LINKS section
-# of the man page ("considered unsafe if they are absolute symlinks").
-#
-# The same link written as a *relative* path is safe and survives, which is
-# the recommended fix.
-
-import os
-
-from rsyncfns import (
-    TMPDIR, is_a_link, run_rsync, test_fail,
-)
-
-
-def assert_symlink(path, target):
-    if not is_a_link(path):
-        test_fail(f"File {path} is not a symlink")
-    actual = os.readlink(path)
-    if actual != target:
-        test_fail(f"symlink {path} target is {actual!r}, expected {target!r}")
-
-
-def assert_notexist(path):
-    # os.path.exists() follows the link, so a dropped link reads as "missing";
-    # islink() catches a link that was copied verbatim but left dangling.
-    if os.path.exists(path) or os.path.islink(path):
-        test_fail(f"File {path} unexpectedly exists")
-
-
-def assert_regular_file(path):
-    if is_a_link(path):
-        test_fail(f"File {path} is a symlink, expected a regular file")
-    if not os.path.isfile(path):
-        test_fail(f"File {path} is not a regular file")
-
-
-os.chdir(TMPDIR)
-
-os.mkdir("from")
-with open("from/linked_file", "w") as f:
-    f.write("payload\n")
-
-# Both links point at the very same in-tree file; only the spelling differs.
-abs_target = os.path.abspath("from/linked_file")
-os.symlink(abs_target, "from/abs_link")      # absolute -> always "unsafe"
-os.symlink("linked_file", "from/rel_link")   # relative, same dir -> "safe"
-
-# Sanity: the absolute link really does resolve to the in-tree file.
-if os.path.realpath("from/abs_link") != os.path.realpath("from/linked_file"):
-    test_fail("test setup: abs_link does not resolve to linked_file")
-
-# --- 1. Baseline: plain -a (no --safe-links) keeps the absolute link as-is. --
-print("baseline: -a without --safe-links preserves the absolute symlink")
-run_rsync('-a', 'from/', 'to-plain')
-assert_symlink("to-plain/abs_link", abs_target)
-assert_symlink("to-plain/rel_link", "linked_file")
-
-# --- 2. --safe-links drops the absolute link though it resolves in-tree. -----
-print("--safe-links drops the in-tree-resolving absolute symlink")
-proc = run_rsync('-av', '--safe-links', 'from/', 'to-safe',
-                 capture_output=True)
-out = proc.stdout + proc.stderr
-if 'ignoring unsafe symlink' not in out:
-    test_fail(f"expected 'ignoring unsafe symlink' message, got:\n{out}")
-
-# The absolute link is omitted entirely -- NOT replaced by its target file.
-assert_notexist("to-safe/abs_link")
-# The relative link to the same file survives untouched.
-assert_symlink("to-safe/rel_link", "linked_file")
-# The referent itself is still copied normally.
-assert_regular_file("to-safe/linked_file")
-
-# --- 3. The fix paths. -------------------------------------------------------
-# --copy-unsafe-links turns the unsafe (absolute) link into a real file copy.
-print("--copy-unsafe-links materialises the absolute link as a file")
-run_rsync('-a', '--copy-unsafe-links', 'from/', 'to-copy')
-assert_regular_file("to-copy/abs_link")
-assert_symlink("to-copy/rel_link", "linked_file")
diff --git a/testsuite/safe-links-unsafe-def_test.py b/testsuite/safe-links-unsafe-def_test.py
deleted file mode 100644
index 0e8b7fac2..000000000
--- a/testsuite/safe-links-unsafe-def_test.py
+++ /dev/null
@@ -1,130 +0,0 @@
-#!/usr/bin/env python3
-"""Pin what `--safe-links` / `--copy-unsafe-links` call an "unsafe" symlink, and
-the "top of the transfer" cut-off.
-
-The rsync(1) docs define an unsafe symlink only loosely: --safe-links "ignore[s]
-symlinks that point outside the destination tree", and --copy-unsafe-links acts
-on links "that point outside the copied tree", with the cut-off described as
-"the top of the transfer ... the part of the path that rsync isn't mentioning in
-the verbose output".  That last phrase is not something a user can test against.
-
-The actual rule (unsafe_symlink() in util1.c) is purely LEXICAL on the link
-value relative to the link's depth within the transfer:
-  - any absolute target ('/...') is unsafe;
-  - a relative target is unsafe iff its ".." count rises above the transfer top.
-It does NOT resolve the target on disk.  This test pins both the per-shape
-verdict and the trailing-slash cut-off, measured (not assumed), so the doc can
-state the rule concretely.  Pure local client behaviour: no daemon/root/tcp.
-
-Cross-version: the lexical rule is long-standing; expected identical against
---rsync-bin=old_versions/rsync_3.2.7.
-"""
-
-import os
-import subprocess
-
-from rsyncfns import SCRATCHDIR, rmtree, rsync_argv, test_fail
-
-base = SCRATCHDIR / 'safe-links'
-rmtree(base)
-base.mkdir(parents=True)
-
-# A target that physically exists ABOVE every transfer root, to prove the rule
-# is lexical (verdict doesn't depend on whether the target resolves).
-(base / 'sibling').write_text('SIBLING\n')
-
-# tree/ is the thing we transfer.  Build the symlink shapes inside it.
-tree = base / 'tree'
-tree.mkdir()
-(tree / 'file').write_text('FILE\n')
-(tree / 'sub').mkdir()
-(tree / 'sub' / 'subfile').write_text('SUBFILE\n')
-
-SHAPES = {
-    'rel-same-dir':   ('link_a', 'file'),               # -> tree/file     SAFE
-    'rel-into-sub':   ('link_b', 'sub/subfile'),        # -> tree/sub/...  SAFE
-    'rel-up-inside':  ('sub/link_c', '../file'),        # -> tree/file     SAFE
-    'rel-escape':     ('link_d', '../sibling'),         # -> base/sibling  UNSAFE
-    'rel-deep-escape':('sub/link_e', '../../sibling'),  # -> base/sibling  UNSAFE
-    'abs-target':     ('link_f', str(base / 'sibling')),# absolute         UNSAFE
-}
-for _name, (where, val) in SHAPES.items():
-    lp = tree / where
-    lp.parent.mkdir(parents=True, exist_ok=True)
-    os.symlink(val, lp)
-
-# Expected unsafe verdict when the transfer top is `tree` (the usual case).
-UNSAFE = {'rel-escape', 'rel-deep-escape', 'abs-target'}
-
-
-def run(*args):
-    subprocess.run(rsync_argv('-a', *args), stdout=subprocess.DEVNULL,
-                   stderr=subprocess.DEVNULL)
-
-
-def fresh(dst):
-    rmtree(dst)
-    dst.mkdir(parents=True)
-
-
-grid, mism = [], []
-
-# --- --safe-links: unsafe links are DROPPED, safe links KEPT (top = tree) ----
-dst = base / 'safe_dst'
-fresh(dst)
-run('--safe-links', f'{tree}/', f'{dst}/')
-for name, (where, _val) in SHAPES.items():
-    present = (dst / where).is_symlink()
-    want_present = name not in UNSAFE
-    grid.append(f"safe-links {name:15} present={int(present)} want={int(want_present)}")
-    if present != want_present:
-        mism.append(f"--safe-links {name}: present={present}, expected={want_present}")
-
-# --- --copy-unsafe-links: unsafe links DEREFERENCED to a real file, safe kept -
-dst = base / 'copy_dst'
-fresh(dst)
-run('--copy-unsafe-links', f'{tree}/', f'{dst}/')
-for name, (where, _val) in SHAPES.items():
-    p = dst / where
-    is_link = p.is_symlink()
-    is_file = p.is_file() and not is_link
-    if name in UNSAFE:
-        # dereferenced: a real file/dir, not a symlink
-        ok = is_file
-        grid.append(f"copy-unsafe {name:15} deref={int(is_file)} want=1")
-    else:
-        ok = is_link
-        grid.append(f"copy-unsafe {name:15} keptlink={int(is_link)} want=1")
-    if not ok:
-        mism.append(f"--copy-unsafe-links {name}: is_link={is_link} is_file={is_file}")
-
-# --- cut-off: the SAME link is safe or unsafe depending on the transfer top ---
-# `tree/sub/link_c` has value '../file'.  When `sub` is a name INSIDE the
-# transfer (top = tree) the link resolves within the top -> SAFE/kept.  When we
-# transfer `sub/` itself (top = sub) the same '../file' rises above the top ->
-# UNSAFE/dropped.  This is the "top of the transfer" cut-off, made concrete.
-dst = base / 'cut_inside'
-fresh(dst)
-run('--safe-links', f'{tree}/', f'{dst}/')        # top = tree
-kept_inside = (dst / 'sub' / 'link_c').is_symlink()
-grid.append(f"cutoff top=tree   sub/link_c kept={int(kept_inside)} want=1")
-if not kept_inside:
-    mism.append("cut-off: sub/link_c (../file) should be SAFE when top=tree")
-
-dst = base / 'cut_sub'
-fresh(dst)
-run('--safe-links', f'{tree}/sub/', f'{dst}/')    # top = sub
-kept_sub = (dst / 'link_c').is_symlink()
-grid.append(f"cutoff top=sub    link_c     kept={int(kept_sub)} want=0")
-if kept_sub:
-    mism.append("cut-off: link_c (../file) should be UNSAFE when top=sub")
-
-if os.environ.get('REPORT_SAFE'):
-    test_fail("REPORT-SAFE grid:\n  " + "\n  ".join(grid))
-if mism:
-    test_fail("safe-links/copy-unsafe-links contract deviated:\n  " + "\n  ".join(mism))
-
-print("safe-links-unsafe-def: unsafe == absolute target OR a relative target "
-      "whose '..' depth rises above the transfer top (lexical, not resolved); "
-      "--safe-links drops unsafe links, --copy-unsafe-links dereferences them; "
-      "the same '../file' link flips safe->unsafe as the transfer top moves down")
diff --git a/testsuite/safe-links_test.py b/testsuite/safe-links_test.py
deleted file mode 100644
index 9a74095cd..000000000
--- a/testsuite/safe-links_test.py
+++ /dev/null
@@ -1,51 +0,0 @@
-#!/usr/bin/env python3
-# Python rewrite of testsuite/safe-links.test.
-#
-# --safe-links must drop symlinks whose target escapes the transfer root.
-# In-tree symlinks survive; escape-attempt symlinks (../../..., a/a/../../...)
-# must NOT appear at the destination at all.
-
-import os
-
-from rsyncfns import TMPDIR, is_a_link, run_rsync, test_fail
-
-
-def assert_symlink(path, target):
-    if not is_a_link(path):
-        test_fail(f"File {path} is not a symlink")
-    actual = os.readlink(path)
-    if actual != target:
-        test_fail(f"symlink {path} target is {actual!r}, expected {target!r}")
-
-
-def assert_notexist(path):
-    if os.path.exists(path):
-        test_fail(f"File {path} exists")
-    if os.path.islink(path):
-        test_fail(f"File {path} exists as a symlink")
-
-
-os.chdir(TMPDIR)
-
-os.mkdir("from")
-os.mkdir("from/safe")
-os.mkdir("from/unsafe")
-os.mkdir("from/safe/files")
-os.mkdir("from/safe/links")
-
-open("from/safe/files/file1", "w").close()
-open("from/safe/files/file2", "w").close()
-open("from/unsafe/unsafefile", "w").close()
-
-os.symlink("../files/file1", "from/safe/links/file1")
-os.symlink("../files/file2", "from/safe/links/file2")
-os.symlink("../../unsafe/unsafefile", "from/safe/links/unsafefile")
-os.symlink("a/a/a/../../../unsafe2", "from/safe/links/unsafe2")
-
-print("rsync with relative path and --safe-links")
-run_rsync('-avv', '--safe-links', 'from/safe/', 'to')
-
-assert_symlink("to/links/file1", "../files/file1")
-assert_symlink("to/links/file2", "../files/file2")
-assert_notexist("to/links/unsafefile")
-assert_notexist("to/links/unsafe2")
diff --git a/testsuite/scanner-batch-flag-mismatch_test.py b/testsuite/scanner-batch-flag-mismatch_test.py
deleted file mode 100644
index 58be95146..000000000
--- a/testsuite/scanner-batch-flag-mismatch_test.py
+++ /dev/null
@@ -1,54 +0,0 @@
-#!/usr/bin/python3
-# Regression test for run5 0016: a --read-batch whose recorded stream-flags
-# enable a metadata class (xattrs/acls/uid/gid) that the reading command line
-# did not.  setup_protocol() used to compute xattrs_ndx BEFORE check_batch_flags()
-# flipped preserve_xattrs on, leaving xattrs_ndx=0 -- so F_XATTR(file) wrote a
-# 4-byte int at offset 0 of every file_struct, clobbering file->dirname into a
-# wild pointer that flist_sort_and_clean() then dereferenced (heap overflow).
-import subprocess
-from rsyncfns import (
-    FROMDIR, SCRATCHDIR, forced_protocol, makepath, rmtree, run_rsync, rsync_argv,
-    test_fail, test_skipped, xattr_set, xattrs_supported,
-)
-
-if not xattrs_supported():
-    test_skipped("needs xattr support to write an -X batch")
-
-proto = forced_protocol()
-if proto is not None and proto < 30:
-    test_skipped("xattrs (-X) need protocol 30+")
-
-src = FROMDIR
-rmtree(src)
-makepath(src)
-# Several files, each with an xattr, so the post-clobber flist_sort_and_clean()
-# walks file->dirname across many entries.  Some platforms advertise xattr
-# support yet reject a user-namespace xattr on a plain file (e.g. FreeBSD's
-# setextattr) -- skip cleanly there rather than fail in setup.
-for i in range(40):
-    f = src / f'f{i:03d}'
-    f.write_text('x\n')
-    try:
-        xattr_set('user.m', 'v', f)
-    except Exception as e:
-        test_skipped(f"cannot set a user xattr on a regular file here: {e}")
-
-batch = SCRATCHDIR / 'xbatch'
-wb_dest = SCRATCHDIR / 'wb-dest'
-rmtree(wb_dest)
-# Write the batch WITH -X: the stream-flags record preserve_xattrs.
-run_rsync('-a', '-X', f'--only-write-batch={batch}', f'{src}/', str(wb_dest))
-
-dest = SCRATCHDIR / 'rb-dest'
-rmtree(dest)
-makepath(dest)
-# Replay with BARE -a (no -X): the batch flips preserve_xattrs on after the
-# *_ndx were computed.  Must complete cleanly now.
-r = subprocess.run(rsync_argv('-a', f'--read-batch={batch}', str(dest)),
-                   capture_output=True, text=True)
-if r.returncode < 0 or r.returncode >= 128:
-    test_fail(f'read-batch crashed (rc={r.returncode}): {r.stderr.strip()[:200]}')
-if not (dest / 'f000').exists():
-    test_fail(f'read-batch did not replay the files (rc={r.returncode}): '
-              f'{r.stderr.strip()[:200]}')
-print("scanner-batch-flag-mismatch: -X batch replayed with bare -a is clean")
diff --git a/testsuite/search-only-destination_test.py b/testsuite/search-only-destination_test.py
deleted file mode 100644
index 46108e2f5..000000000
--- a/testsuite/search-only-destination_test.py
+++ /dev/null
@@ -1,77 +0,0 @@
-#!/usr/bin/env python3
-"""The receiver must traverse a searchable but unreadable destination parent.
-
-Android exposes /sdcard through such a path, so the race-safe destination walk
-must use directory descriptors that require search permission only.
-"""
-
-import os
-import shutil
-import subprocess
-import sys
-import tempfile
-from pathlib import Path
-
-from rsyncfns import SCRATCHDIR, rmtree, rsync_argv, test_fail, test_skipped
-
-if not sys.platform.startswith('linux'):
-    test_skipped('search-only-destination is Linux-specific')
-
-launcher = []
-if os.geteuid() == 0:
-    setpriv = shutil.which('setpriv')
-    if setpriv is None:
-        test_skipped('setpriv is unavailable for the root-run testsuite')
-    launcher = [setpriv, '--reuid=65534', '--regid=65534', '--clear-groups']
-
-external_base = os.geteuid() == 0
-if external_base:
-    base = Path(tempfile.mkdtemp(prefix='rsync-search-only-'))
-    base.chmod(0o755)
-else:
-    base = SCRATCHDIR / 'search-only-destination'
-src = base / 'src'
-parent = base / 'search-only'
-dest = parent / 'dest'
-rmtree(base)
-src.mkdir(parents=True)
-dest.mkdir(parents=True)
-(src / 'probe').write_text('search-only destination\n')
-
-if os.geteuid() == 0:
-    for path in (src, src / 'probe', dest):
-        os.chown(path, 65534, 65534)
-
-try:
-    parent.chmod(0o111)
-    try:
-        probe = subprocess.run(
-            launcher + ['test', '-r', str(parent)],
-            stdout=subprocess.DEVNULL,
-            stderr=subprocess.DEVNULL,
-        )
-        if probe.returncode == 0:
-            test_skipped('filesystem does not enforce the search-only test mode')
-        if probe.returncode != 1:
-            test_fail(f'search-only permission probe failed with exit {probe.returncode}')
-
-        proc = subprocess.run(
-            launcher + rsync_argv('-a', f'{src}/', f'{dest}/'),
-            stdout=subprocess.PIPE,
-            stderr=subprocess.PIPE,
-            text=True,
-        )
-    finally:
-        parent.chmod(0o755)
-    copied = (dest / 'probe').read_text() if (dest / 'probe').is_file() else None
-finally:
-    if external_base:
-        rmtree(base)
-
-if proc.returncode != 0:
-    test_fail(
-        'receiver could not enter a destination below a searchable, unreadable '
-        f'parent (exit {proc.returncode}): {proc.stderr.strip()}'
-    )
-if copied != 'search-only destination\n':
-    test_fail('receiver did not copy into the search-only destination')
diff --git a/testsuite/secure-relpath-validation_test.py b/testsuite/secure-relpath-validation_test.py
deleted file mode 100644
index c71294f12..000000000
--- a/testsuite/secure-relpath-validation_test.py
+++ /dev/null
@@ -1,30 +0,0 @@
-#!/usr/bin/env python3
-# Python rewrite of testsuite/secure-relpath-validation.test.
-#
-# Regression test for codex audit Finding 5: secure_relative_open()'s
-# front-door input check rejects "../foo" and "foo/../bar" but missed
-# bare "..", "subdir/..", and other variants whose "/"-split components
-# contain a literal "..". RESOLVE_BENEATH equivalents catch these in
-# the kernel, but the per-component O_NOFOLLOW fallback (on NetBSD,
-# OpenBSD, Solaris, Cygwin, pre-5.6 Linux) does not -- so the
-# validation must happen at the front door.
-#
-# The t_secure_relpath helper runs each suspect input through
-# secure_relative_open() and confirms it gets back -1/EINVAL (the
-# marker that the front-door check kicked in, not the kernel).
-
-import subprocess
-
-from rsyncfns import SCRATCHDIR, TOOLDIR, rmtree, test_fail
-
-
-testdir = SCRATCHDIR / 'relpath-test'
-rmtree(testdir)
-testdir.mkdir(parents=True)
-
-proc = subprocess.run([str(TOOLDIR / 't_secure_relpath'), str(testdir)])
-if proc.returncode != 0:
-    test_fail(
-        "t_secure_relpath rejected one or more inputs incorrectly "
-        "(see stderr above for the specific case)"
-    )
diff --git a/testsuite/sender-scan-dir-escape_test.py b/testsuite/sender-scan-dir-escape_test.py
deleted file mode 100644
index 654680425..000000000
--- a/testsuite/sender-scan-dir-escape_test.py
+++ /dev/null
@@ -1,110 +0,0 @@
-#!/usr/bin/env python3
-# Source-tree directory-ENUMERATION escape via a parent-component symlink race.
-#
-# Companion to symlink-race-source (which races the sender's file CONTENT open).
-# The sender enumerates each source directory with a plain opendir(fbuf) on the
-# full accumulated path (flist.c send_directory) -- no O_NOFOLLOW, not routed
-# through the held-dirfd resolver.  scan_dirfd = dirfd(d) only makes the
-# per-entry stats safe, not the opendir itself.  So a parent component raced from
-# a directory to a symlink->OUTSIDE the transfer root between scan time and the
-# recursive opendir makes the sender enumerate an out-of-tree directory and copy
-# its entries -- names, metadata and SYMLINK TARGETS -- into the destination,
-# escaping the root of the transfer.
-#
-# Regular-file content stays protected by the confined content open (the
-# symlink-race-source fix), so the leak signal here is deliberately a SYMLINK in
-# the outside dir whose target is a unique marker: it is transferred purely via
-# readlinkat() during the scan (no content open), so its appearance in the
-# destination proves the enumeration -- not the content open -- escaped.  A
-# uniquely-named out-of-tree subdir/file is also checked as a secondary signal.
-#
-# The escape needs a genuine TOCTOU (a STATIC symlink parent is lstat'd and
-# recorded as a symlink, never descended), so a flipper process swaps the
-# component directory <-> symlink while rsync runs, retried up to RACE_TIMEOUT.
-# Any uid: the attacker owns the source subtree it races.  FAILS on the unfixed
-# tree (the out-of-tree symlink target lands in dest); PASSES once the
-# enumeration is confined beneath the transfer root.
-
-import os
-import subprocess
-import time
-
-from rsyncfns import (
-    SCRATCHDIR, race_budget, rmtree, rsync_argv, rsync_supports,
-    start_path_flipper, stop_flipper, test_fail,
-)
-
-MARKER = "XFIL-OUTSIDE-SYMLINK-TARGET-do-not-copy"
-NKEEP = 64
-
-base = SCRATCHDIR / 'scan-dir-escape'
-src = base / 'src'
-outside = base / 'outside'
-dest = base / 'dest'
-
-rmtree(base)
-
-# Real-directory state of the flipping component, with in-tree entries whose
-# names never appear outside (so an out-of-tree name in dest is unambiguous).
-realsub = src / '.realsub'
-realsub.mkdir(parents=True)
-for i in range(NKEEP):
-    (realsub / f'keep{i}').write_text("in-tree\n")
-
-# The out-of-tree target the attacker points the raced component at.  Its
-# entries have distinctive names and the symlink carries the marker target.
-outside.mkdir(parents=True)
-os.symlink(MARKER, outside / 'xfil_link')          # target leaks via readlinkat
-(outside / 'xfil_dir').mkdir()                      # name leaks via getdents
-(outside / 'xfil_dir' / 'inner').write_text("x\n")
-(outside / 'xfil_file').write_text("x\n")           # name/metadata leaks
-
-# 'sub' starts as the real directory; 'evil' is the escaping symlink.  The
-# flipper swaps them so 'sub' alternates directory <-> symlink->../outside.
-os.rename(realsub, src / 'sub')
-os.symlink('../outside', src / 'evil')
-dest.mkdir(parents=True)
-
-
-def escaped():
-    """Return a description of any out-of-tree entry that reached dest/sub."""
-    d = dest / 'sub'
-    if d.is_symlink() or not d.is_dir():
-        return None
-    link = d / 'xfil_link'
-    if link.is_symlink() and os.readlink(link) == MARKER:
-        return f"symlink target leaked: dest/sub/xfil_link -> {MARKER}"
-    for name in ('xfil_dir', 'xfil_file', 'xfil_link'):
-        if (d / name).exists() or (d / name).is_symlink():
-            return f"out-of-tree name leaked: dest/sub/{name}"
-    return None
-
-
-# --no-inc-recursive widens the window: the whole tree is scanned (recording
-# sub/ as a directory) before the recursive opendir of sub/, giving the flipper
-# the scan phase to flip sub to a symlink.  The escape exists with incremental
-# recursion too; this makes it reliably winnable within the budget.  Skip the
-# flag on implementations that lack it (they default to the safer behaviour).
-extra = ['--no-inc-recursive'] if rsync_supports('--no-inc-recursive') else []
-
-flip = start_path_flipper(src / 'sub', src / 'evil')
-leak = None
-deadline = time.monotonic() + race_budget()
-try:
-    while time.monotonic() < deadline and leak is None:
-        rmtree(dest)
-        dest.mkdir(parents=True)
-        subprocess.run(rsync_argv('-a', *extra, f'{src}/', f'{dest}/'),
-                       stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
-        leak = escaped()
-finally:
-    stop_flipper(flip)
-
-if leak is not None:
-    test_fail(
-        "source-tree directory-enumeration TOCTOU: the sender followed a "
-        "parent-component symlink it should have confined and copied an "
-        f"out-of-tree entry into the output ({leak}).  The directory scan's "
-        "opendir(fbuf) (flist.c send_directory) must resolve beneath the "
-        "transfer root, like the content open.")
-print("sender-scan-dir-escape: directory enumeration stayed within the transfer root")
diff --git a/testsuite/simd-checksum_test.py b/testsuite/simd-checksum_test.py
deleted file mode 100644
index bae98d1fd..000000000
--- a/testsuite/simd-checksum_test.py
+++ /dev/null
@@ -1,20 +0,0 @@
-#!/usr/bin/env python3
-# Python rewrite of testsuite/simd-checksum.test.
-#
-# Run the simdtest helper, which compares the SIMD checksum
-# implementations against the C reference. Skip if the helper wasn't
-# built (i.e. SIMD acceleration is unavailable on this host).
-
-import os
-import subprocess
-
-from rsyncfns import TOOLDIR, test_fail, test_skipped
-
-
-simdtest = TOOLDIR / 'simdtest'
-if not (simdtest.is_file() and os.access(simdtest, os.X_OK)):
-    test_skipped("simdtest not built (SIMD not available)")
-
-proc = subprocess.run([str(simdtest)])
-if proc.returncode != 0:
-    test_fail(f"simdtest exited {proc.returncode}")
diff --git a/testsuite/skiplist-spec_test.py b/testsuite/skiplist-spec_test.py
deleted file mode 100644
index 2fe0dde28..000000000
--- a/testsuite/skiplist-spec_test.py
+++ /dev/null
@@ -1,174 +0,0 @@
-#!/usr/bin/env python3
-# runtests.py's RSYNC_EXPECT_SKIPPED parser.  The per-platform expected-skip
-# lists live in testsuite/skiplist/*.txt and are referenced from the workflows
-# as @FILE, so a bug here silently weakens the skip oracle on every CI job (an
-# unreadable or truncated list must never read as "expect no skips").  Also
-# checks that the committed lists themselves parse and are referenced.
-
-import importlib.util
-import os
-from pathlib import Path
-
-from rsyncfns import SCRATCHDIR, SRCDIR, test_fail
-
-# srcdir arrives relative under `make installcheck` (--srcdir=../src).  Resolve
-# it once: paths built from it are handed back to a srcdir-relative API below,
-# which would otherwise re-prefix them.
-SRC = Path(SRCDIR).resolve()
-
-spec = importlib.util.spec_from_file_location('runtests', SRC / 'runtests.py')
-runtests = importlib.util.module_from_spec(spec)
-spec.loader.exec_module(runtests)
-
-SUITE = str(SRC / 'testsuite')
-ERROR = f'exit:{runtests.Exit.ERROR}'
-
-
-def expand(text_spec, srcdir=None, suitedir=None):
-    """expand_skip_spec, but reporting a SystemExit as a string."""
-    try:
-        return runtests.expand_skip_spec(text_spec, srcdir or str(SRC),
-                                         suitedir or SUITE)
-    except SystemExit as e:
-        return f'exit:{e.code}'
-
-
-def write(name, body):
-    p = SCRATCHDIR / name
-    if isinstance(body, bytes):
-        p.write_bytes(body)
-    else:
-        p.write_text(body)
-    return '@' + str(p)
-
-
-# A stand-in suite whose entries make each malformed name *look* real, so that
-# removing the guard for it cannot be masked by the "no such test" check.
-FAKE = SCRATCHDIR / 'fakesuite'
-FAKE.mkdir(exist_ok=True)
-(FAKE / 'acls sparse_test.py').write_text('')   # if the one-name-per-line
-(FAKE / 'foo,bar_test.py').write_text('')       # ... comma and
-(FAKE / 'adir_test.py').mkdir(exist_ok=True)    # ... regular-file guards went
-
-# --- a bad spec must be a hard error, never a silently smaller expectation --
-#
-# The sorted/duplicate cases use real test names in descending order, so that
-# dropping the sort check cannot be masked by the stale-name check.
-
-for what, arg, suite in (
-    ('missing file', '@testsuite/skiplist/does-not-exist.txt', None),
-    ('unknown test name', 'no-such-test-here', None),
-    ('unsorted list', write('unsorted.txt', 'sparse\nacls\n'), None),
-    ('duplicate entry', write('dup.txt', 'acls\nacls\n'), None),
-    ('stale name in a list', write('stale.txt', 'gone-away-test\n'), None),
-    ('empty file', write('empty.txt', ''), None),
-    ('comments only', write('comments.txt', '# nothing here\n\n'), None),
-    ('not valid text', write('binary.txt', b'acls\n\xff\xfe not utf-8\n'), None),
-    ('empty entry', 'acls,,sparse', None),
-    ('trailing comma', 'acls,', None),
-    ('leading comma', ',acls', None),
-    ('path in a name', '../testsuite/acls', None),
-    ('two names on a line', write('twonames.txt', 'acls sparse\n'), str(FAKE)),
-    ('comma in a name', write('comma.txt', 'foo,bar\n'), str(FAKE)),
-    ('a directory, not a test', 'adir', str(FAKE)),
-):
-    got = expand(arg, suitedir=suite)
-    if got != ERROR:
-        test_fail(f'{what}: expected a hard error, got {got!r}')
-
-# --- good specs ------------------------------------------------------------
-
-one = write('one.txt', '# comment\n\nacls  # trailing comment\nsparse\n')
-two = write('two.txt', 'devices\nsparse\n')
-
-for what, arg, want in (
-    ('@FILE expansion', one, 'acls,sparse'),
-    ('composing two lists', f'{one},{two}', 'acls,devices,sparse'),
-    ('a bare name with @FILE', f'{one},crtimes', 'acls,crtimes,sparse'),
-    ('an empty spec is "no skips"', '', ''),
-):
-    got = expand(arg)
-    if got != want:
-        test_fail(f'{what}: expected {want!r}, got {got!r}')
-
-# A relative @FILE resolves against srcdir, not the cwd: `make check` in an
-# out-of-tree build directory would otherwise not find the lists.  srcdir is
-# itself relative under `make installcheck` (--srcdir=../src), so check a
-# non-trivial one too -- in-tree, os.path.relpath() would just be ".".
-got = expand('@testsuite/skiplist/common.txt', str(SRC))
-if got.startswith('exit:') or not got:
-    test_fail(f'relative @FILE did not resolve against srcdir: {got!r}')
-
-cwd = os.getcwd()
-try:
-    os.chdir(SRC.parent)
-    got = expand('@testsuite/skiplist/common.txt', SRC.name)
-finally:
-    os.chdir(cwd)
-if got.startswith('exit:') or not got:
-    test_fail(f'@FILE did not resolve against a relative srcdir: {got!r}')
-
-# --- the committed lists ---------------------------------------------------
-
-# backport.txt is not an expected-skip list: it is an EXCLUDE list that a
-# backport branch ships to say which of this suite's tests it cannot run, and
-# fleettest reads it from the BUILT tree rather than from any workflow.  It only
-# appears here when a backport tree has been overlaid with this suite, so it is
-# exempt from the checks below that assume a workflow points at the file.
-BACKPORT_LIST = 'backport.txt'
-
-lists = sorted(p for p in (SRC / 'testsuite' / 'skiplist').glob('*.txt')
-               if p.name != BACKPORT_LIST)
-if len(lists) < 5:
-    test_fail(f'expected the per-platform skip lists, found {lists}')
-for path in lists:
-    got = expand('@' + str(path))
-    if got.startswith('exit:') or not got:
-        test_fail(f'{path.name} is empty or does not parse: {got!r} '
-                  '(run runtests.py to see the diagnostic)')
-
-# Every workflow reference must expand, and every committed list must be
-# referenced by some workflow -- a list nothing points at silently stops
-# being enforced.
-wf = sorted((SRC / '.github' / 'workflows').glob('*.yml'))
-refs, referenced = 0, set()
-for path in wf:
-    for line in path.read_text().splitlines():
-        if 'RSYNC_EXPECT_SKIPPED=' not in line:
-            continue
-        arg = line.split('RSYNC_EXPECT_SKIPPED=', 1)[1].split()[0]
-        got = expand(arg)
-        if got.startswith('exit:') or not got:
-            test_fail(f'{path.name}: unusable RSYNC_EXPECT_SKIPPED spec {arg!r}')
-        refs += 1
-        for tok in arg.split(','):
-            if tok.startswith('@'):
-                referenced.add(Path(tok[1:]).name)
-if wf:
-    if refs == 0:
-        test_fail('no workflow references RSYNC_EXPECT_SKIPPED any more')
-    orphans = sorted({p.name for p in lists} - referenced)
-    if orphans:
-        test_fail(f'skip lists no workflow references: {", ".join(orphans)}')
-# '-name' removals.  fleettest emits these for a host that can genuinely run a
-# test its platform list expects to skip; the name being dropped lives inside an
-# @FILE, so no composer can subtract it before runtests expands the spec.
-common = SRC / 'testsuite' / 'skiplist' / 'common.txt'
-if common.is_file():
-    full = expand('@' + str(common))
-    victim = full.split(',')[0]
-    got = expand(f'@{common},-{victim}')
-    if got == full or victim in got.split(','):
-        test_fail(f'-{victim} did not remove it from the expanded list')
-    if len(got.split(',')) != len(full.split(',')) - 1:
-        test_fail(f'-{victim} removed more than the one name')
-    # Order must not matter: removals apply after every addition.
-    if expand(f'-{victim},@{common}') != got:
-        test_fail('a removal before the list it removes from behaved differently')
-    # A removal that removes nothing is stale, and shrinking the expected set
-    # quietly is the whole failure mode this parser exists to prevent.
-    for stale in (f'@{common},-no-such-test-here', f'@{common},-{victim},-{victim}'):
-        if expand(stale) != ERROR:
-            test_fail(f'a stale removal was accepted: {stale!r}')
-
-print(f'ok: {len(lists)} skip lists, {refs} workflow references')
diff --git a/testsuite/skiplist/README.md b/testsuite/skiplist/README.md
deleted file mode 100644
index b7bfbe72f..000000000
--- a/testsuite/skiplist/README.md
+++ /dev/null
@@ -1,118 +0,0 @@
-# Expected-skip lists
-
-`runtests.py` checks, on a full run, that the set of tests which skipped is
-*exactly* the set that was expected. That oracle is what stops a test from
-quietly turning into a permanent no-op: if a test starts skipping (a probe
-regresses, a helper goes missing) the run fails instead of reporting green.
-
-The expected set is passed in `RSYNC_EXPECT_SKIPPED`. It used to be one huge
-comma-separated line per CI job, duplicated across seven workflow steps, which
-meant every branch that added a skipping test edited the same line in the same
-files and conflicted with every other such branch. The lists now live here, one
-test name per line, and a workflow step references them:
-
-```yaml
-run: RSYNC_EXPECT_SKIPPED=@testsuite/skiplist/common.txt,@testsuite/skiplist/linux.txt make check
-```
-
-Adding a test therefore touches one line of one file, and two branches adding
-different tests merge cleanly.
-
-## Files
-
-| file | contents |
-| --- | --- |
-| `common.txt` | skipped on every platform that runs the oracle — mostly `require_tcp` / `require_asan` tests, which the default stdio-pipe `make check` cannot satisfy |
-| `linux.txt` | Linux-only additions |
-| `macos.txt` | macOS-only additions |
-| `cygwin.txt` | Cygwin-only additions |
-| `proto29.txt` | additions for a `--protocol=29` run, on any platform |
-| `proto30.txt` | additions for a `--protocol=30` run, on any platform |
-
-Compose them with commas; the result is the union, so listing a test twice is
-harmless. Plain test names may be mixed in with `@FILE` entries.
-
-## Format rules
-
-One test name per line. `#` starts a comment; a trailing `# reason` is
-encouraged — it is the only place the reason for the expectation is recorded.
-Each file must be **sorted and duplicate-free**, and every name must be a plain
-test name matching a real `testsuite/<name>_test.py`. Sorting is not cosmetic:
-it is what makes two independent additions land on different lines.
-
-`runtests.py` exits 2 on anything malformed — an unreadable file, an empty or
-comment-only one, an empty entry (`a,,b`, which is what an unset variable
-expands to), an unsorted or duplicated name, a stale name. The set comparison
-is exact, so a truncated list would not pass unnoticed; it would surface as a
-page of "unexpected skips" naming every test the list lost, which reads like a
-suite-wide regression rather than a bad list. Failing at the source says what
-actually happened. A wholly empty `RSYNC_EXPECT_SKIPPED` is still the
-legitimate "expect no skips at all".
-
-Relative `@FILE` paths resolve against `srcdir`, so out-of-tree builds and
-`make installcheck` work.
-
-## Changing a list
-
-If a test newly skips on a platform, prefer fixing the test so it does not skip.
-When the skip is legitimate, add the name to the narrowest file that fits, with
-a reason. Do not paper over a mismatch by adding a name you cannot explain — an
-unexpected skip is usually a real regression in that test's setup.
-
-`testsuite/fleettest.py` reads these same lists (through each target's
-workflow), and merges per-box `expect_skip_extra` from `fleettest.json` on top
-for facts that are true of one machine rather than one platform.
-
-Fleet takes each pass's spec from the workflow step of the same name, so a
-target with `"protocols": [29]` is only pinned if its workflow actually has a
-`make check29` step composing `proto29.txt`. Today only the Ubuntu workflows
-do; a macOS or Cygwin target set to run protocol 29 gets no expected-skip
-oracle for that pass rather than a wrong one.
-
-## `backport.txt` — a different thing in the same directory
-
-A backport branch (`v3.4.1-sec-patches3`, `v3.2.7-sec-patches3`) is tested with
-a NEWER suite than it shipped with, via
-`fleettest.py --repo <backport> --testsuite-repo <3.5.0>`. Such a tree cannot
-pass tests for fixes it does not carry, and cannot build unit-test helpers its
-Makefile has never heard of.
-
-Those branches each carry their own `testsuite/skiplist/backport.txt`. It is
-**not** an expected-skip list:
-
-* the other files here are `RSYNC_EXPECT_SKIPPED` oracles — "these should skip,
-  tell me if that changes";
-* `backport.txt` is an `RSYNC_EXCLUDE` list — "do not run these at all".
-
-It has to be an exclusion because some of the tests *fail* rather than skip on
-an older tree, and an expected-skip list cannot describe a failure.
-
-`fleettest.py` reads it from the tree being BUILT (`--repo`), not from the tree
-providing the suite, because only the built tree knows what it lacks. The
-overlay that puts a newer `testsuite/` onto an older tree is a merge with no
-delete, so a file that exists only on the backport survives it.
-
-`skiplist-spec` exempts this name from the rule that every committed list must
-be referenced by a workflow: nothing references it, by design.
-
-### Accepted breakage vs absent features
-
-`backport.txt` holds two different kinds of entry, and they must stay
-distinguishable:
-
-* **absent** — a fix, feature or helper the branch does not have. The test
-  could never pass and is not telling you anything.
-* **accepted breakage** — a real defect on that branch that we have chosen to
-  ship. The test *was* telling you something, and excluding it is a decision
-  rather than bookkeeping.
-
-Keep the second kind in its own commented section naming the defect and where
-it is written up. `v3.2.7-sec-patches3` has one today
-(`fake-super-acl-xattr`, the `--remote-option` local-transfer bug). A list that
-does not distinguish them turns "we know about this and accepted it" into "this
-test never applied here" within about one release.
-
-**CI for the backport branches**, when it is set up to run this suite against
-them, has to honour these lists the same way `fleettest.py` does — read
-`backport.txt` from the branch being built and pass it as `RSYNC_EXCLUDE`.
-A CI job that does not will fail on every one of these and be turned off.
diff --git a/testsuite/skiplist/common.txt b/testsuite/skiplist/common.txt
deleted file mode 100644
index cb09e33e8..000000000
--- a/testsuite/skiplist/common.txt
+++ /dev/null
@@ -1,62 +0,0 @@
-# Tests expected to SKIP.  One name per line, '#' starts a comment; the file
-# must stay sorted and duplicate-free (runtests.py enforces both).  Referenced
-# from a workflow as RSYNC_EXPECT_SKIPPED=@testsuite/skiplist/<file>[,@...].
-# See testsuite/skiplist/README.md.
-#
-# Skipped on every platform that runs the oracle (Linux, macOS, Cygwin).
-# Mostly tests that need the real-TCP transport (require_tcp) or an ASan
-# build (require_asan), neither of which the default `make check` provides.
-# Reasons below are the ones this box reported; another platform may skip
-# the same test earlier for a different reason.
-
-checksum-zero-blocklen  # the pure-Python receiver needs a real TCP socket; run with --use-tcp
-chroot-basis-forge-inner-module  # the pure-Python sender needs a real TCP daemon; run with --use-tcp
-daemon-access-idn  # hosts allow/deny hostname matching needs a real TCP peer
-daemon-access-ip  # hosts allow/deny address matching needs a real TCP peer
-daemon-argv-limit  # raw malicious daemon client needs a real TCP daemon; run with --use-tcp
-daemon-chroot  # daemon chroot path needs the real start_daemon socket flow
-daemon-chroot-acl  # needs a real TCP peer address for reverse-DNS hostname ACL; run with --use-tcp
-daemon-deny-dns-failopen  # hosts deny DNS-failure matching needs a real TCP peer
-daemon-dot-file-force-wipe  # the malicious daemon client needs a real TCP socket; run with --use-tcp
-daemon-handshake-timeout  # stalling the pre-transfer handshake needs a real listening socket; run with --use-tcp
-daemon-http-proxy  # RSYNC_PROXY uses open_socket_out(), needs a real TCP connect
-daemon-leaf-type-race-fchmod  # leaf-type authority proof currently requires Darwin
-daemon-module-options  # motd/socket-options need a real socket
-daemon-namecvt-empty-response  # namecvt-empty-response test must run as a non-root user (sender uid/gid must differ from 0 to expose the bug)
-daemon-namecvt-newline-token  # the pure-Python sender needs a real TCP daemon; run with --use-tcp
-daemon-proxy-protocol  # PROXY-protocol header is read from a real TCP socket; run with --use-tcp
-daemon-refuse-compress-threads-alias  # the malicious receiver needs a real TCP daemon; run with --use-tcp
-daemon-standalone-detach  # standalone detaching daemon opens a real loopback listener; run with --use-tcp
-daemon-symlink-escape-matrix  # the daemon symlink-resolution flow needs a real TCP peer
-daemon-zstd-thread-exhaustion  # the malicious receiver needs a real TCP daemon; run with --use-tcp
-exclude-implied-trailing-backslash  # a real network rsync daemon is needed (am_server==0 per-module); run with --use-tcp
-inband-modname-leak  # the daemon @ERROR handshake needs a real TCP peer
-io-noop-flood-recursion  # the pure-Python client needs a real TCP daemon; run with --use-tcp
-io-nosend-flood-recursion  # the pure-Python client needs a real TCP daemon; run with --use-tcp
-io-readargs-argv-nullwrite  # the pure-Python client needs a real TCP daemon; run with --use-tcp
-ki62-io-error-mask  # needs --use-tcp to kill the daemon (sender) mid-transfer
-macos-setgid-ordinary-mode-regression  # macOS-specific fchmodat setgid behavior
-malicious-dot-dir-delete-scope  # the malicious sender needs a real TCP socket; run with --use-tcp
-malicious-dot-file-delete-scope  # the malicious sender needs a real TCP socket; run with --use-tcp
-malicious-server-partial-basis-symlink-overwrite  # the malicious sender needs a real TCP socket; run with --use-tcp
-match-append-empty-nullmap  # the pure-Python generator needs a real TCP daemon; run with --use-tcp
-match-want-i-nolen  # the pure-Python generator needs a real TCP daemon; run with --use-tcp
-peer-legacy-implied-delete-scope  # the malicious protocol-29 server needs TCP; run with --use-tcp
-proto-cleared-dirflist  # the pure-Python sender needs a real TCP daemon; run with --use-tcp
-proto-cleared-ndx  # the pure-Python sender needs a real TCP daemon; run with --use-tcp
-proto-hlink-flag-oob  # the pure-Python sender needs a real TCP daemon; run with --use-tcp
-proto-hlink-gnum  # the pure-Python sender needs a real TCP daemon; run with --use-tcp
-proto-msg-info-assert  # the pure-Python sender needs a real TCP daemon; run with --use-tcp
-proto-parent-ndx-empty-dirflist  # the pure-Python sender needs a real TCP daemon; run with --use-tcp
-proto-sender-selftest  # the pure-Python sender needs a real TCP daemon; run with --use-tcp
-proto-subflist-freed  # the pure-Python sender needs a real TCP daemon; run with --use-tcp
-proxy-connect-request-too-long  # fake-proxy listener needs a real TCP socket; run with --use-tcp
-proxy-protocol-trusted-peer  # PROXY protocol peer policy needs a real TCP daemon; run with --use-tcp
-proxy-response-header-too-long  # fake-proxy listener needs a real TCP socket; run with --use-tcp
-proxy-response-line-too-long  # fake-proxy listener needs a real TCP socket; run with --use-tcp
-recv-discard-nullderef  # root bypasses DAC: the unwritable dest dir wouldn't make the receiver's mkstemp fail, so the discard path (and the bug) is never reached
-recv-generator-acl-leak  # KI-23 real_sx ACL leak is only observable under AddressSanitizer/LSan
-uidlist-id0-name-leak  # KI-25 id-0 name leak is only observable under AddressSanitizer/LSan
-variety-symlink-traversal  # no old peer selected (RSYNC_PEER == RSYNC); nothing to compare for symlink-traversal divergence
-xattr-wire-cap  # the pure-Python daemon needs a real TCP socket; run with --use-tcp
-xrsync  # xrsync speaks the daemon protocol over a raw TCP socket; run with --use-tcp
diff --git a/testsuite/skiplist/cygwin.txt b/testsuite/skiplist/cygwin.txt
deleted file mode 100644
index 3ea71beb5..000000000
--- a/testsuite/skiplist/cygwin.txt
+++ /dev/null
@@ -1,73 +0,0 @@
-# Tests expected to SKIP.  One name per line, '#' starts a comment; the file
-# must stay sorted and duplicate-free (runtests.py enforces both).  Referenced
-# from a workflow as RSYNC_EXPECT_SKIPPED=@testsuite/skiplist/<file>[,@...].
-# See testsuite/skiplist/README.md.
-#
-# Cygwin-only additions to common.txt.
-
-acl-symlink-race
-acls
-acls-default
-acls-depth
-acls-unpinnable
-backup-acl-xattr-cache
-backup-dir-symlink-race
-basis-xname-traversal
-batch-file-symlink
-chown
-chroot-alt-dest-inner-module
-chroot-copy-dest-inner-module
-chroot-link-dest-inner-module
-chroot-receiver-write-inner-module
-chroot-special-inner-module
-copy-dest-symlink-readleak
-copy-xattrs-symlink-race
-daemon-auth-group
-daemon-chroot-munge-default
-daemon-config-symlink
-daemon-module-chdir-symlink
-daemon-module-private-parent
-daemon-secrets-file-symlink
-daemon-stdin-local-socket             # Cygwin Python has no AF_UNIX socketpair
-daemon-stdin-unix-listener            # Cygwin cannot pass a named AF_UNIX listener as daemon stdin
-devices
-dir-sgid
-early-input-symlink
-excludefrom-symlink
-fake-super-acl-xattr
-fake-super-backup-fifo-regression
-files-from-leak
-filter-leak
-filter-merge-symlink
-insecure-links-admin-optout
-link-dest-symlink-enotsup                # the ENOTSUP hard-link hook is an LD_PRELOAD, Linux-only
-log-file-symlink
-msg-io-timeout-overflow
-nondaemon-symlink-race
-nonroot-restrictive-perms
-open-noatime
-operator-path-backup-rmdir
-operator-path-backup-symlink
-operator-path-insecure-links-daemon
-partial-protected-regular-retry-linux
-partial-protected-regular-retry-policy  # deterministic partial EACCES recovery uses dyld interposing
-password-file-symlink
-protected-regular
-pseudo-paths
-pseudo-paths-daemon
-read-batch-pipe
-rename-mixed-parent-transfer
-rrsync-sender-leaf-flip
-rrsync-sender-parent-pin
-rrsync-symlink
-rrsync-userns-procfs
-search-only-destination
-search-only-held-dirfd
-sender-remove-source-root-anchor
-simd-checksum
-source-change-size-continues
-symlink-dest-backupdir
-symlink-race-dest
-symlink-race-relative-dest
-symlink-unix-perms  # platform does not support changing symlink permissions
-temp-dir-symlink-injection
diff --git a/testsuite/skiplist/linux.txt b/testsuite/skiplist/linux.txt
deleted file mode 100644
index d9c543411..000000000
--- a/testsuite/skiplist/linux.txt
+++ /dev/null
@@ -1,11 +0,0 @@
-# Tests expected to SKIP.  One name per line, '#' starts a comment; the file
-# must stay sorted and duplicate-free (runtests.py enforces both).  Referenced
-# from a workflow as RSYNC_EXPECT_SKIPPED=@testsuite/skiplist/<file>[,@...].
-# See testsuite/skiplist/README.md.
-#
-# Linux-only additions to common.txt.
-
-crtimes  # Rsync is configured without crtimes support
-partial-protected-regular-retry-policy  # deterministic partial EACCES recovery uses dyld interposing
-readonly-partial-abort-mode-regression  # 
-symlink-unix-perms  # platform does not support changing symlink permissions
diff --git a/testsuite/skiplist/macos.txt b/testsuite/skiplist/macos.txt
deleted file mode 100644
index 7ba8d589d..000000000
--- a/testsuite/skiplist/macos.txt
+++ /dev/null
@@ -1,38 +0,0 @@
-# Tests expected to SKIP.  One name per line, '#' starts a comment; the file
-# must stay sorted and duplicate-free (runtests.py enforces both).  Referenced
-# from a workflow as RSYNC_EXPECT_SKIPPED=@testsuite/skiplist/<file>[,@...].
-# See testsuite/skiplist/README.md.
-#
-# macOS-only additions to common.txt.
-
-acl-symlink-race
-acls-default
-acls-depth
-acls-unpinnable
-backup-acl-xattr-cache
-backup-crossdev-copy
-chmod-temp-dir
-copy-xattrs-symlink-race
-daemon-auth-group
-dir-sgid
-fake-super-acl-xattr
-link-dest-symlink-enotsup                # the ENOTSUP hard-link hook is an LD_PRELOAD, Linux-only
-open-noatime
-partial-protected-regular-retry-linux
-preallocate
-protected-regular
-pseudo-paths  # Linux-only: procfs pseudo-paths
-pseudo-paths-daemon
-read-batch-pipe
-readonly-partial-abort-mode-regression  # 
-rrsync-sender-leaf-flip
-rrsync-sender-parent-pin
-rrsync-symlink
-rrsync-userns-procfs
-search-only-destination
-search-only-held-dirfd
-sender-remove-source-root-anchor
-simd-checksum
-source-change-size-continues
-sparse
-symlink-exclude-xattr
diff --git a/testsuite/skiplist/proto29.txt b/testsuite/skiplist/proto29.txt
deleted file mode 100644
index 9ce01019d..000000000
--- a/testsuite/skiplist/proto29.txt
+++ /dev/null
@@ -1,17 +0,0 @@
-# Tests expected to SKIP.  One name per line, '#' starts a comment; the file
-# must stay sorted and duplicate-free (runtests.py enforces both).  Referenced
-# from a workflow as RSYNC_EXPECT_SKIPPED=@testsuite/skiplist/<file>[,@...].
-# See testsuite/skiplist/README.md.
-#
-# Additions for a --protocol=29 run (make check29), on top of the platform
-# files.  These tests transfer something the 29 wire format cannot carry
-# (ACLs, xattrs) or drive a helper that speaks 30+, so they gate on the
-# protocol regardless of platform.
-
-acl-symlink-race  # ACL transfer requires protocol 30+ (negotiated 29)
-acls-unpinnable  # ACL transfer requires protocol 30+ (negotiated 29)
-daemon-copylinks-parent-target-regression  # the stdio_daemon client speaks protocol 30 (forced 29)
-partial-protected-regular-retry-linux  # one-inplace partial staging needs protocol >= 30 (forced 29)
-scanner-batch-flag-mismatch  # xattrs (-X) need protocol 30+
-symlink-exclude-xattr  # xattr (-X) transfer requires protocol 30+ (negotiated 29)
-write-touched-blocks  # logical-block statistics require protocol 33+ (forced 29)
diff --git a/testsuite/skiplist/proto30.txt b/testsuite/skiplist/proto30.txt
deleted file mode 100644
index f3575cfbe..000000000
--- a/testsuite/skiplist/proto30.txt
+++ /dev/null
@@ -1,9 +0,0 @@
-# Tests expected to SKIP.  One name per line, '#' starts a comment; the file
-# must stay sorted and duplicate-free (runtests.py enforces both).  Referenced
-# from a workflow as RSYNC_EXPECT_SKIPPED=@testsuite/skiplist/<file>[,@...].
-# See testsuite/skiplist/README.md.
-#
-# Additions for a --protocol=30 run (make check30), on top of the platform
-# files.
-
-write-touched-blocks  # logical-block statistics require protocol 33+ (forced 30)
diff --git a/testsuite/sparse_test.py b/testsuite/sparse_test.py
deleted file mode 100644
index 898ed8c96..000000000
--- a/testsuite/sparse_test.py
+++ /dev/null
@@ -1,59 +0,0 @@
-#!/usr/bin/env python3
-"""Coverage of -S (--sparse) at depth.
-
-A file with a large hole, several directory levels deep, should arrive sparse
-(its allocated blocks much smaller than its apparent size) and byte-identical
-when copied with -S.
-
-We do NOT assert the converse (that a plain copy fills the hole): whether a
-zero-run is stored as a hole when -S is absent is the filesystem's choice, not
-rsync's -- ZFS/APFS transparently sparsify zero blocks, so a --no-sparse copy
-can legitimately stay sparse there.
-"""
-
-import os
-
-from rsyncfns import (
-    FROMDIR, TODIR,
-    assert_same, makepath, rmtree, run_rsync, test_fail, test_skipped,
-)
-
-src = FROMDIR
-deep = os.path.join('d1', 'd2', 'd3', 'holey')
-SIZE = 4 * 1024 * 1024
-
-
-def make_sparse(path):
-    with open(path, 'wb') as f:
-        f.write(b'head')
-        f.seek(SIZE - 4)
-        f.write(b'tail')
-
-
-def allocated(path):
-    return os.stat(path).st_blocks * 512
-
-
-rmtree(src)
-rmtree(TODIR)
-makepath(src / 'd1' / 'd2' / 'd3')
-make_sparse(src / deep)
-
-# Confirm the source filesystem actually made a sparse file; otherwise the
-# whole premise (and any dest comparison) is meaningless here.
-if allocated(src / deep) >= SIZE:
-    test_skipped("source filesystem did not create a sparse file")
-
-# --- with -S the hole is preserved at the destination -----------------------
-run_rsync('-a', '-S', f'{src}/', f'{TODIR}/')
-assert_same(TODIR / deep, src / deep, label='-S content')
-if allocated(TODIR / deep) >= SIZE:
-    test_fail(f"-S did not preserve the hole at depth "
-              f"(allocated {allocated(TODIR / deep)} for a {SIZE}-byte file)")
-
-# --- a plain copy reproduces the content too (allocation is FS-defined) ------
-rmtree(TODIR)
-run_rsync('-a', '--no-sparse', f'{src}/', f'{TODIR}/')
-assert_same(TODIR / deep, src / deep, label='no-sparse content')
-
-print("sparse: -S preserves a deep hole; content correct with and without it")
diff --git a/testsuite/stdio_daemon.py b/testsuite/stdio_daemon.py
deleted file mode 100644
index d7258d94c..000000000
--- a/testsuite/stdio_daemon.py
+++ /dev/null
@@ -1,74 +0,0 @@
-"""Launch one rsync daemon session over a loopback TCP connection."""
-
-import socket
-import subprocess
-
-import rsync_proto as rp
-
-from rsyncfns import rsync_argv
-
-
-def _client_for_socket(sock, timeout=10):
-    client = object.__new__(rp.DaemonClient)
-    client.sock = sock
-    client.sock.settimeout(timeout)
-    client.protocol = rp.DEFAULT_PROTOCOL
-    client.compat_flags = None
-    client.seed = None
-    client.xfer_sum_len = 16
-    client._rbuf = b''
-    client._ndx_prev_positive = -1
-    client._ndx_prev_negative = 1
-    client._mux_in = b''
-    client._r_ndx_prev_positive = -1
-    client._r_ndx_prev_negative = 1
-    client.messages = []
-    return client
-
-
-def start_stdio_daemon(conf, timeout=10, env=None):
-    """Return ``(DaemonClient, Popen)`` for one daemon connection."""
-    listener = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
-    parent = None
-    try:
-        listener.bind(('127.0.0.1', 0))
-        listener.listen(1)
-        parent = socket.create_connection(listener.getsockname(), timeout)
-        child, _ = listener.accept()
-    except OSError:
-        if parent is not None:
-            parent.close()
-        raise
-    finally:
-        listener.close()
-    try:
-        proc = subprocess.Popen(
-            rsync_argv('--daemon', '--no-detach', f'--config={conf}'),
-            stdin=child.fileno(), stdout=child.fileno(),
-            stderr=subprocess.PIPE, close_fds=True, env=env,
-        )
-    except Exception:
-        parent.close()
-        child.close()
-        raise
-    child.close()
-    return _client_for_socket(parent, timeout), proc
-
-
-def finish_stdio_daemon(client, proc, timeout=5):
-    """Close a test session and return the daemon's stderr text."""
-    try:
-        client.drain(timeout=0.25)
-    except OSError:
-        pass
-    client.close()
-    try:
-        proc.wait(timeout=timeout)
-    except subprocess.TimeoutExpired:
-        proc.terminate()
-        try:
-            proc.wait(timeout=timeout)
-        except subprocess.TimeoutExpired:
-            proc.kill()
-            proc.wait(timeout=timeout)
-    return proc.stderr.read().decode('utf-8', 'replace') if proc.stderr else ''
diff --git a/testsuite/symlink-dest-backupdir_test.py b/testsuite/symlink-dest-backupdir_test.py
deleted file mode 100644
index 26ca00ca3..000000000
--- a/testsuite/symlink-dest-backupdir_test.py
+++ /dev/null
@@ -1,73 +0,0 @@
-#!/usr/bin/env python3
-# Destination config-path (--backup-dir) symlink confinement -- DETERMINISTIC.
-#
-# An attacker who controls a component of the destination plants a STATIC symlink
-# as the backup directory, pointing OUTSIDE the destination tree.  When the
-# receiver backs up files it is about to overwrite, a plain resolution writes
-# each backup through the symlink, outside the tree (root-owned writes to an
-# arbitrary location in the worst case).  The secure resolver must confine the
-# backup write beneath the destination.
-#
-# No race is needed: unlike the bare write path -- where rsync re-creates a
-# wrong-typed destination directory, normalising a flipped parent away -- the
-# --backup-dir path follows the planted symlink directly, so a static symlink
-# suffices.  (--temp-dir / --partial-dir do NOT work as escape vectors: rsync
-# normalises them the same way it does the destination directory, so this is the
-# one config-path that escapes deterministically.)  This complements the racy
-# source/chdir tests and nondaemon-symlink-race (a single-file --backup-dir case)
-# by confirming confinement across a small tree.
-
-import os
-import subprocess
-
-from rsyncfns import (
-    SCRATCHDIR, find_attacker_uid, rmtree, rsync_argv, test_fail, test_skipped,
-)
-
-# Operator paths follow a uid0/euid-owned symlink (the operator's own backup
-# dir) and refuse a foreign-owned one, so the escape vector is an ATTACKER-owned
-# backup-dir symlink with rsync run as root.
-if os.geteuid() != 0:
-    test_skipped("requires root to plant a backup-dir symlink owned by a non-self uid")
-ATT_UID = find_attacker_uid()
-if ATT_UID is None:
-    test_skipped("no untrusted-uid user available for cross-uid plant")
-
-
-NFILES = 8
-
-base = SCRATCHDIR / 'destbackup'
-src = base / 'src'
-dest = base / 'dest'
-outside = base / 'outside'
-
-rmtree(base)
-# A small set of files the transfer will overwrite (so each triggers a backup).
-# --backup-dir is resolved relative to the destination directory, so the planted
-# symlink and the transfer target are both at the dest top level.
-src.mkdir(parents=True)
-dest.mkdir(parents=True)
-for i in range(NFILES):
-    # Different sizes so the transfer actually overwrites (triggering a backup);
-    # equal-size content with matching mtimes would be skipped by the quick check.
-    (src / f'f{i}').write_text("NEW-PUSHED-CONTENT\n")
-    (dest / f'f{i}').write_text("OLD\n")
-outside.mkdir(parents=True)
-# Attacker-planted backup directory: a foreign-owned symlink pointing outside
-# the dest tree (owned by the attacker uid, not root/the operator).
-os.symlink('../outside', dest / 'bdir')
-os.lchown(dest / 'bdir', ATT_UID, ATT_UID)
-
-subprocess.run(
-    rsync_argv('-a', '--backup', '--backup-dir=bdir', f'{src}/', f'{dest}/'),
-    stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
-
-leaked = []
-for root, _dirs, files in os.walk(outside):
-    leaked += [os.path.join(root, f) for f in files]
-if leaked:
-    test_fail(
-        "backup escaped the destination tree via the planted --backup-dir "
-        f"symlink: {sorted(leaked)} were created outside the tree. The secure "
-        "resolver failed to confine the backup write.")
-# Nothing landed outside the tree -> the backup write was confined.
diff --git a/testsuite/symlink-exclude-chdir-alias_test.py b/testsuite/symlink-exclude-chdir-alias_test.py
deleted file mode 100644
index 6422a2ccf..000000000
--- a/testsuite/symlink-exclude-chdir-alias_test.py
+++ /dev/null
@@ -1,61 +0,0 @@
-#!/usr/bin/env python3
-# Daemon module-exclude under-block via an ALLOWED symlinked chdir whose logical
-# path then mislabels descendants.  (Probe for codex residual #2.)
-#
-# The module excludes a *nested* subtree: exclude = /public/secret/.  public/ is
-# NOT excluded, so an in-module symlink  blink2 -> public/  is followed when used
-# as the destination.  After that chdir the daemon's logical cwd is "blink2"
-# while the physical cwd is "public"; a file then pushed to "secret/x" lands in
-# public/secret/x -- the excluded subtree -- because the exclude check sees the
-# logical "blink2/secret", not the physical "public/secret".
-#
-# RED = under-block reproduces (the alias defeats the nested exclude).  Runs
-# unprivileged.
-import os
-import subprocess
-
-from rsyncfns import (
-    SCRATCHDIR, rmtree, rsync_argv, start_test_daemon, test_fail, write_daemon_conf,
-)
-
-DAEMON_PORT = 12982
-SECRET = "PROTECTED-IN-EXCLUDED-SUBTREE\n"
-
-base = SCRATCHDIR / 'symlink-exclude-chdir-alias'
-rmtree(base)
-base.mkdir()
-
-mod = base / 'mod'
-mod.mkdir()
-public = mod / 'public'                        # NOT excluded
-public.mkdir()
-secret = public / 'secret'                     # excluded: /public/secret/
-secret.mkdir()
-victim = secret / 'x'
-victim.write_text(SECRET)
-
-os.symlink('public/', mod / 'blink2')          # allowed symlink -> public/
-
-src = base / 'src'
-(src / 'secret').mkdir(parents=True)
-(src / 'secret' / 'x').write_text("NEW\n")
-
-conf = write_daemon_conf(
-    [('mod', {'path': str(mod), 'read only': 'no', 'exclude': '/public/secret/'})])
-url = start_test_daemon(conf, DAEMON_PORT)
-
-# Destination is the allowed symlink blink2 -> public; the pushed secret/x then
-# resolves to public/secret/x (excluded).
-subprocess.run(
-    rsync_argv('-a', '--keep-dirlinks', f'{src}/', f'{url}mod/blink2/'),
-    stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
-
-after = victim.read_text() if victim.exists() else None
-if after == SECRET:
-    test_fail(
-        "the daemon refused a symlinked-chdir push that stock rsync (3.2.7) "
-        f"follows: blink2/secret/x did not reach public/secret/ ({victim} is still "
-        f"{after!r}).  The exclude is name-based (the logical alias path), not the "
-        "physical target; it must not block this.")
-print("daemon exclude is name-based: a push via an allowed symlinked chdir reaches "
-      "the nested excluded subtree (3.2.7-equivalent)")
diff --git a/testsuite/symlink-exclude-component_test.py b/testsuite/symlink-exclude-component_test.py
deleted file mode 100644
index f0e5edab3..000000000
--- a/testsuite/symlink-exclude-component_test.py
+++ /dev/null
@@ -1,62 +0,0 @@
-#!/usr/bin/env python3
-# Daemon module-exclude bypass via an in-DESTINATION symlink that appears as a
-# PATH COMPONENT of a transferred file (not as the destination argument).
-# (Probe for the broader variant of the symlink-exclude finding.)
-#
-# The module excludes a subtree (exclude = /secret/) and already contains an
-# in-module, euid-owned symlink  blink -> secret/  plus a protected victim
-# secret/x.  A peer pushes a tree whose file list contains the path "blink/x".
-# With --keep-dirlinks the receiver treats the existing dest symlink "blink" as
-# the directory it points at and writes THROUGH it, so "blink/x" lands in the
-# excluded secret/x -- the per-file daemon filter only ever sees the logical
-# name "blink/x", never the physical "secret/x".
-#
-# RED here = the bypass reproduces (the broader, file-list-component variant is
-# exploitable). GREEN = rsync refuses it (e.g. replaces the symlink, or the
-# resolver's exclude check catches the physical target).  Runs unprivileged.
-import os
-import subprocess
-
-from rsyncfns import (
-    SCRATCHDIR, rmtree, rsync_argv, start_test_daemon, test_fail, write_daemon_conf,
-)
-
-DAEMON_PORT = 12978
-SECRET = "PROTECTED-IN-EXCLUDED-SUBTREE\n"
-
-base = SCRATCHDIR / 'symlink-exclude-component'
-rmtree(base)
-base.mkdir()
-
-mod = base / 'mod'
-mod.mkdir()
-secret = mod / 'secret'                       # excluded subtree
-secret.mkdir()
-victim = secret / 'x'
-victim.write_text(SECRET)                      # must not be clobbered
-
-blink = mod / 'blink'                          # in-module symlink -> excluded dir
-os.symlink('secret/', blink)
-
-src = base / 'src'
-(src / 'blink').mkdir(parents=True)            # file list will contain blink/ + blink/x
-(src / 'blink' / 'x').write_text("NEW\n")
-
-conf = write_daemon_conf(
-    [('mod', {'path': str(mod), 'read only': 'no', 'exclude': '/secret/'})])
-url = start_test_daemon(conf, DAEMON_PORT)
-
-# --keep-dirlinks: treat the dest symlink "blink" as the dir it points at.
-subprocess.run(
-    rsync_argv('-a', '--keep-dirlinks', f'{src}/', f'{url}mod/'),
-    stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
-
-after = victim.read_text() if victim.exists() else None
-if after == SECRET:
-    test_fail(
-        "the daemon refused a transferred path through an in-dest symlink that "
-        f"stock rsync (3.2.7) follows: {victim} is still {after!r}.  The daemon "
-        "filter is name-based (it sees the logical 'blink/x', not 'secret/x'); it "
-        "must not block this -- `munge symlinks` defends a writable module.")
-print("daemon exclude is name-based: a transferred path through an in-dest symlink "
-      "lands in the excluded subtree (3.2.7-equivalent)")
diff --git a/testsuite/symlink-exclude-deep_test.py b/testsuite/symlink-exclude-deep_test.py
deleted file mode 100644
index 928aeb35b..000000000
--- a/testsuite/symlink-exclude-deep_test.py
+++ /dev/null
@@ -1,64 +0,0 @@
-#!/usr/bin/env python3
-# Daemon module-exclude bypass via a DEEPER in-tree directory symlink (not the
-# destination argument).  (Probe for codex's "per-chdir physical tracking"
-# concern.)
-#
-# The module excludes a nested subtree exclude = /pub/secret/.  pub/ is NOT
-# excluded.  An in-module dir symlink  dir2 -> pub/  sits inside the dest tree
-# (a level below the dest root).  A peer pushes a tree whose file list contains
-# dir2/secret/x and runs with --keep-dirlinks, so the receiver follows dir2 into
-# pub while descending, then writes secret/x into pub/secret/x -- the excluded
-# subtree -- if the exclude is checked on the logical "dir2/secret" rather than
-# the physical "pub/secret".
-#
-# This differs from symlink-exclude-component (one level, leaf parent) and
-# symlink-exclude-chdir-alias (the symlink IS the dest arg): here the followed
-# symlink is a deeper subdirectory reached as the transfer descends.  RED here
-# means the held-dirfd seed alone is NOT enough and per-chdir physical tracking
-# is required.  Runs unprivileged.
-import os
-import subprocess
-
-from rsyncfns import (
-    SCRATCHDIR, rmtree, rsync_argv, start_test_daemon, test_fail, write_daemon_conf,
-)
-
-DAEMON_PORT = 12983
-SECRET = "PROTECTED-IN-EXCLUDED-SUBTREE\n"
-
-base = SCRATCHDIR / 'symlink-exclude-deep'
-rmtree(base)
-base.mkdir()
-
-mod = base / 'mod'
-mod.mkdir()
-pub = mod / 'pub'                              # NOT excluded
-pub.mkdir()
-secret = pub / 'secret'                        # excluded: /pub/secret/
-secret.mkdir()
-victim = secret / 'x'
-victim.write_text(SECRET)
-
-os.symlink('pub/', mod / 'dir2')               # in-tree dir symlink -> pub/
-
-src = base / 'src'
-(src / 'dir2' / 'secret').mkdir(parents=True)
-(src / 'dir2' / 'secret' / 'x').write_text("NEW\n")
-
-conf = write_daemon_conf(
-    [('mod', {'path': str(mod), 'read only': 'no', 'exclude': '/pub/secret/'})])
-url = start_test_daemon(conf, DAEMON_PORT)
-
-subprocess.run(
-    rsync_argv('-a', '--keep-dirlinks', f'{src}/', f'{url}mod/'),
-    stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
-
-after = victim.read_text() if victim.exists() else None
-if after == SECRET:
-    test_fail(
-        "the daemon refused a deeper in-tree dir symlink that stock rsync (3.2.7) "
-        f"follows: a push to dir2/secret/x did not reach pub/secret/ ({victim} is "
-        f"still {after!r}).  The exclude is name-based ('dir2/secret', not the "
-        "physical 'pub/secret'); it must not block this.")
-print("daemon exclude is name-based: a deeper in-tree dir symlink reaches the "
-      "nested excluded subtree (3.2.7-equivalent)")
diff --git a/testsuite/symlink-exclude-leaf_test.py b/testsuite/symlink-exclude-leaf_test.py
deleted file mode 100644
index 651883a2a..000000000
--- a/testsuite/symlink-exclude-leaf_test.py
+++ /dev/null
@@ -1,51 +0,0 @@
-#!/usr/bin/env python3
-# Daemon module-exclude bypass on an excluded LEAF (file) reached through an
-# in-tree directory symlink.  (Reported by codex.)
-#
-# Unlike the subtree cases, the exclude here names a single leaf: /pub/blocked.
-# pub/ itself is NOT excluded, so resolving the parent through the in-module
-# symlink  blink2 -> pub/  does not refuse it; only the final basename is
-# excluded.  A peer sends blink2/blocked under --keep-dirlinks: the held-dirfd
-# resolves the parent to pub and the leaf create/rename writes pub/blocked --
-# the excluded file -- because the leaf basename is never physically
-# exclude-checked.  Runs unprivileged.
-import os
-import subprocess
-
-from rsyncfns import (
-    SCRATCHDIR, rmtree, rsync_argv, start_test_daemon, test_fail, write_daemon_conf,
-)
-
-DAEMON_PORT = 12987
-
-base = SCRATCHDIR / 'symlink-exclude-leaf'
-rmtree(base)
-base.mkdir()
-
-mod = base / 'mod'
-mod.mkdir()
-pub = mod / 'pub'                              # NOT excluded
-pub.mkdir()
-os.symlink('pub/', mod / 'blink2')             # in-tree dir symlink -> pub/
-
-src = base / 'src'
-(src / 'blink2').mkdir(parents=True)
-(src / 'blink2' / 'blocked').write_text("SHOULD-NOT-LAND\n")
-
-conf = write_daemon_conf(
-    [('mod', {'path': str(mod), 'read only': 'no', 'exclude': '/pub/blocked'})])
-url = start_test_daemon(conf, DAEMON_PORT)
-
-subprocess.run(
-    rsync_argv('-a', '--keep-dirlinks', f'{src}/', f'{url}mod/'),
-    stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
-
-blocked = pub / 'blocked'
-if not blocked.exists():
-    test_fail(
-        "the daemon refused an excluded leaf that stock rsync (3.2.7) writes: "
-        f"{blocked} was not created through the in-tree symlink.  The exclude is "
-        "name-based (it sees 'blink2/blocked', not the physical 'pub/blocked'); it "
-        "must not block this.")
-print("daemon exclude is name-based: an excluded leaf reached through an in-tree "
-      "dir symlink is written (3.2.7-equivalent)")
diff --git a/testsuite/symlink-exclude-meta_test.py b/testsuite/symlink-exclude-meta_test.py
deleted file mode 100644
index 822cfd439..000000000
--- a/testsuite/symlink-exclude-meta_test.py
+++ /dev/null
@@ -1,57 +0,0 @@
-#!/usr/bin/env python3
-# Daemon module-exclude bypass: metadata write on a PRE-EXISTING excluded leaf
-# reached through an in-tree directory symlink.  (Reported by codex.)
-#
-# No create is needed: pub/blocked already exists and is excluded (/pub/blocked).
-# pub/ is not excluded, so resolving the parent through blink2 -> pub/ succeeds;
-# the generator can then stat the leaf through the held parent fd and push
-# metadata (chmod/chown/times) onto it via the held-dirfd metadata ops.  Those
-# must refuse an excluded physical leaf, or a peer can alter a file the module
-# does not serve.  Runs unprivileged (mtime is the observable a non-root peer can
-# drive).
-import os
-import subprocess
-import time
-
-from rsyncfns import (
-    SCRATCHDIR, rmtree, rsync_argv, start_test_daemon, test_fail, write_daemon_conf,
-)
-
-DAEMON_PORT = 12989
-
-base = SCRATCHDIR / 'symlink-exclude-meta'
-rmtree(base)
-base.mkdir()
-
-mod = base / 'mod'
-mod.mkdir()
-pub = mod / 'pub'                              # NOT excluded
-pub.mkdir()
-victim = pub / 'blocked'                       # excluded leaf, pre-exists
-victim.write_text("PROTECTED\n")
-old = 1_000_000_000
-os.utime(victim, (old, old))                   # known baseline mtime
-os.symlink('pub/', mod / 'blink2')             # in-tree dir symlink -> pub/
-
-src = base / 'src'
-(src / 'blink2').mkdir(parents=True)
-(src / 'blink2' / 'blocked').write_text("PROTECTED\n")   # same content: only meta differs
-new = old + 999_999
-os.utime(src / 'blink2' / 'blocked', (new, new))
-
-conf = write_daemon_conf(
-    [('mod', {'path': str(mod), 'read only': 'no', 'exclude': '/pub/blocked'})])
-url = start_test_daemon(conf, DAEMON_PORT)
-
-subprocess.run(
-    rsync_argv('-a', '--keep-dirlinks', f'{src}/', f'{url}mod/'),
-    stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
-
-if int(victim.stat().st_mtime) == old:
-    test_fail(
-        "the daemon refused a metadata write onto an excluded leaf that stock "
-        f"rsync (3.2.7) performs: {victim} mtime is still {old} (expected it to "
-        f"advance to {new}).  The exclude is name-based ('blink2/blocked', not the "
-        "physical 'pub/blocked'); it must not block this.")
-print("daemon exclude is name-based: metadata on an excluded leaf via an in-tree "
-      "symlink is written (3.2.7-equivalent)")
diff --git a/testsuite/symlink-exclude_test.py b/testsuite/symlink-exclude_test.py
deleted file mode 100644
index 6557b9670..000000000
--- a/testsuite/symlink-exclude_test.py
+++ /dev/null
@@ -1,54 +0,0 @@
-#!/usr/bin/env python3
-# The daemon exclude/filter is a NAME-based listing/tamper filter, not a
-# physical-path security boundary: a peer that pushes through an in-module symlink
-# whose own name is not excluded reaches the excluded target.  This is the
-# behaviour of stock rsync (verified against 3.2.7) and is documented in
-# rsyncd.conf(5) -- the symlink defense is `munge symlinks` (default on for a
-# writable non-chroot module), NOT the filter.  This test asserts that
-# 3.2.7-equivalent behaviour: the symlink IS followed.
-
-import os
-import subprocess
-
-from rsyncfns import (
-    SCRATCHDIR, rmtree, rsync_argv, start_test_daemon, test_fail, write_daemon_conf,
-)
-
-DAEMON_PORT = 12962
-
-base = SCRATCHDIR / 'symlink-exclude-daemon'
-rmtree(base)
-base.mkdir()
-
-mod = base / 'mod'
-mod.mkdir()
-
-secret = mod / 'secret'
-secret.mkdir(parents=True)
-victim = secret / 'f0'
-victim.write_text("OLD-EXCLUDED-CONTENT\n")
-src = mod / 'src'
-src.mkdir()
-(src / 'f0').write_text("NEW\n")
-
-blink = mod / 'blink'                        # in-module symlink -> excluded subtree
-os.symlink('secret/', blink)
-
-conf = write_daemon_conf(
-    [('mod', {'path': str(mod), 'read only': 'no', 'exclude': '/secret/'})])
-url = start_test_daemon(conf, DAEMON_PORT)
-
-# Push through the symlink whose own name ("blink") is not excluded.
-subprocess.run(
-    rsync_argv('-a', f'{src}/', f'{url}mod/blink/'),
-    stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
-
-after = victim.read_text() if victim.exists() else None
-if after != "NEW\n":
-    test_fail(
-        "the daemon refused a symlink that stock rsync (3.2.7) follows: "
-        f"{secret / 'f0'} is {after!r}, expected 'NEW\\n'.  The daemon exclude "
-        "filter is name-based, not a symlink boundary -- it must not block this "
-        "(use `munge symlinks` to defend a writable module).")
-print("daemon exclude is name-based: a symlink whose name is not excluded is "
-      "followed (3.2.7-equivalent)")
diff --git a/testsuite/symlink-race-source_test.py b/testsuite/symlink-race-source_test.py
deleted file mode 100644
index 7eba52a81..000000000
--- a/testsuite/symlink-race-source_test.py
+++ /dev/null
@@ -1,121 +0,0 @@
-#!/usr/bin/env python3
-# Source-tree parent-component symlink race (TOCTOU) -- scenarios 1 & 3.
-#
-# An unprivileged user who controls a subtree of the SOURCE races a parent
-# directory component between a real directory and a symlink pointing OUTSIDE the
-# source tree.  A higher-authority rsync (a root nightly backup, or a victim user
-# copying the attacker's tree) that saw the component as a directory at scan time
-# but follows the flipped symlink when it opens a file under it then reads a file
-# it should not and copies its contents into the output.
-#
-# This is the source-side counterpart of nondaemon-symlink-race, which uses
-# --backup-dir as a deterministic, race-free RECEIVER primitive.  The pure
-# source-read path has no operator-config component the attacker controls:
-# rsync's directory descent lstat()s every component with O_NOFOLLOW, so a STATIC
-# symlink parent is detected and copied as a symlink, never followed.  The escape
-# needs a genuine TOCTOU -- the component must be a directory when rsync scans it
-# (so its files enter the file list) and a symlink when rsync opens those files
-# -- so we run a flipping thread and retry for up to RACE_TIMEOUT seconds.
-#
-# Status: FIXED.  For default symlink handling the sender now opens each file's
-# content through the confined held-ancestor-dirfd stack anchored at the transfer
-# root, so a parent component flipped to a symlink->outside is refused.  The
-# symlink-following modes (-L/--copy-links/--copy-unsafe-links/-k) still follow,
-# and --insecure-links restores the legacy open.  The test asserts the secret
-# does NOT leak: a leak is a hard FAIL.
-
-import os
-import platform
-import subprocess
-import time
-
-from rsyncfns import (
-    SCRATCHDIR, race_budget, rmtree, rsync_argv, rsync_supports,
-    start_path_flipper, stop_flipper, test_fail, test_xfail,
-)
-
-_CYGWIN = platform.system().startswith('CYGWIN')
-
-SECRET = "OUTSIDE-SECRET-do-not-copy"
-NFILES = 64
-
-base = SCRATCHDIR / 'srcrace'
-src = base / 'src'
-outside = base / 'outside'
-dest = base / 'dest'
-
-rmtree(base)
-# The real-directory state of the flipping component, with in-tree dummy files.
-realsub = src / '.realsub'
-realsub.mkdir(parents=True)
-for i in range(NFILES):
-    (realsub / f'loot{i}').write_text("in-tree dummy\n")
-# The out-of-tree target the attacker wants rsync to read, under the same names.
-outside.mkdir(parents=True)
-for i in range(NFILES):
-    (outside / f'loot{i}').write_text(SECRET + "\n")
-# 'sub' starts as the real directory; 'evil' is the escaping symlink. The flipper
-# swaps them so 'sub' alternates directory <-> symlink->../outside.
-os.rename(realsub, src / 'sub')
-os.symlink('../outside', src / 'evil')
-dest.mkdir(parents=True)
-
-
-def leaked():
-    d = dest / 'sub'
-    if d.is_symlink() or not d.is_dir():
-        return False
-    for f in d.iterdir():
-        try:
-            if f.read_text().strip() == SECRET:
-                return True
-        except OSError:
-            pass
-    return False
-
-
-# --no-inc-recursive widens the TOCTOU window: rsync scans the whole tree
-# first (recording sub/ as a directory) and only then opens the files under
-# it, so the flipper has the entire read phase -- 64 separate opens of
-# sub/* -- to flip sub to a symlink. The disclosure exists with incremental
-# recursion too; this just makes the race reliably winnable within the
-# budget rather than depending on lucky scan/read interleaving.
-#
-# Pass the flag only when the rsync binary accepts it: implementations
-# without incremental recursion (gokrazy/rsync targets protocol 27, no
-# inc-recursive at all) reject --no-inc-recursive as an unknown option,
-# but they already default to the safer pre-inc-recursive behaviour.
-extra = ['--no-inc-recursive'] if rsync_supports('--no-inc-recursive') else []
-
-flip = start_path_flipper(src / 'sub', src / 'evil')
-won = False
-deadline = time.monotonic() + race_budget()
-try:
-    while time.monotonic() < deadline:
-        rmtree(dest)
-        dest.mkdir(parents=True)
-        subprocess.run(rsync_argv('-a', *extra, f'{src}/', f'{dest}/'),
-                       stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
-        if leaked():
-            won = True
-            break
-finally:
-    stop_flipper(flip)
-
-if won:
-    if _CYGWIN:
-        # Cygwin emulates symlinks as special files and its open()/path
-        # resolution does not enforce the per-component O_NOFOLLOW walk the
-        # confined sender open relies on, so the parent-flip leak is still
-        # observed here.  The native POSIX symlink-race tests are likewise not
-        # enforced on Cygwin (see cygwin-build.yml); track this as a documented
-        # Cygwin platform residual rather than a hard failure.
-        test_xfail(
-            f"cygwin: source-tree parent-flip race still leaks ({SECRET!r}); the "
-            "confined sender open is compiled in but Cygwin's symlink emulation "
-            "does not enforce it -- documented platform residual.")
-    test_fail(
-        f"source-tree TOCTOU: content from outside the source tree ({SECRET!r}) "
-        "was copied into the output -- the sender followed a parent-component "
-        "symlink it should have confined.")
-# No leak within the race budget -> the source-side resolution was confined.
diff --git a/testsuite/symlink-unix-perms_test.py b/testsuite/symlink-unix-perms_test.py
deleted file mode 100644
index 9827a6bf2..000000000
--- a/testsuite/symlink-unix-perms_test.py
+++ /dev/null
@@ -1,117 +0,0 @@
-#!/usr/bin/env python3
-
-import errno
-import os
-import stat
-import sys
-
-from rsyncfns import (
-    FROMDIR, SCRATCHDIR, TODIR,
-    assert_mode, rmtree, run_rsync, test_fail, test_skipped
-)
-
-#   Put some error messages into variable to make later code more readable.
-
-error = 'error occurred during test of symlink access change capability: '
-notimplemented = 'symlink Unix access change is not implemented on this system'
-notsupported = 'symlink Unix access change is not supported on this system'
-
-#   Make sure that the FROMDIR and TODIR directories exist. These are the
-#   source and destination directories, respectively, for the test.
-
-os.chdir(SCRATCHDIR)
-
-FROMDIR.mkdir(parents=True, exist_ok=True)
-TODIR.mkdir(parents=True, exist_ok=True)
-
-#   Create a test directory and a test file in FROMDIR for use later as symlink
-#   targets, saving the actual names of each in a variable that will also be
-#   used later.
-
-testdirectory = 'testdirectory'
-testfile = 'testfile'
-
-(FROMDIR / testdirectory).mkdir(parents=True)
-(FROMDIR / testfile).touch()
-
-#   See if the system permits setting Unix access permssions on symlinks.
-#   If not, there's no point in continuing.
-#
-#   To test this, the following code creates a symlink in FROMDIR that points
-#   to the test directory there. It then tries to change the Unix access
-#   permission for that symlink. If the result is a "not implemented" or a
-#   "not supported" error, the actual test is skipped. If any other error is
-#   returned, the test reports failure.
-
-os.chdir(FROMDIR)
-
-os.symlink(testdirectory, 'symlink', target_is_directory=True)
-
-try:
-    os.chmod('symlink', stat.S_IREAD + stat.S_IXOTH, follow_symlinks=False)
-
-except NotImplementedError:
-    test_skipped(notimplemented)
-
-except OSError as e:
-    if (e.errno == errno.ENOTSUP):
-        test_skipped(notsupported)
-    test_fail('OS' + error + f'{e}')
-
-except Exception as e:
-    test_fail(error + f'{e}')
-
-#   The symlink access change attempt reported success. Make sure that the
-#   Unix access permissions were actually changed. If not, the test fails.
-
-assert_mode('symlink', stat.S_IREAD + stat.S_IXOTH)
-
-#   The system can change symlink Unix access permissions. Continue ...
-
-os.remove('symlink')
-
-os.chdir(SCRATCHDIR)
-
-#   Create a number of symlinks to use for testing rsync.
-#
-#   Set the Unix access permissions for those symlinks to selected values.
-#   The selected values have no specific agenda. However, owner read access
-#   is always maintained to ensure that stat info is readable.
-
-#   The following array consists of a number of targets and associated Unix
-#   access permissions that will be used in the actual test. The symlink
-#   names will be of the form "symlink-{n}" where "{n}" is the array index
-#   for each symlink created.
-
-symlinks = [
-    [ testdirectory, 0o770 ],
-    [ testfile, 0o0444 ],
-    [ testfile, 0o0711 ],
-    [ testfile, 0o0777 ],
-    [ testdirectory, 0o7777 ],
-    [ testfile, 0o0400 ],
-    [ testdirectory, 0o1407 ],
-    [ testdirectory, 0o2470 ],
-    [ testdirectory, 0o4777 ],
-    [ testfile, 0o7777 ],
-]
-
-#   Actually create the test symlinks in the source directory.
-
-for n, symlink in enumerate(symlinks):
-    target, access = symlink
-
-    os.symlink(target, FROMDIR / f'symlink-{n}', target_is_directory=(target == testdirectory))
-    os.chmod(FROMDIR / f'symlink-{n}', access, follow_symlinks=False)
-
-#   Now, use rsync to copy the source directory to the destination.
-
-run_rsync('-av', f'{FROMDIR}/', f'{TODIR}/')
-
-#   Finally, check to make sure that the Unix access permissions on the
-#   symlinks in the destination match those in the source. The test fail
-#   if any one doesn't match.
-
-for n, symlink in enumerate(symlinks):
-    expected = stat.S_IMODE(os.stat(FROMDIR / f'symlink-{n}', follow_symlinks=False).st_mode)
-    assert_mode(TODIR / f'symlink-{n}', expected)
diff --git a/testsuite/temp-dir_test.py b/testsuite/temp-dir_test.py
deleted file mode 100644
index 63c37ea63..000000000
--- a/testsuite/temp-dir_test.py
+++ /dev/null
@@ -1,61 +0,0 @@
-#!/usr/bin/env python3
-"""Coverage of --temp-dir (-T) at depth and across directory boundaries.
-
---temp-dir tells the receiver to create its scratch/temp copies in DIR rather
-than in the destination directory, then rename the finished file into place.
-That rename crosses from the temp directory to a destination directory several
-levels deep -- exactly the two-directory operation the path-resolution
-restructure rewrites -- so it must be guarded at depth with the temp dir kept
-OUTSIDE the destination tree.
-
-Asserts:
-  * a transfer with --temp-dir pointing outside the dest tree reproduces the
-    source byte-for-byte at every level;
-  * no temp/scratch files are left behind in the temp dir or the dest tree;
-  * a non-existent --temp-dir makes the receiver fail (so we know the option
-    is actually consulted, not silently ignored).
-"""
-
-import os
-
-from rsyncfns import (
-    FROMDIR, SCRATCHDIR, TODIR,
-    assert_same, make_tree, rmtree, run_rsync, test_fail, walk_files,
-)
-
-src = FROMDIR
-tmp = SCRATCHDIR / 'scratch-temp'   # sibling of from/ and to/ -- outside both
-rmtree(src)
-rmtree(TODIR)
-rmtree(tmp)
-tmp.mkdir()
-
-make_tree(src, depth=3, data=True)
-rels = [p.relative_to(src) for p in walk_files(src)]
-
-# Transfer with the temp dir outside the destination tree.
-run_rsync('-a', f'--temp-dir={tmp}', f'{src}/', f'{TODIR}/')
-
-for rel in rels:
-    assert_same(TODIR / rel, src / rel, label=f'temp-dir {rel}')
-
-# The temp dir must be clean afterwards (every scratch file renamed away).
-leftover = sorted(p for p in tmp.rglob('*'))
-if leftover:
-    test_fail(f"--temp-dir left scratch files behind: {leftover}")
-
-# No stray rsync temp files (.name.XXXXXX) anywhere in the dest tree.
-strays = [p for p in TODIR.rglob('.*') if p.is_file()]
-if strays:
-    test_fail(f"dest tree contains stray temp files: {strays}")
-
-# Negative: a missing temp dir must cause a receiver failure, proving the
-# option is honoured rather than ignored.
-rmtree(TODIR)
-proc = run_rsync('-a', f'--temp-dir={SCRATCHDIR}/does-not-exist',
-                 f'{src}/', f'{TODIR}/', check=False)
-if proc.returncode == 0:
-    test_fail("--temp-dir pointing at a missing directory unexpectedly "
-              "succeeded")
-
-print("temp-dir: cross-dir rename at depth verified; missing temp dir fails")
diff --git a/testsuite/authenticate-no-ocloexec-build-regression_test.py b/testsuite/tests/build/authenticate-no-ocloexec-build.py
similarity index 68%
rename from testsuite/authenticate-no-ocloexec-build-regression_test.py
rename to testsuite/tests/build/authenticate-no-ocloexec-build.py
index 672fc9262..0bdae3d85 100644
--- a/testsuite/authenticate-no-ocloexec-build-regression_test.py
+++ b/testsuite/tests/build/authenticate-no-ocloexec-build.py
@@ -1,5 +1,4 @@
 #!/usr/bin/env python3
-"""authenticate.c must build on supported systems without O_CLOEXEC."""
 
 import os
 import shlex
@@ -7,18 +6,9 @@
 import subprocess
 from pathlib import Path
 
-from rsyncfns import SCRATCHDIR, rmtree, test_fail, test_skipped
-
+from harness.rsync import SCRATCHDIR, rmtree, test_fail, test_skipped
 
 def makefile_vars(repo, names):
-    """Read variables out of the tree's configured Makefile.
-
-    The probe has to compile the production translation unit the same way the
-    build does.  Where a dependency lives outside the default search path --
-    openssl from brew on macOS, say -- configure records that in CPPFLAGS, and
-    a probe that hard-codes its own include list fails to find <openssl/sha.h>
-    for reasons that have nothing to do with O_CLOEXEC.
-    """
     found = {}
     makefile = repo / "Makefile"
     if makefile.exists():
@@ -28,9 +18,7 @@ def makefile_vars(repo, names):
                     found[name] = line[len(name) + 1:].strip()
     return found
 
-
-repo = Path(os.environ.get(
-    "RSYNC_SOURCE_UNDER_TEST", Path(__file__).resolve().parent.parent))
+repo = Path(os.environ.get('RSYNC_SOURCE_UNDER_TEST', os.environ['srcdir']))
 source_path = repo / "authenticate.c"
 config_path = repo / "config.h"
 if not source_path.exists() or not config_path.exists():
@@ -38,7 +26,6 @@ def makefile_vars(repo, names):
 
 build_vars = makefile_vars(repo, ("CC", "CPPFLAGS"))
 
-
 def compiler():
     value = os.environ.get("CC") or build_vars.get("CC")
     if value:
@@ -49,17 +36,14 @@ def compiler():
             return [path]
     return None
 
-
 cc = compiler()
 if not cc:
     test_skipped("no C compiler available for the O_CLOEXEC feature probe")
 
-base = SCRATCHDIR / "authenticate-no-ocloexec-build-regression"
+base = SCRATCHDIR / 'authenticate-no-ocloexec-build'
 rmtree(base)
 base.mkdir(parents=True)
 
-# Model a libc that lacks O_CLOEXEC after all system headers have been read,
-# then compile the real production translation unit rather than a code model.
 source = source_path.read_text()
 needle = '#include "rsync.h"\n'
 if source.count(needle) != 1:
diff --git a/testsuite/git-set-file-times-python-compat-regression_test.py b/testsuite/tests/build/git-set-file-times-python-compat.py
similarity index 82%
rename from testsuite/git-set-file-times-python-compat-regression_test.py
rename to testsuite/tests/build/git-set-file-times-python-compat.py
index 1c70d480d..9d9590b4f 100644
--- a/testsuite/git-set-file-times-python-compat-regression_test.py
+++ b/testsuite/tests/build/git-set-file-times-python-compat.py
@@ -1,13 +1,11 @@
 #!/usr/bin/env python3
-"""The support utility must start on the suite's supported Python."""
 
 import os
 import subprocess
 import sys
 from pathlib import Path
 
-
-source_dir = Path(os.environ.get("srcdir", Path(__file__).resolve().parents[1]))
+source_dir = Path(os.environ['srcdir'])
 script = source_dir / "support" / "git-set-file-times"
 proc = subprocess.run(
     [sys.executable, str(script), "--help"],
diff --git a/testsuite/install-strip_test.py b/testsuite/tests/build/install-strip.py
similarity index 98%
rename from testsuite/install-strip_test.py
rename to testsuite/tests/build/install-strip.py
index e1b6c8e6f..592d654d7 100644
--- a/testsuite/install-strip_test.py
+++ b/testsuite/tests/build/install-strip.py
@@ -7,8 +7,7 @@
 import shutil
 import subprocess
 
-from rsyncfns import SCRATCHDIR, SRCDIR, TOOLDIR, test_fail
-
+from harness.rsync import SCRATCHDIR, SRCDIR, TOOLDIR, test_fail
 
 make_vars = {}
 for line in (TOOLDIR / 'Makefile').read_text().splitlines():
@@ -46,7 +45,6 @@
     if source.is_file():
         shutil.copy2(source, builddir / name)
 
-
 def expand_make_value(value):
     for _ in range(10):
         expanded = re.sub(
@@ -60,7 +58,6 @@ def expand_make_value(value):
         value = expanded
     test_fail(f'cannot expand Makefile value {value!r}')
 
-
 bindir = expand_make_value(make_vars.get('bindir', ''))
 if not bindir or '$' in bindir:
     test_fail(f'cannot determine configured bindir from {bindir!r}')
diff --git a/testsuite/tests/build/simd-checksum.py b/testsuite/tests/build/simd-checksum.py
new file mode 100644
index 000000000..37a980de8
--- /dev/null
+++ b/testsuite/tests/build/simd-checksum.py
@@ -0,0 +1,14 @@
+#!/usr/bin/env python3
+
+import os
+import subprocess
+
+from harness.rsync import TOOLDIR, test_fail, test_skipped
+
+simdtest = TOOLDIR / 'simdtest'
+if not (simdtest.is_file() and os.access(simdtest, os.X_OK)):
+    test_skipped("simdtest not built (SIMD not available)", capability='simd')
+
+proc = subprocess.run([str(simdtest)])
+if proc.returncode != 0:
+    test_fail(f"simdtest exited {proc.returncode}")
diff --git a/testsuite/tests/daemon/chroot-alt-dest-inner-module.py b/testsuite/tests/daemon/chroot-alt-dest-inner-module.py
new file mode 100644
index 000000000..7ab1ea420
--- /dev/null
+++ b/testsuite/tests/daemon/chroot-alt-dest-inner-module.py
@@ -0,0 +1,28 @@
+#!/usr/bin/env python3
+
+import os
+import shutil
+
+from harness.rsync import run_checked, setup_chroot_inner
+from harness.rsync import makepath, rsync_argv, test_fail
+
+for option in ('compare', 'copy', 'link'):
+    base, inner, outside, source, url = setup_chroot_inner(f'chroot-{option}-dest-inner')
+    makepath(inner / 'destination')
+    (source / 'file').write_text('source\n')
+    shutil.copy2(source / 'file', outside / 'file')
+    if option == 'copy':
+        (outside / 'file').write_text('escape\n')
+        mtime = (source / 'file').stat().st_mtime
+        os.utime(outside / 'file', (mtime, mtime))
+    _, output = run_checked(rsync_argv('-a', f'--{option}-dest=../linkparent',
+                                       f'{source}/', f'{url}mod/destination/'))
+    result = inner / 'destination' / 'file'
+    if not result.exists():
+        test_fail(f'{option}-dest suppressed destination creation:\n{output}')
+    if option == 'copy' and result.read_text() != 'source\n':
+        test_fail(f'copy-dest read an outside basis:\n{output}')
+    if option == 'link' and result.stat().st_ino == (outside / 'file').stat().st_ino:
+        test_fail(f'link-dest linked an outside basis:\n{output}')
+
+print('alternate destinations remain inside the chroot module')
diff --git a/testsuite/tests/daemon/chroot-basis-forge-inner-module.py b/testsuite/tests/daemon/chroot-basis-forge-inner-module.py
new file mode 100644
index 000000000..d4c523001
--- /dev/null
+++ b/testsuite/tests/daemon/chroot-basis-forge-inner-module.py
@@ -0,0 +1,73 @@
+#!/usr/bin/env python3
+
+import os
+import time
+
+from harness.rsync import (
+    SCRATCHDIR, claim_ports, get_rootuid, get_testuid, makepath, require_tcp,
+    rmtree, start_test_daemon, test_fail, test_skipped, write_daemon_conf,
+)
+from harness import protocol as rp
+
+PORT = 12973
+require_tcp("the pure-Python sender needs a real TCP daemon; run with --use-tcp")
+if get_testuid() != get_rootuid():
+    test_skipped("the /./ inner-module chroot regression requires root", capability='root')
+claim_ports(PORT)
+
+base = SCRATCHDIR / 'chroot-basis-forge'
+outer = base / 'outer'
+inner = outer / 'inner'
+outside = outer / 'outside'
+src = base / 'src'
+rmtree(base)
+makepath(inner, outside, src)
+os.symlink('../outside', inner / 'linkparent')
+
+BLK = 700
+SECRET = b'S' * BLK + b'Y'
+PUBLIC = b'A' * BLK
+SOURCE = b'A' * BLK + b'X'
+
+(outside / 'f').write_bytes(SECRET)
+(outside / 'dest').mkdir()
+(outside / 'dest' / 'f').write_bytes(SECRET)
+(src / 'f').write_bytes(SOURCE)
+(inner / 'dest').mkdir()
+(inner / 'dest' / 'f').write_bytes(PUBLIC)
+
+conf = write_daemon_conf([
+    ('mod', {'path': str(outer) + '/./inner', 'read only': 'no',
+             'use chroot': 'yes', 'munge symlinks': 'no'}),
+], name='chroot-basis-forge.conf')
+log = SCRATCHDIR / 'rsyncd.log'
+before = log.read_text(errors='replace') if log.exists() else ''
+start_test_daemon(conf, PORT)
+
+s = rp.DaemonSender('127.0.0.1', PORT)
+s.handshake('mod', ['--server', '-le.LsfxCIu', '--no-whole-file',
+                    '--compare-dest=../linkparent', '.', 'dest/'],
+            greeting_version=30)
+s.send_flat_flist([rp.FileEntry('f', mode=rp.S_IFREG | 0o644, length=len(SOURCE))])
+s.run_forged_transfer(rp.FNAMECMP_FUZZY + 1, b'f', literal_tail=b'X')
+s.drain(timeout=3.0)
+s.close()
+
+leaked = False
+for _ in range(50):
+    new = log.read_text(errors='replace')[len(before):]
+    if 'failed verification' in new:
+        leaked = True
+        break
+    time.sleep(0.1)
+
+if leaked:
+    new = log.read_text(errors='replace')[len(before):]
+    test_fail("receiver opened and read an outside-inner-module file as the delta "
+              "basis via a forged fnamecmp_type (the reconstruction failed the "
+              "whole-file checksum -- but the out-of-module read already "
+              "happened); secure_basis_open did not confine the /./ chroot.\n"
+              + new)
+
+print("chroot-basis-forge-inner-module: a forged alt-dest basis index cannot "
+      "open a file outside the inner module")
diff --git a/testsuite/chroot-receiver-write-inner-module_test.py b/testsuite/tests/daemon/chroot-receiver-write-inner-module.py
similarity index 80%
rename from testsuite/chroot-receiver-write-inner-module_test.py
rename to testsuite/tests/daemon/chroot-receiver-write-inner-module.py
index cb5cc14d0..36cb1c119 100644
--- a/testsuite/chroot-receiver-write-inner-module_test.py
+++ b/testsuite/tests/daemon/chroot-receiver-write-inner-module.py
@@ -1,6 +1,7 @@
 #!/usr/bin/env python3
-from rsyncfns import run_checked, setup_chroot_inner
-from rsyncfns import rsync_argv, test_fail
+
+from harness.rsync import run_checked, setup_chroot_inner
+from harness.rsync import rsync_argv, test_fail
 
 base, inner, outside, src, url = setup_chroot_inner('chroot-write-inner')
 (src / 'pwn').write_text('payload\n')
diff --git a/testsuite/chroot-special-inner-module_test.py b/testsuite/tests/daemon/chroot-special-inner-module.py
similarity index 81%
rename from testsuite/chroot-special-inner-module_test.py
rename to testsuite/tests/daemon/chroot-special-inner-module.py
index ab5ea4ad9..2873bca7a 100644
--- a/testsuite/chroot-special-inner-module_test.py
+++ b/testsuite/tests/daemon/chroot-special-inner-module.py
@@ -1,8 +1,9 @@
 #!/usr/bin/env python3
+
 import os
 
-from rsyncfns import run_checked, setup_chroot_inner
-from rsyncfns import rsync_argv, test_fail
+from harness.rsync import run_checked, setup_chroot_inner
+from harness.rsync import rsync_argv, test_fail
 
 base, inner, outside, src, url = setup_chroot_inner('chroot-special-inner')
 os.symlink('target', src / 'link')
diff --git a/testsuite/connect-prog-host-quoting_test.py b/testsuite/tests/daemon/connect-prog-host-quoting.py
similarity index 91%
rename from testsuite/connect-prog-host-quoting_test.py
rename to testsuite/tests/daemon/connect-prog-host-quoting.py
index 47c791c2c..51a0c7a4d 100644
--- a/testsuite/connect-prog-host-quoting_test.py
+++ b/testsuite/tests/daemon/connect-prog-host-quoting.py
@@ -1,8 +1,9 @@
 #!/usr/bin/env python3
+
 import os
 import subprocess
 
-from rsyncfns import SCRATCHDIR, rmtree, rsync_argv, test_fail, test_skipped
+from harness.rsync import SCRATCHDIR, rmtree, rsync_argv, test_fail, test_skipped
 
 base = SCRATCHDIR / 'connect-prog-quote'
 rmtree(base)
diff --git a/testsuite/connect-prog-nested-singlequote-host-injection_test.py b/testsuite/tests/daemon/connect-prog-nested-singlequote-host-injection.py
old mode 100755
new mode 100644
similarity index 59%
rename from testsuite/connect-prog-nested-singlequote-host-injection_test.py
rename to testsuite/tests/daemon/connect-prog-nested-singlequote-host-injection.py
index 86275ae13..b2701d6b9
--- a/testsuite/connect-prog-nested-singlequote-host-injection_test.py
+++ b/testsuite/tests/daemon/connect-prog-nested-singlequote-host-injection.py
@@ -1,24 +1,10 @@
 #!/usr/bin/env python3
-"""RSYNC_CONNECT_PROG host quoting composes unsafely with single quotes.
-
-%H is substituted into a command string that a shell runs; a program of the
-form `sh -c '... %H ...'` re-parses the word in a NESTED shell, where the
-quoting rsync added has already been consumed by the outer one.  A host of
-`localhost;touch$IFS<marker>;#` therefore executes in the inner shell.
-
-Asserting only that the marker is absent is not enough: it is equally absent
-when rsync failed to parse its arguments, when socketpair_tcp is blocked in the
-environment, or when `touch` could not be found.  Each refusal below is checked
-by its specific message, and the accepted-host cases prove the allow-list has
-not simply refused everything -- which would satisfy an absence-only test
-perfectly.
-"""
 
 import os
 import shlex
 import subprocess
 
-from rsyncfns import SCRATCHDIR, rmtree, rsync_argv, test_fail, test_skipped
+from harness.rsync import SCRATCHDIR, rmtree, rsync_argv, test_fail, test_skipped
 
 REFUSAL = 'unsafe host characters for RSYNC_CONNECT_PROG'
 
@@ -26,31 +12,19 @@
 rmtree(base)
 base.mkdir(parents=True)
 
-# Records what %H expanded to, so an accepted host is checked for real rather
-# than inferred from the transfer having failed for some other reason.
 seen = base / 'seen'
 probe = base / 'probe.sh'
-# Records and exits: anything that keeps reading stdin would hang the
-# transfer until the harness timeout instead of failing fast.
 probe.write_text(f'#!/bin/sh\nprintf %s "$1" > {shlex.quote(str(seen))}\n')
 probe.chmod(0o755)
 
-
 def run(host, prog):
     env = os.environ.copy()
     env['RSYNC_CONNECT_PROG'] = prog
-    # cwd=base so a bare marker name in the payload lands in the scratch dir.
-    # It has to be bare: a URL authority ends at the first '/', so an absolute
-    # path never reaches the shell at all -- the injected `touch` would run
-    # with no operand and could not create anything, which would make the
-    # marker check below unfalsifiable.
     return subprocess.run(
         rsync_argv(f'rsync://{host}/m/', str(base / 'out')),
         stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True, env=env,
         cwd=str(base))
 
-
-# --- the injection itself --------------------------------------------------
 marker = base / 'pwned'
 proc = run('localhost;touch${IFS}pwned;#', "sh -c 'printf %H >/dev/null'")
 if 'socketpair_tcp failed' in proc.stdout:
@@ -65,9 +39,6 @@ def run(host, prog):
               'something else stopped the transfer, so this check would pass '
               f'with the guard removed: {proc.stdout!r}')
 
-# --- first characters that change an argument's meaning --------------------
-# Quoting keeps these as a single word but cannot stop '-' looking like an
-# option to the named program, nor '~' being tilde-expanded by the nested shell.
 for host, why in (('-c', "looks like an option to the connect program"),
                   ('+x', "looks like an option too: `sh +x` is as real as `sh -x`"),
                   ('~root', "is tilde-expanded by the nested shell"),
@@ -80,10 +51,6 @@ def run(host, prog):
         test_fail(f'host {host!r} was accepted, and it {why}; '
                   f'the connect program received {got!r}')
 
-# --- hosts that must still work -------------------------------------------
-# RSYNC_CONNECT_PROG exists for custom transports, so %H is not always a name
-# the resolver ever sees.  Without these, an allow-list that refused far too
-# much would still look perfect above.
 for host, expect in (('example.com', 'example.com'),
                      ('example.com.', 'example.com.'),
                      ('host_name', 'host_name'),
diff --git a/testsuite/daemon-access-idn_test.py b/testsuite/tests/daemon/daemon-access-idn.py
old mode 100755
new mode 100644
similarity index 55%
rename from testsuite/daemon-access-idn_test.py
rename to testsuite/tests/daemon/daemon-access-idn.py
index 05fea678a..2b69cca71
--- a/testsuite/daemon-access-idn_test.py
+++ b/testsuite/tests/daemon/daemon-access-idn.py
@@ -1,28 +1,10 @@
 #!/usr/bin/env python3
-"""Daemon coverage: IDN hosts allow / hosts deny matching (access.c).
-
-A daemon gets its peer's name from DNS as ASCII, so an rsyncd.conf entry
-written with non-ASCII characters is folded to its IDNA A-label form before
-being matched.  The IDNA mapping also folds some non-ASCII characters onto
-ASCII ones (U+FF0A FULLWIDTH ASTERISK becomes '*'), so the checks below cover
-both directions: a Unicode name that has to match, and the tokens that must
-stay denied rather than turn into a wildcard or an address/mask.  Punycode,
-mixed case and an unconvertible name are covered too.
-
-The peer name isn't assumed: a throwaway daemon comes up first to log the name
-this host's resolver gives it, and the real config is written around that.
-"forward lookup" is off throughout, which pins the match on the reverse-DNS
-name and keeps a denied module from waiting out a resolver timeout on a name
-that deliberately doesn't exist.
-
-Like daemon-access-ip_test.py this needs a real TCP peer (--use-tcp), and the
-config sets no global hosts allow so each module's own patterns decide.
-"""
 
 import re
 import subprocess
 
-from rsyncfns import (
+from harness.daemon import probe_module
+from harness.rsync import (
     FROMDIR, SCRATCHDIR,
     claim_ports, make_tree, require_tcp, rmtree, rsync_argv, start_rsyncd,
     start_test_daemon, test_fail, test_skipped,
@@ -34,16 +16,14 @@
 
 if '"IDN": true' not in subprocess.run(rsync_argv('-VV'), capture_output=True,
                                        text=True).stdout:
-    test_skipped("rsync built without IDN support")
+    test_skipped("rsync built without IDN support", capability='idn')
 
 src = FROMDIR
 rmtree(src)
 make_tree(src, depth=2)
 
-
 def write_conf(path, modules, log, pidfile):
     lines = [
-        '# autogenerated by daemon-access-idn_test.py',
         f'pid file = {pidfile}',
         'use chroot = no',
         'forward lookup = no',
@@ -56,14 +36,9 @@ def write_conf(path, modules, log, pidfile):
         lines.append('\tread only = yes')
         lines += [f'\t{k} = {v}' for k, v in params.items()]
         lines.append('')
-    # rsyncd.conf is read as UTF-8 by the daemon whatever the test's locale is.
     path.write_text('\n'.join(lines) + '\n', encoding='utf-8')
     return path
 
-
-# --- find out what this host's resolver calls the loopback peer -------------
-# A throwaway daemon with one wide-open module: connect once, read the name it
-# logged for us, then shut it down before the real config goes up.
 probe_log = SCRATCHDIR / 'rsyncd-idn-probe.log'
 probe_conf = write_conf(SCRATCHDIR / 'access-idn-probe.conf', [('probe', {})],
                         probe_log, SCRATCHDIR / 'rsyncd-idn-probe.pid')
@@ -82,51 +57,30 @@ def write_conf(path, modules, log, pidfile):
 peer = m.group(1)
 print(f"daemon sees its peer as {peer!r}")
 
-
 def fullwidth(name):
-    """The fullwidth-forms spelling of an ASCII name.
-
-    IDNA (UTS #46) maps U+FF01..U+FF5E back onto ASCII, so this gives us a
-    genuinely non-ASCII name that folds to a peer name we can predict without
-    controlling DNS.  Label separators stay ASCII dots.
-    """
     return ''.join(chr(ord(c) - 0x21 + 0xFF01) if '!' <= c <= '~' and c != '.'
                    else c for c in name)
 
-
 if fullwidth(peer) == peer:
     test_skipped(f"peer name {peer!r} has no ASCII to respell in fullwidth")
 
-ZWSP = '​'         # maps to nothing, leaving no label at all
-FW_STAR = '＊'      # FULLWIDTH ASTERISK, which IDNA maps to '*'
-FW_SLASH = '／'     # FULLWIDTH SOLIDUS, which IDNA maps to '/'
+ZWSP = '​'
+FW_STAR = '＊'
+FW_SLASH = '／'
 
 modules = [
     ('ascii-name',    {'hosts allow': peer}),
     ('ascii-upper',   {'hosts allow': peer.upper()}),
     ('ascii-wild',    {'hosts allow': peer[:1] + '*'}),
-    # The same name in fullwidth forms, which only matches once the token has
-    # been folded to A-labels.
     ('idn-name',      {'hosts allow': fullwidth(peer)}),
     ('idn-mixedcase', {'hosts allow': fullwidth(peer.upper())}),
     ('idn-deny',      {'hosts deny': fullwidth(peer)}),
-    # A real IDN that is not the peer, plus its punycode spelling: both must
-    # stay denied, and neither may be mistaken for a wildcard.
     ('idn-other',     {'hosts allow': 'čičku.example'}),
     ('idn-puny',      {'hosts allow': 'xn--iku-eqab.example'}),
-    # idn-other's token respelled with combining carons: an equivalent name
-    # under Unicode, so it has to be treated the same way.  (A decomposed
-    # token that *matches* isn't constructible here -- the peer name comes
-    # from DNS and is ASCII -- so idn_test checks the two spellings convert
-    # alike, and this checks the daemon agrees they don't match.)
     ('idn-nfd',       {'hosts allow': 'c\u030ci' 'c\u030cku.example'}),
-    # Tokens whose IDNA mapping yields ASCII the author never wrote.  Left
-    # unconverted they match nothing; converted blindly, the first two would
-    # allow every host and the third would read as an address/mask.
     ('wide-star',     {'hosts allow': FW_STAR}),
     ('wide-star-dom', {'hosts allow': FW_STAR + '.example'}),
     ('wide-mask',     {'hosts allow': '127.0.0.0' + FW_SLASH + '8'}),
-    # An IDN that can't be converted at all (its label maps to nothing).
     ('bad-idn',       {'hosts allow': ZWSP + '.example'}),
 ]
 
@@ -134,24 +88,14 @@ def fullwidth(name):
                   SCRATCHDIR / 'rsyncd.log', SCRATCHDIR / 'rsyncd.pid')
 url = start_test_daemon(conf, DAEMON_PORT)
 
-
-def connect(mod):
-    """Return rsync's exit code for listing the module over the daemon."""
-    return subprocess.run(rsync_argv('-r', f'{url}{mod}/'),
-                          stdout=subprocess.DEVNULL, stderr=subprocess.PIPE,
-                          text=True).returncode
-
-
 def allowed(mod, why):
-    if connect(mod) != 0:
+    if probe_module(url, mod) != 0:
         test_fail(f"connection to {mod} should be ALLOWED ({why}) but was refused")
 
-
 def denied(mod, why):
-    if connect(mod) == 0:
+    if probe_module(url, mod) == 0:
         test_fail(f"connection to {mod} should be DENIED ({why}) but succeeded")
 
-
 allowed('ascii-name', "the peer's own name in a hosts allow")
 allowed('ascii-upper', "hostname matching is case-insensitive")
 allowed('ascii-wild', "an ASCII wildcard still matches")
diff --git a/testsuite/daemon-access-ip_test.py b/testsuite/tests/daemon/daemon-access-ip.py
similarity index 56%
rename from testsuite/daemon-access-ip_test.py
rename to testsuite/tests/daemon/daemon-access-ip.py
index 52d616637..dab647a8c 100644
--- a/testsuite/daemon-access-ip_test.py
+++ b/testsuite/tests/daemon/daemon-access-ip.py
@@ -1,20 +1,9 @@
 #!/usr/bin/env python3
-"""Daemon coverage: hosts allow / hosts deny IP and CIDR matching (access.c).
-
-access.c's make_mask / match_address / match_binary only run for a real TCP
-peer matched against a numeric hosts allow/deny pattern -- so this needs
---use-tcp (the loopback peer is 127.0.0.1). Verifies that exact-IP and CIDR
-allow patterns permit the connection while a CIDR deny / a non-matching allow
-refuse it.
-
-The config sets NO global hosts allow: an inherited global allow-list would
-match (e.g. via "localhost") and short-circuit before a module's deny is
-consulted, so the per-module patterns must be the sole decider here.
-"""
 
 import subprocess
 
-from rsyncfns import (
+from harness.daemon import probe_module
+from harness.rsync import (
     FROMDIR, SCRATCHDIR,
     make_tree, require_tcp, rmtree, rsync_argv, start_test_daemon, test_fail,
 )
@@ -38,23 +27,13 @@
 )
 url = start_test_daemon(conf, DAEMON_PORT)
 
-
-def connect(mod):
-    """Return rsync's exit code for listing the module over the daemon."""
-    return subprocess.run(rsync_argv('-r', f'{url}{mod}/'),
-                          stdout=subprocess.DEVNULL, stderr=subprocess.PIPE,
-                          text=True).returncode
-
-
 for mod in ('allow-exact', 'allow-cidr'):
-    if connect(mod) != 0:
+    if probe_module(url, mod) != 0:
         test_fail(f"connection to {mod} should be ALLOWED but was refused")
 for mod in ('deny-cidr', 'allow-other'):
-    if connect(mod) == 0:
+    if probe_module(url, mod) == 0:
         test_fail(f"connection to {mod} should be DENIED but succeeded")
 
-# Client --address binds the outgoing socket to a local address (socket.c
-# try_bind_local) before connecting to the daemon.
 proc = subprocess.run(
     rsync_argv('-r', '--address=127.0.0.1', f'{url}allow-cidr/'),
     stdout=subprocess.DEVNULL, stderr=subprocess.PIPE, text=True)
diff --git a/testsuite/daemon-access_test.py b/testsuite/tests/daemon/daemon-access.py
similarity index 74%
rename from testsuite/daemon-access_test.py
rename to testsuite/tests/daemon/daemon-access.py
index fe07a4936..524acdef9 100644
--- a/testsuite/daemon-access_test.py
+++ b/testsuite/tests/daemon/daemon-access.py
@@ -1,18 +1,15 @@
 #!/usr/bin/env python3
-"""Daemon coverage: module path, read only, write only, list.
-
-Drives a loopback daemon (secure stdio-pipe transport by default) and checks
-the access-control parameters, transferring a >=3-deep tree through each module
-and pulling a deep sub-path to exercise in-module path resolution.
-"""
 
 import subprocess
 
-from rsyncfns import (
+from harness.rsync import (
     FROMDIR, SCRATCHDIR, TODIR,
     assert_same, make_tree, makepath, rmtree, rsync_argv, run_rsync,
     start_test_daemon, test_fail, verify_dirs, walk_files, write_daemon_conf,
 )
+from harness import metadata
+
+metadata(features={'daemon'}, transports={'pipe', 'tcp'}, min_peer='2.6.0', mutates={'filesystem', 'process', 'socket'}, tags={'daemon', 'transfer', 'version-mix'})
 
 DAEMON_PORT = 12886
 
@@ -35,7 +32,6 @@
 ])
 url = start_test_daemon(conf, DAEMON_PORT)
 
-
 def fails(args, what):
     proc = subprocess.run(rsync_argv(*args),
                           stdout=subprocess.DEVNULL, stderr=subprocess.PIPE,
@@ -44,28 +40,22 @@ def fails(args, what):
         test_fail(f"{what} unexpectedly succeeded")
     return proc.stderr
 
-
-# --- read only module: pull works (deep), push refused ----------------------
-run_rsync('-a', f'{url}ro/', f'{pulld}/', check=False)   # codes 0/23 ok
+run_rsync('-a', f'{url}ro/', f'{pulld}/', check=False)
 for rel in rels:
     assert_same(pulld / rel, src / rel, label=f'pull ro {rel}')
-# deep sub-path pull
 rmtree(pulld)
 makepath(pulld)
 run_rsync('-a', f'{url}ro/d1/d2/', f'{pulld}/', check=False)
 assert_same(pulld / 'f2', src / 'd1' / 'd2' / 'f2', label='deep sub-path pull')
 fails(['-a', f'{src}/', f'{url}ro/'], "push to a read-only module")
 
-# --- read/write module: push works at depth ---------------------------------
 run_rsync('-a', f'{src}/', f'{url}rw/', check=False)
 verify_dirs(src, rwdir, label="push to rw module")
 
-# --- write only module: push works, pull refused ----------------------------
 run_rsync('-a', f'{src}/', f'{url}wo/', check=False)
 verify_dirs(src, wodir, label="push to wo module")
 fails(['-a', f'{url}wo/', f'{pulld}/'], "pull from a write-only module")
 
-# --- list: hidden module absent from the listing, ro/rw/wo present ----------
 proc = subprocess.run(rsync_argv(url), capture_output=True, text=True)
 listing = proc.stdout
 for m in ('ro', 'rw', 'wo'):
@@ -73,7 +63,6 @@ def fails(args, what):
         test_fail(f"module {m} missing from the daemon listing:\n{listing}")
 if 'hidden' in listing:
     test_fail(f"list=no module leaked into the listing:\n{listing}")
-# ...but the hidden module is still usable by name.
 rmtree(pulld)
 makepath(pulld)
 run_rsync('-a', f'{url}hidden/f0', f'{pulld}/', check=False)
diff --git a/testsuite/tests/daemon/daemon-address-family.py b/testsuite/tests/daemon/daemon-address-family.py
new file mode 100644
index 000000000..1c11d5b09
--- /dev/null
+++ b/testsuite/tests/daemon/daemon-address-family.py
@@ -0,0 +1,53 @@
+#!/usr/bin/env python3
+
+import socket
+
+from harness.rsync import (
+    FROMDIR, RSYNC, SCRATCHDIR, claim_ports, make_tree, rmtree, run_rsync,
+    start_rsyncd, write_daemon_conf,
+)
+
+PORT4 = 13020
+PORT6 = 13021
+claim_ports(PORT4, PORT6)
+
+rmtree(FROMDIR)
+make_tree(FROMDIR, depth=1)
+modules = [('module', {'path': str(FROMDIR), 'read only': 'yes'})]
+conf4 = write_daemon_conf(
+    modules,
+    globals={
+        'pid file': str(SCRATCHDIR / 'rsyncd-v4.pid'),
+        'log file': str(SCRATCHDIR / 'rsyncd-v4.log'),
+        'hosts allow': '127.0.0.0/8',
+    },
+    name='address-family-v4.conf',
+)
+conf6 = write_daemon_conf(
+    modules,
+    globals={
+        'pid file': str(SCRATCHDIR / 'rsyncd-v6.pid'),
+        'log file': str(SCRATCHDIR / 'rsyncd-v6.log'),
+        'hosts allow': '::1',
+    },
+    name='address-family-v6.conf',
+)
+
+start_rsyncd(conf4, PORT4, rsync_cmd=RSYNC, address='127.0.0.1')
+run_rsync('-4', '--list-only', f'rsync://127.0.0.1:{PORT4}/module/')
+
+ipv6_tested = False
+if socket.has_ipv6:
+    try:
+        with socket.socket(socket.AF_INET6, socket.SOCK_STREAM) as probe:
+            probe.setsockopt(socket.IPPROTO_IPV6, socket.IPV6_V6ONLY, 1)
+            probe.bind(('::1', 0))
+    except OSError as error:
+        print(f'IPv6 loopback is unavailable: {error}')
+    else:
+        start_rsyncd(conf6, PORT6, rsync_cmd=RSYNC, address='::1')
+        run_rsync('-6', '--list-only', f'rsync://[::1]:{PORT6}/module/')
+        ipv6_tested = True
+
+print('explicit IPv4 daemon connection succeeded' +
+      ('; explicit IPv6 daemon connection succeeded' if ipv6_tested else ''))
diff --git a/testsuite/daemon-argv-limit_test.py b/testsuite/tests/daemon/daemon-argv-limit.py
similarity index 68%
rename from testsuite/daemon-argv-limit_test.py
rename to testsuite/tests/daemon/daemon-argv-limit.py
index 58e1ad615..4858352fa 100644
--- a/testsuite/daemon-argv-limit_test.py
+++ b/testsuite/tests/daemon/daemon-argv-limit.py
@@ -1,7 +1,9 @@
 #!/usr/bin/env python3
+
 import socket
+import time
 
-from rsyncfns import SCRATCHDIR, claim_ports, require_tcp, start_rsyncd, test_fail
+from harness.rsync import SCRATCHDIR, claim_ports, require_tcp, start_rsyncd, test_fail
 
 PORT = 12934
 require_tcp("raw malicious daemon client needs a real TCP daemon; run with --use-tcp")
@@ -23,6 +25,7 @@
 start_rsyncd(conf, PORT)
 
 with socket.create_connection(('127.0.0.1', PORT), timeout=5) as s:
+    s.settimeout(30)
     greeting = s.recv(4096)
     if not greeting.startswith(b'@RSYNCD:'):
         test_fail(f"unexpected daemon greeting: {greeting!r}")
@@ -35,12 +38,18 @@
     payload = b''.join(b'a%05d\0' % i for i in range(17000)) + b'\0'
     s.sendall(payload)
     try:
-        s.recv(4096)
-    except (ConnectionResetError, BrokenPipeError):
+        s.shutdown(socket.SHUT_WR)
+    except OSError:
         pass
 
-text = log.read_text(errors='replace')
-if 'too many daemon arguments' not in text:
-    test_fail("daemon did not reject the malicious client's oversized argv list")
+deadline = time.monotonic() + 30
+while time.monotonic() < deadline:
+    if log.exists() and 'too many daemon arguments' in log.read_text(errors='replace'):
+        break
+    time.sleep(0.05)
+else:
+    text = log.read_text(errors='replace') if log.exists() else ''
+    test_fail("daemon did not reject the malicious client's oversized argv "
+              f"list. Daemon log:\n{text}")
 
 print("daemon-argv-limit: malicious client argv flood is rejected")
diff --git a/testsuite/daemon-auth-digest-floor_test.py b/testsuite/tests/daemon/daemon-auth-digest-floor.py
similarity index 60%
rename from testsuite/daemon-auth-digest-floor_test.py
rename to testsuite/tests/daemon/daemon-auth-digest-floor.py
index a8c4111b2..e537a0206 100644
--- a/testsuite/daemon-auth-digest-floor_test.py
+++ b/testsuite/tests/daemon/daemon-auth-digest-floor.py
@@ -1,32 +1,9 @@
 #!/usr/bin/env python3
-"""Daemon 'auth digest' floor: refuse an auth digest weaker than a configured minimum.
-
-The daemon picks the auth challenge-response digest from the client's
-negotiation, or -- for a peer that sends no digest list (any rsync older than
-3.2.0, e.g. the macOS openrsync) -- falls back to md5 (proto >= 30) or md4.  So
-an on-path downgrade, or simply an old client, can pin the auth exchange to
-md5/md4, making a captured response far cheaper to brute-force offline.
-'auth digest = NAME' lets the operator require at least NAME (strongest-first
-order: sha512 sha256 sha1 md5 md4); a connection whose negotiated digest is
-weaker -- or a misconfigured floor naming an unknown digest -- is refused before
-the challenge.  Default off (no floor).
-
-Coverage:
-  * a default (modern) client negotiates sha512 and clears an 'auth digest =
-    sha256' floor;
-  * a floor naming a digest this build doesn't have is fail-closed (rejects even
-    a strong client) -- portable, proves the floor actually enforces;
-  * a genuine pre-3.2.0 client (no digest list -> md5 fallback) is accepted by a
-    no-floor module but refused by the sha256 floor (the real downgrade case) --
-    gated on a bundled old static rsync, which is export-ignored from the fleet
-    git-archive, so it's only exercised where that binary is present.
-"""
 
 import os
-import shlex
 import subprocess
 
-from rsyncfns import (
+from harness.rsync import (
     FROMDIR, RSYNC, SCRATCHDIR, SRCDIR,
     make_tree, makepath, rmtree, run_rsync, rsync_argv, start_test_daemon,
     test_fail, test_skipped, write_daemon_conf, split_rsync_cmd,
@@ -34,14 +11,11 @@
 
 DAEMON_PORT = 12953
 
-# Requiring a strong auth digest needs a build that has one.
 vv = run_rsync('-VV', check=True, capture_output=True).stdout
 if '"sha256"' not in vv or '"sha512"' not in vv:
     test_skipped("rsync built without sha256/sha512 daemon-auth digests "
                  "(no openssl); cannot require a strong auth digest")
 
-# Never fall back to an interactive getpass() on a missing password (it reads
-# /dev/tty and would hang the harness) -- see daemon-auth_test.py.
 os.environ['RSYNC_PASSWORD'] = 'env-fallback-wrong'
 
 src = FROMDIR
@@ -72,45 +46,32 @@
 url = start_test_daemon(conf, DAEMON_PORT)
 userurl = url.replace('rsync://', 'rsync://tuser@', 1)
 
-
 def push(module, dest, rsync_cmd=None):
     rmtree(dest)
     makepath(dest)
     argv = rsync_argv('-a', f'--password-file={pw}', f'{src}/', f'{userurl}{module}/')
     if rsync_cmd:
-        # Replace the whole RSYNC wrapper (which under --valgrind is
-        # 'valgrind <opts> .../rsync', not a bare binary) with the old static
-        # rsync; keep only the transfer args that rsync_argv appended.  The old
-        # fixture binary is run directly, not under valgrind.
         argv = [rsync_cmd] + list(argv[len(split_rsync_cmd(RSYNC)):])
     return subprocess.run(argv, stdout=subprocess.DEVNULL,
                           stderr=subprocess.PIPE, text=True)
 
-
-# --- a strong (default) client clears the floor -----------------------------
 proc = push('floor', floordir)
 if proc.returncode not in (0, 23):
     test_fail("a default client (negotiates sha512) was refused by the "
               f"'auth digest = sha256' floor: {proc.stderr}")
 
-# --- a floor naming an unknown digest is fail-closed (portable reject) -------
 proc = push('badfloor', badfloordir)
 if proc.returncode == 0 or 'auth failed' not in proc.stderr:
     test_fail("a module whose 'auth digest' names an unsupported digest must "
               "refuse auth (fail-closed) with an auth-failure error, not just a "
               f"transfer failure: rc={proc.returncode} stderr={proc.stderr!r}")
 
-# --- real downgrade: a pre-3.2.0 client (md5 fallback) vs the floor ----------
 old_rsync = SRCDIR / 'old_versions' / 'rsync_3.1.3'
 if not old_rsync.is_file() or not os.access(old_rsync, os.X_OK):
     print("daemon auth-digest floor: strong client accepted, bad-floor refused; "
           "skipped the md5-downgrade case (no old_versions/rsync_3.1.3 here)")
     raise SystemExit(0)
 
-# The static rsync_3.1.3 is a Linux binary; confirm it actually runs on this
-# OS/arch before depending on it (a full checkout ships it even on BSD/macOS,
-# where exec raises OSError or it won't print the rsync banner) -- skip the
-# md5-downgrade case there rather than failing the whole test.
 try:
     probe = subprocess.run([str(old_rsync), '--version'],
                            stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True)
@@ -122,13 +83,11 @@ def push(module, dest, rsync_cmd=None):
           "skipped the md5-downgrade case (rsync_3.1.3 does not run on this OS/arch)")
     raise SystemExit(0)
 
-# Control: the old (md5-auth) client authenticates fine against a no-floor module.
 proc = push('nofloor', nofloordir, rsync_cmd=str(old_rsync))
 if proc.returncode not in (0, 23):
     test_fail("control failed: a pre-3.2.0 (md5-auth) client could not "
               f"authenticate even without an auth-digest floor: {proc.stderr}")
 
-# The floor refuses that same md5 client.
 proc = push('floor', floordir, rsync_cmd=str(old_rsync))
 if proc.returncode == 0 or 'auth failed' not in proc.stderr:
     test_fail("the 'auth digest = sha256' floor did NOT refuse (with an "
diff --git a/testsuite/daemon-auth-group_test.py b/testsuite/tests/daemon/daemon-auth-group.py
similarity index 58%
rename from testsuite/daemon-auth-group_test.py
rename to testsuite/tests/daemon/daemon-auth-group.py
index 1d3820cb9..c9ae0004d 100644
--- a/testsuite/daemon-auth-group_test.py
+++ b/testsuite/tests/daemon/daemon-auth-group.py
@@ -1,17 +1,4 @@
 #!/usr/bin/env python3
-"""Daemon coverage: `auth users = @group` matching and `gid = *`.
-
-daemon-auth_test.py covers plain username auth; this exercises the
-`@group` branch in authenticate.c auth_server() (lines ~362-395), which
-resolves the connecting username to a uid (user_to_uid), enumerates that
-uid's groups via uidlist.c getallgroups() -> getgrouplist(), and
-wildmatches each group name against the @pattern.  Also covers
-clientserver.c want_all_groups() via a `gid = *` module, and
-uidlist.c is_in_group() via a non-root receiver child.
-
-Needs real passwd/group entries -- skips if `daemon` (or any non-root
-user with a same-named primary group) isn't present.
-"""
 
 import grp
 import os
@@ -19,26 +6,19 @@
 import pwd
 import subprocess
 
-from rsyncfns import (
+from harness.rsync import (
     FROMDIR, SCRATCHDIR,
     make_tree, makepath, owners_supported, rmtree, rsync_argv,
     start_test_daemon, test_fail, test_skipped, write_daemon_conf,
+    write_text_file,
 )
 
-# This covers the @group / getgrouplist daemon-auth path, which depends on the
-# group membership of system users (daemon/bin/nobody).  That membership and the
-# group-name matching differ enough on the BSDs/Solaris/macOS that the test's
-# fixed expectations don't hold there; it is a Linux daemon-coverage test.
 if platform.system() != 'Linux':
-    test_skipped("@group daemon-auth coverage is Linux-specific")
+    test_skipped("@group daemon-auth coverage is Linux-specific", capability='group_auth')
 
 DAEMON_PORT = 12892
-os.environ['RSYNC_PASSWORD'] = 'env-fallback-wrong'  # never prompt
+os.environ['RSYNC_PASSWORD'] = 'env-fallback-wrong'
 
-# Find a non-root user whose PRIMARY group name we can wildmatch on -- on a
-# minimal Debian/gcc image that's `daemon` (uid 1, gid 1, group "daemon").
-# We need the user to exist in passwd (for user_to_uid + getgrouplist) and
-# its primary gid to resolve to a name (for gid_to_group).
 def pick_user():
     for name in ('daemon', 'bin', 'nobody'):
         try:
@@ -52,9 +32,8 @@ def pick_user():
 
 U, G = pick_user()
 if U is None:
-    test_skipped("no suitable non-root passwd entry for @group auth")
+    test_skipped("no suitable non-root passwd entry for @group auth", capability='group_auth')
 
-# A second user NOT in U's group, for the negative case.
 def pick_outsider():
     for p in pwd.getpwall():
         if p.pw_uid in (0, U.pw_uid):
@@ -83,28 +62,21 @@ def pick_outsider():
 dest_star = SCRATCHDIR / 'dest-gidstar'
 dest_nonroot = SCRATCHDIR / 'dest-nonroot'
 makepath(dest_g, dest_star, dest_nonroot)
-# The non-root receiver child (uid=U) must be able to write its dest, which
-# needs a cross-uid chown -- i.e. root.  Skip cleanly when we can't.
 if not owners_supported():
-    test_skipped("needs chown to set up the non-root-owned dest tree")
+    test_skipped("needs chown to set up the non-root-owned dest tree", capability='group_auth')
 os.chown(dest_nonroot, U.pw_uid, U.pw_gid)
 
 mods = [
-    # @group auth: U matches its own primary group exactly; root matches the
-    # wildcard `@ro*` (group "root") and gets :ro; anyone else is denied.
     ('gauth', {
         'path': str(dest_g), 'read only': 'no', 'use chroot': 'no',
         'auth users': f'@{G.gr_name}, @ro*:ro',
         'secrets file': str(secrets), 'strict modes': 'no',
     }),
-    # gid = * -> clientserver.c want_all_groups() -> uidlist.c getallgroups().
     ('gidstar', {
         'path': str(dest_star), 'read only': 'no', 'use chroot': 'no',
         'uid': '0', 'gid': '*',
     }),
 ]
-# Non-root receiver (am_root==0 in the child) -> recv_add_id() for gids calls
-# uidlist.c is_in_group(). Only when we can chown the dest and setuid.
 if owners_supported():
     mods.append(('nonroot', {
         'path': str(dest_nonroot), 'read only': 'no', 'use chroot': 'no',
@@ -114,14 +86,6 @@ def pick_outsider():
 conf = write_daemon_conf(mods, name='auth-group.conf')
 url = start_test_daemon(conf, DAEMON_PORT)
 
-
-def pwfile(name, text):
-    p = SCRATCHDIR / name
-    p.write_text(text)
-    p.chmod(0o600)
-    return p
-
-
 def push(user, pw, module, *extra):
     return subprocess.run(
         rsync_argv('-r', f'--password-file={pw}', *extra,
@@ -129,37 +93,29 @@ def push(user, pw, module, *extra):
         capture_output=True, text=True,
     )
 
-
-# --- @group exact match: U is in group G -> allowed rw -----------------------
-r = push(U.pw_name, pwfile('pw-u', 'upass'), 'gauth')
+r = push(U.pw_name, write_text_file(SCRATCHDIR / 'pw-u', 'upass', 0o600), 'gauth')
 if r.returncode != 0:
     test_fail(f"@{G.gr_name} should allow {U.pw_name!r} (rc={r.returncode}):\n{r.stderr}")
 
-# --- @group wildcard + :ro: root is in group "root" which matches @ro* ------
-# The :ro suffix flips the module read-only for this user, so a push fails
-# with "module is read only" -- proving the @ro* matched AND the suffix took.
-r = push('root', pwfile('pw-r', 'rpass'), 'gauth')
+r = push('root', write_text_file(SCRATCHDIR / 'pw-r', 'rpass', 0o600), 'gauth')
 if r.returncode == 0:
     test_fail(f"@ro*:ro should make [gauth] read-only for root, but push succeeded")
 if 'read only' not in r.stderr:
     test_fail(f"expected 'read only' for root@gauth (got rc={r.returncode}):\n{r.stderr}")
 
-# --- @group negative: outsider's primary group matches neither --------------
 if OUT:
-    r = push(OUT.pw_name, pwfile('pw-o', 'opass'), 'gauth')
+    r = push(OUT.pw_name, write_text_file(SCRATCHDIR / 'pw-o', 'opass', 0o600), 'gauth')
     if r.returncode == 0:
         test_fail(f"{OUT.pw_name!r} (group {grp.getgrgid(OUT.pw_gid).gr_name!r}) "
                   f"should NOT match @{G.gr_name}/@ro*, but push succeeded")
     if 'auth failed' not in r.stderr:
         test_fail(f"expected 'auth failed' for {OUT.pw_name!r}:\n{r.stderr}")
 
-# --- gid = * -> want_all_groups() -------------------------------------------
 r = subprocess.run(rsync_argv('-r', f'{src}/', f'{url}gidstar/'),
                    capture_output=True, text=True)
 if r.returncode != 0:
     test_fail(f"push to [gidstar] (gid=*) failed (rc={r.returncode}):\n{r.stderr}")
 
-# --- non-root receiver -> is_in_group() -------------------------------------
 if owners_supported():
     r = subprocess.run(rsync_argv('-rg', f'{src}/', f'{url}nonroot/'),
                        capture_output=True, text=True)
diff --git a/testsuite/tests/daemon/daemon-auth-users-comma-only.py b/testsuite/tests/daemon/daemon-auth-users-comma-only.py
new file mode 100644
index 000000000..38ed2866d
--- /dev/null
+++ b/testsuite/tests/daemon/daemon-auth-users-comma-only.py
@@ -0,0 +1,95 @@
+#!/usr/bin/env python3
+
+import os
+import pwd
+import subprocess
+
+from harness.rsync import (
+    SCRATCHDIR, makepath, rmtree, rsync_argv, start_test_daemon, test_fail,
+    write_daemon_conf,
+)
+
+PORT = 12949
+USER = 'authuser'
+PASSWORD = 'known-password'
+DATA = 'AUTH-USERS-PARSE\n'
+
+base = SCRATCHDIR / 'auth-users-comma-only'
+rmtree(base)
+src = base / 'src'
+mod = base / 'mod'
+ctrl = base / 'ctrl'
+grp = base / 'grp'
+grpc = base / 'grpc'
+makepath(src, mod, ctrl, grp, grpc)
+(src / 'f1').write_text(DATA)
+
+REALUSER = pwd.getpwuid(os.geteuid()).pw_name
+
+secrets = base / 'auth-users.secrets'
+secrets.write_text(f'{USER}:{PASSWORD}\n{REALUSER}:{PASSWORD}\n')
+secrets.chmod(0o600)
+pwfile = base / 'auth-users.password'
+pwfile.write_text(PASSWORD + '\n')
+pwfile.chmod(0o600)
+
+common = {
+    'read only': 'no',
+    'use chroot': 'no',
+    'secrets file': str(secrets),
+}
+
+conf = write_daemon_conf([
+    ('spaced', dict(common, path=str(mod),
+                    **{'auth users': f',@nosuchgroup {USER}:deny, {USER}:rw'})),
+    ('plain', dict(common, path=str(ctrl),
+                   **{'auth users': f'{USER}:rw'})),
+    ('grpctl', dict(common, path=str(grpc),
+                    **{'auth users': f'@*:rw'})),
+    ('grpdeny', dict(common, path=str(grp),
+                     **{'auth users': f',@[! []*:deny, {REALUSER}:rw'})),
+], name='auth-users-comma-only.conf')
+url = start_test_daemon(conf, PORT)
+
+os.environ['RSYNC_PASSWORD'] = 'wrong-environment-fallback'
+
+def push(module, dest_dir, as_user=USER):
+    proc = subprocess.run(
+        rsync_argv('-r', f'--password-file={pwfile}', f'{src}/',
+                   url.replace('rsync://', f'rsync://{as_user}@', 1) + module + '/'),
+        stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True)
+    landed = dest_dir / 'f1'
+    return proc, landed
+
+proc, landed = push('plain', ctrl)
+if proc.returncode != 0 or not landed.is_file() or landed.read_text() != DATA:
+    test_fail('positive control failed: the credential could not push to a '
+              f'module with a plain "auth users" (rc={proc.returncode}, '
+              f'output={proc.stdout.strip()[:300]!r})')
+
+proc, landed = push('spaced', mod)
+ctx = f'rc={proc.returncode}, output={proc.stdout.strip()[:300]!r}'
+if not landed.is_file():
+    test_fail(f'comma-separated auth rule was split on whitespace ({ctx})')
+if landed.read_text() != DATA:
+    test_fail(f'transfer was allowed but delivered the wrong content ({ctx})')
+if proc.returncode != 0:
+    test_fail(f'transfer was allowed but failed ({ctx})')
+
+proc, landed = push('grpctl', grpc, as_user=REALUSER)
+ctx = f'rc={proc.returncode}, output={proc.stdout.strip()[:300]!r}'
+if proc.returncode != 0 or not landed.is_file():
+    test_fail(f'@*:rw rejected {REALUSER} ({ctx})')
+
+proc, landed = push('grpdeny', grp, as_user=REALUSER)
+ctx = f'rc={proc.returncode}, output={proc.stdout.strip()[:300]!r}'
+if landed.is_file() or proc.returncode == 0:
+    test_fail(f'spaced group deny did not reject {REALUSER} ({ctx})')
+logfile = SCRATCHDIR / 'rsyncd.log'
+log = logfile.read_text(errors='replace') if logfile.is_file() else ''
+if not [ln for ln in log.splitlines()
+        if 'auth failed on module grpdeny' in ln
+        and f'for {REALUSER}: denied by rule' in ln]:
+    test_fail(f'grpdeny did not log a deny-rule match ({ctx}, log={log.strip()[-500:]!r})')
+
+print('a leading comma in "auth users" splits on commas alone')
diff --git a/testsuite/daemon-auth_test.py b/testsuite/tests/daemon/daemon-auth.py
similarity index 53%
rename from testsuite/daemon-auth_test.py
rename to testsuite/tests/daemon/daemon-auth.py
index 5075f1cbf..ecadbc52a 100644
--- a/testsuite/daemon-auth_test.py
+++ b/testsuite/tests/daemon/daemon-auth.py
@@ -1,29 +1,19 @@
 #!/usr/bin/env python3
-"""Daemon coverage: auth users, secrets file, strict modes.
-
-A module with auth users + a secrets file must accept the right password,
-reject a wrong one, and (with the default strict modes) refuse a
-world-readable secrets file. Authentication happens in the daemon protocol, so
-it works over the default secure stdio-pipe transport.
-"""
 
 import os
 import subprocess
 
-from rsyncfns import (
+from harness.rsync import (
     FROMDIR, SCRATCHDIR,
     make_tree, makepath, rmtree, rsync_argv, start_test_daemon, test_fail,
-    verify_dirs, write_daemon_conf,
+    verify_dirs, write_daemon_conf, write_text_file,
 )
+from harness import metadata
+
+metadata(features={'daemon'}, transports={'pipe', 'tcp'}, min_peer='2.6.0', mutates={'filesystem', 'process', 'socket'}, tags={'authentication', 'daemon', 'version-mix'})
 
 DAEMON_PORT = 12888
 
-# When a daemon module needs auth and no password is available, rsync falls back
-# to an interactive getpass() prompt that reads /dev/tty directly -- which the
-# test harness cannot redirect, so it would hang `make coverage` (or any run
-# with a controlling terminal). Give every client a fallback password via the
-# environment so it never prompts: the --password-file cases below override it,
-# and the invalid-credentials case uses it and is correctly rejected.
 os.environ['RSYNC_PASSWORD'] = 'env-fallback-wrong'
 
 src = FROMDIR
@@ -42,14 +32,6 @@
 url = start_test_daemon(conf, DAEMON_PORT)
 userurl = url.replace('rsync://', 'rsync://tuser@', 1)
 
-
-def pwfile(name, text):
-    p = SCRATCHDIR / name
-    p.write_text(text)
-    p.chmod(0o600)
-    return p
-
-
 def push(pw, **kw):
     rmtree(authdir)
     makepath(authdir)
@@ -57,23 +39,17 @@ def push(pw, **kw):
         rsync_argv('-a', f'--password-file={pw}', f'{src}/', f'{userurl}auth/'),
         stdout=subprocess.DEVNULL, stderr=subprocess.PIPE, text=True, **kw)
 
-
-# --- correct password succeeds ----------------------------------------------
-ok = pwfile('pw.ok', 'secretpass\n')
+ok = write_text_file(SCRATCHDIR / 'pw.ok', 'secretpass\n', 0o600)
 proc = push(ok)
 if proc.returncode not in (0, 23):
     test_fail(f"auth with the correct password failed: {proc.stderr}")
 verify_dirs(src, authdir, label="auth success")
 
-# --- wrong password is rejected ---------------------------------------------
-bad = pwfile('pw.bad', 'wrongpass\n')
+bad = write_text_file(SCRATCHDIR / 'pw.bad', 'wrongpass\n', 0o600)
 proc = push(bad)
 if proc.returncode == 0:
     test_fail("auth with the wrong password unexpectedly succeeded")
 
-# --- a request with invalid credentials is rejected ------------------------
-# Local user (not an auth user) with the wrong env-supplied password; rejected
-# without ever prompting on the tty.
 proc = subprocess.run(
     rsync_argv('-a', f'{src}/', f'{url}auth/'),
     stdout=subprocess.DEVNULL, stderr=subprocess.PIPE, text=True,
@@ -82,7 +58,6 @@ def push(pw, **kw):
     test_fail("a request with invalid credentials succeeded against an "
               "auth-users module")
 
-# --- strict modes rejects a world-readable secrets file ---------------------
 secrets.chmod(0o644)
 proc = push(ok)
 if proc.returncode == 0:
diff --git a/testsuite/daemon_test.py b/testsuite/tests/daemon/daemon-basics.py
similarity index 61%
rename from testsuite/daemon_test.py
rename to testsuite/tests/daemon/daemon-basics.py
index 3b1adda4e..094833148 100644
--- a/testsuite/daemon_test.py
+++ b/testsuite/tests/daemon/daemon-basics.py
@@ -1,47 +1,39 @@
 #!/usr/bin/env python3
-# Python rewrite of testsuite/daemon.test.
-#
-# Basic daemon-mode operations against an in-process rsyncd: list
-# modules, list a hidden module, list a single-glob match, and the
-# atimes-format variant. We avoid actually starting a listening server
-# by using RSYNC_CONNECT_PROG to spawn the daemon as a child of rsync.
-
-# Rerun under the fleet harness's non-root pass (testsuite/fleettest.py): a
-# non-root rsyncd emits different uid/gid config, so exercise that path too.
-fleet_nonroot = True
 
 import os
 import subprocess
 
-from rsyncfns import (
-    CHKFILE, FROMDIR, OUTFILE, RSYNC, RSYNC_PEER, SCRATCHDIR, SRCDIR, TODIR,
-    build_rsyncd_conf, get_rootuid, get_testuid, makepath,
-    rsync_argv, run_rsync, start_test_daemon, test_fail, rsh_cmd,
+from harness.rsync import (
+    FROMDIR,
+    RSYNC_PEER,
+    SCRATCHDIR,
+    TODIR,
+    build_rsyncd_conf,
+    get_rootuid,
+    get_testuid,
+    makepath,
+    rsync_argv,
+    run_rsync,
+    start_test_daemon,
+    test_fail,
+    rsh_cmd,
 )
+from harness import metadata
 
+metadata(features={'daemon'}, transports={'pipe', 'tcp'}, min_peer='2.6.0', mutates={'filesystem', 'process', 'socket'}, tags={'compatibility', 'daemon', 'version-mix'})
 
 DAEMON_PORT = 12877
 
-
 SSH = rsh_cmd(None, '--no-cd')
 
-
 def listed_paths(text: str) -> set:
-    """The set of path names in an `rsync -r` listing. Each listing line is
-    "<mode> <size> <date> <time> <path>"; pull out the trailing path. Comparing
-    the whole set (not just checking individual paths are present) catches a
-    listing that leaks EXTRA paths, not only one that omits expected ones."""
     paths = set()
     for line in text.splitlines():
         parts = line.split()
-        # A listing line starts with a 10-char mode string and ends with the
-        # path; -U adds extra date columns, so take the last token (the test's
-        # paths contain no spaces).
         if len(parts) >= 5 and len(parts[0]) == 10 and parts[0][0] in '-dlbcps':
             paths.add(parts[-1])
     return paths
 
-
 conf = build_rsyncd_conf()
 
 makepath(FROMDIR / 'foo', FROMDIR / 'bar' / 'baz', TODIR)
@@ -55,7 +47,6 @@ def listed_paths(text: str) -> set:
 
 confopt = []
 if get_testuid() == get_rootuid():
-    # Root needs an explicit --config; otherwise rsync uses /etc/rsyncd.conf.
     print(f"Forcing --config={conf}")
     confopt = [f'--config={conf}']
 
@@ -65,7 +56,6 @@ def listed_paths(text: str) -> set:
     "test-scratch   \t\n"
 )
 
-
 def run_and_check(args, label, capture_stderr=False):
     proc = subprocess.run(
         rsync_argv(*args),
@@ -80,8 +70,6 @@ def run_and_check(args, label, capture_stderr=False):
         test_fail(f"{label}: rsync exited {proc.returncode}\n{proc.stderr}")
     return out
 
-
-# Module list via the lsh.sh stand-in.
 rsync_path = f"{RSYNC_PEER}{(' ' + ' '.join(confopt)) if confopt else ''}"
 out = run_and_check(
     ['-ve', SSH, f'--rsync-path={rsync_path}', 'localhost::'],
@@ -89,28 +77,21 @@ def run_and_check(args, label, capture_stderr=False):
 )
 if expected_modules not in out:
     test_fail("module list via lsh.sh did not contain the expected modules")
-# test-hidden is `list = no`; it must NOT appear in the module listing.
 if 'test-hidden' in out:
     print(out)
     test_fail("module list via lsh.sh leaked the `list = no` test-hidden module")
 print('====')
 
-# Same module list via the test daemon (pipe transport by default; real
-# loopback rsyncd under --use-tcp).
 daemon_url = start_test_daemon(conf, DAEMON_PORT).rstrip('/')
 
 out = run_and_check(['-v', f'{daemon_url}/'], "module list via daemon")
 if expected_modules not in out:
     test_fail("module list via daemon did not contain the expected modules")
-# test-hidden is `list = no`; it must NOT appear in the module listing.
 if 'test-hidden' in out:
     print(out)
     test_fail("module list via daemon leaked the `list = no` test-hidden module")
 print('====')
 
-# test-hidden: a recursive listing of the whole module. Compare the exact set
-# of listed paths so an unexpected/leaked extra path is caught, not only a
-# missing one.
 out = run_and_check(['-r', f'{daemon_url}/test-hidden'], "test-hidden listing")
 got = listed_paths(out)
 want = {'.', 'bar', 'bar/two', 'bar/baz', 'bar/baz/three', 'foo', 'foo/one'}
@@ -118,7 +99,6 @@ def run_and_check(args, label, capture_stderr=False):
     print(out)
     test_fail(f"test-hidden listing paths {sorted(got)} != expected {sorted(want)}")
 
-# test-from/f* glob: only the foo subtree, nothing from bar.
 out = run_and_check(['-r', f'{daemon_url}/test-from/f*'], "test-from glob")
 got = listed_paths(out)
 want = {'foo', 'foo/one'}
@@ -126,7 +106,6 @@ def run_and_check(args, label, capture_stderr=False):
     print(out)
     test_fail(f"test-from glob paths {sorted(got)} != expected {sorted(want)}")
 
-# atimes-format variant -- only if rsync was built with atimes support.
 vv = run_rsync('-VV', check=True, capture_output=True)
 if '"atimes": true' in vv.stdout:
     out = run_and_check(['-rU', f'{daemon_url}/test-from/f*'], "test-from glob with -U")
diff --git a/testsuite/daemon-chroot-acl_test.py b/testsuite/tests/daemon/daemon-chroot-acl.py
similarity index 70%
rename from testsuite/daemon-chroot-acl_test.py
rename to testsuite/tests/daemon/daemon-chroot-acl.py
index f477145e4..61032b8e7 100644
--- a/testsuite/daemon-chroot-acl_test.py
+++ b/testsuite/tests/daemon/daemon-chroot-acl.py
@@ -1,12 +1,4 @@
 #!/usr/bin/env python3
-# Python rewrite of testsuite/daemon-chroot-acl.test.
-#
-# Regression test for GHSA-rjfm-3w2m-jf4f: a hostname-based "hosts deny"
-# rule must still match when the daemon performs a 'daemon chroot' and
-# the chroot does not contain the NSS files glibc needs for reverse
-# DNS. Pre-fix, reverse DNS happened *after* the chroot, the lookup
-# failed, client_name() returned "UNKNOWN", and a deny rule referring
-# to the connecting hostname silently failed to match.
 
 import os
 import platform
@@ -14,30 +6,25 @@
 import subprocess
 import sys
 
-from rsyncfns import (
+from harness.rsync import (
     SCRATCHDIR, TODIR,
     require_tcp, rmtree, rsync_argv, start_test_daemon, test_fail, test_skipped,
 )
 
-
 DAEMON_PORT = 12878
 
-# This test fundamentally needs a real TCP peer address: the daemon reverse-
-# resolves the connecting IP for a hostname-based "hosts deny" ACL check.
-# The stdio-pipe transport has no peer IP, so only run under --use-tcp.
 require_tcp("needs a real TCP peer address for reverse-DNS hostname ACL; "
             "run with --use-tcp")
 
 if platform.system() != 'Linux':
-    test_skipped("test is Linux-specific (uses chroot+unshare)")
+    test_skipped("test is Linux-specific (uses chroot+unshare)",
+                 capability='linux_nss_chroot')
 
-# Need CAP_SYS_CHROOT. Re-exec under a user namespace if not root.
 def _can_chroot() -> bool:
     proc = subprocess.run(['chroot', '/', '/bin/true'],
                           stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
     return proc.returncode == 0
 
-
 if not _can_chroot():
     if not os.environ.get('RSYNC_UNSHARED'):
         unshare = shutil.which('unshare')
@@ -56,10 +43,9 @@ def _can_chroot() -> bool:
                      sys.executable, __file__],
                     env,
                 )
-    test_skipped("need CAP_SYS_CHROOT (root or unshare --user --map-root-user)")
+    test_skipped("need CAP_SYS_CHROOT (root or unshare --user --map-root-user)",
+                 capability='chroot')
 
-
-# Find what 127.0.0.1 reverse-resolves to.
 def _client_hostname() -> str:
     try:
         out = subprocess.check_output(['getent', 'hosts', '127.0.0.1'], text=True)
@@ -71,10 +57,9 @@ def _client_hostname() -> str:
             return parts[1]
     return ''
 
-
 client_hostname = _client_hostname()
 if not client_hostname or client_hostname == '127.0.0.1':
-    test_skipped("no reverse DNS for 127.0.0.1")
+    test_skipped("no reverse DNS for 127.0.0.1", capability='linux_nss_chroot')
 
 chrootdir = SCRATCHDIR / 'chroot'
 rmtree(chrootdir)
@@ -84,7 +69,6 @@ def _client_hostname() -> str:
 conf = SCRATCHDIR / 'test-rsyncd.conf'
 logfile = SCRATCHDIR / 'rsyncd.log'
 
-
 def write_conf(global_rev: str, module_rev: str) -> None:
     conf.write_text(f"""\
 use chroot = no
@@ -100,16 +84,12 @@ def write_conf(global_rev: str, module_rev: str) -> None:
     reverse lookup = {module_rev}
 """)
 
-
 def run_check(label: str) -> bool:
     if logfile.exists():
         logfile.unlink()
     rmtree(TODIR)
     TODIR.mkdir()
 
-    # rsyncd re-reads its config file on each accepted connection, so
-    # rewriting `conf` between scenarios is enough -- we keep the one
-    # daemon for both.
     proc = subprocess.run(
         rsync_argv('-av', f'{url}chrootmod/', f'{TODIR}/'),
         capture_output=True, text=True,
@@ -125,17 +105,12 @@ def run_check(label: str) -> bool:
 
     return '@ERROR' in out and 'access denied' in out
 
-
-# Spin up the daemon once; we'll rewrite `conf` between scenarios and rely
-# on rsyncd's per-connection re-read of the config file.
 write_conf('yes', 'yes')
 url = start_test_daemon(conf, DAEMON_PORT)
 
-# Scenario A: global reverse lookup. Covered by b6abdb4c.
 if not run_check("Scenario A (global reverse lookup = yes)"):
     test_fail("Scenario A: hostname deny rule was bypassed")
 
-# Scenario B: only per-module reverse-lookup enabled.
 write_conf('no', 'yes')
 if not run_check("Scenario B (per-module reverse lookup only)"):
     test_fail(
diff --git a/testsuite/daemon-chroot-munge-default_test.py b/testsuite/tests/daemon/daemon-chroot-munge-default.py
similarity index 54%
rename from testsuite/daemon-chroot-munge-default_test.py
rename to testsuite/tests/daemon/daemon-chroot-munge-default.py
index 97feed38c..21c82d4d9 100644
--- a/testsuite/daemon-chroot-munge-default_test.py
+++ b/testsuite/tests/daemon/daemon-chroot-munge-default.py
@@ -1,55 +1,27 @@
 #!/usr/bin/env python3
-"""Pin WHEN the daemon applies default symlink munging, by config regime.
-
-The rsyncd.conf(5) `use chroot` entry says:
-
-  "If the daemon is serving the / dir (either directly or due to being chrooted
-   to the module's path), rsync does not do any path sanitizing or (default)
-   munging.  When it has to limit access to a particular subdir (either due to
-   chroot being disabled or having an inside-chroot path set), rsync will munge
-   symlinks (by default) and sanitize paths."
-
-This was flagged as a suspected code mismatch during the doc audit.  It is NOT a
-mismatch: clientserver.c derives `module_dirlen` (0 when the inside-chroot path
-is "/", >0 for a real subdir) and sets
-    munge_symlinks default = !use_chroot || module_dirlen
-so the doc's regime split is exactly right.  This test confirms it by observing
-the default (no explicit `munge symlinks`) across three regimes:
-
-  A. use chroot = no            -> module_dirlen>0 -> munge ON
-  B. use chroot = yes, path=DIR -> chrooted to DIR, inside path "/", len 0 -> munge OFF
-  C. use chroot = yes, path=BASE/./SUB -> inside path "SUB", len>0 -> munge ON
-
-Regimes B and C need root (chroot).  A runs anywhere.  The observable is whether
-an uploaded symlink is stored verbatim or with the /rsyncd-munged/ prefix.
-(Path sanitizing -- the other half of the same sentence -- is exercised by the
-operator-path-* and daemon-scan-dir-escape tests.)
-"""
 
 import os
 import subprocess
 
-from rsyncfns import (
+from harness.rsync import (
     SCRATCHDIR,
     rmtree, rsync_argv, start_test_daemon, test_fail, test_skipped,
     write_daemon_conf,
 )
 
 DAEMON_PORT = 12911
-LINKVAL = 'realfile'        # a plain rel-within target
+LINKVAL = 'realfile'
 
 base = SCRATCHDIR / 'chroot-munge'
 rmtree(base)
 base.mkdir(parents=True)
 
-# Upload source: one symlink we can inspect after it lands.
 srcup = base / 'srcup'
 srcup.mkdir()
 os.symlink(LINKVAL, srcup / 'sl')
 
 is_root = os.geteuid() == 0
 
-# Module A: no chroot.  Modules B/C: chroot (root only).
 mod_a_dir = base / 'a_root'
 mod_b_dir = base / 'b_root'
 mod_c_base = base / 'c_base'
@@ -70,9 +42,7 @@
 conf = write_daemon_conf(modules, name='chroot-munge.conf')
 url = start_test_daemon(conf, DAEMON_PORT)
 
-
 def stored_link(module, landing_dir):
-    """Upload the symlink into `module`; return the value as stored on disk."""
     subprocess.run(rsync_argv('-al', f'{srcup}/', f'{url}{module}/'),
                    stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
     sl = landing_dir / 'sl'
@@ -80,21 +50,17 @@ def stored_link(module, landing_dir):
         test_fail(f"{module}: uploaded symlink did not land at {sl}")
     return os.readlink(sl)
 
-
 MUNGED = '/rsyncd-munged/' + LINKVAL
 
-# A: no chroot -> default munge ON.
 got = stored_link('a_nochroot', mod_a_dir)
 if got != MUNGED:
     test_fail(f"use chroot=no: expected default munge ({MUNGED!r}), stored {got!r}")
 
 if is_root:
-    # B: chrooted to the module path, inside path "/" -> default munge OFF.
     got = stored_link('b_chroot_root', mod_b_dir)
     if got != LINKVAL:
         test_fail(f"use chroot=yes serving '/': expected NO munge ({LINKVAL!r}), "
                   f"stored {got!r}")
-    # C: chroot with a /./ inner subdir -> default munge ON.
     got = stored_link('c_chroot_sub', mod_c_sub)
     if got != MUNGED:
         test_fail(f"use chroot=yes with inside-path 'sub': expected default munge "
@@ -104,4 +70,4 @@ def stored_link(module, landing_dir):
           "-- the use-chroot doc regime split is accurate")
 else:
     test_skipped("chroot regimes (B/C) need root; verified the no-chroot regime "
-                 "munges by default")
+                 "munges by default", capability='root')
diff --git a/testsuite/daemon-chroot_test.py b/testsuite/tests/daemon/daemon-chroot.py
similarity index 55%
rename from testsuite/daemon-chroot_test.py
rename to testsuite/tests/daemon/daemon-chroot.py
index 0cea480da..063d6fa18 100644
--- a/testsuite/daemon-chroot_test.py
+++ b/testsuite/tests/daemon/daemon-chroot.py
@@ -1,52 +1,32 @@
 #!/usr/bin/env python3
-"""Daemon coverage: `use chroot = yes` and the `path = /outer/./inner`
-chroot-with-inner-subdir syntax.
-
-Every other daemon test in the suite forces `use chroot = no` (via
-write_daemon_conf()'s globals) so the chroot setup in clientserver.c
-rsync_module() -- the use_chroot path-split (~866-887), the actual
-chroot(2) call (~1003-1012), and the `temp dir` module option -- was
-never reached.  Those lines are also where the per-connection child
-loses the ability to write its .gcda counters (the build-tree paths
-are outside the chroot), so a companion gcov_flush() lands just before
-chroot() in clientserver.c; this test exercises that flush point and
-everything before it.
-
-Three modules:
-  chr        use chroot = yes, plain path           -> 880-887, 1003-1012
-  chrinner   use chroot = yes, path = /outer/./in   -> 868-877 split
-  chrtmp     use chroot = yes, temp dir = /tmpd     -> 1093-1095 lp_temp_dir
-
-Requires CAP_SYS_CHROOT (root in the test container); skips cleanly
-without it.
-"""
 
 import ctypes
 import os
 import subprocess
 
-from rsyncfns import (
+from harness.rsync import (
     SCRATCHDIR, FROMDIR,
     claim_ports, get_rootuid, get_testuid, make_tree, makepath, require_tcp,
-    rmtree, rsync_argv, start_test_daemon, test_fail, test_skipped,
+    rmtree, rsync_argv, start_test_daemon, test_fail, test_skipped, under_valgrind,
     write_daemon_conf,
 )
 
 if get_testuid() != get_rootuid():
-    test_skipped("use chroot = yes needs root (CAP_SYS_CHROOT)")
+    test_skipped("use chroot = yes needs root (CAP_SYS_CHROOT)", capability='root')
+if under_valgrind():
+    test_skipped("per-process Valgrind logs are outside the daemon chroot",
+                 capability='chroot')
 
-# Probe chroot() directly so a rootless/seccomp'd container that maps uid 0
-# but withholds CAP_SYS_CHROOT skips cleanly instead of failing.
 pid = os.fork()
 if pid == 0:
     try:
-        ctypes.CDLL(None).chroot(b"/")
-        os._exit(0)
-    except Exception:
+        result = ctypes.CDLL(None, use_errno=True).chroot(b'/')
+        os._exit(0 if result == 0 else 1)
+    except OSError:
         os._exit(1)
 _, st = os.waitpid(pid, 0)
 if not (os.WIFEXITED(st) and os.WEXITSTATUS(st) == 0):
-    test_skipped("chroot(2) not permitted in this environment")
+    test_skipped("chroot(2) not permitted in this environment", capability='chroot')
 
 require_tcp("daemon chroot path needs the real start_daemon socket flow")
 
@@ -57,13 +37,11 @@
 rmtree(src)
 make_tree(src, depth=1)
 
-# Module roots.  For the /./ form the OUTER path is what gets chroot()'d
-# and the INNER path is chdir'd inside it.
 root_chr = SCRATCHDIR / 'chroot-plain'
 root_outer = SCRATCHDIR / 'chroot-outer'
 root_inner = root_outer / 'inner'
 root_tmp = SCRATCHDIR / 'chroot-tmp'
-tmpd = root_tmp / 'tmpd'      # `temp dir` is interpreted INSIDE the chroot
+tmpd = root_tmp / 'tmpd'
 for d in (root_chr, root_inner, root_tmp, tmpd):
     rmtree(d)
 makepath(root_chr, root_inner, root_tmp, tmpd)
@@ -75,7 +53,6 @@
         'read only': 'no',
     }),
     ('chrinner', {
-        # /outer/./inner: chroot to /outer, chdir to /inner inside.
         'path': f'{root_outer}/./inner',
         'use chroot': 'yes',
         'read only': 'no',
@@ -84,14 +61,12 @@
         'path': str(root_tmp),
         'use chroot': 'yes',
         'read only': 'no',
-        # Relative to the chroot root (= module path).
         'temp dir': '/tmpd',
     }),
 ]
 conf = write_daemon_conf(mods, name='chroot.conf')
 url = start_test_daemon(conf, PORT)
 
-
 def push(module, dest):
     r = subprocess.run(rsync_argv('-r', f'{src}/', f'{url}{module}/'),
                        capture_output=True, text=True)
@@ -101,14 +76,13 @@ def push(module, dest):
     if not any(dest.iterdir()):
         test_fail(f"push to [{module}] wrote nothing into {dest}")
 
-
 push('chr', root_chr)
 push('chrinner', root_inner)
 push('chrtmp', root_tmp)
 
-# Pull from a chrooted module too (sender side under chroot).
 pull_dst = SCRATCHDIR / 'pull-chr'
-rmtree(pull_dst); makepath(pull_dst)
+rmtree(pull_dst)
+makepath(pull_dst)
 r = subprocess.run(rsync_argv('-r', f'{url}chr/', f'{pull_dst}/'),
                    capture_output=True, text=True)
 if r.returncode != 0:
diff --git a/testsuite/tests/daemon/daemon-config-symlink.py b/testsuite/tests/daemon/daemon-config-symlink.py
new file mode 100644
index 000000000..95cc89437
--- /dev/null
+++ b/testsuite/tests/daemon/daemon-config-symlink.py
@@ -0,0 +1,76 @@
+#!/usr/bin/env python3
+
+import os
+import pwd
+import subprocess
+
+from harness.rsync import (
+    FROMDIR, SCRATCHDIR, make_tree, rmtree, rsync_argv, start_test_daemon,
+    test_fail, test_skipped, write_daemon_conf,
+)
+
+DAEMON_PORT = 12901
+MARKER = "AUDIT_MOTD_LEAK_MARKER_DO_NOT_DISCLOSE"
+
+if os.geteuid() != 0:
+    test_skipped("requires root to plant a symlink owned by a non-self uid "
+                 "(the attacker simulation)", capability='cross_uid')
+
+NOBODY_UID = None
+for name in ('nobody', 'nfsnobody', 'daemon'):
+    try:
+        u = pwd.getpwnam(name).pw_uid
+        if u != 0 and u != os.geteuid():
+            NOBODY_UID = u
+            break
+    except KeyError:
+        continue
+if NOBODY_UID is None:
+    test_skipped("no untrusted-uid user available for cross-uid plant", capability='cross_uid')
+
+src = FROMDIR
+rmtree(src)
+make_tree(src, depth=1)
+
+base = SCRATCHDIR / 'daemoncfg'
+rmtree(base)
+base.mkdir()
+plants = base / 'plants'
+plants.mkdir()
+modpath = base / 'mod'
+modpath.mkdir()
+
+victim = plants / 'motd_victim'
+victim.write_text(MARKER + "\n")
+os.chmod(victim, 0o600)
+
+motd_plant = plants / 'motd_plant'
+os.symlink(victim, motd_plant)
+os.lchown(motd_plant, NOBODY_UID, NOBODY_UID)
+
+lock_victim_dir = base / 'lock_victim'
+lock_victim_dir.mkdir()
+lock_plant = plants / 'lock_plant'
+os.symlink(lock_victim_dir / 'leaked_lockfile', lock_plant)
+os.lchown(lock_plant, NOBODY_UID, NOBODY_UID)
+
+conf = write_daemon_conf(
+    [('mod', {'path': modpath, 'read only': 'yes',
+              'max connections': '5'})],
+    globals={'motd file': str(motd_plant),
+             'lock file': str(lock_plant)},
+)
+url = start_test_daemon(conf, DAEMON_PORT)
+
+proc = subprocess.run(
+    rsync_argv(url + 'mod/'),
+    stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True)
+
+if MARKER in proc.stdout or MARKER in proc.stderr:
+    test_fail(f'daemon read motd through untrusted uid {NOBODY_UID} symlink: '
+              f'{motd_plant} -> {victim}')
+
+leaked_lockfile = lock_victim_dir / 'leaked_lockfile'
+if leaked_lockfile.exists():
+    test_fail(f'daemon created a lock file through untrusted uid {NOBODY_UID} '
+              f'symlink: {lock_plant} -> {leaked_lockfile}')
diff --git a/testsuite/tests/daemon/daemon-config.py b/testsuite/tests/daemon/daemon-config.py
new file mode 100644
index 000000000..f693baa64
--- /dev/null
+++ b/testsuite/tests/daemon/daemon-config.py
@@ -0,0 +1,50 @@
+#!/usr/bin/env python3
+
+from harness.rsync import (
+    FROMDIR, SCRATCHDIR, make_tree, makepath, rmtree, run_rsync, start_test_daemon, test_fail,
+)
+from harness import metadata
+
+metadata(features={'daemon'}, transports={'pipe', 'tcp'}, min_peer='2.6.0', mutates={'filesystem', 'process', 'socket'}, tags={'configuration', 'daemon', 'version-mix'})
+
+DAEMON_PORT = 12893
+
+src = FROMDIR
+rmtree(src)
+make_tree(src, depth=2)
+
+def module(name):
+    return f'[{name}]\n\tpath = {src}\n\tread only = yes\n'
+
+included = SCRATCHDIR / 'included.conf'
+included.write_text(module('inc-file'))
+directory = SCRATCHDIR / 'rsyncd.conf.d'
+makepath(directory)
+(directory / '20-b.conf').write_text(module('inc-b'))
+(directory / '10-a.conf').write_text(module('inc-a'))
+(directory / 'README').write_text('ignored\n')
+merged = SCRATCHDIR / 'merged.inc'
+merged.write_text(module('merged'))
+
+conf = SCRATCHDIR / 'daemon-config.conf'
+conf.write_text(
+    f"pid file = {SCRATCHDIR}/rsyncd.pid\n"
+    "use chroot = no\n"
+    "hosts allow = localhost 127.0.0.0/8\n"
+    f"log file = {SCRATCHDIR}/rsyncd.log\n"
+    f"&include {included}\n"
+    f"&include = {directory}\n"
+    f"&merge = {merged}\n"
+    f"\n[badpath]\n\tpath = {SCRATCHDIR}/no-such-dir\n\tread only = yes\n"
+)
+url = start_test_daemon(conf, DAEMON_PORT)
+
+listing = run_rsync(url, capture_output=True).stdout
+for name in ('inc-file', 'inc-a', 'inc-b', 'merged'):
+    if name not in listing:
+        test_fail(f'{name}: included module is absent from the listing')
+    run_rsync('-r', f'{url}{name}/')
+if run_rsync('-r', f'{url}badpath/', check=False, capture_output=True).returncode == 0:
+    test_fail('a module with a missing path accepted a connection')
+
+print('daemon includes, merges and missing paths verified')
diff --git a/testsuite/tests/daemon/daemon-connection-limits.py b/testsuite/tests/daemon/daemon-connection-limits.py
new file mode 100644
index 000000000..c642041bf
--- /dev/null
+++ b/testsuite/tests/daemon/daemon-connection-limits.py
@@ -0,0 +1,70 @@
+#!/usr/bin/env python3
+
+import socket
+import time
+
+from harness.rsync import (
+    FROMDIR, RSYNC, SCRATCHDIR, claim_ports, make_tree, rmtree, start_rsyncd,
+    test_fail, write_daemon_conf,
+)
+
+PORT = 13022
+claim_ports(PORT)
+
+rmtree(FROMDIR)
+make_tree(FROMDIR, depth=1)
+conf = write_daemon_conf([
+    ('limited', {
+        'path': str(FROMDIR),
+        'read only': 'yes',
+        'max connections': '1',
+        'lock file': str(SCRATCHDIR / 'connections.lock'),
+    }),
+], name='connection-limits.conf')
+start_rsyncd(conf, PORT, rsync_cmd=RSYNC)
+
+def recv_line(sock):
+    data = bytearray()
+    while not data.endswith(b'\n'):
+        chunk = sock.recv(1)
+        if not chunk:
+            break
+        data += chunk
+        if len(data) > 4096:
+            test_fail(f'daemon response line is too long: {bytes(data)!r}')
+    return bytes(data)
+
+def open_module(module):
+    sock = socket.create_connection(('127.0.0.1', PORT), timeout=10)
+    greeting = recv_line(sock)
+    if not greeting.startswith(b'@RSYNCD:'):
+        sock.close()
+        test_fail(f'unexpected daemon greeting: {greeting!r}')
+    sock.sendall(f'@RSYNCD: 31.0\n{module}\n'.encode())
+    return sock, recv_line(sock)
+
+first, reply = open_module('limited')
+if reply != b'@RSYNCD: OK\n':
+    first.close()
+    test_fail(f'first limited connection was not accepted: {reply!r}')
+
+second, reply = open_module('limited')
+second.close()
+if b'max connections (1) reached' not in reply:
+    first.close()
+    test_fail(f'second limited connection was not rejected: {reply!r}')
+
+first.close()
+
+deadline = time.monotonic() + 10
+while True:
+    third, reply = open_module('limited')
+    if reply == b'@RSYNCD: OK\n':
+        third.close()
+        break
+    third.close()
+    if time.monotonic() >= deadline:
+        test_fail(f'connection slot was not released after disconnect: {reply!r}')
+    time.sleep(0.05)
+
+print('daemon enforces max connections and releases its lock after disconnect')
diff --git a/testsuite/daemon-copylinks-parent-escape_test.py b/testsuite/tests/daemon/daemon-copy-links-parent-escape.py
similarity index 59%
rename from testsuite/daemon-copylinks-parent-escape_test.py
rename to testsuite/tests/daemon/daemon-copy-links-parent-escape.py
index cfdf6045b..19860169b 100644
--- a/testsuite/daemon-copylinks-parent-escape_test.py
+++ b/testsuite/tests/daemon/daemon-copy-links-parent-escape.py
@@ -1,28 +1,9 @@
 #!/usr/bin/env python3
-"""--copy-links may follow ".." inside the module, but never out of it.
-
-Allowing a parent-relative symlink target to resolve at all is a loosening:
-the resolver used to refuse every literal ".." at the front door, which
-protected the module boundary by accident while also breaking legitimate
-in-module targets.  Now the fd-anchored walk decides, popping a held parent
-descriptor per ".." and refusing to pop above the module root.
-
-So both directions need holding down together, which is what this checks:
-
-  in-module  ../target.txt   file symlink -> dereferenced (the loosening works)
-  in-module  ../targetdir    dir  symlink -> dereferenced
-  escaping   ../../outside/* file symlink -> refused, no content leaves
-  escaping   ../../outside/* dir  symlink -> refused, no content leaves
-
-A file and a directory symlink are both covered because they take different
-paths through the sender -- the directory one already understood "..", the
-file one did not, which is the asymmetry this fix removes.
-"""
 
 import os
 import subprocess
 
-from rsyncfns import (
+from harness.rsync import (
     SCRATCHDIR, makepath, rmtree, rsync_argv, start_test_daemon, test_fail,
     write_daemon_conf,
 )
@@ -43,7 +24,6 @@
 
 (module / 'target.txt').write_text(IN_FILE)
 (module / 'targetdir' / 'f.txt').write_text(IN_DIRFILE)
-# Siblings of the module root: reachable only by climbing above it.
 (outside / 'secret.txt').write_text(SECRET)
 (outside / 'outdir' / 's.txt').write_text(DIRSECRET)
 
@@ -57,22 +37,17 @@
 ], name='copylinks-parent-escape.conf')
 url = start_test_daemon(conf, PORT)
 
-# A refused escape makes rsync exit 23; that is the expected outcome here, so
-# the oracle is what landed on disk rather than the exit status.
 proc = subprocess.run(
     rsync_argv('-r', '--copy-links', f'{url}m/sub/', str(dest) + '/'),
     stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True)
 ctx = f'rc={proc.returncode}, output={proc.stdout.strip()[:400]!r}'
 
-# 1. Nothing from above the module root may appear anywhere in the destination.
 for path in sorted(p for p in dest.rglob('*') if p.is_file()):
     body = path.read_text(errors='replace')
     if body in (SECRET, DIRSECRET):
         test_fail(f'--copy-links followed a symlink out of the module: {path} '
                   f'holds out-of-module content ({ctx})')
 
-# 2. The in-module targets must still be dereferenced -- otherwise "no leak"
-#    could be satisfied by refusing everything, which is the bug being fixed.
 got_file = dest / 'in_file'
 if not got_file.is_file() or got_file.is_symlink():
     test_fail(f'in-module ../target.txt was not dereferenced ({ctx})')
diff --git a/testsuite/daemon-copylinks-parent-target-regression_test.py b/testsuite/tests/daemon/daemon-copy-links-parent-target.py
similarity index 61%
rename from testsuite/daemon-copylinks-parent-target-regression_test.py
rename to testsuite/tests/daemon/daemon-copy-links-parent-target.py
index b0cb6fb93..80f35936d 100644
--- a/testsuite/daemon-copylinks-parent-target-regression_test.py
+++ b/testsuite/tests/daemon/daemon-copy-links-parent-target.py
@@ -1,26 +1,21 @@
 #!/usr/bin/env python3
-"""Daemon --copy-links must follow a safe parent-relative symlink target."""
 
 import os
 
-from rsyncfns import (
+from harness.rsync import (
     SCRATCHDIR, forced_protocol, makepath, rmtree, test_fail, test_skipped,
     write_daemon_conf,
 )
-from stdio_daemon import finish_stdio_daemon, start_stdio_daemon
+from harness.daemon import finish_stdio_daemon, start_stdio_daemon
 
-# The hand-rolled client below speaks protocol 30 and greets with it, so a run
-# that pins the daemon lower cannot complete the handshake and just times out.
-# The behaviour under test is not protocol-specific -- the sibling
-# daemon-copylinks-parent-escape drives the same paths with the real client at
-# whatever protocol the run selects.
 _proto = forced_protocol()
 if _proto is not None and _proto < 30:
-    test_skipped(f'the stdio_daemon client speaks protocol 30 (forced {_proto})')
+    test_skipped(f'the stdio daemon client speaks protocol 30 (forced {_proto})',
+                 capability='protocol_30')
 
 PAYLOAD = 'safe-parent-relative-target\n'
 
-base = SCRATCHDIR / 'daemon-copylinks-parent'
+base = SCRATCHDIR / 'daemon-copy-links-parent'
 module = base / 'module'
 dest = base / 'dest'
 rmtree(base)
@@ -40,7 +35,7 @@
         greeting_version=30,
     )
     client.pull(str(dest), preserve_times=False, preserve_perms=False)
-except Exception as exc:  # noqa: BLE001 - retain daemon stderr for the oracle
+except Exception as exc:
     failure = repr(exc)
 daemon_stderr = finish_stdio_daemon(client, daemon)
 
@@ -52,4 +47,4 @@
         f'stderr={daemon_stderr.strip()!r})'
     )
 
-print('daemon-copylinks-parent-target: safe ../ target was dereferenced')
+print('daemon-copy-links-parent-target: safe ../ target was dereferenced')
diff --git a/testsuite/tests/daemon/daemon-copy-links.py b/testsuite/tests/daemon/daemon-copy-links.py
new file mode 100644
index 000000000..64c566862
--- /dev/null
+++ b/testsuite/tests/daemon/daemon-copy-links.py
@@ -0,0 +1,28 @@
+#!/usr/bin/env python3
+
+from harness.rsync import (
+    SCRATCHDIR, assert_same, makepath, rmtree, run_rsync, start_test_daemon,
+    test_fail, write_daemon_conf,
+)
+
+base = SCRATCHDIR / 'daemon-copy-links'
+module = base / 'module'
+destination = base / 'destination'
+rmtree(base)
+makepath(module / 'real-dir', destination)
+(module / 'real-file').write_text('file target\n')
+(module / 'real-dir' / 'nested').write_text('directory target\n')
+(module / 'file-link').symlink_to('real-file')
+(module / 'dir-link').symlink_to('real-dir')
+
+config = write_daemon_conf([('module', {'path': str(module), 'read only': 'yes'})])
+url = start_test_daemon(config, 12935)
+run_rsync('-aL', f'{url}module/', f'{destination}/')
+
+for link, target in (('file-link', 'real-file'), ('dir-link/nested', 'real-dir/nested')):
+    result = destination / link
+    if not result.is_file() or result.is_symlink():
+        test_fail(f'{link} was not copied as a regular file')
+    assert_same(result, module / target, label=link)
+
+print('daemon --copy-links follows in-module file and directory symlinks')
diff --git a/testsuite/daemon-delete-stats_test.py b/testsuite/tests/daemon/daemon-delete-stats.py
similarity index 78%
rename from testsuite/daemon-delete-stats_test.py
rename to testsuite/tests/daemon/daemon-delete-stats.py
index 3639a5b19..83d481789 100644
--- a/testsuite/daemon-delete-stats_test.py
+++ b/testsuite/tests/daemon/daemon-delete-stats.py
@@ -1,15 +1,13 @@
 #!/usr/bin/env python3
-"""Daemon upload delete stats report deleted files."""
 
 import subprocess
 
-from rsyncfns import (
+from harness.rsync import (
     FROMDIR, TODIR,
     build_rsyncd_conf, forced_protocol, makepath, rmtree, rsync_argv,
     start_test_daemon, test_fail,
 )
 
-
 DAEMON_PORT = 12899
 
 src = FROMDIR
@@ -39,9 +37,6 @@
 if '*deleting   delete.txt' not in out:
     test_fail(f"daemon upload did not itemize the deleted file:\n{out}")
 
-# The delete-stats summary line is only sent to the client at protocol >= 31
-# (the NDX_DEL_STATS message); an older client can't receive the count, so
-# only assert it when the protocol isn't pinned below 31.
 pv = forced_protocol()
 if pv is None or pv >= 31:
     if 'Number of deleted files: 1 (reg: 1)' not in out:
diff --git a/testsuite/tests/daemon/daemon-deny-dns-failopen.py b/testsuite/tests/daemon/daemon-deny-dns-failopen.py
new file mode 100644
index 000000000..6b7a45c8d
--- /dev/null
+++ b/testsuite/tests/daemon/daemon-deny-dns-failopen.py
@@ -0,0 +1,39 @@
+#!/usr/bin/env python3
+
+from harness.daemon import probe_module
+from harness.rsync import (
+    FROMDIR, SCRATCHDIR, RSYNC,
+    make_tree, require_tcp, rmtree, start_test_daemon, test_fail,
+)
+
+DAEMON_PORT = 12894
+require_tcp("hosts deny DNS-failure matching needs a real TCP peer")
+
+src = FROMDIR
+rmtree(src)
+make_tree(src, depth=2)
+
+conf = SCRATCHDIR / 'deny-dns.conf'
+conf.write_text(
+    f"pid file = {SCRATCHDIR}/rsyncd.pid\n"
+    "use chroot = no\n"
+    f"log file = {SCRATCHDIR}/rsyncd.log\n"
+    f"\n[plain]\n\tpath = {src}\n\tread only = yes\n"
+    f"\n[deny-match]\n\tpath = {src}\n\tread only = yes\n\thosts deny = 127.0.0.0/8\n"
+    f"\n[deny-nomatch]\n\tpath = {src}\n\tread only = yes\n\thosts deny = 10.0.0.0/8\n"
+    f"\n[deny-unresolvable]\n\tpath = {src}\n\tread only = yes\n\thosts deny = nope.nonexistent.invalid\n"
+)
+url = start_test_daemon(conf, DAEMON_PORT, rsync_cmd=RSYNC)
+
+if probe_module(url, 'plain') != 0:
+    test_fail("control: connection to [plain] (no deny) should be ALLOWED but was refused")
+if probe_module(url, 'deny-match') == 0:
+    test_fail("control: [deny-match] (hosts deny = 127.0.0.0/8) should be DENIED but succeeded")
+if probe_module(url, 'deny-nomatch') != 0:
+    test_fail("control: [deny-nomatch] (hosts deny = 10.0.0.0/8, non-matching) should be ALLOWED but was refused")
+
+if probe_module(url, 'deny-unresolvable') == 0:
+    test_fail("[deny-unresolvable] (hosts deny = nope.nonexistent.invalid) was ALLOWED: "
+              "an unresolvable deny token failed OPEN (KI-43)")
+
+print("daemon-deny-dns-failopen: unresolvable hosts-deny token fails closed")
diff --git a/testsuite/daemon-dot-file-force-wipe_test.py b/testsuite/tests/daemon/daemon-dot-file-force-wipe.py
similarity index 91%
rename from testsuite/daemon-dot-file-force-wipe_test.py
rename to testsuite/tests/daemon/daemon-dot-file-force-wipe.py
index 895f3f68b..35960a43e 100644
--- a/testsuite/daemon-dot-file-force-wipe_test.py
+++ b/testsuite/tests/daemon/daemon-dot-file-force-wipe.py
@@ -1,13 +1,12 @@
 #!/usr/bin/env python3
-"""A write client must not use a forged dot entry to wipe a daemon module."""
 
 import time
 
-from rsyncfns import (
+from harness.rsync import (
     SCRATCHDIR, claim_ports, makepath, require_tcp, rmtree, start_rsyncd,
     test_fail,
 )
-import rsync_proto as rp
+from harness import protocol as rp
 
 PORT = 13013
 
diff --git a/testsuite/daemon-early-exec-nameconv_test.py b/testsuite/tests/daemon/daemon-early-exec-nameconv.py
similarity index 53%
rename from testsuite/daemon-early-exec-nameconv_test.py
rename to testsuite/tests/daemon/daemon-early-exec-nameconv.py
index deba2a9e2..37b5826af 100644
--- a/testsuite/daemon-early-exec-nameconv_test.py
+++ b/testsuite/tests/daemon/daemon-early-exec-nameconv.py
@@ -1,29 +1,23 @@
 #!/usr/bin/env python3
-"""Daemon coverage: `early exec` and `name converter` module hooks.
-
-daemon-exec_test.py covers pre-xfer/post-xfer exec; this fills in the other
-two start_pre_exec() callers in clientserver.c:
-
-  early exec     -- runs before the @RSYNCD: OK, before pre-xfer exec, with
-                    request="(NONE)" and the client's --early-input bytes on
-                    its stdin (write_pre_exec_args type 1).
-  name converter -- a long-running script that the daemon queries via
-                    namecvt_call() (uidlist.c) for every uid/gid <-> name
-                    mapping, used when chroot would hide /etc/passwd.
-
-Both go through the start_pre_exec() forked-child path that 845fd1103113
-made gcov-visible.
-"""
 
 import os
 import pwd
 import subprocess
 import time
 
-from rsyncfns import (
-    FROMDIR, SCRATCHDIR, SRCDIR,
-    make_tree, makepath, owners_supported, rmtree, rsync_argv,
-    start_test_daemon, test_fail, test_skipped, write_daemon_conf,
+from harness.rsync import (
+    FROMDIR,
+    SCRATCHDIR,
+    SRCDIR,
+    make_tree,
+    makepath,
+    owners_supported,
+    rmtree,
+    rsync_argv,
+    start_test_daemon,
+    test_fail,
+    write_daemon_conf,
+    write_text_file,
 )
 
 DAEMON_PORT = 12891
@@ -39,28 +33,17 @@
 dest_conv = SCRATCHDIR / 'dest-conv'
 makepath(dest_early, dest_conv)
 
-
-def script(name, body):
-    p = SCRATCHDIR / name
-    p.write_text('#!/bin/sh\n' + body)
-    p.chmod(0o755)
-    return p
-
-
-# early-exec: capture RSYNC_MODULE_NAME (set before start_pre_exec) and the
-# --early-input bytes (piped to the child's stdin after the request/argv).
-early = script(
-    'early.sh',
-    f'printf "%s|" "$RSYNC_MODULE_NAME" > {markers}/early\n'
+early = write_text_file(
+    SCRATCHDIR / 'early.sh',
+    f'#!/bin/sh\nprintf "%s|" "$RSYNC_MODULE_NAME" > {markers}/early\n'
     f'cat >> {markers}/early\n',
+    0o755,
 )
 
-# name converter: log every request to a marker so the test can verify
-# namecvt_call() actually drove it, then defer to the shipped support script
-# for the answer.
-nameconv = script(
-    'nameconv.sh',
-    f'tee -a {markers}/nameconv | python3 {SRCDIR}/support/nameconvert\n',
+nameconv = write_text_file(
+    SCRATCHDIR / 'nameconv.sh',
+    f'#!/bin/sh\ntee -a {markers}/nameconv | python3 {SRCDIR}/support/nameconvert\n',
+    0o755,
 )
 
 early_input = SCRATCHDIR / 'early-input.bin'
@@ -74,15 +57,11 @@ def script(name, body):
     ('conv', {
         'path': str(dest_conv), 'read only': 'no', 'use chroot': 'no',
         'name converter': str(nameconv),
-        # Force name<->id mapping so uidlist.c hits namecvt_call().
         'numeric ids': 'no',
     }),
 ], name='early-nameconv.conf')
 url = start_test_daemon(conf, DAEMON_PORT)
 
-
-# --- early exec -------------------------------------------------------------
-
 r = subprocess.run(
     rsync_argv('-r', f'--early-input={early_input}', f'{src}/', f'{url}early/'),
     capture_output=True, text=True,
@@ -96,13 +75,6 @@ def script(name, body):
 if got != 'early|EARLY-PAYLOAD':
     test_fail(f"early-exec env/--early-input wrong: {got!r}")
 
-
-# --- name converter ---------------------------------------------------------
-
-# recv_add_id() only calls user_to_uid()/group_to_gid() (-> namecvt_call) when
-# the incoming id is NON-zero, so the source tree needs a non-root owner.
-# Pick any non-root passwd entry that exists in this environment; skip the
-# name-converter half if there isn't one (or we can't chown).
 nonroot = next((p for p in pwd.getpwall() if p.pw_uid != 0 and p.pw_gid != 0), None)
 if not owners_supported() or nonroot is None:
     print("daemon-early-exec-nameconv: early-exec ok; "
@@ -111,8 +83,6 @@ def script(name, body):
 for p in src.rglob('*'):
     os.chown(p, nonroot.pw_uid, nonroot.pw_gid)
 
-# -og (preserve owner+group) without --numeric-ids: the daemon receiver maps
-# the sender's uid/gid names through namecvt_call() -> our script.
 r = subprocess.run(
     rsync_argv('-rog', f'{src}/', f'{url}conv/'),
     capture_output=True, text=True,
@@ -120,7 +90,6 @@ def script(name, body):
 if r.returncode != 0:
     test_fail(f"push to [conv] failed (rc={r.returncode}):\n{r.stderr}")
 
-# The converter is a co-process; give it a moment to flush the tee.
 nm = markers / 'nameconv'
 deadline = time.monotonic() + 5
 while time.monotonic() < deadline and not (nm.is_file() and nm.stat().st_size):
@@ -129,13 +98,11 @@ def script(name, body):
     test_fail("name-converter script never received any namecvt_call() requests")
 
 reqs = nm.read_text().splitlines()
-# At minimum: a 'usr <name>' and a 'grp <name>' for the sending user's uid/gid.
 if not any(l.startswith('usr ') for l in reqs):
     test_fail(f"name-converter saw no 'usr' request: {reqs!r}")
 if not any(l.startswith('grp ') for l in reqs):
     test_fail(f"name-converter saw no 'grp' request: {reqs!r}")
 
-# And the dest tree's owner should have been mapped through to the same uid.
 some_dest = next(p for p in dest_conv.rglob('*') if p.is_file())
 st = os.stat(some_dest)
 if st.st_uid != nonroot.pw_uid:
diff --git a/testsuite/daemon-exclude-from-outside-module_test.py b/testsuite/tests/daemon/daemon-exclude-from-outside-module.py
similarity index 59%
rename from testsuite/daemon-exclude-from-outside-module_test.py
rename to testsuite/tests/daemon/daemon-exclude-from-outside-module.py
index 3a86af67c..c5ca07140 100644
--- a/testsuite/daemon-exclude-from-outside-module_test.py
+++ b/testsuite/tests/daemon/daemon-exclude-from-outside-module.py
@@ -1,22 +1,8 @@
 #!/usr/bin/env python3
-"""A daemon's own "exclude from" file may live outside the module root.
-
-"exclude from" / "include from" / "filter" name operator-configured paths, and
-pointing them at something like /etc/rsync/excludes is the ordinary way to
-write them -- rsyncd.conf(5) puts no constraint on where the file lives.
-
-parse_filter_file() confines a PEER-driven merge file to the module root, since
-a non-chrooted daemon writes --backup-dir entries as root and a raced backup
-symlink is therefore root-owned, which the ownership walk trusts (see
-filter-leak).  That confinement must not extend to the operator's own
-parameters: applying it to these three refuses the file outright and takes the
-whole connection down with it, for a config that has nothing to do with the
-attack.
-"""
 
 import subprocess
 
-from rsyncfns import (
+from harness.rsync import (
     SCRATCHDIR, makepath, rmtree, rsync_argv, start_test_daemon, test_fail,
     write_daemon_conf,
 )
@@ -32,7 +18,6 @@
 
 (module / 'keep.txt').write_text('KEEP\n')
 (module / 'drop.txt').write_text('DROP\n')
-# Deliberately a sibling of the module root, not inside it.
 (etc / 'excludes').write_text('drop.txt\n')
 
 conf = write_daemon_conf([
diff --git a/testsuite/daemon-exclude-namebased_test.py b/testsuite/tests/daemon/daemon-exclude-namebased.py
similarity index 53%
rename from testsuite/daemon-exclude-namebased_test.py
rename to testsuite/tests/daemon/daemon-exclude-namebased.py
index 84275d551..4d0c5c734 100644
--- a/testsuite/daemon-exclude-namebased_test.py
+++ b/testsuite/tests/daemon/daemon-exclude-namebased.py
@@ -1,31 +1,17 @@
 #!/usr/bin/env python3
-# The daemon exclude/filter matches the LOGICAL module-relative NAME, anchored at
-# the module root -- it is a visibility/tamper filter, not a physical-path
-# boundary.  rsyncd.conf(5) (filter parameter) says a subtree must be excluded
-# with a trailing-slash or "/***" pattern; a bare anchored name protects only an
-# entry literally of that name, not paths under it.  This test makes that
-# documented, name-based behaviour executable (it matches stock rsync 3.2.7).
-#
-# A direct push of a FILE to <excluded>/x2.tx:
-#   exclude = /excluded      (bare name)   -> LANDS  (subtree not protected)
-#   exclude = /excluded/     (dir form)    -> refused
-#   exclude = /excluded/***  (subtree)     -> refused
-# One daemon serves three modules (one per pattern) so a single rsyncd handles
-# all cases -- avoids multi-daemon port/pid churn on some platforms.  Unprivileged.
 
 import subprocess
 
-from rsyncfns import (
+from harness.rsync import (
     SCRATCHDIR, rmtree, rsync_argv, start_test_daemon, test_fail, write_daemon_conf,
 )
 
 DAEMON_PORT = 13010
 
-# (module name, exclude pattern, expect the pushed file to land)
 CASES = [
-    ('bare',    '/excluded',     True),   # bare name: does NOT protect the subtree
-    ('dir',     '/excluded/',    False),  # dir form: protects the subtree
-    ('triple',  '/excluded/***', False),  # documented subtree form: protects
+    ('bare',    '/excluded',     True),
+    ('dir',     '/excluded/',    False),
+    ('triple',  '/excluded/***', False),
 ]
 
 base = SCRATCHDIR / 'daemon-exclude-namebased'
diff --git a/testsuite/daemon-exec-metachar-documented-limit_test.py b/testsuite/tests/daemon/daemon-exec-metachar-documented-limit.py
similarity index 69%
rename from testsuite/daemon-exec-metachar-documented-limit_test.py
rename to testsuite/tests/daemon/daemon-exec-metachar-documented-limit.py
index 4bf638e05..10c3e84e2 100644
--- a/testsuite/daemon-exec-metachar-documented-limit_test.py
+++ b/testsuite/tests/daemon/daemon-exec-metachar-documented-limit.py
@@ -1,43 +1,24 @@
 #!/usr/bin/env python3
-"""The hook metacharacter refusal applies to operator values too, as documented.
-
-rsyncd.conf(5) states this under `pre-xfer exec`: a %VAR% expanded into a hook
-command is refused if the value carries a shell-active character, and that
-applies to EVERY %RSYNC_*% value including ones the operator supplied.  A module
-whose path contains a space therefore cannot be interpolated into a hook, and
-the documented alternative is to read the value from the environment instead.
-
-The refusal is deliberate rather than an oversight -- rsync cannot tell an
-operator's space from an attacker's once both are inside the same string, and
-`path` may itself be built from a peer value (`path = /home/%RSYNC_USER_NAME%`).
-It is pinned here because it is a real usability cost, and if it ever changes
-the manual has to change with it.
-"""
 
 import os
 import shlex
 import subprocess
 
-from rsyncfns import (
+from harness.rsync import (
     SCRATCHDIR, makepath, rmtree, rsync_argv, start_test_daemon, test_fail,
     write_daemon_conf,
 )
 
 REFUSAL = 'holds a shell metacharacter'
 
-# The daemon inherits this process's environment.  If RSYNC_MODULE_PATH happens
-# to be set already, %RSYNC_MODULE_PATH% expands from the inherited value and
-# the workaround half passes even when rsync never exported it -- the check
-# would prove nothing.  Poison it, so a pass means rsync overwrote it.
 os.environ['RSYNC_MODULE_PATH'] = '/inherited-value-that-rsync-must-overwrite'
 
 base = SCRATCHDIR / 'exec-metachar-documented-limit'
 rmtree(base)
-module = base / 'My Backups'          # an ordinary directory name with a space
+module = base / 'My Backups'
 makepath(module)
 (module / 'f.txt').write_text('DATA\n')
 
-# --- interpolated: refused ------------------------------------------------
 dest = base / 'dest'
 makepath(dest)
 conf = write_daemon_conf([
@@ -61,8 +42,6 @@
     test_fail('the transfer failed, but not with the documented metacharacter '
               f'refusal -- something else stopped it: {proc.stdout.strip()[:300]!r}')
 
-# --- read from the environment: works -------------------------------------
-# The manual offers this as the way to use such a value, so it has to work.
 hook = base / 'hook.sh'
 witness = base / 'saw.txt'
 hook.write_text(f'#!/bin/sh\nprintf %s "$RSYNC_MODULE_PATH" > {shlex.quote(str(witness))}\n')
@@ -92,11 +71,6 @@
     test_fail(f'the hook received {got!r} from the environment, not the module '
               f'path {str(module)!r} -- the space did not survive')
 
-# The manual lists the refused characters; only the space is exercised above,
-# so the rest would silently become wrong if the set were narrowed.  Each module
-# path must EXIST and each daemon needs its own log: a path that is merely
-# missing makes the transfer fail on its own, and checking only the exit status
-# then passes whether or not the character was refused.
 port = 12995
 for ch in ('*', '?', '[', ']', '#', '!', '~', '{', '}'):
     mod = base / f'ch{ord(ch)}' / f'x{ch}y'
diff --git a/testsuite/daemon-exec-metachar-refused_test.py b/testsuite/tests/daemon/daemon-exec-metachar-refused.py
similarity index 72%
rename from testsuite/daemon-exec-metachar-refused_test.py
rename to testsuite/tests/daemon/daemon-exec-metachar-refused.py
index 7c7d161df..67be76f69 100644
--- a/testsuite/daemon-exec-metachar-refused_test.py
+++ b/testsuite/tests/daemon/daemon-exec-metachar-refused.py
@@ -1,26 +1,10 @@
 #!/usr/bin/env python3
-"""A peer value carrying shell syntax must not reach a shell-executed hook.
-
-Context-aware quoting is only correct for a single level of shell parsing, and
-a hook may re-parse the substituted word in a nested shell:
-
-    pre-xfer exec = sh -c 'printf %s %RSYNC_USER_NAME% >out'
-
-There the level-1 quotes are removed before the inner shell sees the value, so
-no amount of escaping keeps it as data.  The daemon therefore refuses the value
-outright.  This checks the refusal in each quote context, including the nested
-form, and -- so the rule cannot be satisfied by refusing everything -- that an
-ordinary value still runs the hook and arrives intact.
-
-One daemon serves a module per case: a second daemon cannot lock the shared pid
-file, so starting one per case would only work in the stdio-pipe transport.
-"""
 
 import os
 import subprocess
 from pathlib import Path
 
-from rsyncfns import (
+from harness.rsync import (
     FROMDIR, SCRATCHDIR, make_tree, makepath, rmtree, rsync_argv,
     start_test_daemon, test_fail, write_daemon_conf,
 )
@@ -31,8 +15,6 @@
 rmtree(src)
 make_tree(src, depth=1)
 
-# Each quote context the tracker distinguishes, plus the nested-shell form that
-# defeats escaping entirely.  %s is printf's format; the value is its argument.
 TEMPLATES = {
     'unq': 'printf %s {v} >{out}',
     'sq': "printf %s '{v}' >{out}",
@@ -41,8 +23,6 @@
     'nest': "sh -c 'printf %s {v} >{out}'",
 }
 
-# No spaces or ':' are possible in a wire username; ${IFS} supplies the
-# separator once command substitution is live.
 MARKER = 'metachar-pwned'
 HOSTILE = f'$(touch${{IFS}}{MARKER})x'
 BENIGN = 'alice.b-1_x'
@@ -100,7 +80,6 @@
             test_fail(f'peer value executed as shell syntax {ctx}')
         if proc.returncode == 0:
             test_fail(f'hostile value did not fail the transfer {ctx}')
-        # Make sure it failed for the intended reason, not some other error.
         if 'shell metacharacter' not in log:
             test_fail(f'transfer failed but not via the metacharacter refusal {ctx}')
     else:
diff --git a/testsuite/daemon-exec-rsync-env-shell-escape_test.py b/testsuite/tests/daemon/daemon-exec-rsync-env-shell-escape.py
similarity index 80%
rename from testsuite/daemon-exec-rsync-env-shell-escape_test.py
rename to testsuite/tests/daemon/daemon-exec-rsync-env-shell-escape.py
index f0053e1b7..e522b84cb 100644
--- a/testsuite/daemon-exec-rsync-env-shell-escape_test.py
+++ b/testsuite/tests/daemon/daemon-exec-rsync-env-shell-escape.py
@@ -1,8 +1,9 @@
 #!/usr/bin/env python3
+
 import os
 import subprocess
 
-from rsyncfns import SCRATCHDIR, rmtree, rsync_argv, start_test_daemon, test_fail, write_daemon_conf
+from harness.rsync import SCRATCHDIR, rmtree, rsync_argv, start_test_daemon, test_fail, write_daemon_conf
 
 base = SCRATCHDIR / 'exec-env-escape'
 rmtree(base)
@@ -24,8 +25,6 @@
 
 if sentinel.exists():
     test_fail("daemon exec-hook %RSYNC_REQUEST% expansion executed injected shell syntax")
-# A value carrying shell syntax is refused outright rather than quoted, so the
-# hook must not run and the transfer must fail closed.
 if proc.returncode == 0:
     test_fail("daemon exec-hook accepted a %RSYNC_REQUEST% holding shell syntax")
 
diff --git a/testsuite/daemon-exec-second-shell-argument-injection_test.py b/testsuite/tests/daemon/daemon-exec-second-shell-argument-injection.py
old mode 100755
new mode 100644
similarity index 52%
rename from testsuite/daemon-exec-second-shell-argument-injection_test.py
rename to testsuite/tests/daemon/daemon-exec-second-shell-argument-injection.py
index 38342a836..24654580a
--- a/testsuite/daemon-exec-second-shell-argument-injection_test.py
+++ b/testsuite/tests/daemon/daemon-exec-second-shell-argument-injection.py
@@ -1,33 +1,9 @@
 #!/usr/bin/env python3
-"""A peer value with no EXECUTING character still selects a command.
-
-`pre-xfer exec = sh -c '.../%RSYNC_USER_NAME% ...'` re-parses the substituted
-word in a SECOND shell.  rsync escapes for the quoting context it sees, which is
-correct for the outer shell only; the inner one gets the value bare.  A username
-of `touc?` carries nothing that can execute in one level of parsing -- which
-is why the original character set let it through -- yet the inner shell
-glob-expands `<dir>/touc?` to `<dir>/touch` and runs it.  ('?' is refused now,
-which is what this test pins; it was not when the hole was found.)  The substitution has stopped being data and has chosen the command.
-
-Two things this test has to avoid.
-
-It must not pass merely because nothing happened: an absent marker plus a
-non-zero exit is equally true when authentication failed, when the daemon could
-not start, or when the globbed command was missing.  So the daemon log is
-required to carry the specific refusal.
-
-And it must not pass because the attack was inert here.  The control below runs
-the same nested-shell expansion directly and requires it to work, so a pass
-means rsync refused a live attack rather than that the mechanism never fired in
-this environment.  The command it globs onto is one this test creates, rather
-than /usr/bin/touch -- a hardcoded system path would make the whole thing hinge
-on a binary the build never guaranteed.
-"""
 
 import os
 import subprocess
 
-from rsyncfns import (
+from harness.rsync import (
     SCRATCHDIR, makepath, rmtree, rsync_argv, start_test_daemon, test_fail,
     write_daemon_conf,
 )
@@ -40,18 +16,12 @@
 makepath(module)
 sentinel = module / 'pwned'
 
-# The command the glob resolves to.  Ours, so the test does not depend on a
-# system binary's presence or on its argument handling.  Exactly one file in
-# this directory matches "touc?", so the expansion is unambiguous.
 bindir = base / 'bin'
 makepath(bindir)
 victim = bindir / 'touch'
 victim.write_text('#!/bin/sh\n: > "$1"\n')
 victim.chmod(0o755)
 
-# Data to the outer shell, a pathname expansion in the nested one.  '?' IS in
-# shell_unsafe_value()'s set today -- that is the point: this asserts it stays
-# there.
 user = 'touc?'
 password = 'known-password'
 secrets = base / 'secrets'
@@ -61,11 +31,7 @@
 pwfile.write_text(password + '\n')
 pwfile.chmod(0o600)
 
-# --- positive control: the attack must be live in this environment ---------
 control = base / 'control-marker'
-# The OUTER shell must be the one rsync would use -- shell_exec() honours
-# RSYNC_SHELL -- or the control can succeed on /bin/sh while rsync's hook path
-# could not have run at all, and "the attack is live here" would be false.
 outer = os.environ.get('RSYNC_SHELL') or '/bin/sh'
 subprocess.run([outer, '-c', f"sh -c '{bindir}/touc? {control}'"],
                stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True)
@@ -74,7 +40,6 @@
               'environment, so this test cannot show rsync refusing it; the '
               'check below would pass no matter what rsync did')
 
-# --- the daemon must refuse the same value --------------------------------
 conf = write_daemon_conf([
     ('m', {
         'path': str(module), 'read only': 'no', 'auth users': '*',
diff --git a/testsuite/daemon-exec-singlequote-injection_test.py b/testsuite/tests/daemon/daemon-exec-singlequote-injection.py
similarity index 67%
rename from testsuite/daemon-exec-singlequote-injection_test.py
rename to testsuite/tests/daemon/daemon-exec-singlequote-injection.py
index 60d533b25..4a921041c 100644
--- a/testsuite/daemon-exec-singlequote-injection_test.py
+++ b/testsuite/tests/daemon/daemon-exec-singlequote-injection.py
@@ -1,20 +1,10 @@
 #!/usr/bin/env python3
-"""PoC: shell-escaped %RSYNC_USER_NAME% is unsafe inside single quotes.
-
-expand_vars_shell_escape() produces a shell word of the form 'value'.  That is
-safe when substituted into an unquoted command, but a common hook such as
-
-    pre-xfer exec = printf '%RSYNC_USER_NAME%' >/dev/null
-
-already supplies single quotes.  The generated quotes cancel those quotes and
-leave an authenticated client's username in shell syntax context.
-"""
 
 import os
 import subprocess
 from pathlib import Path
 
-from rsyncfns import (
+from harness.rsync import (
     FROMDIR, SCRATCHDIR, make_tree, makepath, rmtree, rsync_argv,
     start_test_daemon, test_fail, write_daemon_conf,
 )
@@ -28,14 +18,10 @@
 rmtree(dest)
 makepath(dest)
 
-# A slash would be interpreted as the URL's module separator before the client
-# sends the username, so create the marker in the daemon's inherited cwd.
 sentinel = Path.cwd() / 'exec-singlequote-pwned'
 if sentinel.exists():
     sentinel.unlink()
 
-# No spaces or ':' are needed in the wire username.  ${IFS} becomes a shell
-# separator only after the broken quote composition exposes the value.
 user = f';touch${{IFS}}{sentinel.name};true'
 password = 'known-password'
 
@@ -73,8 +59,6 @@
         f"single-quoted %RSYNC_USER_NAME% hook (rc={proc.returncode}):\n"
         f"{proc.stderr}"
     )
-# The username carries shell syntax, so the daemon refuses it rather than
-# trying to quote it; the transfer must fail closed.
 if proc.returncode == 0:
     test_fail(
         "daemon accepted an authenticated username holding shell syntax "
diff --git a/testsuite/daemon-exec_test.py b/testsuite/tests/daemon/daemon-exec.py
similarity index 64%
rename from testsuite/daemon-exec_test.py
rename to testsuite/tests/daemon/daemon-exec.py
index a0669b730..64979418e 100644
--- a/testsuite/daemon-exec_test.py
+++ b/testsuite/tests/daemon/daemon-exec.py
@@ -1,26 +1,19 @@
 #!/usr/bin/env python3
-"""Daemon coverage: pre-xfer exec and post-xfer exec.
-
-A module's pre-xfer/post-xfer exec hooks must run with the documented
-environment (RSYNC_MODULE_NAME, RSYNC_EXIT_STATUS, ...), and a non-zero
-pre-xfer exec must abort the transfer.
-"""
 
 import shlex
 import subprocess
 import time
 
-from rsyncfns import (
+from harness.rsync import (
     FROMDIR, SCRATCHDIR,
     make_tree, makepath, rmtree, rsync_argv, start_test_daemon, test_fail,
-    write_daemon_conf,
+    write_daemon_conf, write_text_file,
 )
+from harness import metadata
 
+metadata(features={'daemon', 'exec-hooks'}, transports={'pipe', 'tcp'}, min_peer='2.6.0', mutates={'filesystem', 'process', 'socket'}, tags={'daemon', 'process', 'version-mix'})
 
 def wait_for(path, want, secs=5):
-    """Poll for a marker file to contain `want`. post-xfer exec runs on the
-    daemon side after the client disconnects (a real race under --use-tcp),
-    so we must wait for it rather than check immediately."""
     deadline = time.monotonic() + secs
     while time.monotonic() < deadline:
         if path.is_file() and path.read_text().strip() == want:
@@ -41,18 +34,17 @@ def wait_for(path, want, secs=5):
 faildir = SCRATCHDIR / 'faildest'
 makepath(hookdir, faildir)
 
-
-def script(name, body):
-    p = SCRATCHDIR / name
-    p.write_text('#!/bin/sh\n' + body)
-    p.chmod(0o755)
-    return p
-
-
-pre = script('pre.sh', f'echo "$RSYNC_MODULE_NAME" > {shlex.quote(str(markers / "pre.out"))}\nexit 0\n')
-post = script('post.sh', f'echo "$RSYNC_EXIT_STATUS" > {shlex.quote(str(markers / "post.out"))}\n'
-                         'exit 0\n')
-prefail = script('prefail.sh', 'exit 1\n')
+pre = write_text_file(
+    SCRATCHDIR / 'pre.sh',
+    f'#!/bin/sh\necho "$RSYNC_MODULE_NAME" > {shlex.quote(str(markers / "pre.out"))}\nexit 0\n',
+    0o755,
+)
+post = write_text_file(
+    SCRATCHDIR / 'post.sh',
+    f'#!/bin/sh\necho "$RSYNC_EXIT_STATUS" > {shlex.quote(str(markers / "post.out"))}\nexit 0\n',
+    0o755,
+)
+prefail = write_text_file(SCRATCHDIR / 'prefail.sh', '#!/bin/sh\nexit 1\n', 0o755)
 
 conf = write_daemon_conf([
     ('hook', {'path': hookdir, 'read only': 'no',
@@ -63,7 +55,6 @@ def script(name, body):
 ])
 url = start_test_daemon(conf, DAEMON_PORT)
 
-# --- pre/post hooks run with the documented environment ---------------------
 proc = subprocess.run(rsync_argv('-a', f'{src}/', f'{url}hook/'),
                       stdout=subprocess.DEVNULL, stderr=subprocess.PIPE,
                       text=True)
@@ -74,7 +65,6 @@ def script(name, body):
 if not wait_for(markers / 'post.out', '0'):
     test_fail("post-xfer exec did not run with RSYNC_EXIT_STATUS=0")
 
-# --- a failing pre-xfer exec aborts the transfer ----------------------------
 proc = subprocess.run(rsync_argv('-a', f'{src}/', f'{url}failhook/'),
                       stdout=subprocess.DEVNULL, stderr=subprocess.PIPE,
                       text=True)
diff --git a/testsuite/tests/daemon/daemon-filter-merge-bypass.py b/testsuite/tests/daemon/daemon-filter-merge-bypass.py
new file mode 100644
index 000000000..157a4d1f4
--- /dev/null
+++ b/testsuite/tests/daemon/daemon-filter-merge-bypass.py
@@ -0,0 +1,49 @@
+#!/usr/bin/env python3
+
+import subprocess
+
+from harness.rsync import (
+    SCRATCHDIR, makepath, rmtree, rsync_argv, start_test_daemon,
+    test_fail, write_daemon_conf,
+)
+
+DAEMON_PORT = 12921
+
+mod = SCRATCHDIR / 'srvmod'
+rmtree(mod)
+makepath(mod / 'secret')
+(mod / 'public.txt').write_text("PUBLIC\n")
+(mod / 'secret' / 'rules').write_text("- *\n")
+
+conf = write_daemon_conf([
+    ('mod', {'path': str(mod),
+             'read only': 'yes',
+             'filter': '- /secret/***'}),
+])
+url = start_test_daemon(conf, DAEMON_PORT)
+
+def pull(args, dest):
+    rmtree(dest)
+    makepath(dest)
+    return subprocess.run(rsync_argv('-a', *args, f'{url}mod/', f'{dest}/'),
+                          stdout=subprocess.DEVNULL,
+                          stderr=subprocess.PIPE, text=True)
+
+base_dest = SCRATCHDIR / 'base'
+rc = pull([], base_dest)
+if rc.returncode not in (0, 23):
+    test_fail(f"baseline pull failed (rc={rc.returncode}): {rc.stderr!r}")
+if not (base_dest / 'public.txt').is_file():
+    test_fail('baseline did not transfer public.txt')
+if (base_dest / 'secret' / 'rules').exists():
+    test_fail('baseline exposed /secret/rules')
+
+atk_dest = SCRATCHDIR / 'atk'
+rc = pull(['-M', '--filter=._/secret/rules'], atk_dest)
+if (atk_dest / 'secret' / 'rules').exists():
+    test_fail('daemon delivered hidden merge file /secret/rules')
+
+if not (atk_dest / 'public.txt').is_file():
+    test_fail('daemon parsed hidden merge file /secret/rules')
+
+print('daemon filter refused the hidden merge file')
diff --git a/testsuite/daemon-filter_test.py b/testsuite/tests/daemon/daemon-filter.py
similarity index 82%
rename from testsuite/daemon-filter_test.py
rename to testsuite/tests/daemon/daemon-filter.py
index 59566068c..cb41eb319 100644
--- a/testsuite/daemon-filter_test.py
+++ b/testsuite/tests/daemon/daemon-filter.py
@@ -1,19 +1,16 @@
 #!/usr/bin/env python3
-"""Daemon coverage: exclude, incoming chmod, outgoing chmod (at depth).
-
-A daemon-side exclude must hide matching files everywhere in the module tree;
-incoming/outgoing chmod must rewrite the permissions of every transferred file,
-including ones several levels deep.
-"""
 
 import os
 import subprocess
 
-from rsyncfns import (
+from harness.rsync import (
     FROMDIR, SCRATCHDIR,
     assert_mode, assert_not_exists, assert_same, make_tree, makepath, rmtree,
     rsync_argv, start_test_daemon, test_fail, walk_files, write_daemon_conf,
 )
+from harness import metadata
+
+metadata(features={'daemon', 'filters'}, transports={'pipe', 'tcp'}, min_peer='2.6.0', mutates={'filesystem', 'process', 'socket'}, tags={'daemon', 'metadata', 'transfer', 'version-mix'})
 
 DAEMON_PORT = 12887
 
@@ -36,7 +33,6 @@
 ])
 url = start_test_daemon(conf, DAEMON_PORT)
 
-
 def pull(mod, dest):
     rmtree(dest)
     makepath(dest)
@@ -46,8 +42,6 @@ def pull(mod, dest):
     if proc.returncode not in (0, 23):
         test_fail(f"pull from {mod} failed (rc={proc.returncode}): {proc.stderr}")
 
-
-# --- daemon exclude hides *.secret everywhere in the module -----------------
 fp = SCRATCHDIR / 'filtpull'
 pull('filt', fp)
 assert_not_exists(fp / 'a.secret', label='daemon exclude top')
@@ -55,7 +49,6 @@ def pull(mod, dest):
 assert_same(fp / 'd1' / 'd2' / 'f2', src / 'd1' / 'd2' / 'f2',
             label='daemon exclude kept others')
 
-# --- incoming chmod rewrites pushed file modes at depth ---------------------
 proc = subprocess.run(rsync_argv('-a', f'{src}/', f'{url}inc/'),
                       stdout=subprocess.DEVNULL, stderr=subprocess.PIPE,
                       text=True)
@@ -70,7 +63,6 @@ def pull(mod, dest):
 if checked == 0:
     test_fail("incoming chmod test transferred no files")
 
-# --- outgoing chmod rewrites pulled file modes at depth ---------------------
 op = SCRATCHDIR / 'outpull'
 pull('out', op)
 checked = 0
diff --git a/testsuite/daemon-groupmap-wild_test.py b/testsuite/tests/daemon/daemon-groupmap-wild.py
similarity index 51%
rename from testsuite/daemon-groupmap-wild_test.py
rename to testsuite/tests/daemon/daemon-groupmap-wild.py
index 1f67846f4..111a5fc00 100644
--- a/testsuite/daemon-groupmap-wild_test.py
+++ b/testsuite/tests/daemon/daemon-groupmap-wild.py
@@ -1,39 +1,15 @@
 #!/usr/bin/env python3
-# Regression test for issue #829.
-#
-# Without --secluded-args the client's safe_arg() backslash-escapes wildcard
-# chars in option values, so --chown / --groupmap=*:GROUP is sent to a daemon
-# as --groupmap=\*:GROUP.  A daemon has no shell to strip the backslash, and
-# read_args() used to store option args verbatim, so the receiver saw the
-# literal "\*", the wildcard never matched, and the map was ignored (the
-# module's configured gid won instead).  The fix un-backslashes daemon option
-# args.
-#
-# We run it both ways:
-#   * default args    -- the '*' is safe_arg-escaped and the daemon must
-#                        un-backslash it (the path the fix repairs);
-#   * --secluded-args -- the '*' is sent raw over the protected channel and
-#                        read with unescape=0, so it must keep working too
-#                        (a guard that the fix didn't disturb that path).
-#
-# No root needed: a non-root receiver can chgrp(2) to a group the test user
-# belongs to, so we map every source group to a second such group and check
-# the wildcard took effect.
 
 import os
 import subprocess
 
-from rsyncfns import (
+from harness.rsync import (
     SCRATCHDIR, makepath, rmtree, rsync_argv, start_test_daemon,
     test_fail, test_skipped, write_daemon_conf,
 )
 
 DAEMON_PORT = 12923
 
-# Two distinct groups to map between.  As root (the usual CI case) we can
-# chgrp(2) to any gid, so take two distinct named groups from the group
-# database; a non-root user can only chgrp to groups it belongs to, so use those
-# (skip if it is in fewer than two).
 if os.geteuid() == 0:
     import grp
     usable = []
@@ -58,7 +34,6 @@
 conf = write_daemon_conf([('gmod', {'path': str(moddir), 'read only': 'no'})])
 url = start_test_daemon(conf, DAEMON_PORT) + 'gmod/'
 
-
 def check(label, *extra_opts):
     rmtree(moddir)
     rmtree(srcdir)
@@ -66,10 +41,8 @@ def check(label, *extra_opts):
     makepath(srcdir)
     f = srcdir / 'f.dat'
     f.write_text("hi\n")
-    os.chown(f, -1, src_gid)        # source group differs from the map target
+    os.chown(f, -1, src_gid)
 
-    # A --chown-style wildcard map sent to a daemon: the '*' must survive as a
-    # wildcard so every source group is remapped to dst_gid.
     proc = subprocess.run(
         rsync_argv('-rg', *extra_opts, f'--groupmap=*:{dst_gid}', str(f), url),
         stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True)
@@ -82,6 +55,5 @@ def check(label, *extra_opts):
         test_fail(f"[{label}] --groupmap='*:{dst_gid}' wildcard ignored over "
                   f"daemon: got gid {got}, expected {dst_gid} (regression of #829)")
 
-
 check('default-args')
 check('secluded-args', '--secluded-args')
diff --git a/testsuite/tests/daemon/daemon-gzip.py b/testsuite/tests/daemon/daemon-gzip.py
new file mode 100644
index 000000000..5f9e2293d
--- /dev/null
+++ b/testsuite/tests/daemon/daemon-gzip.py
@@ -0,0 +1,16 @@
+#!/usr/bin/env python3
+
+from harness import metadata
+from harness.rsync import (CHKDIR, FROMDIR, TODIR, build_rsyncd_conf, checkit, hands_setup, rmtree,
+                      run_rsync, start_test_daemon)
+
+metadata(features={'compression', 'daemon'}, transports={'pipe', 'tcp'}, min_peer='2.6.0', mutates={'filesystem', 'process', 'socket'}, tags={'daemon', 'transfer', 'version-mix'})
+
+hands_setup()
+run_rsync('-av', '--exclude=foobar.baz', f'{FROMDIR}/', f'{CHKDIR}/')
+url = start_test_daemon(build_rsyncd_conf(), 12879)
+
+checkit(['-avvvvzz', f'{FROMDIR}/', f'{url}test-to/'], CHKDIR, TODIR, allowed_codes=(0, 23))
+rmtree(TODIR)
+TODIR.mkdir()
+checkit(['-avvvvzz', f'{url}test-from/', f'{TODIR}/'], CHKDIR, TODIR, allowed_codes=(0, 23))
diff --git a/testsuite/daemon-handshake-timeout_test.py b/testsuite/tests/daemon/daemon-handshake-timeout.py
similarity index 68%
rename from testsuite/daemon-handshake-timeout_test.py
rename to testsuite/tests/daemon/daemon-handshake-timeout.py
index 266a30a3c..6ee4e56f1 100644
--- a/testsuite/daemon-handshake-timeout_test.py
+++ b/testsuite/tests/daemon/daemon-handshake-timeout.py
@@ -1,25 +1,18 @@
 #!/usr/bin/env python3
-"""Exercise the absolute deadline on peer-controlled daemon handshake reads.
-
-The deadline is separate from the transfer's idle timeout.  These probes cover
-the pre-module phase, anonymous modules, both argument reads, module-local
-policy, trickling input, and transfer timeout combinations.  Raw sockets are
-intentional: a normal rsync client never leaves a handshake line unfinished.
-"""
 
 import select
 from pathlib import Path
 import socket
 import time
 
-from rsyncfns import (
+from harness.rsync import (
     RSYNC, SCRATCHDIR, makepath, require_tcp, rmtree, start_test_daemon,
-    test_fail, write_daemon_conf,
+    test_fail, under_valgrind, write_daemon_conf,
 )
 
 require_tcp("raw stalled clients need a real TCP daemon; run with --use-tcp")
 
-BUILTIN = 60                 # DAEMON_HANDSHAKE_TIMEOUT in clientserver.c
+BUILTIN = 60
 FAST = 2
 SLOP = 8
 
@@ -32,13 +25,10 @@
 secrets.write_text('user:password\n')
 secrets.chmod(0o600)
 
-
 def port_of(url):
     return int(url.rsplit(':', 1)[1].rstrip('/'))
 
-
 def recv_until(sock, marker, deadline):
-    """Read through marker using an absolute monotonic deadline."""
     data = b''
     while marker not in data:
         left = deadline - time.monotonic()
@@ -54,7 +44,6 @@ def recv_until(sock, marker, deadline):
         data += chunk
     return data
 
-
 def connect(port):
     deadline = time.monotonic() + 10
     left = deadline - time.monotonic()
@@ -65,7 +54,6 @@ def connect(port):
     recv_until(sock, b'\n', deadline)
     return sock
 
-
 def open_module(port, name):
     sock = connect(port)
     sock.sendall(b'@RSYNCD: 31.0\n' + name.encode() + b'\n')
@@ -74,20 +62,11 @@ def open_module(port, name):
         test_fail(f"module {name!r} was not accepted: {got!r}")
     return sock
 
-
-# What the daemon writes when its own deadline fires (io.c).  Nothing else in
-# its log means "this close was the timeout".
 _TIMEOUT_MARKERS = ("daemon handshake timeout", "io timeout after")
 
 _LOG_TAIL_BYTES = 4096
 
-
 def _log_mark(path):
-    """Size of the daemon log now, so a later read can ignore what came before.
-
-    The daemons are long-lived and shared across observations, so an older
-    timeout line must not be read as evidence about this one.
-    """
     if not path:
         return None
     try:
@@ -95,9 +74,7 @@ def _log_mark(path):
     except OSError:
         return 0
 
-
 def _log_since(path, mark):
-    """The daemon's log text written since `mark`, bounded and printable."""
     if not path or mark is None:
         return ""
     try:
@@ -108,58 +85,30 @@ def _log_since(path, mark):
         return ""
     clipped = len(raw) > _LOG_TAIL_BYTES
     text = raw[:_LOG_TAIL_BYTES].decode('utf-8', 'replace')
-    # A daemon log should be text, but a corrupted one must not turn a clear
-    # failure into an unreadable one.
     text = ''.join(c if c == '\n' or ' ' <= c <= '~' else '.' for c in text)
     return text + ('...[truncated]' if clipped else '')
 
-
 def _timed_out_since(path, mark):
-    """Did the daemon record its own deadline firing during this observation?"""
     text = _log_since(path, mark)
     return any(m in text for m in _TIMEOUT_MARKERS)
 
-
 def _clock_note(wall, mono):
-    """State the clock discrepancy without drawing a conclusion from it.
-
-    A stalled guest resyncing its wall clock produces this, but so does an NTP
-    or manual step, and either can coexist with a genuine rsync failure -- so
-    report the numbers and leave the cause to the log.
-    """
     if mono is None:
         return ""
     if abs(wall - mono) < 1.0:
         return ""
-    return (f" [wall={wall:.2f}s vs monotonic={mono:.2f}s: wall time moved "
-            f"{abs(wall - mono):.2f}s relative to monotonic during this "
-            f"observation; the cause of the close is not settled by that alone]")
-
+    return f' [wall={wall:.2f}s monotonic={mono:.2f}s drift={abs(wall - mono):.2f}s]'
 
 def _daemon_log_note(path, mark):
-    """The daemon's own log for this observation, so a close can say why."""
     if not path:
         return ""
     text = _log_since(path, mark).strip()
     if not text:
-        return f" [daemon log {path} recorded nothing during this observation]"
+        return f' [no daemon log output from {path}]'
     return " [daemon log: " + " | ".join(text.splitlines()[-12:]) + "]"
 
-
 def observe_close(sock, expected, label, *, trickle=None, must_close=True,
                   daemon_log=None):
-    """Observe EOF/reset by recv() before an absolute deadline.
-
-    A failed send is only a hint: keep receiving until EOF or a terminal read
-    error.  This avoids the clean-FIN race where a later send can still succeed
-    on Cygwin and some TCP stacks.
-    """
-    # Two clocks on purpose.  The daemon sets its deadline with time(NULL)
-    # (io.c set_daemon_handshake_timeout), so the assertion below has to be made
-    # on the same wall clock it decides with -- a virtualised guest whose wall
-    # clock resyncs after a stall while CLOCK_MONOTONIC does not would otherwise
-    # fail a daemon that timed out exactly when it meant to.  Monotonic still
-    # drives the poll budget, where the job is "do not hang forever".
     start = time.monotonic()
     start_wall = time.time()
     log_mark = _log_mark(daemon_log)
@@ -194,8 +143,6 @@ def observe_close(sock, expected, label, *, trickle=None, must_close=True,
             try:
                 sock.sendall(trickle)
             except OSError:
-                # Do not infer closure from the write side.  FIN/reset/abort is
-                # confirmed by the recv path above on a subsequent iteration.
                 can_send = False
             next_send = now + 0.20
 
@@ -206,25 +153,16 @@ def observe_close(sock, expected, label, *, trickle=None, must_close=True,
                       f"{_daemon_log_note(daemon_log, log_mark)}")
         return None
 
-    # A refusal, parse error, or unrelated daemon failure must not pass as a
-    # timeout.  Leave margin for one-second time() granularity in the daemon.
-    minimum = max(0.5, expected - 1.25)
+    margin = 2.5 if under_valgrind() else 1.25
+    minimum = max(0.5, expected - margin)
     if closed < minimum:
         test_fail(f"{label}: connection closed after {closed:.2f}s, before the "
                   f"expected timeout window ({minimum:.2f}s); this was not the "
                   f"deadline.{_clock_note(closed, closed_mono)}"
                   f"{_daemon_log_note(daemon_log, log_mark)}")
-    # Wall is the clock the daemon decides with, so it is what the bound above
-    # is measured against.  But when monotonic says the close came early and
-    # wall says it was on time, the two disagree and neither settles it alone: a
-    # crash or refusal arriving just as the guest's wall clock caught up would
-    # otherwise read as a clean timeout.  Require the daemon to have said so.
     if closed_mono is not None and closed_mono < minimum \
        and not _timed_out_since(daemon_log, log_mark):
-        test_fail(f"{label}: wall time says the close was on time ({closed:.2f}s) "
-                  f"but monotonic says it came early ({closed_mono:.2f}s), and the "
-                  f"daemon logged no timeout of its own in that window, so this is "
-                  f"not demonstrably the deadline."
+        test_fail(f"{label}: early monotonic close {closed_mono:.2f}s without a timeout log"
                   f"{_clock_note(closed, closed_mono)}"
                   f"{_daemon_log_note(daemon_log, log_mark)}")
     if not must_close:
@@ -233,17 +171,15 @@ def observe_close(sock, expected, label, *, trickle=None, must_close=True,
                   f"{_daemon_log_note(daemon_log, log_mark)}")
     return closed
 
-
 def stall_greeting(port, expected, label, *, daemon_log=None):
     sock = connect(port)
     try:
-        sock.sendall(b'@RSYNCD: 31.0')       # deliberately no newline
+        sock.sendall(b'@RSYNCD: 31.0')
         return observe_close(sock, expected, label, trickle=b'x',
                              daemon_log=daemon_log)
     finally:
         sock.close()
 
-
 def transfer_args(client_timeout=None):
     args = [b'--server', b'--sender', b'-logDtpre.iLsfxCIvu']
     if client_timeout is not None:
@@ -251,7 +187,6 @@ def transfer_args(client_timeout=None):
     args += [b'.', b'/']
     return b'\0'.join(args) + b'\0\0'
 
-
 def stalled_transfer(port, module, expected, label, *, client_timeout=None,
                      must_close=True, daemon_log=None):
     sock = open_module(port, module)
@@ -262,8 +197,6 @@ def stalled_transfer(port, module, expected, label, *, client_timeout=None,
     finally:
         sock.close()
 
-
-# A positive global value governs input before a module is named.
 conf_fast = write_daemon_conf(
     [
         ('zero', {'path': str(mod), 'timeout': '0', 'read only': 'yes'}),
@@ -282,10 +215,6 @@ def stalled_transfer(port, module, expected, label, *, client_timeout=None,
 global_took = stall_greeting(port_fast, FAST, 'global handshake timeout',
                               daemon_log=base / 'fast.log')
 
-
-# Once an anonymous module is named, its local value must cover the claimed
-# slot through the first and the secluded-args read.  Continuous bytes prove
-# this is an absolute deadline, not an idle timeout.
 conf_args = write_daemon_conf(
     [
         ('args', {'path': str(mod), 'timeout': str(FAST), 'read only': 'yes'}),
@@ -326,18 +255,12 @@ def stalled_transfer(port, module, expected, label, *, client_timeout=None,
 
 s = open_module(port_args, 'args')
 try:
-    # The first list selects secluded args and terminates normally.  The second
-    # read gets a never-terminated NUL string and must share the original bound.
     s.sendall(b'--server\0--sender\0-s\0\0')
     second_took = observe_close(s, FAST, 'anonymous secluded-args read', trickle=b'x',
                                 daemon_log=base / 'args.log')
 finally:
     s.close()
 
-
-# Transfer policy is independent: module values may extend the global value,
-# a client may shorten a module, a module may shorten a client, and an explicit
-# module timeout=0 means no transfer timeout at all.
 long_took = stalled_transfer(port_fast, 'long', 5,
                              'module transfer timeout above global',
                              daemon_log=base / 'fast.log')
@@ -351,8 +274,6 @@ def stalled_transfer(port, module, expected, label, *, client_timeout=None,
                  'explicit module timeout=0 transfer', must_close=False,
                  daemon_log=base / 'fast.log')
 
-
-# With no configured timeout, the named and documented built-in bound applies.
 conf_default = write_daemon_conf(
     [('default', {'path': str(mod), 'read only': 'yes'})],
     globals={
diff --git a/testsuite/daemon-http-proxy_test.py b/testsuite/tests/daemon/daemon-http-proxy.py
similarity index 70%
rename from testsuite/daemon-http-proxy_test.py
rename to testsuite/tests/daemon/daemon-http-proxy.py
index 0d71d0a24..8730e9b02 100644
--- a/testsuite/daemon-http-proxy_test.py
+++ b/testsuite/tests/daemon/daemon-http-proxy.py
@@ -1,20 +1,4 @@
 #!/usr/bin/env python3
-"""Coverage: RSYNC_PROXY HTTP CONNECT support (socket.c
-establish_proxy_connection() + open_socket_out()'s proxy branch +
-authenticate.c base64_encode() Proxy-Authorization).
-
-A tiny in-process HTTP CONNECT proxy listens on PROXY_PORT, parses
-`CONNECT host:port HTTP/1.0` (+ optional Proxy-Authorization), responds
-`HTTP/1.0 200 OK`, then transparently relays bytes to the real test
-daemon.  Three legs:
-
-  1. RSYNC_PROXY=host:port (no auth)       -> base CONNECT path
-  2. RSYNC_PROXY=user:pass@host:port       -> base64_encode + Proxy-Auth header
-  3. proxy returns `HTTP/1.0 503 ...`      -> the non-2xx error branch
-
-This is the client-side counterpart to daemon-proxy-protocol_test.py
-(which covers the daemon's PROXY-v1/v2 listener).
-"""
 
 import base64
 import os
@@ -23,14 +7,12 @@
 import subprocess
 import threading
 
-from rsyncfns import (
+from harness.rsync import (
     SCRATCHDIR, FROMDIR,
     claim_ports, make_tree, makepath, require_tcp, rmtree, rsync_argv,
     start_test_daemon, test_fail, write_daemon_conf,
 )
 
-# RSYNC_PROXY only fires on a real TCP socket connect (open_socket_out),
-# not the RSYNC_CONNECT_PROG pipe transport.
 require_tcp("RSYNC_PROXY uses open_socket_out(), needs a real TCP connect")
 
 DAEMON_PORT = 19880
@@ -39,7 +21,8 @@
 
 src = FROMDIR
 dst = SCRATCHDIR / 'dest-httpproxy'
-rmtree(src); rmtree(dst)
+rmtree(src)
+rmtree(dst)
 make_tree(src, depth=1)
 makepath(dst)
 
@@ -53,7 +36,6 @@
 seen_auths = []
 deny_next = threading.Event()
 
-
 def relay(a, b):
     socks = [a, b]
     while True:
@@ -78,15 +60,13 @@ def relay(a, b):
         except OSError:
             pass
 
-
 def proxy_handle(cli):
-    # Read header bytes until blank line. establish_proxy_connection() sends
-    # one CONNECT line + optional Proxy-Authorization line + CRLFCRLF.
     hdr = b''
     while b'\r\n\r\n' not in hdr and len(hdr) < 4096:
         c = cli.recv(1)
         if not c:
-            cli.close(); return
+            cli.close()
+            return
         hdr += c
     lines = hdr.split(b'\r\n')
     seen_connects.append(lines[0].decode('ascii', 'replace'))
@@ -96,12 +76,12 @@ def proxy_handle(cli):
     if deny_next.is_set():
         deny_next.clear()
         cli.sendall(b'HTTP/1.0 503 Service Unavailable\r\n\r\n')
-        cli.close(); return
+        cli.close()
+        return
     cli.sendall(b'HTTP/1.0 200 Connection established\r\n\r\n')
     up = socket.create_connection(('127.0.0.1', DAEMON_PORT))
     relay(cli, up)
 
-
 def proxy_loop(lsock):
     while True:
         try:
@@ -110,19 +90,14 @@ def proxy_loop(lsock):
             return
         threading.Thread(target=proxy_handle, args=(c,), daemon=True).start()
 
-
 lsock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
 lsock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
 lsock.bind(('127.0.0.1', PROXY_PORT))
 lsock.listen(8)
 threading.Thread(target=proxy_loop, args=(lsock,), daemon=True).start()
 
-
 def push_via_proxy(proxy_spec, expect_ok=True):
     env = dict(os.environ, RSYNC_PROXY=proxy_spec)
-    # Any host:port the client asks to CONNECT to is fine; the mock proxy
-    # always relays to DAEMON_PORT regardless. Use a non-loopback name so
-    # the CONNECT line is recognizable.
     r = subprocess.run(
         rsync_argv('-r', f'{src}/',
                    f'rsync://upstream.example:{DAEMON_PORT}/mod/'),
@@ -134,13 +109,10 @@ def push_via_proxy(proxy_spec, expect_ok=True):
         test_fail(f"RSYNC_PROXY={proxy_spec!r}: expected failure, got rc=0")
     return r
 
-
-# --- leg 1: no auth --------------------------------------------------------
 push_via_proxy(f'127.0.0.1:{PROXY_PORT}')
 if not seen_connects or 'CONNECT upstream.example:' not in seen_connects[-1]:
     test_fail(f"mock proxy never saw CONNECT (got: {seen_connects!r})")
 
-# --- leg 2: user:pass@ -> Proxy-Authorization: Basic base64(...) ----------
 seen_auths.clear()
 push_via_proxy(f'puser:ppass@127.0.0.1:{PROXY_PORT}')
 if not seen_auths:
@@ -149,7 +121,6 @@ def push_via_proxy(proxy_spec, expect_ok=True):
 if want not in seen_auths[-1]:
     test_fail(f"Proxy-Authorization mismatch: {seen_auths[-1]!r} vs {want!r}")
 
-# --- leg 3: proxy returns 503 -> client must fail with the bad-response msg
 deny_next.set()
 r = push_via_proxy(f'127.0.0.1:{PROXY_PORT}', expect_ok=False)
 if 'bad response from proxy' not in r.stderr and '503' not in r.stderr:
diff --git a/testsuite/daemon-leaf-type-race-fchmod_test.py b/testsuite/tests/daemon/daemon-leaf-type-race-fchmod.py
similarity index 91%
rename from testsuite/daemon-leaf-type-race-fchmod_test.py
rename to testsuite/tests/daemon/daemon-leaf-type-race-fchmod.py
index ee2052588..9652482e7 100644
--- a/testsuite/daemon-leaf-type-race-fchmod_test.py
+++ b/testsuite/tests/daemon/daemon-leaf-type-race-fchmod.py
@@ -1,16 +1,4 @@
 #!/usr/bin/env python3
-"""A leaf type race must not make the receiver chmod a directory.
-
-The secure resolver probes a non-directory leaf with ``O_DIRECTORY`` and then
-opens it again with the caller's flags.  A Darwin interposer pauses after the
-second failed probe and asks a separately sandboxed path controller to replace
-the regular file with a directory.  The sandbox proves that the controller can
-rename the entries but cannot chmod the directory itself.  A vulnerable
-receiver accepts the directory fd from the second open, changes it from 0755 to
-0600, then leaves the change behind when its write-open fails with EISDIR.
-
-Run via ``runtests.py --use-tcp`` outside an enclosing application sandbox.
-"""
 
 from __future__ import annotations
 
@@ -18,7 +6,6 @@
 import os
 import platform
 import select
-import shlex
 import socket
 import stat
 import subprocess
@@ -26,7 +13,6 @@
 import time
 from pathlib import Path
 
-
 def racer_main(argv: list[str]) -> int:
     if len(argv) != 5:
         raise SystemExit("racer requires TARGET VICTIM OLD READY_FIFO DONE_FIFO")
@@ -68,14 +54,10 @@ def racer_main(argv: list[str]) -> int:
         done.write(b"D")
     return 0
 
-
-# Enter helper mode before importing the test harness, which requires runner
-# environment variables and owns the daemon-port bookkeeping.
 if len(sys.argv) > 1 and sys.argv[1] == "--racer":
     sys.exit(racer_main(sys.argv[2:]))
 
-
-from rsyncfns import (  # noqa: E402
+from harness.rsync import (  # noqa: E402
     RSYNC,
     RSYNC_PEER,
     SCRATCHDIR,
@@ -86,7 +68,6 @@ def racer_main(argv: list[str]) -> int:
     test_skipped, split_rsync_cmd,
 )
 
-
 PORT = 13213
 SANDBOX_PROFILE = "(version 1)(allow default)(deny file-write-mode)"
 
@@ -191,7 +172,6 @@ def racer_main(argv: list[str]) -> int:
 };
 """
 
-
 def wait_for_port(process: subprocess.Popen[bytes]) -> None:
     deadline = time.monotonic() + 8
     while time.monotonic() < deadline:
@@ -204,7 +184,6 @@ def wait_for_port(process: subprocess.Popen[bytes]) -> None:
             time.sleep(0.05)
     raise RuntimeError("timeout waiting for daemon listener")
 
-
 def stop_process(process: subprocess.Popen, timeout: float = 3) -> tuple:
     if process.poll() is None:
         process.terminate()
@@ -214,23 +193,19 @@ def stop_process(process: subprocess.Popen, timeout: float = 3) -> tuple:
         process.kill()
         return process.communicate(timeout=timeout)
 
-
 if platform.system() != "Darwin":
-    test_skipped("leaf-type authority proof currently requires Darwin")
+    test_skipped("leaf-type authority proof currently requires Darwin", capability='darwin')
 if os.geteuid() == 0:
-    test_skipped("leaf-type authority proof needs a non-root EACCES trigger")
+    test_skipped("leaf-type authority proof needs a non-root EACCES trigger", capability='nonroot')
 sandbox_exec = Path("/usr/bin/sandbox-exec")
 if not sandbox_exec.is_file():
-    test_skipped("/usr/bin/sandbox-exec is unavailable")
+    test_skipped("/usr/bin/sandbox-exec is unavailable", capability='sandbox_exec')
 
 require_tcp("leaf-type race needs an injected real TCP daemon")
 claim_ports(PORT)
 
 module = SCRATCHDIR / "module"
 source = SCRATCHDIR / "source"
-# A prior vulnerable run intentionally leaves module/target as a mode-0600
-# directory.  Restore only that per-test object so a preserved scratch tree is
-# removable on rerun.
 if (module / "target").is_dir():
     (module / "target").chmod(0o700)
 rmtree(module)
@@ -295,7 +270,8 @@ def stop_process(process: subprocess.Popen, timeout: float = 3) -> tuple:
     text=True,
     bufsize=1,
 )
-assert racer.stdout is not None
+if racer.stdout is None:
+    test_fail('race helper stdout was not captured')
 readable, _, _ = select.select([racer.stdout], [], [], 5)
 if not readable:
     racer_stdout, racer_stderr = stop_process(racer)
@@ -308,7 +284,7 @@ def stop_process(process: subprocess.Popen, timeout: float = 3) -> tuple:
     racer_stdout, racer_stderr = stop_process(racer)
     combined_stderr = racer_stderr or ""
     if "sandbox_apply: Operation not permitted" in combined_stderr:
-        test_skipped("enclosing sandbox forbids nested sandbox-exec")
+        test_skipped("enclosing sandbox forbids nested sandbox-exec", capability='sandbox_exec')
     test_fail(
         "sandbox racer retained chmod authority: "
         f"preflight={preflight!r} stdout={racer_stdout!r}"
diff --git a/testsuite/tests/daemon/daemon-link-dest-escape.py b/testsuite/tests/daemon/daemon-link-dest-escape.py
new file mode 100644
index 000000000..3dbc77302
--- /dev/null
+++ b/testsuite/tests/daemon/daemon-link-dest-escape.py
@@ -0,0 +1,44 @@
+#!/usr/bin/env python3
+
+import subprocess
+
+from harness.rsync import (
+    SCRATCHDIR, makepath, rmtree, rsync_argv, start_test_daemon, test_fail,
+    write_daemon_conf,
+)
+
+DAEMON_PORT = 12894
+
+base = SCRATCHDIR / 'kid48'
+rmtree(base)
+mod = base / 'mod'
+sibling = base / 'sibling'
+makepath(mod)
+makepath(sibling)
+(sibling / 'probe').write_text('out-of-tree basis content\n')
+
+src = base / 'src'
+makepath(src)
+(src / 'probe').write_text('client content\n')
+
+conf = write_daemon_conf([
+    ('mod', {'path': str(mod), 'read only': 'no'}),
+])
+url = start_test_daemon(conf, DAEMON_PORT)
+
+proc = subprocess.run(
+    rsync_argv('-rv', '--link-dest=../sibling', f'{src}/', f'{url}mod/'),
+    stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True)
+out = proc.stdout or ''
+
+reached_outside = 'does not exist' not in out and 'is not a dir' not in out
+
+if reached_outside:
+    test_fail(
+        "daemon reached outside the module via --link-dest=../sibling: the "
+        "out-of-tree directory was stat'd (no 'arg does not exist' warning), "
+        "leaking the existence of paths outside the module.\n--- client saw ---\n"
+        + out)
+
+print("daemon-link-dest-escape: --link-dest=../sibling was confined to the "
+      "module (out-of-tree basis dir not reachable)")
diff --git a/testsuite/tests/daemon/daemon-module-chdir-symlink.py b/testsuite/tests/daemon/daemon-module-chdir-symlink.py
new file mode 100644
index 000000000..24e32db57
--- /dev/null
+++ b/testsuite/tests/daemon/daemon-module-chdir-symlink.py
@@ -0,0 +1,54 @@
+#!/usr/bin/env python3
+
+import os
+import pwd
+import subprocess
+
+from harness.rsync import (
+    SCRATCHDIR, rmtree, rsync_argv, start_test_daemon, test_fail,
+    test_skipped, write_daemon_conf,
+)
+
+DAEMON_PORT = 12900
+CANARY = "audit_escape_canary"
+
+if os.geteuid() != 0:
+    test_skipped("requires root to plant a symlink owned by a non-self uid "
+                 "(the attacker simulation)", capability='cross_uid')
+
+NOBODY_UID = None
+for name in ('nobody', 'nfsnobody', 'daemon'):
+    try:
+        u = pwd.getpwnam(name).pw_uid
+        if u != 0 and u != os.geteuid():
+            NOBODY_UID = u
+            break
+    except KeyError:
+        continue
+if NOBODY_UID is None:
+    test_skipped("no untrusted-uid user available for cross-uid plant", capability='cross_uid')
+
+base = SCRATCHDIR / 'modchdir'
+rmtree(base)
+base.mkdir()
+
+escape_target = base / 'escape_target'
+escape_target.mkdir()
+(escape_target / CANARY).write_text("you-should-not-see-this\n")
+
+plant = base / 'plant'
+os.symlink(escape_target, plant)
+os.lchown(plant, NOBODY_UID, NOBODY_UID)
+
+conf = write_daemon_conf(
+    [('mod', {'path': plant, 'read only': 'yes'})],
+)
+url = start_test_daemon(conf, DAEMON_PORT)
+
+proc = subprocess.run(
+    rsync_argv(f'{url}mod/'),
+    stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True)
+
+if CANARY in proc.stdout:
+    test_fail(f'daemon served {CANARY!r} through untrusted uid {NOBODY_UID} '
+              f'module symlink: {plant} -> {escape_target}')
diff --git a/testsuite/daemon-module-options_test.py b/testsuite/tests/daemon/daemon-module-options.py
similarity index 61%
rename from testsuite/daemon-module-options_test.py
rename to testsuite/tests/daemon/daemon-module-options.py
index 88fad87b2..66bc5a1ea 100644
--- a/testsuite/daemon-module-options_test.py
+++ b/testsuite/tests/daemon/daemon-module-options.py
@@ -1,30 +1,8 @@
 #!/usr/bin/env python3
-"""Daemon coverage: assorted rsyncd.conf module/global options whose code
-paths the suite never exercised.  One test, many small option-gates --
-each is a handful of lines but together they were a measurable gap.
 
-Covers (all in clientserver.c rsync_module() / send_listing() unless noted):
-  motd file                global  -> read+echo via open_no_attacker_symlinks
-  socket options           global  -> set_socket_options() (socket.c) on the
-                                      daemon's per-connection fd
-  incoming chmod           module  -> parse_chmod into daemon_chmod_modes
-  outgoing chmod           module  -> same, am_sender branch
-  dont compress            module  -> token.c init_set_compression's
-                                      lp_dont_compress() / `dont compress`
-                                      daemon-side suffix list under -z
-  list = no                module  -> the "(list=no)" skip in send_listing()
-  comment                  module  -> printed in send_listing()
-  --sockopts               client  -> set_socket_options() at connect() time
-
-`motd file` and `socket options` need a real TCP daemon (the
-RSYNC_CONNECT_PROG pipe transport bypasses send_listing/motd and there's
-no socket fd to setsockopt on), so this test is require_tcp()-gated.
-"""
-
-import os
 import subprocess
 
-from rsyncfns import (
+from harness.rsync import (
     SCRATCHDIR, FROMDIR,
     claim_ports, make_tree, makepath, require_tcp, rmtree, rsync_argv,
     start_test_daemon, test_fail, write_daemon_conf,
@@ -43,7 +21,6 @@
     rmtree(d)
 make_tree(src, depth=1)
 makepath(dst_in, dst_out, dst_hidden)
-# Seed the outgoing module so a PULL has content for `outgoing chmod`.
 (dst_out / 'o0').write_text('out\n')
 (dst_out / 'o0').chmod(0o644)
 
@@ -54,8 +31,6 @@
     ('inmod', {
         'path': str(dst_in), 'read only': 'no',
         'incoming chmod': 'Fu+x,g-w,o=r',
-        # daemon-side suffix list (token.c lp_dont_compress(), distinct from
-        # the client --skip-compress path the existing tests already cover)
         'dont compress': '*.gz *.bz2',
         'comment': 'incoming-chmod test module',
     }),
@@ -73,17 +48,12 @@
     mods,
     globals={
         'motd file': str(motd),
-        # OPT_BOOL + OPT_INT= + OPT_ON, plus an unknown to hit the
-        # "Unknown socket option" branch.
         'socket options': 'SO_KEEPALIVE SO_RCVBUF=8192 SO_BROADCAST NOSUCHOPT',
     },
     name='module-options.conf',
 )
 url = start_test_daemon(conf, PORT)
 
-
-# --- module listing: motd echoed, [hidden] absent, comments shown ----------
-# A bare daemon URL (ends in '/') with no destination = module listing.
 r = subprocess.run(rsync_argv(f'{url}'), capture_output=True, text=True)
 if r.returncode != 0:
     test_fail(f"module listing failed (rc={r.returncode}):\n{r.stderr}")
@@ -93,11 +63,23 @@
     test_fail(f"list=no module 'hidden' leaked into listing:\n{r.stdout}")
 if 'inmod' not in r.stdout or 'outmod' not in r.stdout:
     test_fail(f"expected modules missing from listing:\n{r.stdout}")
-# The comment column: send_listing() prints "name\tcomment\n" per module.
 if 'incoming-chmod test module' not in r.stdout:
     test_fail(f"module comment missing from listing:\n{r.stdout!r}")
 
-# --- incoming chmod: push, then check Fu+x,g-w,o=r applied -----------------
+nomotd_dst = SCRATCHDIR / 'pull-no-motd'
+makepath(nomotd_dst)
+r = subprocess.run(rsync_argv('-r', '--no-motd', f'{url}outmod/',
+                             f'{nomotd_dst}/'),
+                   capture_output=True, text=True)
+if r.returncode != 0:
+    test_fail(f"module transfer with --no-motd failed (rc={r.returncode}):\n"
+              f"{r.stderr}")
+if 'TEST MOTD BANNER' in r.stdout + r.stderr:
+    test_fail(f"--no-motd did not suppress the banner:\n{r.stdout!r}\n{r.stderr!r}")
+nomotd_file = nomotd_dst / 'o0'
+if not nomotd_file.is_file() or nomotd_file.read_text() != 'out\n':
+    test_fail('--no-motd module transfer did not copy the payload')
+
 r = subprocess.run(
     rsync_argv('-rzp', '--sockopts=SO_KEEPALIVE,SO_SNDBUF=8192',
                f'{src}/', f'{url}inmod/'),
@@ -105,11 +87,9 @@
 )
 if r.returncode != 0:
     test_fail(f"push to [inmod] failed (rc={r.returncode}):\n{r.stderr}")
-# Find any regular file in dst_in and check the mode bits.
 for f in dst_in.rglob('*'):
     if f.is_file():
         m = f.stat().st_mode & 0o777
-        # Fu+x -> u has x; g-w -> g has no w; o=r -> other == r exactly
         if not (m & 0o100):
             test_fail(f"incoming chmod Fu+x not applied to {f.name}: {oct(m)}")
         if m & 0o020:
@@ -120,9 +100,9 @@
 else:
     test_fail("push to [inmod] produced no regular files")
 
-# --- outgoing chmod: pull, then check F-x,o-rwx applied to received perms --
 pull_dst = SCRATCHDIR / 'pull-outmod'
-rmtree(pull_dst); makepath(pull_dst)
+rmtree(pull_dst)
+makepath(pull_dst)
 r = subprocess.run(
     rsync_argv('-rp', f'{url}outmod/', f'{pull_dst}/'),
     capture_output=True, text=True,
@@ -135,7 +115,6 @@
 if m & 0o007:
     test_fail(f"outgoing chmod o-rwx not applied: {oct(m)}")
 
-# --- list=no module is still REACHABLE by name -----------------------------
 r = subprocess.run(rsync_argv('-r', f'{src}/', f'{url}hidden/'),
                    capture_output=True, text=True)
 if r.returncode != 0:
diff --git a/testsuite/tests/daemon/daemon-module-private-parent.py b/testsuite/tests/daemon/daemon-module-private-parent.py
new file mode 100644
index 000000000..da996a93c
--- /dev/null
+++ b/testsuite/tests/daemon/daemon-module-private-parent.py
@@ -0,0 +1,70 @@
+#!/usr/bin/env python3
+
+import os
+import pwd
+import subprocess
+
+from harness.rsync import (
+    SCRATCHDIR, makepath, rmtree, rsync_argv, start_test_daemon,
+    test_fail, test_skipped, write_daemon_conf,
+)
+
+DAEMON_PORT = 12951
+CONTENT = "served-from-under-a-private-parent\n"
+
+if os.geteuid() != 0:
+    test_skipped("requires root (a 0700 parent the served uid cannot traverse, "
+                 "and a daemon that drops to an unprivileged uid)", capability='root')
+
+UNPRIV = None
+for name in ('nobody', 'nfsnobody', 'daemon'):
+    try:
+        u = pwd.getpwnam(name)
+        if u.pw_uid != 0 and u.pw_uid != os.geteuid():
+            UNPRIV = u
+            break
+    except KeyError:
+        continue
+if UNPRIV is None:
+    test_skipped("no unprivileged uid available to drop the daemon to", capability='root')
+
+base = SCRATCHDIR / 'priv-parent'
+rmtree(base)
+private = base / 'private'
+modpath = private / 'mod'
+sub = modpath / 'sub'
+makepath(sub)
+(sub / 'file').write_text(CONTENT)
+os.chmod(modpath, 0o755)
+os.chmod(sub, 0o755)
+os.chmod(sub / 'file', 0o644)
+os.chmod(private, 0o700)
+
+dest = base / 'dest'
+makepath(dest)
+
+conf = write_daemon_conf([
+    ('m', {'path': modpath, 'read only': 'yes',
+           'uid': str(UNPRIV.pw_uid), 'gid': str(UNPRIV.pw_gid)}),
+])
+url = start_test_daemon(conf, DAEMON_PORT)
+
+def pull(*opts):
+    rmtree(dest)
+    makepath(dest)
+    proc = subprocess.run(
+        rsync_argv(*opts, f'{url}m/', f'{dest}/'),
+        stdout=subprocess.DEVNULL, stderr=subprocess.PIPE, text=True)
+    if proc.returncode != 0:
+        test_fail(f"module under 0700 parent failed as {UNPRIV.pw_name} "
+                  f"({' '.join(opts)}): {proc.stderr.strip()!r}")
+    got = dest / 'sub' / 'file'
+    if not got.is_file() or got.read_text() != CONTENT:
+        test_fail(f"the under-0700-parent module did not serve its file with "
+                  f"'{' '.join(opts)}' (dest/sub/file missing/wrong)")
+
+pull('-r')
+pull('-rL')
+
+print("daemon-module-private-parent: served a module under a 0700 parent as "
+      f"uid {UNPRIV.pw_name} (default + --copy-links content opens)")
diff --git a/testsuite/daemon-munge_test.py b/testsuite/tests/daemon/daemon-munge.py
similarity index 69%
rename from testsuite/daemon-munge_test.py
rename to testsuite/tests/daemon/daemon-munge.py
index 05fdb4695..60db1c9ce 100644
--- a/testsuite/daemon-munge_test.py
+++ b/testsuite/tests/daemon/daemon-munge.py
@@ -1,20 +1,16 @@
 #!/usr/bin/env python3
-"""Daemon coverage: munge symlinks.
-
-A module with "munge symlinks = yes" stores incoming symlinks with a
-/rsyncd-munged/ prefix (so they can't be used to escape the module) and strips
-that prefix from outgoing symlinks. Verify both directions on a symlink several
-levels deep.
-"""
 
 import os
 import subprocess
 
-from rsyncfns import (
+from harness.rsync import (
     FROMDIR, SCRATCHDIR,
     assert_is_symlink, make_tree, makepath, rmtree, rsync_argv,
     start_test_daemon, test_fail, write_daemon_conf,
 )
+from harness import metadata
+
+metadata(features={'daemon', 'symlink'}, transports={'pipe', 'tcp'}, min_peer='2.6.0', mutates={'filesystem', 'process', 'socket'}, tags={'daemon', 'security', 'version-mix'})
 
 DAEMON_PORT = 12890
 
@@ -22,7 +18,7 @@
 deep = os.path.join('d1', 'd2')
 rmtree(src)
 make_tree(src, depth=3)
-os.symlink('f3', src / deep / 'sl')          # deep symlink -> f3
+os.symlink('f3', src / deep / 'sl')
 
 mungedest = SCRATCHDIR / 'mungedest'
 pulled = SCRATCHDIR / 'mungepull'
@@ -35,7 +31,6 @@
 ])
 url = start_test_daemon(conf, DAEMON_PORT)
 
-# --- push: the stored symlink is munged with the /rsyncd-munged/ prefix ------
 subprocess.run(rsync_argv('-al', f'{src}/', f'{url}munge/'),
                stdout=subprocess.DEVNULL)
 stored = mungedest / deep / 'sl'
@@ -44,7 +39,6 @@
 if target != '/rsyncd-munged/f3':
     test_fail(f"munge symlinks stored {target!r}, expected '/rsyncd-munged/f3'")
 
-# --- pull: the prefix is stripped back off on the way out -------------------
 subprocess.run(rsync_argv('-al', f'{url}munge/', f'{pulled}/'),
                stdout=subprocess.DEVNULL)
 out = pulled / deep / 'sl'
diff --git a/testsuite/tests/daemon/daemon-namecvt-empty-response.py b/testsuite/tests/daemon/daemon-namecvt-empty-response.py
new file mode 100644
index 000000000..435b2a823
--- /dev/null
+++ b/testsuite/tests/daemon/daemon-namecvt-empty-response.py
@@ -0,0 +1,79 @@
+#!/usr/bin/env python3
+
+import os
+import re
+import subprocess
+
+from harness.rsync import (
+    RSYNC_PREFIX, SCRATCHDIR, makepath, rmtree, rsync_argv, start_test_daemon,
+    test_fail, test_skipped, write_daemon_conf, xattr_get, xattrs_supported,
+)
+
+DAEMON_PORT = 12904
+
+if not xattrs_supported():
+    test_skipped("namecvt-empty-response test requires xattr support to "
+                 "read fake-super metadata", capability='xattr_runtime')
+
+my_uid = os.getuid()
+my_gid = os.getgid()
+if my_uid == 0:
+    test_skipped("namecvt-empty-response test must run as a non-root user "
+                 "(sender uid/gid must differ from 0 to expose the bug)", capability='nonroot')
+
+stub = SCRATCHDIR / 'stub_nameconvert'
+stub.write_text(
+    "#!/usr/bin/env python3\n"
+    "import sys\n"
+    "for _ in sys.stdin:\n"
+    "    print('', flush=True)\n"
+)
+stub.chmod(0o755)
+
+mod = SCRATCHDIR / 'recvmod'
+src = SCRATCHDIR / 'srcdir'
+rmtree(mod)
+rmtree(src)
+makepath(mod)
+makepath(src)
+(src / 'f').write_text("DATA\n")
+
+conf = write_daemon_conf([
+    ('recv', {'path':           str(mod),
+              'read only':      'no',
+              'fake super':     'yes',
+              'numeric ids':    'no',
+              'name converter': str(stub)}),
+])
+url = start_test_daemon(conf, DAEMON_PORT)
+
+proc = subprocess.run(rsync_argv('-a', f'{src}/', f'{url}recv/'),
+                      stdout=subprocess.DEVNULL,
+                      stderr=subprocess.PIPE, text=True)
+if proc.returncode not in (0, 23):
+    test_fail(f"upload to recv module failed (rc={proc.returncode}): "
+              f"{proc.stderr!r}")
+
+stored = mod / 'f'
+if not stored.is_file():
+    test_fail(f"upload did not deliver the file ({stored})")
+
+try:
+    raw = xattr_get(RSYNC_PREFIX + '.%stat', stored)
+    xval = raw.decode('utf-8', 'surrogateescape')
+except OSError:
+    xval = None
+
+if xval is None:
+    print(f'name converter kept sender uid={my_uid} after an empty response')
+else:
+    m = re.match(r'\S+\s+\S+\s+(\d+):(\d+)\s*$', xval)
+    if not m:
+        test_fail(f"unrecognised fake-super xattr format: {xval!r}")
+    stored_uid, stored_gid = int(m.group(1)), int(m.group(2))
+
+    if stored_uid == 0 and stored_gid == 0:
+        test_fail(f'empty name-converter response mapped uid={my_uid}/gid={my_gid} '
+                  f'to root metadata {xval!r}')
+
+    print(f'empty name-converter response retained non-root metadata {xval!r}')
diff --git a/testsuite/daemon-namecvt-newline-token_test.py b/testsuite/tests/daemon/daemon-namecvt-newline-token.py
similarity index 65%
rename from testsuite/daemon-namecvt-newline-token_test.py
rename to testsuite/tests/daemon/daemon-namecvt-newline-token.py
index 5dd21c11d..af2f4b55d 100644
--- a/testsuite/daemon-namecvt-newline-token_test.py
+++ b/testsuite/tests/daemon/daemon-namecvt-newline-token.py
@@ -1,28 +1,12 @@
 #!/usr/bin/env python3
-# A daemon with `numeric ids = no` and a `name converter` maps the user/group
-# names a sender puts in the file list by piping each name to the converter
-# helper as a whitespace-and-newline-delimited token. A malicious sender that
-# sends a user name containing a literal newline could inject an extra token (or
-# a forged converter response) into that pipe. namecvt_call() (clientserver.c)
-# guards this with namecvt_safe_token(), which refuses any token containing a
-# control char (< 0x20 or 0x7F) before writing it to the converter.
-#
-# This drives the attack with the pure-Python sender rather than a recompiled
-# malicious binary: push one file-list entry whose XMIT_USER_NAME_FOLLOWS name
-# is "bad\nname". recv_user_name() -> recv_add_id() -> user_to_uid() ->
-# namecvt_call() runs during file-list receipt, so no transfer phase is needed.
-#
-# Oracle: the converter helper must NOT receive a split "name" token (the
-# newline never reached the pipe) AND the daemon must report "invalid
-# name-converter token" (it refused the control char). Needs a real TCP daemon.
 
 import time
 
-from rsyncfns import (
+from harness.rsync import (
     SCRATCHDIR, claim_ports, makepath, require_tcp, rmtree, start_test_daemon,
     test_fail, write_daemon_conf, xattrs_supported,
 )
-import rsync_proto as rp
+from harness import protocol as rp
 
 PORT = 12974
 require_tcp("the pure-Python sender needs a real TCP daemon; run with --use-tcp")
@@ -59,9 +43,7 @@
 url = start_test_daemon(conf, PORT)
 
 s = rp.DaemonSender('127.0.0.1', PORT)
-# -o => preserve_uid, so the receiver reads the uid + user name and maps it.
 s.handshake('recv', ['--server', '-oe.LsfxCIu', '.', 'recv/'], greeting_version=30)
-# One entry whose owner name carries a literal newline.
 s.send_flat_flist([rp.FileEntry('f', mode=rp.S_IFREG | 0o644, length=0,
                                 uid=1, user_name='bad\nname')])
 back = s.drain(timeout=3.0)
diff --git a/testsuite/tests/daemon/daemon-path-root-read.py b/testsuite/tests/daemon/daemon-path-root-read.py
new file mode 100644
index 000000000..06ad1742f
--- /dev/null
+++ b/testsuite/tests/daemon/daemon-path-root-read.py
@@ -0,0 +1,46 @@
+#!/usr/bin/env python3
+
+import subprocess
+
+from harness.rsync import (
+    SCRATCHDIR, makepath, rmtree, rsync_argv, start_test_daemon, test_fail,
+    write_daemon_conf,
+)
+
+DAEMON_PORT = 12897
+
+served = SCRATCHDIR / 'served'
+dst = SCRATCHDIR / 'pulldst'
+rmtree(served)
+rmtree(dst)
+makepath(served / 'sub')
+makepath(dst)
+(served / 'README').write_text("readme-contents\n")
+(served / 'sub' / 'deep.txt').write_text("deep-contents\n")
+
+conf = write_daemon_conf([
+    ('root', {'path': '/', 'read only': 'yes'}),
+])
+url = start_test_daemon(conf, DAEMON_PORT)
+
+served_rel = str(served).lstrip('/')
+proc = subprocess.run(
+    rsync_argv('-a', f'{url}root/{served_rel}/', f'{dst}/'),
+    stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True,
+)
+out = proc.stdout or ''
+print(out)
+
+if 'Invalid argument (22)' in out or ('failed to open' in out and proc.returncode != 0):
+    from harness.rsync import test_xfail
+    test_xfail('#897: path=/ daemon failed to open an absolute module-root path')
+
+if proc.returncode != 0:
+    test_fail(f"daemon pull failed unexpectedly (rc={proc.returncode}); "
+              f"not the #897 EINVAL symptom:\n{out}")
+for rel in ('README', 'sub/deep.txt'):
+    got = dst / rel
+    if not got.is_file():
+        test_fail(f"daemon pull did not deliver {rel} (dst={dst})")
+    if got.read_text() != (served / rel).read_text():
+        test_fail(f"delivered {rel} content differs from source")
diff --git a/testsuite/daemon-path-rsync-var_test.py b/testsuite/tests/daemon/daemon-path-rsync-var.py
similarity index 55%
rename from testsuite/daemon-path-rsync-var_test.py
rename to testsuite/tests/daemon/daemon-path-rsync-var.py
index 283aa6f37..39a962eb2 100644
--- a/testsuite/daemon-path-rsync-var_test.py
+++ b/testsuite/tests/daemon/daemon-path-rsync-var.py
@@ -1,17 +1,8 @@
 #!/usr/bin/env python3
-# Regression: a %RSYNC_*% reference in an ordinary daemon string param
-# (path/uid/gid/...) must expand to the RAW value, not be shell-quoted.
-#
-# The %RSYNC_*% shell-escaping (an injection guard for the shell-executed hooks:
-# pre/post-xfer exec, early exec, name converter) leaked into the shared
-# expand_vars() used by every string accessor.  So `path = /srv/%RSYNC_MODULE_NAME%`
-# expanded to /srv/'served' and the documented `path = /home/%RSYNC_USER_NAME%`
-# (rsyncd.conf.5) broke with "@ERROR: chdir failed".  Now only the hook
-# accessors escape; ordinary params expand verbatim.
 
 import subprocess
 
-from rsyncfns import (
+from harness.rsync import (
     SCRATCHDIR, rmtree, rsync_argv, start_test_daemon, test_fail,
     write_daemon_conf,
 )
@@ -20,12 +11,8 @@
 
 base = SCRATCHDIR / 'daemon-path-var'
 rmtree(base)
-# The module's real path is <root>/<module-name>; the conf references it via
-# %RSYNC_MODULE_NAME% (set for every connection, no auth needed).  If that
-# expands quoted, the daemon chdir's to <root>/'served' (literal quotes), which
-# does not exist -> the pull fails.
 root = base / 'root'
-served = root / 'served'        # module is named "served"
+served = root / 'served'
 served.mkdir(parents=True)
 (served / 'hello.txt').write_text('EXPANDED\n')
 
diff --git a/testsuite/daemon-proxy-protocol_test.py b/testsuite/tests/daemon/daemon-proxy-protocol.py
similarity index 53%
rename from testsuite/daemon-proxy-protocol_test.py
rename to testsuite/tests/daemon/daemon-proxy-protocol.py
index 450538d8e..02c96746e 100644
--- a/testsuite/daemon-proxy-protocol_test.py
+++ b/testsuite/tests/daemon/daemon-proxy-protocol.py
@@ -1,23 +1,15 @@
 #!/usr/bin/env python3
-# Exercise the daemon's HAProxy PROXY-protocol parser (clientname.c
-# read_proxy_protocol_header), the trusted-peer gate
-# (clientserver.c proxy_peer_allowed -> access.c allow_proxy_protocol_peer),
-# and that the proxied source address is what hosts-allow checks against.
-#
-# Needs a real TCP socket: read_proxy_protocol_header() runs only when
-# lp_proxy_protocol() is set, and it reads from the socket BEFORE the
-# @RSYNCD greeting -- there is no pipe-transport equivalent.
 
 import socket
 import struct
 
-from rsyncfns import (
+from harness.rsync import (
     SCRATCHDIR, claim_ports, makepath, require_tcp, start_rsyncd, test_fail,
     write_daemon_conf,
 )
 
-PORT_OK = 19873          # proxy protocol hosts = 127.0.0.0/8 (we match)
-PORT_NOHOSTS = 19874     # proxy protocol = yes but NO proxy protocol hosts
+PORT_OK = 19873
+PORT_NOHOSTS = 19874
 
 require_tcp("PROXY-protocol header is read from a real TCP socket; run with --use-tcp")
 claim_ports(PORT_OK, PORT_NOHOSTS)
@@ -25,10 +17,6 @@
 base = SCRATCHDIR / 'proxy-protocol'
 makepath(base / 'mod')
 
-
-# Daemon 1: trusted proxy at 127.0.0.0/8.  Module only allows the *proxied*
-# 10.0.0.0/8 (and an IPv6 ULA), so a successful module-list proves the daemon
-# is checking the proxied addr, not the socket peer (127.0.0.1).
 conf_ok = write_daemon_conf(
     [('mod', {
         'path': str(base / 'mod'),
@@ -39,28 +27,19 @@
     globals={
         'proxy protocol': 'yes',
         'proxy protocol hosts': '127.0.0.0/8',
-        # The proxied addrs are not in DNS -- skip name lookup so the test
-        # does not block on a slow reverse-DNS timeout.
         'reverse lookup': 'no',
-        # Override the write_daemon_conf default (localhost 127/8) -- with the
-        # proxy header in play we want hosts-allow to be per-module only.
         'hosts allow': '',
     },
     name='proxyproto.conf',
 )
 start_rsyncd(conf_ok, PORT_OK)
 
-# Daemon 2: proxy protocol = yes but NO `proxy protocol hosts` -> every peer
-# is untrusted (allow_proxy_protocol_peer returns 0 on empty list), the
-# connection is dropped before the header is even read.
 conf_nohosts = write_daemon_conf(
     [('mod', {'path': str(base / 'mod'), 'read only': 'yes', 'use chroot': 'no'})],
     globals={
         'proxy protocol': 'yes',
         'reverse lookup': 'no',
         'hosts allow': '',
-        # Second daemon in one test -> distinct pid/log so we don't collide
-        # with daemon 1's lock.
         'pid file': str(SCRATCHDIR / 'rsyncd-nohosts.pid'),
         'log file': str(SCRATCHDIR / 'rsyncd-nohosts.log'),
     },
@@ -68,61 +47,39 @@
 )
 start_rsyncd(conf_nohosts, PORT_NOHOSTS)
 
-
-# --- PROXY header encoders (mirror clientname.c constants) ------------------
-
-V2_SIG = b'\r\n\r\n\x00\r\nQUIT\n'    # 12 bytes
+V2_SIG = b'\r\n\r\n\x00\r\nQUIT\n'
 CMD_LOCAL, CMD_PROXY = 0, 1
 FAM_TCPv4, FAM_TCPv6 = 0x11, 0x21
 
-
 def v1(line):
     return (b'PROXY ' + line.encode('ascii') + b'\r\n')
 
-
 def v2(cmd, fam, addr):
     return (V2_SIG
             + bytes([(2 << 4) | cmd, fam])
             + struct.pack('>H', len(addr))
             + addr)
 
-
 def v2_ip4(src, dst='127.0.0.1', sport=40000, dport=PORT_OK):
     a = (socket.inet_pton(socket.AF_INET, src)
          + socket.inet_pton(socket.AF_INET, dst)
          + struct.pack('>HH', sport, dport))
     return v2(CMD_PROXY, FAM_TCPv4, a)
 
-
 def v2_ip6(src, dst='::1', sport=40000, dport=PORT_OK):
     a = (socket.inet_pton(socket.AF_INET6, src)
          + socket.inet_pton(socket.AF_INET6, dst)
          + struct.pack('>HH', sport, dport))
     return v2(CMD_PROXY, FAM_TCPv6, a)
 
-
-# --- driver: send proxy header then a minimal @RSYNCD module-list -----------
-
 def probe(port, hdr, label, *, want):
-    """Connect, send `hdr`, then attempt an @RSYNCD module-list of [mod].
-
-    `want` is one of:
-        'ok'     -- daemon answers @RSYNCD: OK (proxied IP passed hosts-allow)
-        'denied' -- daemon answers @ERROR: access denied (proxied IP rejected
-                    by per-module hosts-allow)
-        'drop'   -- daemon closes the socket without an @RSYNCD greeting
-                    (proxy header rejected or untrusted peer)
-    """
     s = socket.create_connection(('127.0.0.1', port), timeout=10)
     s.settimeout(10)
     out = b''
     try:
         if hdr:
             s.sendall(hdr)
-        # @RSYNCD client greeting + module name + a single sender-side
-        # list-only request.  Protocol 30, no capabilities, no auth.
         s.sendall(b'@RSYNCD: 30.0\nmod\n')
-        # Slurp everything the daemon writes before it closes.
         try:
             s.shutdown(socket.SHUT_WR)
         except OSError:
@@ -136,11 +93,6 @@ def probe(port, hdr, label, *, want):
                 break
             out += chunk
     except OSError:
-        # A 'drop' daemon closes the connection, which can surface as
-        # EPIPE/ECONNRESET on our sendall() before we ever read -- a timing
-        # race seen on some CI runners.  Leave `out` empty and let the
-        # want-check below decide: for want='drop' the absent greeting is the
-        # expected outcome; for want='ok'/'denied' it still fails correctly.
         pass
     finally:
         s.close()
@@ -157,9 +109,6 @@ def probe(port, hdr, label, *, want):
             test_fail(f"{label}: expected access-denied, got: {out!r}")
         return
     if want == 'ok':
-        # After greeting + module name the daemon answers @RSYNCD: OK then
-        # waits for client args -- but we sent SHUT_WR so it sees EOF on the
-        # args read and closes.  Seeing OK (not @ERROR) is the success signal.
         if b'@ERROR' in out:
             test_fail(f"{label}: expected OK, got error: {out!r}")
         if b'@RSYNCD: OK' not in out:
@@ -167,71 +116,42 @@ def probe(port, hdr, label, *, want):
         return
     test_fail(f"{label}: bad want={want!r}")
 
-
-# === V1 text header =========================================================
-
-# Proxied src in 10.0.0.0/8 -> module hosts-allow matches.
 probe(PORT_OK, v1('TCP4 10.1.2.3 127.0.0.1 40000 873'), 'v1 TCP4 allow', want='ok')
 
-# Proxied src outside 10.0.0.0/8 -> module hosts-allow rejects (proves the
-# daemon checked the *proxied* addr, not the socket peer 127.0.0.1).
 probe(PORT_OK, v1('TCP4 192.168.1.1 127.0.0.1 40000 873'), 'v1 TCP4 deny', want='denied')
 
-# IPv6 source in fd00::/8 -> matches the ULA hosts-allow entry.
 probe(PORT_OK, v1('TCP6 fd00::1234 ::1 40000 873'), 'v1 TCP6 allow', want='ok')
 
-# UNKNOWN -> parser returns 1 with ipaddr_buf unset, so the daemon falls back
-# to the socket peer (127.0.0.1), which is NOT in 10.0.0.0/8 -> denied.
 probe(PORT_OK, v1('UNKNOWN'), 'v1 UNKNOWN', want='denied')
 
-# Malformed v1: missing dst -> parser returns 0 -> drop.
 probe(PORT_OK, v1('TCP4 10.1.2.3'), 'v1 short', want='drop')
 
-# Malformed v1: bad family token.
 probe(PORT_OK, v1('TCP9 10.1.2.3 127.0.0.1 40000 873'), 'v1 bad-fam', want='drop')
 
-# Malformed v1: non-numeric port.
 probe(PORT_OK, v1('TCP4 10.1.2.3 127.0.0.1 abc 873'), 'v1 bad-port', want='drop')
 
-# Malformed v1: line longer than the 108-byte buffer with no \n -> drop.
 probe(PORT_OK, b'PROXY TCP4 ' + b'1' * 200, 'v1 overlong', want='drop')
 
-# Neither v2 sig nor "PROXY" prefix -> drop.
 probe(PORT_OK, b'GET / HTTP/1.0\r\n\r\n', 'no proxy hdr', want='drop')
 
-
-# === V2 binary header =======================================================
-
 probe(PORT_OK, v2_ip4('10.9.8.7'), 'v2 TCPv4 allow', want='ok')
 probe(PORT_OK, v2_ip4('172.16.0.1'), 'v2 TCPv4 deny', want='denied')
 probe(PORT_OK, v2_ip6('fd00::abcd'), 'v2 TCPv6 allow', want='ok')
 
-# CMD_LOCAL: parser returns 1, ipaddr_buf unset -> socket peer 127.0.0.1
-# checked against hosts-allow -> denied.
 probe(PORT_OK, v2(CMD_LOCAL, 0, b''), 'v2 LOCAL', want='denied')
 
-# Unsupported family with CMD_PROXY -> "ignore proxy data, accept" branch.
 probe(PORT_OK, v2(CMD_PROXY, 0x31, b'\0' * 4), 'v2 unsupp-fam', want='denied')
 
-# Bad version nibble -> drop.
 probe(PORT_OK, V2_SIG + bytes([(3 << 4) | CMD_PROXY, FAM_TCPv4]) + b'\x00\x0c'
       + b'\0' * 12, 'v2 bad-ver', want='drop')
 
-# Declared size larger than the union -> drop.
 probe(PORT_OK, V2_SIG + bytes([(2 << 4) | CMD_PROXY, FAM_TCPv4]) + b'\x10\x00'
       + b'\0' * 12, 'v2 oversize', want='drop')
 
-# TCPv4 with size != 12 -> drop.
 probe(PORT_OK, v2(CMD_PROXY, FAM_TCPv4, b'\0' * 8), 'v2 ip4 bad-len', want='drop')
 
-# Unknown cmd -> drop.
 probe(PORT_OK, v2(7, FAM_TCPv4, b'\0' * 12), 'v2 bad-cmd', want='drop')
 
-
-# === Untrusted-peer gate (no `proxy protocol hosts`) ========================
-
-# allow_proxy_protocol_peer() returns 0 on an empty/NULL list; the daemon
-# drops the connection BEFORE reading any proxy header.
 probe(PORT_NOHOSTS, v2_ip4('10.1.2.3'), 'untrusted v2', want='drop')
 probe(PORT_NOHOSTS, v1('TCP4 10.1.2.3 127.0.0.1 40000 873'), 'untrusted v1', want='drop')
 probe(PORT_NOHOSTS, b'', 'untrusted empty', want='drop')
diff --git a/testsuite/daemon-refuse-compress-threads-alias_test.py b/testsuite/tests/daemon/daemon-refuse-compress-threads-alias.py
similarity index 60%
rename from testsuite/daemon-refuse-compress-threads-alias_test.py
rename to testsuite/tests/daemon/daemon-refuse-compress-threads-alias.py
index 250a461ca..a6bb01769 100644
--- a/testsuite/daemon-refuse-compress-threads-alias_test.py
+++ b/testsuite/tests/daemon/daemon-refuse-compress-threads-alias.py
@@ -1,34 +1,17 @@
 #!/usr/bin/env python3
-"""``refuse options = compress-threads`` must also refuse its ``--zt`` alias.
-
-set_refuse_options() stopped after the first exact long-option match, so the
-canonical compress-threads entry was disabled but its later zt alias stayed
-accepted.  Both halves here build the daemon argv by hand -- a stock client
-does not forward this option at all unless asked to with -M, and the raw
-protocol is what preserves the exact spelling under test.
-
-The oracle is the refusal itself: the alias connection must be torn down and
-the daemon must log "configured to refuse --zt".  It is deliberately NOT the
-worker count.  An accepted --zt that happens to produce few threads is still a
-defeated refuse rule, and several unrelated things bound that count -- a
-separate daemon worker cap (see the Zstandard thread-cap change), a libzstd
-built without multithreading, or a process/thread limit -- so a count-based
-assertion goes green while the rule is bypassed.  The count is still measured,
-but only to say how much capability the bypass delivered.
-"""
 
 import json
 import os
 import re
-import subprocess
 import sys
 import time
 
-from rsyncfns import (
+from harness.rsync import (
     SCRATCHDIR, claim_ports, require_tcp, rmtree, run_rsync,
     start_rsyncd, test_fail, test_skipped,
 )
-import rsync_proto as rp
+from harness import protocol as rp
+from harness import process_thread_count
 
 PORT = 13121
 REQUESTED_THREADS = 256
@@ -39,7 +22,7 @@
 
 version = json.loads(run_rsync('-VV', check=True, capture_output=True).stdout)
 if 'zstd' not in version.get('compress_list', []):
-    test_skipped('this build does not include Zstandard')
+    test_skipped('this build does not include Zstandard', capability='zstd_threads')
 
 base = SCRATCHDIR / 'daemon-refuse-compress-threads-alias'
 rmtree(base)
@@ -60,7 +43,6 @@
 """)
 start_rsyncd(conf, PORT)
 
-
 def refusal_logged(spelling):
     needle = f'configured to refuse --{spelling}'
     for _ in range(100):
@@ -69,9 +51,6 @@ def refusal_logged(spelling):
         time.sleep(0.02)
     return False
 
-
-# Control: preserve the canonical spelling in a hand-built daemon argv and
-# verify that the configured rule rejects it before any file list is served.
 control = rp.DaemonClient('127.0.0.1', PORT)
 control_rejected = False
 try:
@@ -91,7 +70,6 @@ def refusal_logged(spelling):
 if not control_rejected or not refusal_logged('compress-threads'):
     test_fail('canonical --compress-threads unexpectedly bypassed its refuse rule')
 
-# Attack: preserve the accepted alias spelling in a hand-built daemon argv.
 c = rp.DaemonClient('127.0.0.1', PORT)
 try:
     c.handshake(
@@ -111,10 +89,6 @@ def refusal_logged(spelling):
     print('daemon refuse rule rejected both --compress-threads and --zt')
     sys.exit(0)
 
-# Reaching here means the daemon served a file list for --zt: the refuse rule
-# did not fire and the capability was delivered.  That is the bug, whatever
-# the worker count turns out to be.  Measure it anyway, to report what the
-# bypass was worth.
 ndx = next(i for i, entry in enumerate(entries) if entry.name == b'f')
 c.send_data(c.make_request(ndx) + c.w_ndx(rp.NDX_DONE))
 
@@ -130,25 +104,9 @@ def refusal_logged(spelling):
     c.close()
     test_fail('could not identify the per-connection daemon sender')
 
-
-def thread_count(pid):
-    if sys.platform == 'darwin':
-        proc = subprocess.run(['ps', '-M', str(pid)], capture_output=True,
-                              text=True)
-        return max(0, len(proc.stdout.splitlines()) - 1)
-    if sys.platform.startswith('linux'):
-        try:
-            status = open(f'/proc/{pid}/status').read()
-        except OSError:
-            return 0
-        match = re.search(r'^Threads:\s+(\d+)', status, re.M)
-        return int(match.group(1)) if match else 0
-    return -1
-
-
 observed = 0
 for _ in range(100):
-    observed = max(observed, thread_count(child_pid))
+    observed = max(observed, process_thread_count(child_pid))
     if observed >= REQUESTED_THREADS:
         break
     time.sleep(0.02)
diff --git a/testsuite/daemon-refuse-compress_test.py b/testsuite/tests/daemon/daemon-refuse-compress.py
similarity index 72%
rename from testsuite/daemon-refuse-compress_test.py
rename to testsuite/tests/daemon/daemon-refuse-compress.py
index 83af17294..f79624227 100644
--- a/testsuite/daemon-refuse-compress_test.py
+++ b/testsuite/tests/daemon/daemon-refuse-compress.py
@@ -1,23 +1,19 @@
 #!/usr/bin/env python3
-# Python rewrite of testsuite/daemon-refuse-compress.test.
-#
-# A daemon module configured with "refuse options = compress" must
-# reject clients that ask for compression, and still serve the same
-# transfer when the client does not.
 
 import subprocess
 
-from rsyncfns import (
+from harness.rsync import (
     CHKDIR, FROMDIR, SCRATCHDIR, TODIR,
     build_rsyncd_conf, checkit, hands_setup, rmtree,
     rsync_argv, run_rsync, start_test_daemon, test_fail,
 )
+from harness import metadata
 
+metadata(features={'compression', 'daemon'}, transports={'pipe', 'tcp'}, min_peer='2.6.0', mutates={'filesystem', 'process', 'socket'}, tags={'configuration', 'daemon', 'version-mix'})
 
 DAEMON_PORT = 12876
 
 conf = build_rsyncd_conf()
-# Append an extra module that refuses --compress (-z).
 with open(conf, 'a') as f:
     f.write(f"""
 [no-compress]
@@ -31,7 +27,6 @@
 
 url = start_test_daemon(conf, DAEMON_PORT) + 'no-compress/'
 
-# A compressed transfer must be refused.
 errlog = SCRATCHDIR / 'refuse.err'
 proc = subprocess.run(
     rsync_argv('-avz', url, f'{TODIR}/'),
@@ -45,7 +40,6 @@
     print(proc.stderr)
     test_fail("expected refuse error mentioning --compress")
 
-# The same transfer without -z must succeed.
 rmtree(TODIR)
 TODIR.mkdir()
 checkit(['-av', url, f'{TODIR}/'], CHKDIR, TODIR,
diff --git a/testsuite/daemon-refuse-delete-alias_test.py b/testsuite/tests/daemon/daemon-refuse-delete-alias.py
similarity index 59%
rename from testsuite/daemon-refuse-delete-alias_test.py
rename to testsuite/tests/daemon/daemon-refuse-delete-alias.py
index 3b7f92cbf..df7a8e67c 100644
--- a/testsuite/daemon-refuse-delete-alias_test.py
+++ b/testsuite/tests/daemon/daemon-refuse-delete-alias.py
@@ -1,24 +1,8 @@
 #!/usr/bin/env python3
-"""A refuse rule naming one spelling of an option must cover the others.
-
---del and --delete-during are the same capability written two ways, but the
-popt table spells them differently: --del is POPT_ARG_NONE with a destination
-(popt stores 1), --delete-during is POPT_ARG_VAL storing 1.  A refuse rule
-matched on the raw table fields therefore disabled only the spelling the
-administrator happened to write, and the other one still worked.
-
-Both directions are checked, because the mismatch is symmetric: a rule naming
-the canonical option was evaded by the short alias, and a rule naming the
-alias was evaded by the canonical option.
-
-No raw protocol here, and no custom client: --remote-option (-M) puts the
-option in the daemon's argv verbatim, which is exactly the reach an ordinary
-user has.
-"""
 
 import subprocess
 
-from rsyncfns import (
+from harness.rsync import (
     SCRATCHDIR, makepath, rmtree, rsync_argv, start_test_daemon, test_fail,
     write_daemon_conf,
 )
@@ -31,7 +15,6 @@
 makepath(src)
 (src / 'keep').write_text('KEEP\n')
 
-# Two modules, each refusing one spelling of the same capability.
 mods = {}
 for name, rule in (('refuses_canonical', 'delete-during'), ('refuses_alias', 'del')):
     d = base / name
@@ -43,36 +26,20 @@
                            'use chroot': 'no', 'refuse options': 'delete-during'}),
     ('refuses_alias', {'path': str(mods['refuses_alias']), 'read only': 'no',
                        'use chroot': 'no', 'refuse options': 'del'}),
-    # No rule at all: proves the pushes themselves work, so a refusal below
-    # is the rule firing rather than the transfer being broken.
     ('open', {'path': str(base / 'open'), 'read only': 'no', 'use chroot': 'no'}),
 ], name='refuse-delete-alias.conf')
 makepath(base / 'open')
 url = start_test_daemon(conf, PORT)
 
-
 def push(module, *opts):
     return subprocess.run(
         rsync_argv('-r', *opts, f'{src}/', f'{url}{module}/'),
         stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True, timeout=120)
 
-
 def refused(proc, spelling):
-    """Did the daemon refuse this exact spelling?
-
-    Requiring the option name, not just the word "refuse", keeps an unrelated
-    refusal from standing in for the one under test -- and it doubles as proof
-    that -M actually delivered the option to the daemon, which the control
-    below cannot show on its own: a silently discarded -M would let the
-    transfer succeed just the same."""
     return (proc.returncode != 0
             and f'configured to refuse --{spelling}' in proc.stdout)
 
-
-# Control: both spellings transfer where nothing refuses them, so a refusal
-# below is the rule firing rather than the push being broken.  That -M reached
-# the daemon at all is established by the spelling-specific refusals, not here:
-# a silently dropped -M would pass this control too.
 for opt in ('-M--del', '-M--delete-during'):
     proc = push('open', '--delete', opt)
     if proc.returncode != 0 or not (base / 'open' / 'keep').is_file():
@@ -80,8 +47,6 @@ def refused(proc, spelling):
                   f'refuse rule (rc={proc.returncode}, '
                   f'output={proc.stdout.strip()[:300]!r})')
 
-# The reported direction: the rule names the canonical option, the client
-# sends the alias.
 proc = push('refuses_canonical', '--delete', '-M--del')
 if not refused(proc, 'del'):
     test_fail('"refuse options = delete-during" did not refuse --del, which '
@@ -89,13 +54,11 @@ def refused(proc, spelling):
               f'not one spelling of it (rc={proc.returncode}, '
               f'output={proc.stdout.strip()[:300]!r})')
 
-# ...and the mirror, since the table shapes differ in both directions.
 proc = push('refuses_alias', '--delete', '-M--delete-during')
 if not refused(proc, 'delete-during'):
     test_fail('"refuse options = del" did not refuse --delete-during '
               f'(rc={proc.returncode}, output={proc.stdout.strip()[:300]!r})')
 
-# And each rule still refuses the spelling it actually names.
 proc = push('refuses_canonical', '--delete', '-M--delete-during')
 if not refused(proc, 'delete-during'):
     test_fail('"refuse options = delete-during" did not even refuse '
diff --git a/testsuite/daemon-refuse_test.py b/testsuite/tests/daemon/daemon-refuse.py
similarity index 70%
rename from testsuite/daemon-refuse_test.py
rename to testsuite/tests/daemon/daemon-refuse.py
index 054f28099..f6c2d9cae 100644
--- a/testsuite/daemon-refuse_test.py
+++ b/testsuite/tests/daemon/daemon-refuse.py
@@ -1,19 +1,22 @@
 #!/usr/bin/env python3
-"""Daemon coverage: refuse options (a named option, a wildcard, and the
-allow-list negation form).
-
-daemon-refuse-compress_test.py covers the basic case; this widens it to a
-different named option, a wildcard pattern, and the "* !a !v" allow-list idiom
-documented in rsyncd.conf.5.
-"""
 
 import subprocess
 
-from rsyncfns import (
-    FROMDIR, SCRATCHDIR,
-    make_tree, makepath, rmtree, rsync_argv, run_rsync, start_test_daemon,
-    test_fail, verify_dirs, write_daemon_conf,
+from harness.rsync import (
+    FROMDIR,
+    SCRATCHDIR,
+    make_tree,
+    makepath,
+    rmtree,
+    rsync_argv,
+    start_test_daemon,
+    test_fail,
+    verify_dirs,
+    write_daemon_conf,
 )
+from harness import metadata
+
+metadata(features={'daemon'}, transports={'pipe', 'tcp'}, min_peer='2.6.0', mutates={'filesystem', 'process', 'socket'}, tags={'configuration', 'daemon', 'version-mix'})
 
 DAEMON_PORT = 12891
 
@@ -34,7 +37,6 @@
 ])
 url = start_test_daemon(conf, DAEMON_PORT)
 
-
 def refused(args, what):
     proc = subprocess.run(rsync_argv(*args),
                           stdout=subprocess.DEVNULL, stderr=subprocess.PIPE,
@@ -43,32 +45,25 @@ def refused(args, what):
         test_fail(f"{what} was not refused")
     return proc.stderr
 
-
 def allowed(args, what, expected=None, actual=None):
     proc = subprocess.run(rsync_argv(*args),
                           stdout=subprocess.DEVNULL, stderr=subprocess.PIPE,
                           text=True)
     if proc.returncode not in (0, 23):
         test_fail(f"{what} was unexpectedly refused: {proc.stderr}")
-    # A 0/23 exit alone doesn't prove the transfer happened; verify the data
-    # actually landed for the allowed cases.
     if expected is not None:
         verify_dirs(expected, actual, label=what)
 
-
-# --- a named refused option (delete) ----------------------------------------
 refused(['-a', '--delete', f'{src}/', f'{url}refuse-delete/'],
         "--delete on a refuse=delete module")
 allowed(['-a', f'{src}/', f'{url}refuse-delete/'],
         "plain push to a refuse=delete module", src, deldir)
 
-# --- a wildcard refused option (checksum*) ----------------------------------
 dest = SCRATCHDIR / 'wilddest'
 makepath(dest)
 refused(['-a', '--checksum', f'{url}refuse-wild/', f'{dest}/'],
         "--checksum on a refuse=checksum* module")
 
-# --- the "* !a !v" allow-list: -av allowed, -z refused ----------------------
 rmtree(dest)
 makepath(dest)
 allowed(['-av', f'{url}only-av/', f'{dest}/'], "-av on an allow-list module",
diff --git a/testsuite/tests/daemon/daemon-scan-dir-escape.py b/testsuite/tests/daemon/daemon-scan-dir-escape.py
new file mode 100644
index 000000000..7a3db56a2
--- /dev/null
+++ b/testsuite/tests/daemon/daemon-scan-dir-escape.py
@@ -0,0 +1,61 @@
+#!/usr/bin/env python3
+
+import os
+
+from harness.rsync import (
+    SCRATCHDIR, get_rootgid, get_rootuid, get_testuid, makepath, rmtree,
+    run_rsync, start_test_daemon, test_fail,
+)
+
+DAEMON_PORT = 12947
+MARKER = "XFIL-OUTSIDE-MODULE-SYMLINK-TARGET"
+
+base = SCRATCHDIR / 'daemon-scan-escape'
+rmtree(base)
+mod = base / 'mod'
+outside = base / 'outside'
+dest = base / 'dest'
+makepath(mod / 'real', outside, dest)
+
+(mod / 'real' / 'in.txt').write_text("in-module\n")
+
+os.symlink('../outside', mod / 'escape')
+
+os.symlink(MARKER, outside / 'xfil_link')
+(outside / 'xfil_dir').mkdir()
+(outside / 'xfil_dir' / 'inner').write_text("x\n")
+(outside / 'xfil_file').write_text("x\n")
+
+root = get_testuid() == get_rootuid()
+ids = f"uid = {get_rootuid()}\ngid = {get_rootgid()}" if root else ""
+
+conf = base / 'daemon-scan.conf'
+conf.write_text(f"""\
+pid file = {base}/rsyncd.pid
+use chroot = no
+{ids}
+log file = {base}/rsyncd.log
+
+[m]
+    path = {mod}
+    read only = yes
+    hosts allow = 127.0.0.1
+""")
+url = start_test_daemon(conf, DAEMON_PORT)
+
+run_rsync('-a', '--copy-dirlinks', f'{url}m/', f'{dest}/', check=False)
+
+esc = dest / 'escape'
+leak = None
+link = esc / 'xfil_link'
+if link.is_symlink() and os.readlink(link) == MARKER:
+    leak = f"symlink target leaked: dest/escape/xfil_link -> {MARKER}"
+else:
+    for name in ('xfil_dir', 'xfil_file', 'xfil_link'):
+        if (esc / name).exists() or (esc / name).is_symlink():
+            leak = f"out-of-module name leaked: dest/escape/{name}"
+            break
+
+if leak is not None:
+    test_fail(f'--copy-dirlinks escaped the daemon module: {leak}')
+print("daemon-scan-dir-escape: --copy-dirlinks enumeration stayed within the module")
diff --git a/testsuite/tests/daemon/daemon-secrets-file-symlink.py b/testsuite/tests/daemon/daemon-secrets-file-symlink.py
new file mode 100644
index 000000000..e158fe03e
--- /dev/null
+++ b/testsuite/tests/daemon/daemon-secrets-file-symlink.py
@@ -0,0 +1,104 @@
+#!/usr/bin/env python3
+
+import os
+import pwd
+import subprocess
+
+from harness.rsync import (
+    FROMDIR, SCRATCHDIR, make_tree, makepath, rmtree, rsync_argv,
+    start_test_daemon, test_fail, test_skipped, write_daemon_conf,
+)
+
+DAEMON_PORT = 12903
+USER = 'tuser'
+CORRECT_PASSWORD = 'correctpass'
+
+if os.geteuid() != 0:
+    test_skipped("requires root to plant a symlink owned by a non-self uid "
+                 "(the attacker simulation)", capability='cross_uid')
+
+NOBODY_UID = None
+for name in ('nobody', 'nfsnobody', 'daemon'):
+    try:
+        u = pwd.getpwnam(name).pw_uid
+        if u != 0 and u != os.geteuid():
+            NOBODY_UID = u
+            break
+    except KeyError:
+        continue
+if NOBODY_UID is None:
+    test_skipped("no untrusted-uid user available for cross-uid plant", capability='cross_uid')
+
+os.environ['RSYNC_PASSWORD'] = 'env-fallback-wrong'
+
+src = FROMDIR
+rmtree(src)
+make_tree(src, depth=1)
+
+base = SCRATCHDIR / 'secretsplant'
+rmtree(base)
+base.mkdir()
+
+victim = base / 'victim_secrets'
+victim.write_text(f'{USER}:{CORRECT_PASSWORD}\n')
+os.chmod(victim, 0o600)
+os.chown(victim, 0, 0)
+
+leaf_plant = base / 'secrets_leaf'
+os.symlink(victim, leaf_plant)
+os.lchown(leaf_plant, NOBODY_UID, NOBODY_UID)
+
+parent_real = base / 'parent_real'
+parent_real.mkdir()
+victim_in_target = parent_real / 'victim_in_target'
+victim_in_target.write_text(f'{USER}:{CORRECT_PASSWORD}\n')
+os.chmod(victim_in_target, 0o600)
+os.chown(victim_in_target, 0, 0)
+parent_plant = base / 'parent_link'
+os.symlink(parent_real, parent_plant)
+os.lchown(parent_plant, NOBODY_UID, NOBODY_UID)
+
+authreal = base / 'authreal'
+authleaf = base / 'authleaf'
+authparent = base / 'authparent'
+makepath(authreal, authleaf, authparent)
+
+conf = write_daemon_conf([
+    ('authreal', {'path': authreal, 'read only': 'no',
+                  'auth users': USER, 'secrets file': victim}),
+    ('authleaf', {'path': authleaf, 'read only': 'no',
+                  'auth users': USER, 'secrets file': leaf_plant}),
+    ('authparent', {'path': authparent, 'read only': 'no',
+                    'auth users': USER,
+                    'secrets file': parent_plant / 'victim_in_target'}),
+])
+url = start_test_daemon(conf, DAEMON_PORT)
+userurl = url.replace('rsync://', f'rsync://{USER}@', 1)
+
+pwfile = SCRATCHDIR / 'pw.ok'
+pwfile.write_text(CORRECT_PASSWORD + '\n')
+pwfile.chmod(0o600)
+
+def push(module, dest):
+    rmtree(dest)
+    makepath(dest)
+    return subprocess.run(
+        rsync_argv('-a', f'--password-file={pwfile}',
+                   f'{src}/', f'{userurl}{module}/'),
+        stdout=subprocess.DEVNULL, stderr=subprocess.PIPE, text=True)
+
+sanity = push('authreal', authreal)
+if sanity.returncode != 0:
+    test_fail(f'direct secrets file did not authenticate: {sanity.stderr!r}')
+
+leaf = push('authleaf', authleaf)
+if leaf.returncode == 0:
+    test_fail(f'daemon authenticated through untrusted uid {NOBODY_UID} secrets '
+              f'file symlink: {leaf_plant} -> {victim}')
+
+parent = push('authparent', authparent)
+if parent.returncode == 0:
+    test_fail(f'daemon authenticated through untrusted uid {NOBODY_UID} secrets '
+              f'path symlink: {parent_plant} -> {parent_real}')
+
+print("daemon-secrets-file-symlink: leaf + parent plants refused")
diff --git a/testsuite/tests/daemon/daemon-size-arg-overflow.py b/testsuite/tests/daemon/daemon-size-arg-overflow.py
new file mode 100644
index 000000000..b0e6ca44f
--- /dev/null
+++ b/testsuite/tests/daemon/daemon-size-arg-overflow.py
@@ -0,0 +1,41 @@
+#!/usr/bin/env python3
+
+import re
+import subprocess
+
+from harness.rsync import (
+    SCRATCHDIR, makepath, rmtree, rsync_argv, start_test_daemon,
+    test_fail, write_daemon_conf,
+)
+
+DAEMON_PORT = 12939
+
+mod = SCRATCHDIR / 'sizemod'
+rmtree(mod)
+makepath(mod)
+(mod / 'f.txt').write_text("data\n")
+
+conf = write_daemon_conf([
+    ('mod', {'path': str(mod), 'read only': 'yes'}),
+])
+url = start_test_daemon(conf, DAEMON_PORT)
+
+dst = SCRATCHDIR / 'sizeout'
+rmtree(dst)
+makepath(dst)
+
+big = '9' * 5000
+
+proc = subprocess.run(
+    rsync_argv('-a', f'-M--max-size={big}', f'{url}mod/', f'{dst}/'),
+    stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True)
+
+out = proc.stdout
+if not re.search(r'--max-size=9{100,}', out):
+    test_fail(
+        "daemon did not echo back the rejected oversized --max-size value "
+        f"(rc={proc.returncode}); parse_size_arg likely aborted on the "
+        f"unclamped err_buf[len] out-of-bounds write.\noutput:\n{out}")
+
+print("daemon-size-arg-overflow: oversized --max-size rejected by the daemon "
+      "after parse_size_arg ran to completion (err_buf length is clamped).")
diff --git a/testsuite/daemon-standalone-detach_test.py b/testsuite/tests/daemon/daemon-standalone-detach.py
similarity index 63%
rename from testsuite/daemon-standalone-detach_test.py
rename to testsuite/tests/daemon/daemon-standalone-detach.py
index 4f7bfb843..635c3ae77 100644
--- a/testsuite/daemon-standalone-detach_test.py
+++ b/testsuite/tests/daemon/daemon-standalone-detach.py
@@ -1,39 +1,22 @@
 #!/usr/bin/env python3
-"""Daemon coverage: standalone detaching listener.
-
-Every other daemon test spawns rsyncd with `--no-detach --address=127.0.0.1
---port=N`, so daemon_main()'s detach path and the rsyncd.conf port/address
-parameters are never reached:
-
-  clientserver.c become_daemon()   -- only when --no-detach is NOT given
-  daemon-parm.h  lp_rsync_port()   -- only when --port is NOT given
-  daemon-parm.h  lp_bind_address() -- only when --address is NOT given
-
-This test spawns `rsync --daemon --config=<conf>` with NONE of those flags,
-reads port/address from the conf file, waits for the detached child to write
-its pid file and start listening, does one transfer, then kills it via the
-pid file.  require_tcp-gated (it opens a real loopback listener).
-"""
 
+import atexit
 import os
 import platform
-import shlex
 import signal
 import socket
 import subprocess
 import time
 
-from rsyncfns import (
+from harness.rsync import (
     FROMDIR, RSYNC_PEER, SCRATCHDIR,
     claim_ports, make_tree, makepath, require_tcp, rmtree, rsync_argv,
     test_fail, test_skipped, write_daemon_conf, split_rsync_cmd,
 )
 
-# A standalone --daemon detaches via become_daemon(); on cygwin that becomes a
-# disconnected Windows process the harness can't reap, so it lingers as an orphan
-# squatting its port and poisoning later TCP daemon tests.  Skip on cygwin.
 if platform.system().startswith('CYGWIN'):
-    test_skipped("a detached daemon orphans on cygwin's Windows process model")
+    test_skipped("a detached daemon orphans on cygwin's Windows process model",
+                 capability='posix_detach')
 
 PORT = 19877
 require_tcp("standalone detaching daemon opens a real loopback listener; "
@@ -55,7 +38,6 @@
 conf = write_daemon_conf(
     [('mod', {'path': str(dest), 'read only': 'no', 'use chroot': 'no'})],
     globals={
-        # These two are the point of the test: read from the conf, not CLI.
         'port': str(PORT),
         'address': '127.0.0.1',
         'pid file': str(pidfile),
@@ -64,9 +46,6 @@
     name='detach.conf',
 )
 
-# Spawn WITHOUT --no-detach / --port / --address.  The launched process is
-# become_daemon()'s PARENT: it forks, gcov_flush()es, and _exit(0)s
-# immediately; the detached CHILD writes the pid file and listens.
 launcher = subprocess.run(
     split_rsync_cmd(RSYNC_PEER) + ['--daemon', f'--config={conf}'],
     capture_output=True, text=True, timeout=15,
@@ -74,7 +53,6 @@
 if launcher.returncode != 0:
     test_fail(f"daemon launcher exited {launcher.returncode}:\n{launcher.stderr}")
 
-
 def kill_detached():
     try:
         pid = int(pidfile.read_text().strip())
@@ -92,11 +70,8 @@ def kill_detached():
     except ProcessLookupError:
         pass
 
-
-import atexit
 atexit.register(kill_detached)
 
-# Wait for the detached child: pid file written AND port accepting.
 deadline = time.monotonic() + 10
 while time.monotonic() < deadline:
     if pidfile.is_file():
@@ -111,12 +86,10 @@ def kill_detached():
               f"(pidfile={'present' if pidfile.is_file() else 'absent'}; "
               f"log:\n{logfile.read_text() if logfile.is_file() else '(none)'})")
 
-# Verify the log shows the conf-supplied port (lp_rsync_port path).
 log = logfile.read_text()
 if f'listening on port {PORT}' not in log:
     test_fail(f"expected 'listening on port {PORT}' in detach.log:\n{log}")
 
-# One real transfer through the per-connection accept-loop child.
 r = subprocess.run(
     rsync_argv('-r', f'{src}/', f'rsync://127.0.0.1:{PORT}/mod/'),
     capture_output=True, text=True,
@@ -126,9 +99,6 @@ def kill_detached():
 if not any(dest.iterdir()):
     test_fail("push to detached daemon wrote nothing")
 
-# Clean shutdown via SIGTERM -> exit_cleanup -> gcov_flush in the
-# called_from_signal_handler path (cleanup.c).  The daemon removes its own
-# pid file on the way out, so capture it first.
 detached_pid = pidfile.read_text().strip()
 kill_detached()
 atexit.unregister(kill_detached)
diff --git a/testsuite/tests/daemon/daemon-stdin-inetd.py b/testsuite/tests/daemon/daemon-stdin-inetd.py
new file mode 100644
index 000000000..b5823d81d
--- /dev/null
+++ b/testsuite/tests/daemon/daemon-stdin-inetd.py
@@ -0,0 +1,94 @@
+#!/usr/bin/env python3
+
+import socket
+import subprocess
+
+from harness.rsync import (
+    SCRATCHDIR, claim_free_port, rmtree, rsync_argv, test_fail,
+    write_daemon_conf,
+)
+
+base = SCRATCHDIR / 'daemon-stdin-inetd'
+rmtree(base)
+module = base / 'module'
+module.mkdir(parents=True)
+conf = write_daemon_conf([
+    ('module', {'path': str(module), 'read only': 'yes'}),
+])
+
+def check_inetd(family, address, label, fallback_port):
+    listener = socket.socket(family, socket.SOCK_STREAM)
+    client = socket.socket(family, socket.SOCK_STREAM)
+    accepted = None
+    proc = None
+    try:
+        if family == socket.AF_INET6:
+            listener.setsockopt(socket.IPPROTO_IPV6, socket.IPV6_V6ONLY, 1)
+        listener.bind(address)
+        listener.listen(1)
+        client.settimeout(10)
+        client.connect(listener.getsockname())
+        accepted, _ = listener.accept()
+
+        proc = subprocess.Popen(
+            rsync_argv('--daemon', '--no-detach', f'--config={conf}',
+                       f'--port={fallback_port}'),
+            stdin=accepted, stdout=accepted,
+            stderr=subprocess.PIPE, close_fds=True,
+        )
+        accepted.close()
+        accepted = None
+
+        try:
+            greeting = client.recv(256)
+        except socket.timeout:
+            test_fail(f'{label}: daemon did not greet the connected stdin socket')
+        if not greeting.startswith(b'@RSYNCD:'):
+            test_fail(f'{label}: unexpected daemon greeting: {greeting!r}')
+
+        client.sendall(b'@RSYNCD: 31.0\n#exit\n')
+        try:
+            client.shutdown(socket.SHUT_WR)
+        except OSError:
+            pass
+        try:
+            while client.recv(4096):
+                pass
+        except OSError:
+            pass
+
+        try:
+            proc.wait(timeout=5)
+        except subprocess.TimeoutExpired:
+            test_fail(f'{label}: inetd-style daemon did not exit after #exit')
+    finally:
+        if accepted is not None:
+            accepted.close()
+        client.close()
+        listener.close()
+        if proc is not None and proc.poll() is None:
+            proc.terminate()
+            try:
+                proc.wait(timeout=2)
+            except subprocess.TimeoutExpired:
+                proc.kill()
+                proc.wait(timeout=2)
+
+check_inetd(socket.AF_INET, ('127.0.0.1', 0), 'IPv4',
+            claim_free_port(12980))
+
+ipv6_tested = False
+if socket.has_ipv6:
+    try:
+        with socket.socket(socket.AF_INET6, socket.SOCK_STREAM) as probe:
+            probe.setsockopt(socket.IPPROTO_IPV6, socket.IPV6_V6ONLY, 1)
+            probe.bind(('::1', 0))
+    except OSError as error:
+        print(f'IPv6 loopback is unavailable: {error}')
+    else:
+        check_inetd(socket.AF_INET6, ('::1', 0), 'IPv6',
+                    claim_free_port(12981))
+        ipv6_tested = True
+
+print('connected IPv4 stdin selects inetd mode' +
+      ('; connected IPv6 stdin selects inetd mode' if ipv6_tested else ''))
diff --git a/testsuite/daemon-stdin-local-socket_test.py b/testsuite/tests/daemon/daemon-stdin-local-socket.py
similarity index 72%
rename from testsuite/daemon-stdin-local-socket_test.py
rename to testsuite/tests/daemon/daemon-stdin-local-socket.py
index fc240ad54..fb9cfeb4b 100644
--- a/testsuite/daemon-stdin-local-socket_test.py
+++ b/testsuite/tests/daemon/daemon-stdin-local-socket.py
@@ -1,15 +1,14 @@
 #!/usr/bin/env python3
-"""A local stdin socket must not make a standalone daemon enter inetd mode."""
 
 import socket
 
-from rsyncfns import (
+from harness.rsync import (
     RSYNC, SCRATCHDIR, claim_free_port, rmtree, start_rsyncd,
     test_skipped, write_daemon_conf,
 )
 
 if not hasattr(socket, 'AF_UNIX') or not hasattr(socket, 'socketpair'):
-    test_skipped('Unix-domain socket pairs are unavailable')
+    test_skipped('Unix-domain socket pairs are unavailable', capability='unix_socketpair')
 
 base = SCRATCHDIR / 'daemon-stdin-local-socket'
 rmtree(base)
@@ -23,10 +22,8 @@
 try:
     parent, child = socket.socketpair(socket.AF_UNIX, socket.SOCK_STREAM)
 except (OSError, ValueError) as e:
-    test_skipped(f'Unix-domain socket pairs are unavailable: {e}')
+    test_skipped(f'Unix-domain socket pairs are unavailable: {e}', capability='unix_socketpair')
 try:
-    # ADB shell without a PTY similarly presents a local socket as fd 0. The
-    # local socket must not be mistaken for an inetd connection.
     start_rsyncd(conf, port, rsync_cmd=RSYNC, stdin=child)
 finally:
     child.close()
diff --git a/testsuite/daemon-stdin-unix-listener_test.py b/testsuite/tests/daemon/daemon-stdin-unix-listener.py
similarity index 82%
rename from testsuite/daemon-stdin-unix-listener_test.py
rename to testsuite/tests/daemon/daemon-stdin-unix-listener.py
index 3c18f57ea..f4c27af70 100644
--- a/testsuite/daemon-stdin-unix-listener_test.py
+++ b/testsuite/tests/daemon/daemon-stdin-unix-listener.py
@@ -1,5 +1,4 @@
 #!/usr/bin/env python3
-"""A named Unix listener on stdin selects inetd-style daemon mode."""
 
 import os
 import socket
@@ -7,15 +6,16 @@
 import sys
 import tempfile
 
-from rsyncfns import (
+from harness.rsync import (
     SCRATCHDIR, claim_free_port, rmtree, rsync_argv, test_fail,
-    test_skipped, write_daemon_conf,
+    test_skipped, under_valgrind, write_daemon_conf,
 )
 
 if not hasattr(socket, 'AF_UNIX'):
-    test_skipped('Unix-domain sockets are unavailable')
+    test_skipped('Unix-domain sockets are unavailable', capability='unix_listener')
 if sys.platform == 'cygwin':
-    test_skipped('Cygwin cannot pass a named Unix listener as daemon stdin')
+    test_skipped('Cygwin cannot pass a named Unix listener as daemon stdin',
+                 capability='unix_listener')
 
 base = SCRATCHDIR / 'daemon-stdin-unix-listener'
 rmtree(base)
@@ -26,8 +26,8 @@
 ])
 port = claim_free_port(12980)
 
-
 def check_listener(address, label):
+    timeout = 10 if under_valgrind() else 2
     listener = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
     client = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
     child = None
@@ -39,7 +39,7 @@ def check_listener(address, label):
             client.connect(address)
             child, _ = listener.accept()
         except (OSError, ValueError) as e:
-            test_skipped(f'{label} Unix listener is unavailable: {e}')
+            test_skipped(f'{label} Unix listener is unavailable: {e}', capability='unix_listener')
 
         proc = subprocess.Popen(
             rsync_argv('--daemon', '--no-detach', f'--config={conf}',
@@ -50,7 +50,7 @@ def check_listener(address, label):
         child.close()
         child = None
 
-        client.settimeout(2)
+        client.settimeout(timeout)
         try:
             greeting = client.recv(256)
         except socket.timeout:
@@ -64,21 +64,19 @@ def check_listener(address, label):
         listener.close()
         if proc is not None:
             try:
-                proc.wait(timeout=2)
+                proc.wait(timeout=timeout)
             except subprocess.TimeoutExpired:
                 proc.terminate()
                 try:
-                    proc.wait(timeout=2)
+                    proc.wait(timeout=timeout)
                 except subprocess.TimeoutExpired:
                     proc.kill()
-                    proc.wait(timeout=2)
-
+                    proc.wait(timeout=timeout)
 
 with tempfile.TemporaryDirectory(prefix='rsync-listener-') as tmpdir:
     check_listener(f'{tmpdir}/rsyncd.sock', 'filesystem')
 
 if sys.platform.startswith('linux'):
-    # A leading NUL selects Linux's abstract Unix namespace.
     check_listener(f'\0rsync-stdin-listener-{os.getpid()}', 'abstract')
 
 print('named Unix stdin listeners select inetd-style daemon mode')
diff --git a/testsuite/daemon-strict-modes-matrix_test.py b/testsuite/tests/daemon/daemon-strict-modes-matrix.py
similarity index 55%
rename from testsuite/daemon-strict-modes-matrix_test.py
rename to testsuite/tests/daemon/daemon-strict-modes-matrix.py
index 6e7f66658..f407c35d2 100644
--- a/testsuite/daemon-strict-modes-matrix_test.py
+++ b/testsuite/tests/daemon/daemon-strict-modes-matrix.py
@@ -1,43 +1,16 @@
 #!/usr/bin/env python3
-"""Pin the EXACT secrets-file permission contract enforced by `strict modes`.
-
-The rsyncd.conf(5) `strict modes` entry says the secrets file "must not be
-readable by any user ID other than the one that the rsync daemon is running
-under".  That is not what the code does.  check_secret() (authenticate.c) only
-rejects the file when:
-
-    (st.st_mode & 06) != 0          -> other-READ or other-WRITE bit set
-  OR (daemon running as root AND the file is not owned by root)
-
-So group permissions are never consulted, and even an other-EXECUTE-only bit is
-ignored.  A group-readable secrets file is ACCEPTED, directly contradicting the
-"any user ID other than" wording.  This test measures accept/reject across a
-mode sweep so the behaviour is unambiguous and the doc can be made to match it.
-
-Auth runs inside the daemon protocol, so the default stdio-pipe transport is
-fine (no TCP needed).  The owner-mismatch row needs the daemon to run as root
-plus an unprivileged uid to chown to, so it is gated on both.
-
-Cross-version: the `& 06` test is long-standing, so running this with
-`--rsync-bin=old_versions/rsync_3.2.7` is expected to reproduce the same grid --
-i.e. the doc has been imprecise for many releases, this is not a regression.
-Set REPORT_MODES=1 to dump the observed grid (via test_fail) for eyeballing.
-"""
 
 import os
 import subprocess
 
-from rsyncfns import (
-    FROMDIR, SCRATCHDIR,
-    find_attacker_uid, make_tree, makepath, rmtree, rsync_argv,
-    start_test_daemon, test_fail, write_daemon_conf,
+from harness.mutation import find_attacker_uid
+from harness.rsync import (
+    FROMDIR, SCRATCHDIR, make_tree, makepath, rmtree, rsync_argv, start_test_daemon, test_fail,
+    write_daemon_conf,
 )
 
 DAEMON_PORT = 12910
 
-# Never let a rejected secrets file fall through to an interactive getpass()
-# on /dev/tty (which would hang an automated run): give a wrong env password so
-# the client always has something to send and never prompts.
 os.environ['RSYNC_PASSWORD'] = 'env-fallback-wrong'
 
 src = FROMDIR
@@ -49,7 +22,6 @@
 secrets.write_text('tuser:secretpass\n')
 secrets.chmod(0o600)
 
-# Two modules: strict modes on (default) and off, same secrets file.
 conf = write_daemon_conf([
     ('strict', {'path': str(authdir), 'read only': 'no',
                 'auth users': 'tuser', 'secrets file': str(secrets),
@@ -60,20 +32,15 @@
 ], name='strict-modes.conf')
 url = start_test_daemon(conf, DAEMON_PORT)
 
-
 def pwfile():
     p = SCRATCHDIR / 'pw.strict'
     p.write_text('secretpass\n')
     p.chmod(0o600)
     return p
 
-
 PW = pwfile()
 
-
 def accepted(module):
-    """Push with the correct password; True == the daemon honoured the secrets
-    file (auth succeeded), False == it ignored/rejected it (auth failed)."""
     rmtree(authdir)
     makepath(authdir)
     userurl = url.replace('rsync://', 'rsync://tuser@', 1)
@@ -83,8 +50,6 @@ def accepted(module):
         stdin=subprocess.DEVNULL)
     return proc.returncode in (0, 23)
 
-
-# (mode, expected-accepted-under-strict-modes, human note)
 MODE_GRID = [
     (0o600, True,  'owner rw only'),
     (0o400, True,  'owner r only'),
@@ -107,18 +72,16 @@ def accepted(module):
     if got != want:
         mism.append(f"strict modes, 0{mode:04o}: accepted={got}, expected={want} ({note})")
 
-# strict modes = no: even a world-rw secrets file is honoured.
 secrets.chmod(0o666)
 got = accepted('loose')
 grid.append(f"loose  00666 accepted={int(got)} want=1  strict modes=no skips the check")
 if not got:
     mism.append("strict modes=no still rejected a 0666 secrets file")
 
-# Owner mismatch is only enforced when the daemon runs as root.
 ATT = find_attacker_uid() if os.geteuid() == 0 else None
 if ATT is not None:
     secrets.chmod(0o600)
-    os.chown(secrets, ATT, ATT)        # 0600 but NOT owned by root
+    os.chown(secrets, ATT, ATT)
     got = accepted('strict')
     grid.append(f"strict 00600 owner={ATT} accepted={int(got)} want=0  "
                 f"non-root owner rejected when daemon is root")
@@ -135,7 +98,4 @@ def accepted(module):
 if mism:
     test_fail("strict-modes contract deviated:\n  " + "\n  ".join(mism))
 
-print("daemon-strict-modes-matrix: secrets-file accept/reject pinned -- only "
-      "other-read/other-write (st_mode & 06) and (under a root daemon) a "
-      "non-root owner are rejected; group bits and other-exec are NOT checked, "
-      "so a group-readable secrets file is accepted")
+print('strict modes rejects other-read, other-write and invalid ownership')
diff --git a/testsuite/daemon-symlink-escape-matrix_test.py b/testsuite/tests/daemon/daemon-symlink-escape-matrix.py
similarity index 53%
rename from testsuite/daemon-symlink-escape-matrix_test.py
rename to testsuite/tests/daemon/daemon-symlink-escape-matrix.py
index 2865c518a..f47863ecc 100644
--- a/testsuite/daemon-symlink-escape-matrix_test.py
+++ b/testsuite/tests/daemon/daemon-symlink-escape-matrix.py
@@ -1,57 +1,12 @@
 #!/usr/bin/env python3
-"""Lock down daemon in-module-symlink resolution for a writable, non-chroot
-module, across every combination of:
-
-    insecure links {no (default secure), yes (admin opt-out)}
-  x munge symlinks {no, yes}
-  x link origin    {pre-existing on disk, uploaded via rsync}
-  x access VECTOR  (how the client reaches the in-module link "evil"):
-        read         : --copy-dirlinks pull of the module        (send_directory)
-        write        : --keep-dirlinks push into the module       (send_directory)
-        read-plain   : plain pull of an explicit sub-path "evil/" (change_dir)
-        write-plain   : plain push into an explicit sub-path "evil/" (change_dir)
-        compare-dest : push with --compare-dest=/evil             (basis_link_stat)
-  x symlink TYPE   (the target the in-module link "evil" points at):
-        rel-within   : relative, stays inside the module           (legit)
-        rel-outside  : relative, climbs OUT of the module           (escape)
-        rel-transits : relative, climbs above the module root with ".."
-                       then back IN -- net target inside, path transits out
-        abs-outside  : absolute, lands OUTSIDE the module           (escape)
-        abs-inside   : absolute, lands INSIDE the module            (legit)
-
-We measure whether the operation FOLLOWED the link to its target ("followed").
-For an *outside* target, followed == an out-of-module escape.
-
-Contract pinned here for THIS branch:
-  - insecure links = no (default): NO out-of-module escape via ANY vector --
-    every site (send_directory, change_dir, basis_link_stat, secure_basis_open)
-    refuses a link whose target lands outside the module root.
-  - insecure links = yes (admin opt-out): restores stock-3.2.7 follow behaviour
-    UNIFORMLY at every site (the whole point of the option). We assert this
-    against a REAL 3.2.7 daemon oracle when old_versions/rsync_3.2.7 is present:
-    for every insecure=yes cell the current build must follow iff 3.2.7 follows.
-    Without the oracle we fall back to a static contract that still catches a
-    regression (the broken build returns follow=0 where 3.2.7/the contract
-    want 1).
-
-Why the earlier version of this test missed the change_dir / basis_link_stat
-gap: its only vectors were `read`/`write` (--copy-dirlinks/--keep-dirlinks),
-which route 100%% through send_directory/secure_opendir -- the one daemon
-descent site that already honoured the opt-out -- so insecure=yes followed there
-and the test passed. The explicit-path (read-plain/write-plain -> change_dir) and
-alt-dest-basis (compare-dest -> basis_link_stat) vectors below exercise the sites
-that did NOT honour the opt-out.
-
-Needs root (foreign-owned plant; served as root) + a real TCP peer.
-"""
 
 import os
 import subprocess
 from pathlib import Path
 
-from rsyncfns import (
-    RSYNC, RSYNC_PEER, SCRATCHDIR,
-    find_attacker_uid, require_tcp, rmtree, rsync_argv, rsync_supports,
+from harness.mutation import find_attacker_uid
+from harness.rsync import (
+    RSYNC, RSYNC_PEER, SCRATCHDIR, require_tcp, rmtree, rsync_argv, rsync_supports,
     start_test_daemon, test_fail, test_skipped, write_daemon_conf,
 )
 
@@ -62,28 +17,22 @@
 
 require_tcp("the daemon symlink-resolution flow needs a real TCP peer")
 if os.geteuid() != 0:
-    test_skipped("requires root to plant a foreign-owned symlink and serve as root")
+    test_skipped("requires root to plant a foreign-owned symlink and serve as root",
+                 capability='root')
 if not rsync_supports('--copy-dirlinks'):
     test_skipped("rsync lacks --copy-dirlinks")
 ATT = find_attacker_uid()
 if ATT is None:
-    test_skipped("no untrusted-uid user available for the cross-uid plant")
+    test_skipped("no untrusted-uid user available for the cross-uid plant",
+                 capability='cross_uid')
 
-# The 3.2.7 oracle: prefer a --rsync-bin2 peer if it differs from the build under
-# test, else the in-tree static binary. None -> degrade to the static contract.
-_repo = Path(__file__).resolve().parent.parent
+_repo = Path(os.environ['srcdir'])
 ORACLE_BIN = None
 if RSYNC_PEER != RSYNC:
     ORACLE_BIN = RSYNC_PEER
 elif (_repo / 'old_versions' / 'rsync_3.2.7').is_file():
     ORACLE_BIN = str(_repo / 'old_versions' / 'rsync_3.2.7')
 
-# The in-tree oracle is a Linux x86-64 static binary, so on a non-Linux runner it
-# is present but not usable: a BSD/macOS host refuses to exec it (ENOEXEC), while
-# Solaris execs it but it crashes (SIGSEGV).  Probe it with `--version` and degrade
-# to the static contract unless it ran cleanly (rc == 0) -- catching can't-exec
-# (OSError), a hang (TimeoutExpired), and a non-zero/signal exit alike -- rather
-# than later crashing the oracle daemon launch.
 if ORACLE_BIN:
     try:
         _probe = subprocess.run([ORACLE_BIN, '--version'],
@@ -101,14 +50,15 @@
 rmtree(base)
 base.mkdir(parents=True)
 
-MODS = {}   # (insecure, munge) -> (modname, moddir, outside)
+MODS = {}
 mod_conf = []
 for insecure in (False, True):
     for munge in (False, True):
         name = f"m_{'ins' if insecure else 'safe'}_{'munge' if munge else 'nomunge'}"
         moddir = base / (name + '_root')
         outside = base / (name + '_outside')
-        moddir.mkdir(); outside.mkdir()
+        moddir.mkdir()
+        outside.mkdir()
         MODS[(insecure, munge)] = (name, moddir, outside)
         mod_conf.append((name, {
             'path': str(moddir), 'use chroot': 'no', 'read only': 'no',
@@ -118,10 +68,6 @@
         }))
 
 conf = write_daemon_conf(mod_conf, name='symlink-escape-matrix.conf')
-# Daemon UNDER TEST is always the current build; the oracle (if any) is a second
-# daemon on its own port serving the identical modules (3.2.7 ignores the unknown
-# "insecure links" param and just follows -- exactly the legacy oracle we want).
-# The oracle needs its OWN pid/log file so the two daemons don't fight one lock.
 url_cur = start_test_daemon(conf, PORT_CUR, rsync_cmd=RSYNC)
 url_oracle = None
 if ORACLE_BIN:
@@ -132,15 +78,13 @@
         name='symlink-escape-matrix-oracle.conf')
     url_oracle = start_test_daemon(conf_oracle, PORT_ORACLE, rsync_cmd=ORACLE_BIN)
 
-
 def link_target(moddir, outside, sltype):
-    """(symlink value, resolved target dir, target_is_outside) for a TYPE."""
     realdir = moddir / 'realdir'
     if sltype == 'rel-within':
         return 'realdir', realdir, False
     if sltype == 'rel-outside':
         return '../' + outside.name, outside, True
-    if sltype == 'rel-transits':       # up to the parent, then back into the module
+    if sltype == 'rel-transits':
         return f'../{moddir.name}/realdir', realdir, False
     if sltype == 'abs-outside':
         return str(outside), outside, True
@@ -148,26 +92,26 @@ def link_target(moddir, outside, sltype):
         return str(realdir), realdir, False
     raise AssertionError(sltype)
 
-
 def attempt(url, insecure, munge, origin, vector, sltype):
-    """Build the cell fresh, run `vector` against daemon `url`, return
-    (followed, target_outside)."""
     name, moddir, outside = MODS[(insecure, munge)]
-    rmtree(moddir); moddir.mkdir()
-    rmtree(outside); outside.mkdir()
+    rmtree(moddir)
+    moddir.mkdir()
+    rmtree(outside)
+    outside.mkdir()
     realdir = moddir / 'realdir'
     realdir.mkdir()
-    (realdir / 'tgtfile').write_text(SECRET)     # in-module target content
-    (outside / 'tgtfile').write_text(SECRET)     # out-of-module target content
+    (realdir / 'tgtfile').write_text(SECRET)
+    (outside / 'tgtfile').write_text(SECRET)
     symval, resolved, t_out = link_target(moddir, outside, sltype)
     evil = moddir / 'evil'
 
     if origin == 'preexist':
         os.symlink(symval, evil)
         os.lchown(evil, ATT, ATT)
-    else:  # uploaded: transfer the link in so munge/sanitise applies on the daemon
+    else:
         up = base / 'srcup'
-        rmtree(up); up.mkdir()
+        rmtree(up)
+        up.mkdir()
         os.symlink(symval, up / 'evil')
         subprocess.run(rsync_argv('-al', f'{up}/', f'{url}{name}/'),
                        stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
@@ -178,57 +122,54 @@ def run(*args):
         subprocess.run(rsync_argv(*args),
                        stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
 
-    if vector == 'read':                         # --copy-dirlinks pull (send_directory)
+    if vector == 'read':
         dest = base / 'dest'
-        rmtree(dest); dest.mkdir()
+        rmtree(dest)
+        dest.mkdir()
         run('-r', '--copy-dirlinks', f'{url}{name}/', f'{dest}/')
         through = dest / 'evil' / 'tgtfile'
         return (through.is_file() and through.read_text() == SECRET), t_out
 
-    if vector == 'write':                        # --keep-dirlinks push (send_directory)
+    if vector == 'write':
         sw = base / 'srcw'
-        rmtree(sw); sw.mkdir()
+        rmtree(sw)
+        sw.mkdir()
         (sw / 'evil').mkdir()
         (sw / 'evil' / 'pwned').write_text(PWNED)
         run('-r', '--keep-dirlinks', f'{sw}/', f'{url}{name}/')
         landed = resolved / 'pwned'
         return (landed.is_file() and landed.read_text() == PWNED), t_out
 
-    if vector == 'read-plain':                   # plain pull of "evil/" (change_dir)
+    if vector == 'read-plain':
         dest = base / 'dest'
-        rmtree(dest); dest.mkdir()
+        rmtree(dest)
+        dest.mkdir()
         run('-r', f'{url}{name}/evil/', f'{dest}/')
         through = dest / 'tgtfile'
         return (through.is_file() and through.read_text() == SECRET), t_out
 
-    if vector == 'write-plain':                  # plain push into "evil/" (change_dir)
+    if vector == 'write-plain':
         sw = base / 'srcw'
-        rmtree(sw); sw.mkdir()
+        rmtree(sw)
+        sw.mkdir()
         (sw / 'pwned').write_text(PWNED)
         run('-r', f'{sw}/', f'{url}{name}/evil/')
         landed = resolved / 'pwned'
         return (landed.is_file() and landed.read_text() == PWNED), t_out
 
-    # compare-dest: push a file whose content matches the through-the-link basis;
-    # if the daemon follows /evil it finds the match and SKIPS the transfer, so
-    # the file never lands in the module.  followed == the file was skipped.
     sc = base / 'srcc'
-    rmtree(sc); sc.mkdir()
+    rmtree(sc)
+    sc.mkdir()
     (sc / 'tgtfile').write_text(SECRET)
     run('-r', '--checksum', '--compare-dest=/evil', f'{sc}/', f'{url}{name}/')
     pushed = moddir / 'tgtfile'
     return (not pushed.is_file()), t_out
 
-
 def static_followed(insecure, munge, origin, sltype):
-    """Fallback contract when no 3.2.7 oracle is present (insecure=yes only).
-    The opt-out follows every pre-existing link; an uploaded link is sanitised
-    (munge -> none follow; munge-off -> only a rel-within value survives)."""
     if origin == 'uploaded':
         return sltype == 'rel-within' and not munge
     return True
 
-
 _REPORT = os.environ.get('REPORT_MATRIX')
 grid, mismatches, escapes = [], [], []
 for insecure in (False, True):
@@ -240,9 +181,6 @@ def static_followed(insecure, munge, origin, sltype):
                     esc = got and t_out
 
                     if not insecure:
-                        # Secure default: the ONLY hard contract is "no escape".
-                        # (In-module follow differs per resolver family, so we
-                        # don't over-pin it -- see module docstring.)
                         line = (f"ins=0 munge={int(munge)} {origin:8} {vector:12} "
                                 f"{sltype:11}: followed={int(got)} "
                                 f"{'ESCAPE' if esc else ''}")
@@ -250,8 +188,6 @@ def static_followed(insecure, munge, origin, sltype):
                             escapes.append(f"DEFAULT ESCAPE: munge={int(munge)} "
                                            f"{origin}/{vector}/{sltype}")
                     else:
-                        # Opt-out: must match stock 3.2.7 (live oracle) or the
-                        # static fallback contract.
                         if url_oracle is not None:
                             want, src = attempt(url_oracle, insecure, munge,
                                                 origin, vector, sltype)[0], '327'
@@ -280,7 +216,4 @@ def static_followed(insecure, munge, origin, sltype):
 
 oracle_note = ("vs a real 3.2.7 daemon oracle" if url_oracle
                else "vs the static fallback contract (no 3.2.7 binary present)")
-print("daemon-symlink-escape-matrix: 5 link types x preexist/uploaded x "
-      f"5 vectors (read/write/read-plain/write-plain/compare-dest) x munge: "
-      f"secure default never escapes the module, and insecure links=yes matches "
-      f"stock-3.2.7 following uniformly ({oracle_note}).")
+print(f'daemon symlink matrix stayed confined; insecure-links control: {oracle_note}')
diff --git a/testsuite/tests/daemon/daemon-symlink-scan.py b/testsuite/tests/daemon/daemon-symlink-scan.py
new file mode 100644
index 000000000..8375ad8c2
--- /dev/null
+++ b/testsuite/tests/daemon/daemon-symlink-scan.py
@@ -0,0 +1,48 @@
+#!/usr/bin/env python3
+
+import os
+
+from harness.rsync import (
+    SCRATCHDIR, get_rootgid, get_rootuid, get_testuid, makepath, rmtree,
+    run_rsync, start_test_daemon, test_fail,
+)
+
+DAEMON_PORT = 12950
+base = SCRATCHDIR / 'scan-desync'
+rmtree(base)
+mod = base / 'module'
+makepath(mod / 'y', mod / 'x', mod / 'sub', mod / 'sibling')
+(mod / 'y' / 'real.txt').write_text('shallow\n')
+os.symlink('../y', mod / 'x' / 'jump')
+(mod / 'sibling' / 's.txt').write_text('sibling\n')
+os.symlink('../sibling', mod / 'sub' / 'climb')
+
+root = get_testuid() == get_rootuid()
+ids = f"uid = {get_rootuid()}\ngid = {get_rootgid()}" if root else ""
+
+conf = base / 'd.conf'
+conf.write_text(f"""\
+pid file = {base}/rsyncd.pid
+use chroot = no
+{ids}
+log file = {base}/rsyncd.log
+
+[m]
+    path = {mod}
+    read only = yes
+    hosts allow = 127.0.0.1
+""")
+url = start_test_daemon(conf, DAEMON_PORT)
+
+for name, source, relative, content in (
+    ('shallow', 'x/jump', 'real.txt', 'shallow\n'),
+    ('subdir', 'sub', 'climb/s.txt', 'sibling\n'),
+):
+    destination = base / name
+    destination.mkdir()
+    run_rsync('-a', '--copy-dirlinks', f'{url}m/{source}/', f'{destination}/')
+    result = destination / relative
+    if not result.is_file() or result.read_text() != content:
+        test_fail(f'{name}: daemon scan lost an in-module climbing symlink')
+
+print('daemon scans remain anchored at the module root')
diff --git a/testsuite/daemon-unix-socket-atfd_test.py b/testsuite/tests/daemon/daemon-unix-socket-atfd.py
similarity index 97%
rename from testsuite/daemon-unix-socket-atfd_test.py
rename to testsuite/tests/daemon/daemon-unix-socket-atfd.py
index 84f048b00..a6041d4a2 100644
--- a/testsuite/daemon-unix-socket-atfd_test.py
+++ b/testsuite/tests/daemon/daemon-unix-socket-atfd.py
@@ -1,8 +1,9 @@
 #!/usr/bin/env python3
+
 import socket
 import stat
 
-from rsyncfns import (
+from harness.rsync import (
     SCRATCHDIR, makepath, rmtree, rsync_argv, start_test_daemon, test_skipped, test_fail,
     write_daemon_conf,
 )
diff --git a/testsuite/daemon-zstd-thread-exhaustion_test.py b/testsuite/tests/daemon/daemon-zstd-thread-exhaustion.py
similarity index 51%
rename from testsuite/daemon-zstd-thread-exhaustion_test.py
rename to testsuite/tests/daemon/daemon-zstd-thread-exhaustion.py
index c7ee91bf4..3584dd648 100644
--- a/testsuite/daemon-zstd-thread-exhaustion_test.py
+++ b/testsuite/tests/daemon/daemon-zstd-thread-exhaustion.py
@@ -1,35 +1,20 @@
 #!/usr/bin/env python3
-"""A daemon client must not control an unbounded Zstandard worker count.
-
-The daemon parses the peer-supplied server argv, so a client that names a
-large --compress-threads (or its --zt alias) on a PULL makes the daemon-side
-sender materialize that many Zstandard workers.  A stock client can do this
-with -M--compress-threads=N; no custom client is needed.  On an anonymous
-module no authentication is required first.
-
-The bound asserted here is the implementation's own: MAX_DAEMON_COMPRESSION
-_THREADS workers plus the main thread.  A looser threshold would go green on a
-build that simply cannot create the workers -- a libzstd without
-multithreading, or a process thread limit -- so the test first proves that a
-threaded worker pool IS reachable here, and only then that it is bounded.
-"""
 
 import json
 import os
 import re
-import subprocess
 import sys
 import time
 
-from rsyncfns import (
+from harness.rsync import (
     SCRATCHDIR, claim_ports, require_tcp, rmtree, run_rsync, start_rsyncd,
     test_fail, test_skipped,
 )
-import rsync_proto as rp
+from harness import protocol as rp
+from harness import process_thread_count
 
 PORT = 13120
 REQUESTED_THREADS = 256
-# options.c: MAX_DAEMON_COMPRESSION_THREADS, plus the main thread.
 MAX_DAEMON_COMPRESSION_THREADS = 8
 MAX_SAFE_THREADS = MAX_DAEMON_COMPRESSION_THREADS + 1
 
@@ -38,14 +23,12 @@
 
 version = json.loads(run_rsync('-VV', check=True, capture_output=True).stdout)
 if 'zstd' not in version.get('compress_list', []):
-    test_skipped('this build does not include Zstandard')
+    test_skipped('this build does not include Zstandard', capability='zstd_threads')
 
 base = SCRATCHDIR / 'daemon-zstd-thread-exhaustion'
 rmtree(base)
 mod = base / 'module'
 mod.mkdir(parents=True)
-# Incompressible output fills the socket while the client deliberately stops
-# reading, keeping the per-connection process alive for a thread snapshot.
 (mod / 'f').write_bytes(os.urandom(2 * 1024 * 1024))
 
 log = base / 'rsyncd.log'
@@ -74,7 +57,6 @@
 ndx = next(i for i, entry in enumerate(entries) if entry.name == b'f')
 c.send_data(c.make_request(ndx) + c.w_ndx(rp.NDX_DONE))
 
-# Identify the exact per-connection sender from the daemon log.
 child_pid = None
 for _ in range(100):
     matches = re.findall(r'\[(\d+)\] rsync on mod/f',
@@ -87,36 +69,15 @@
     c.close()
     test_fail('could not identify the per-connection daemon sender')
 
-
-def thread_count(pid):
-    if sys.platform == 'darwin':
-        proc = subprocess.run(['ps', '-M', str(pid)], capture_output=True,
-                              text=True)
-        return max(0, len(proc.stdout.splitlines()) - 1)
-    if sys.platform.startswith('linux'):
-        try:
-            status = open(f'/proc/{pid}/status').read()
-        except OSError:
-            return 0
-        match = re.search(r'^Threads:\s+(\d+)', status, re.M)
-        return int(match.group(1)) if match else 0
-    return -1
-
-
-# Ask once whether this platform can be counted at all, BEFORE folding the
-# answer into a max(): the -1 meaning "unsupported" never survives
-# max(0, -1), so testing for it afterwards can never fire, and an uncountable
-# platform instead looks like a sender that died before it could be read.
-# Cygwin reported exactly that.
-if thread_count(child_pid) < 0:
+if process_thread_count(child_pid) < 0:
     c.close()
     test_skipped("counting a process's threads is unsupported on "
                  f'{sys.platform}, so a bound on the worker pool cannot be '
-                 'observed here')
+                 'observed here', capability='thread_count')
 
 observed = 0
 for _ in range(100):
-    observed = max(observed, thread_count(child_pid))
+    observed = max(observed, process_thread_count(child_pid))
     if observed >= REQUESTED_THREADS:
         break
     time.sleep(0.02)
@@ -125,12 +86,9 @@ def thread_count(pid):
 if observed == 0:
     test_fail('the daemon sender exited before its thread count could be read')
 if observed < 2:
-    # Only the main thread: this libzstd cannot make workers at all (built
-    # without multithreading, or a thread limit).  The bound below would then
-    # hold for a reason that has nothing to do with the cap, so do not claim
-    # to have tested it.
     test_skipped('this build creates no Zstandard worker threads, so a bound '
-                 f'on them cannot be demonstrated (observed {observed})')
+                 f'on them cannot be demonstrated (observed {observed})',
+                 capability='zstd_threads')
 if observed > MAX_SAFE_THREADS:
     test_fail(
         f'one unauthenticated daemon client requested {REQUESTED_THREADS} '
diff --git a/testsuite/idn_test.py b/testsuite/tests/daemon/idn.py
similarity index 69%
rename from testsuite/idn_test.py
rename to testsuite/tests/daemon/idn.py
index a4e914f8f..78a3fd503 100644
--- a/testsuite/idn_test.py
+++ b/testsuite/tests/daemon/idn.py
@@ -1,21 +1,4 @@
 #!/usr/bin/env python3
-# Verify that rsync converts an IDN (internationalized domain name) host to
-# its IDNA A-label (Punycode) form, and that it leaves an ASCII host name
-# alone.  Only the labels that are not ASCII get rewritten, so an address
-# literal, an already-punycoded name, and a name that isn't a valid IDN all
-# reach the resolver as typed.  A name typed with combining marks is normalized
-# on the way, so it converts the same as its precomposed spelling.
-#
-# Two daemon connection methods carry the host name out of rsync, so both are
-# checked:
-#   * daemon over a remote shell (what rsync-ssl does): the host is handed to
-#     the --rsh helper.
-#   * direct daemon socket: observed through a dummy HTTP proxy (RSYNC_PROXY) on
-#     loopback, so this part only runs under --use-tcp.
-# A plain remote-shell transfer (host:path) is intentionally left alone, since
-# that name belongs to the user's ssh.
-#
-# The daemon side of IDN -- hosts allow/deny matching -- is daemon-access-idn.
 
 import os
 import shlex
@@ -24,15 +7,13 @@
 import sys
 import threading
 
-from rsyncfns import (
+from harness.rsync import (
     RSYNC, SCRATCHDIR, USE_TCP, claim_ports, run_rsync,
     test_fail, test_skipped,
 )
 
-
 if '"IDN": true' not in run_rsync('-VV', check=True, capture_output=True).stdout:
-    test_skipped("rsync built without IDN support")
-
+    test_skipped("rsync built without IDN support", capability='idn')
 
 def find_utf8_locale():
     try:
@@ -49,26 +30,19 @@ def find_utf8_locale():
             return loc
     return None
 
-
 utf8_locale = find_utf8_locale()
 if not utf8_locale:
     test_skipped("no UTF-8 locale available to encode the IDN host")
 
 idn_host = "\u010ci\u010dku.example"
 ascii_host = "xn--iku-eqab.example"
-# The same name with each caron letter spelled as a plain "c" plus a combining
-# caron (U+030C).  Unicode calls the two spellings equivalent, so both have to
-# come out as the same A-label; libidn2 is what normalizes them.
 nfd_host = "c\u030ci" "c\u030cku.example"
 
 env = os.environ.copy()
 env['LC_ALL'] = utf8_locale
 out_dir = (str(SCRATCHDIR / 'out') + '/').encode()
 
-
 def run_idn(url, *extra, extra_env=None):
-    # A bytes argv keeps the UTF-8 host intact regardless of Python's
-    # filesystem encoding.
     e = dict(env)
     if extra_env:
         e.update(extra_env)
@@ -77,17 +51,13 @@ def run_idn(url, *extra, extra_env=None):
     argv += [url.encode('utf-8'), out_dir]
     return subprocess.run(argv, capture_output=True, env=e, timeout=30)
 
-
-# --- daemon over a remote shell (the rsync-ssl mechanism) ------------------
 helper = SCRATCHDIR / 'idn-rsh.sh'
 helper.write_text('#!/bin/sh\nprintf %s "$1" > "$IDN_RSH_OUT"\nexit 1\n')
 helper.chmod(0o755)
 
 hostfile = SCRATCHDIR / 'idn-rsh-host'
 
-
 def rsh_host(url_host):
-    """The host name rsync hands the --rsh helper for rsync://<url_host>/."""
     if hostfile.exists():
         hostfile.unlink()
     run_idn(f"rsync://{url_host}/module/", f"--rsh={helper}",
@@ -96,7 +66,6 @@ def rsh_host(url_host):
         test_fail(f"the --rsh helper never ran for {url_host!r}")
     return hostfile.read_bytes().decode('utf-8', 'surrogateescape')
 
-
 def check_rsh(url_host, want, what):
     got = rsh_host(url_host)
     if got != want:
@@ -104,9 +73,6 @@ def check_rsh(url_host, want, what):
                   f"({url_host!r}), expected {want!r}")
     print(f"OK: {what} -> {got}")
 
-
-# A U-label becomes its A-label, case-folded by the IDNA mapping.  An ASCII
-# label is handed on byte for byte, case included, since DNS doesn't care.
 check_rsh(idn_host, ascii_host, "a Unicode host")
 check_rsh(nfd_host, ascii_host, "a decomposed Unicode host")
 check_rsh("C\u030cI" "C\u030cKU.Example", "xn--iku-eqab.Example",
@@ -116,15 +82,10 @@ def check_rsh(url_host, want, what):
 check_rsh(ascii_host, ascii_host, "an already-punycoded host")
 check_rsh("XN--IKU-EQAB.Example", "XN--IKU-EQAB.Example",
           "a mixed-case punycoded host")
-# A name that isn't a valid IDN goes out as-is instead of being rewritten into
-# some other name (the U+200B one would map to ".example"), so the resolver
-# fails on it just as it did before.
 check_rsh("xn--0.example", "xn--0.example", "an undecodable A-label")
 check_rsh("ـx.example", "ـx.example", "a label with a disallowed character")
 check_rsh("​.example", "​.example", "a label that maps to nothing")
 
-
-# --- direct daemon socket, observed via a dummy proxy -----------------------
 if not USE_TCP:
     print("direct-socket proxy check needs --use-tcp; skipping that part")
     sys.exit(0)
@@ -139,7 +100,6 @@ def check_rsh(url_host, want, what):
 
 captured = {}
 
-
 def serve_one():
     conn, _ = listener.accept()
     conn.settimeout(5)
@@ -160,7 +120,6 @@ def serve_one():
         pass
     conn.close()
 
-
 t = threading.Thread(target=serve_one)
 t.daemon = True
 t.start()
diff --git a/testsuite/inband-modname-leak_test.py b/testsuite/tests/daemon/inband-modname-leak.py
similarity index 65%
rename from testsuite/inband-modname-leak_test.py
rename to testsuite/tests/daemon/inband-modname-leak.py
index a8b41d964..313692063 100644
--- a/testsuite/inband-modname-leak_test.py
+++ b/testsuite/tests/daemon/inband-modname-leak.py
@@ -1,21 +1,10 @@
 #!/usr/bin/env python3
-"""KI-17: start_inband_exchange leaks modname on early error returns.
-
-clientserver.c:start_inband_exchange allocates `modname` (new_array) and frees
-it only on the success path; the early `return -1` error paths (e.g. the
-daemon replying @ERROR for an unknown module) leak it.  Client-side, one-shot
-per failed connection.
-
-ASan/LSan reproducer: connect to a daemon requesting a non-existent module so
-the @ERROR path is taken, then assert no client leak report names
-start_inband_exchange.  Gated on an AddressSanitizer build and --use-tcp.
-"""
 
 import glob
 import os
 import subprocess
 
-from rsyncfns import (
+from harness.rsync import (
     FROMDIR, SCRATCHDIR, RSYNC,
     make_tree, require_asan, require_tcp, rmtree, rsync_argv,
     start_test_daemon, test_fail,
@@ -45,13 +34,9 @@
     f"detect_leaks=1:abort_on_error=0:log_path={asan_log}"
 )
 
-# Request a module that does not exist: the daemon replies @ERROR and the
-# client's start_inband_exchange takes the early `return -1` that leaks modname.
 p = subprocess.run(rsync_argv('-r', f'{url}no-such-module/'),
                    capture_output=True, text=True)
 
-# Non-vacuity: the connection must have been refused via the @ERROR path that
-# leaks modname (rc != 0 and an "Unknown module" / @ERROR diagnostic).
 if p.returncode == 0:
     test_fail("connection to a non-existent module unexpectedly succeeded; "
               "the modname-leak path was not exercised")
diff --git a/testsuite/tests/daemon/reverse-daemon-delta.py b/testsuite/tests/daemon/reverse-daemon-delta.py
new file mode 100644
index 000000000..5d50d9e35
--- /dev/null
+++ b/testsuite/tests/daemon/reverse-daemon-delta.py
@@ -0,0 +1,86 @@
+#!/usr/bin/env python3
+
+import filecmp
+import os
+import re
+import subprocess
+
+from harness.rsync import (
+    FROMDIR, RSYNC, RSYNC_PEER, TMPDIR,
+    build_rsyncd_conf, makepath, make_data_file, start_test_daemon, test_fail, split_rsync_cmd,
+)
+from harness import metadata
+
+metadata(features={'compression', 'daemon', 'remote-shell'}, transports={'pipe', 'tcp'}, min_peer='2.6.0', mutates={'filesystem', 'process', 'socket'}, tags={'compatibility', 'daemon', 'transfer', 'version-mix'})
+
+DAEMON_PORT = 12894
+FILESIZE = 512 * 1024
+_SUMMARY = re.compile(r'(?:sent|wrote) ([\d,]+) bytes\s+(?:received|read) ([\d,]+) bytes')
+
+TODIR = TMPDIR / 'to'
+
+def make_versions(path_old, path_new):
+    make_data_file(path_old, FILESIZE)
+    data = bytearray(open(path_old, 'rb').read())
+    data[100000:100050] = bytes(((b + 1) & 0xFF) for b in data[100000:100050])
+    data += b'reverse-delta appended tail\n' * 64
+    with open(path_new, 'wb') as f:
+        f.write(data)
+
+def peer_client(args, label):
+    argv = split_rsync_cmd(RSYNC_PEER) + args
+    proc = subprocess.run(argv, stdout=subprocess.PIPE,
+                          stderr=subprocess.STDOUT, text=True,
+                          env={**os.environ, 'LC_ALL': 'C'})
+    print(proc.stdout, end='')
+    if proc.returncode != 0:
+        test_fail(f"{label}: old client exited {proc.returncode}")
+    m = _SUMMARY.search(proc.stdout)
+    if not m:
+        test_fail(f"{label}: could not parse sent/received from client output")
+    return int(m.group(1).replace(',', '')), int(m.group(2).replace(',', ''))
+
+def assert_delta(label, moved):
+    if moved >= FILESIZE // 2:
+        test_fail(f"{label}: {moved} bytes crossed the wire -- delta did not "
+                  f"engage (file is {FILESIZE} bytes)")
+
+def run_push(compress):
+    tag = "push+z" if compress else "push"
+    basis = TODIR / f'{tag}.dat'
+    source = src / f'{tag}.dat'
+    make_versions(basis, source)
+    opts = ['-a', '-v'] + (['-z'] if compress else [])
+    sent, _ = peer_client(opts + [str(source), f'{url}test-to/'], tag)
+    if not filecmp.cmp(source, basis, shallow=False):
+        test_fail(f"{tag}: daemon-side file does not match source after push")
+    assert_delta(tag, sent)
+    print(f"{tag}: OK (sent {sent} bytes for a {FILESIZE}-byte file)")
+
+def run_pull(compress):
+    tag = "pull+z" if compress else "pull"
+    served = FROMDIR / f'{tag}.dat'
+    local = dst / f'{tag}.dat'
+    make_versions(local, served)
+    opts = ['-a', '-v'] + (['-z'] if compress else [])
+    _, received = peer_client(
+        opts + [f'{url}test-from/{tag}.dat', str(dst) + '/'], tag)
+    if not filecmp.cmp(served, local, shallow=False):
+        test_fail(f"{tag}: client file does not match daemon source after pull")
+    assert_delta(tag, received)
+    print(f"{tag}: OK (received {received} bytes for a {FILESIZE}-byte file)")
+
+os.chdir(TMPDIR)
+makepath(FROMDIR, TODIR)
+
+conf = build_rsyncd_conf()
+url = start_test_daemon(conf, DAEMON_PORT, rsync_cmd=RSYNC)
+
+src = TMPDIR / 'client-src'
+dst = TMPDIR / 'client-dst'
+makepath(src, dst)
+
+run_push(compress=False)
+run_push(compress=True)
+run_pull(compress=False)
+run_pull(compress=True)
diff --git a/testsuite/tests/harness/filesystem.py b/testsuite/tests/harness/filesystem.py
new file mode 100644
index 000000000..65e752938
--- /dev/null
+++ b/testsuite/tests/harness/filesystem.py
@@ -0,0 +1,63 @@
+#!/usr/bin/env python3
+
+import os
+
+from harness import (TestContext, assert_exists, assert_hardlinked, assert_is_symlink, assert_mode,
+                     assert_mtime_close, assert_not_exists, assert_not_hardlinked, assert_same, cp_p,
+                     is_a_link, make_data_file, make_text_file, make_tree, makepath, requires, rmtree,
+                     run, test_fail, walk_dirs, walk_files, write_text_file)
+
+@requires(transports={'pipe'}, tags={'harness'})
+def test(context: TestContext):
+    root = context.scratch / 'filesystem'
+    source = root / 'source'
+    copy = root / 'copy'
+    link = root / 'link'
+    symlink = root / 'symlink'
+    data = root / 'data'
+    makepath(root)
+    make_text_file(source, 3)
+    cp_p(source, copy)
+    assert_same(source, copy)
+    assert_exists(copy)
+    assert_not_exists(root / 'missing')
+    os.link(source, link)
+    assert_hardlinked(source, link)
+    assert_not_hardlinked(source, copy)
+    symlink.symlink_to(source.name)
+    assert_is_symlink(symlink, source.name)
+    if not is_a_link(symlink):
+        test_fail('is_a_link rejected a symlink')
+    source.chmod(0o600)
+    assert_mode(source, 0o600)
+    assert_mtime_close(source, source.stat().st_mtime)
+    make_data_file(data, 4096)
+    if data.stat().st_size != 4096:
+        test_fail('make_data_file wrote the wrong size')
+    fixture = write_text_file(root / 'fixture', 'fixture\n', 0o600)
+    if fixture.read_text() != 'fixture\n':
+        test_fail('write_text_file wrote the wrong content')
+    assert_mode(fixture, 0o600)
+
+    dirs, files = make_tree(root / 'tree', depth=2, content_lines=2)
+    if set(walk_dirs(root / 'tree')) != set(dirs) or set(walk_files(root / 'tree')) != set(files):
+        test_fail('tree traversal does not match make_tree')
+
+    target = root / 'target'
+    target.mkdir()
+    removable_link = root / 'removable-link'
+    removable_link.symlink_to(target.name, target_is_directory=True)
+    rmtree(removable_link)
+    assert_not_exists(removable_link)
+    assert_exists(target)
+
+    removable_file = root / 'removable-file'
+    removable_file.write_text('data\n')
+    rmtree(removable_file)
+    assert_not_exists(removable_file)
+
+    rmtree(root)
+    assert_not_exists(root)
+
+if __name__ == '__main__':
+    run(test)
diff --git a/testsuite/tests/harness/metadata.py b/testsuite/tests/harness/metadata.py
new file mode 100644
index 000000000..1b1e331f6
--- /dev/null
+++ b/testsuite/tests/harness/metadata.py
@@ -0,0 +1,107 @@
+#!/usr/bin/env python3
+
+from harness import (TestContext, applies_to_peer, discover_tests, metadata, placeholder_target,
+                     read_requirements, requires, resolve_test_path, run, test_name)
+from harness.rsync import test_fail
+
+@requires(transports={'pipe'}, tags={'harness'})
+def test(context: TestContext):
+    discovery = context.scratch / 'discovery'
+    first = discovery / 'transfer' / 'first.py'
+    second = discovery / 'daemon' / 'second.py'
+    first.parent.mkdir(parents=True)
+    second.parent.mkdir(parents=True)
+    first.write_text('')
+    second.write_text('')
+    paths = discover_tests(discovery)
+    if paths != [first, second] or [test_name(path) for path in paths] != ['first', 'second']:
+        test_fail('nested tests were not discovered in basename order')
+    duplicate = discovery / 'build' / 'first.py'
+    duplicate.parent.mkdir()
+    duplicate.write_text('')
+    try:
+        discover_tests(discovery)
+    except ValueError:
+        pass
+    else:
+        test_fail('duplicate test names were accepted')
+
+    decorated = context.scratch / 'decorated.py'
+    decorated.write_text("from harness import requires\n"
+                         "@requires(protocols={27}, transports={'pipe', 'tcp'}, min_peer='2.6.0', "
+                         "tags={'version-mix'})\n"
+                         "def test(context): pass\n")
+    requirements = read_requirements(decorated)
+    if requirements['min_peer'] != '2.6.0' or requirements['transports'] != ('pipe', 'tcp'):
+        test_fail('smoke metadata was not discovered')
+    if not applies_to_peer(requirements, '2.6.0', 27, 'pipe'):
+        test_fail('matching peer metadata was rejected')
+    if (applies_to_peer(requirements, '2.5.0', 27, 'pipe')
+            or applies_to_peer(requirements, '2.6.0', 26, 'pipe')
+            or applies_to_peer(requirements, '2.6.0', 27, 'socket')):
+        test_fail('inapplicable peer metadata was accepted')
+
+    module = context.scratch / 'module.py'
+    module.write_text("from harness import metadata\nmetadata(features={'acl'}, tags={'version-mix'})\n")
+    if read_requirements(module)['features'] != ('acl',):
+        test_fail('module metadata was not discovered')
+
+    alias = context.scratch / 'alias.py'
+    alias.symlink_to(module.name)
+    if resolve_test_path(alias) != module or read_requirements(alias) != read_requirements(module):
+        test_fail('link alias did not inherit target metadata')
+
+    placeholder = context.scratch / 'placeholder.py'
+    placeholder.write_text(module.name)
+    if (placeholder_target(placeholder) != module or resolve_test_path(placeholder) != module
+            or read_requirements(placeholder) != read_requirements(module)):
+        test_fail('placeholder did not inherit target metadata')
+
+    cycle_a = context.scratch / 'cycle-a.py'
+    cycle_b = context.scratch / 'cycle-b.py'
+    cycle_a.write_text(cycle_b.name)
+    cycle_b.write_text(cycle_a.name)
+    try:
+        read_requirements(cycle_a)
+    except ValueError:
+        pass
+    else:
+        test_fail('placeholder cycle was accepted')
+
+    inferred = context.scratch / 'inferred.py'
+    inferred.write_text("require_tcp('tcp')\nrequire_asan('asan')\n"
+                        "setup_chroot_inner('chroot')\n"
+                        "test_skipped('root', capability='nonroot')\n")
+    if read_requirements(inferred)['features'] != ('asan', 'chroot', 'nonroot', 'root', 'tcp'):
+        test_fail('capability metadata was not inferred')
+
+    invalid_capability = context.scratch / 'invalid-capability.py'
+    invalid_capability.write_text("test_skipped('bad', capability=1)\n")
+    try:
+        read_requirements(invalid_capability)
+    except ValueError:
+        pass
+    else:
+        test_fail('invalid capability metadata was accepted')
+
+    invalid = (
+        {'features': {''}}, {'features': 'acl'}, {'features': {'acl', 1}},
+        {'protocols': {0}}, {'protocols': {True}},
+        {'transports': {'socket'}}, {'min_peer': 'three'}, {'min_peer': True},
+        {'cost': 'slow'},
+    )
+    for values in invalid:
+        try:
+            requires(**values)
+        except ValueError:
+            continue
+        test_fail(f'invalid metadata was accepted: {values}')
+    try:
+        metadata(unknown=True)
+    except TypeError:
+        pass
+    else:
+        test_fail('unknown metadata field was accepted')
+
+if __name__ == '__main__':
+    run(test)
diff --git a/testsuite/tests/harness/process.py b/testsuite/tests/harness/process.py
new file mode 100644
index 000000000..44c27cd8f
--- /dev/null
+++ b/testsuite/tests/harness/process.py
@@ -0,0 +1,92 @@
+#!/usr/bin/env python3
+
+from contextlib import redirect_stderr
+from io import StringIO
+import shlex
+import sys
+from types import SimpleNamespace
+from unittest.mock import patch
+
+from harness import daemon
+from harness import (Exit, TestContext, forced_protocol, requires, rsh_cmd, rsync_argv,
+                     rsync_argv_for, rsync_command_binary, rsync_path_arg, rsync_supports, run,
+                     run_rsync, split_rsync_cmd, test_fail, under_valgrind)
+
+@requires(transports={'pipe'}, tags={'harness'})
+def test(context: TestContext):
+    bindir = context.scratch / 'bin with spaces'
+    bindir.mkdir()
+    binary = bindir / 'rsync'
+    binary.write_text('')
+    command = f'{binary} --protocol=31'
+    if split_rsync_cmd(command) != [str(binary), '--protocol=31']:
+        test_fail('an unquoted executable path containing spaces was split')
+    if rsync_command_binary(command) != str(binary):
+        test_fail('the rsync executable was not found in its command')
+    if forced_protocol(command) != 31 or forced_protocol(str(binary)) is not None:
+        test_fail('the forced protocol was parsed incorrectly')
+    protocol_dir = context.scratch / '--protocol=99'
+    protocol_dir.mkdir()
+    protocol_binary = protocol_dir / 'rsync'
+    protocol_binary.write_text('')
+    if forced_protocol(str(protocol_binary)) is not None:
+        test_fail('a protocol-like path was parsed as an option')
+
+    wrapped = f'valgrind --tool=memcheck {shlex.quote(str(binary))}'
+    wrapped_argv = ['valgrind', '--tool=memcheck', str(binary)]
+    if split_rsync_cmd(wrapped) != wrapped_argv or not under_valgrind(wrapped):
+        test_fail('a wrapped rsync command was not preserved')
+    if under_valgrind(str(bindir / 'valgrind-rsync')):
+        test_fail('valgrind was inferred from an executable path')
+    if rsync_path_arg(wrapped) != shlex.join(wrapped_argv):
+        test_fail('the remote rsync command was not quoted')
+    if rsync_argv(command, '-a') != [str(binary), '--protocol=31', '-a']:
+        test_fail('rsync arguments were not appended')
+
+    replacement = bindir / 'peer'
+    replacement.write_text('')
+    if rsync_argv_for(wrapped, replacement, '-a') != [
+            'valgrind', '--tool=memcheck', str(replacement), '-a']:
+        test_fail('the wrapped rsync executable was not replaced')
+
+    source = context.scratch / 'source with spaces'
+    shell = str(source / 'support' / 'lsh.sh')
+    expected_rsh = shlex.join([shell, '--option', 'value with spaces'])
+    if rsh_cmd(shell, '--option', 'value with spaces') != expected_rsh:
+        test_fail('the remote shell command was not quoted')
+
+    unsupported = context.scratch / 'unsupported.py'
+    unsupported.write_text("import sys\nsys.stderr.write('unknown option\\n')\nraise SystemExit(1)\n")
+    supported = context.scratch / 'supported.py'
+    supported.write_text('raise SystemExit(0)\n')
+    unsupported_command = f'{sys.executable} {unsupported}'
+    supported_command = f'{sys.executable} {supported}'
+    if rsync_supports(unsupported_command, '--same-flag'):
+        test_fail('an unsupported option was accepted')
+    if not rsync_supports(supported_command, '--same-flag'):
+        test_fail('feature-probe caching ignored the changed command')
+    if run_rsync(supported_command, capture_output=True).returncode != 0:
+        test_fail('a successful command failed')
+    if run_rsync(unsupported_command, check=False, capture_output=True).returncode != 1:
+        test_fail('a failed command result was not returned')
+
+    with patch.object(daemon.os, 'kill'), patch.object(daemon.subprocess, 'run') as run_ps:
+        run_ps.return_value = SimpleNamespace(returncode=0, stdout='notrsync\n')
+        if daemon._is_rsync(123):
+            test_fail('daemon cleanup accepted a process name containing rsync')
+        run_ps.return_value = SimpleNamespace(returncode=0, stdout='rsync\n')
+        if not daemon._is_rsync(123):
+            test_fail('daemon cleanup rejected the configured rsync process name')
+
+    error_output = StringIO()
+    try:
+        with redirect_stderr(error_output):
+            run_rsync(unsupported_command, capture_output=True)
+    except SystemExit as error:
+        if error.code != Exit.FAIL or 'rsync exited 1:' not in error_output.getvalue():
+            test_fail('a failed command reported the wrong result')
+    else:
+        test_fail('a failed command did not stop the test')
+
+if __name__ == '__main__':
+    run(test)
diff --git a/testsuite/tests/harness/profile.py b/testsuite/tests/harness/profile.py
new file mode 100644
index 000000000..0650c6c3d
--- /dev/null
+++ b/testsuite/tests/harness/profile.py
@@ -0,0 +1,62 @@
+#!/usr/bin/env python3
+
+import json
+
+from harness import (TestContext, applies_to_peer, discover_tests, load_profile, merge_profiles,
+                     parse_peer_banner, read_requirements, requires, run, test_name)
+from harness.rsync import test_fail
+
+@requires(transports={'pipe'}, tags={'harness'})
+def test(context: TestContext):
+    test_paths = discover_tests(context.repository / 'testsuite' / 'tests')
+    requirements = {test_name(path): read_requirements(path) for path in test_paths}
+    tests = set(requirements)
+    paths = sorted((context.repository / 'testsuite' / 'profiles').glob('*.json'))
+    profiles = [load_profile(path, tests) for path in paths]
+    if not any(profile.peer for profile in profiles) or not any(profile.unsupported for profile in profiles):
+        test_fail('profile set is incomplete')
+    features = {feature for values in requirements.values() if values for feature in values['features']}
+    for profile in profiles:
+        unknown = set(profile.unsupported) - features
+        if unknown:
+            test_fail(f'{profile.name} permits unknown capabilities: {", ".join(sorted(unknown))}')
+    peers = {profile.peer for profile in profiles if profile.peer}
+    archived = {path.name[len('rsync_'):] for path in (context.repository / 'old_versions').glob('rsync_*')}
+    if archived and peers != archived:
+        test_fail('peer profiles do not match archived binaries')
+    by_name = {profile.name: profile for profile in profiles}
+    environment = [by_name[name] for name in ('linux', 'non-asan', 'pipe', 'root', 'self-peer')]
+    peer, protocol, unsupported, xfail = merge_profiles(environment)
+    if peer or protocol or not unsupported or xfail:
+        test_fail('platform profile composition failed')
+    _, _, unsupported, _ = merge_profiles([by_name['nonroot'], by_name['cygwin']])
+    if 'device_nodes' not in unsupported:
+        test_fail('overlapping unsupported capabilities were dropped')
+    for profile in profiles:
+        if profile.peer and any(not applies_to_peer(requirements[name], profile.peer, profile.protocol)
+                                for name in profile.xfail):
+            test_fail(f'{profile.name} has an inapplicable deviation')
+    if parse_peer_banner('rsync  version 3.5.1-gabc  protocol version 33') != ('3.5.1', 33):
+        test_fail('version banner was not parsed')
+
+    def reject(name, data):
+        path = context.scratch / name
+        path.write_text(json.dumps(data))
+        try:
+            load_profile(path, tests)
+        except ValueError:
+            return
+        test_fail(f'{name} was accepted')
+
+    reject('field.json', {'unknown': {}})
+    reject('object.json', [])
+    reject('peer.json', {'peer': ''})
+    reject('peer-format.json', {'peer': 'current', 'protocol': 33})
+    reject('missing-protocol.json', {'peer': '3.4.1'})
+    reject('wrong-name.json', {'peer': '3.4.1', 'protocol': 32})
+    reject('protocol.json', {'protocol': True})
+    reject('unsupported.json', {'unsupported': {'acl': ''}})
+    reject('xfail.json', {'xfail': {'missing-test': 'issue-1'}})
+
+if __name__ == '__main__':
+    run(test)
diff --git a/testsuite/tests/harness/results.py b/testsuite/tests/harness/results.py
new file mode 100644
index 000000000..edc8c1dc1
--- /dev/null
+++ b/testsuite/tests/harness/results.py
@@ -0,0 +1,30 @@
+#!/usr/bin/env python3
+
+from harness import Exit, TestContext, TestResult, requires, run, test_fail, verdict_of
+
+@requires(transports={'pipe'}, tags={'harness'})
+def test(context: TestContext):
+    cases = (
+        (Exit.PASS, '', 'pass'), (Exit.FAIL, '', 'fail'),
+        (Exit.ERROR, '', 'error'), (Exit.SKIP, '', 'skip'),
+        (Exit.SKIP, 'acl', 'unsupported'), (Exit.XFAIL, '', 'xfail'),
+    )
+    for exit_code, unsupported, expected in cases:
+        result = TestResult('case', exit_code, unsupported=unsupported)
+        if result.outcome != expected:
+            test_fail(f'{exit_code} normalised as {result.outcome}')
+
+    verdicts = (
+        ('pass', 'xfail:issue-1', 'xpass'),
+        ('fail', 'xfail:issue-1', 'xfail'),
+        ('unsupported', 'pass', 'profile_error'),
+        ('unsupported', 'unsupported:acl', 'unsupported'),
+    )
+    for outcome, expected, verdict in verdicts:
+        if verdict_of(outcome, expected) != verdict:
+            test_fail(f'{outcome} against {expected} produced the wrong verdict')
+    if TestResult('case', Exit.SKIP, unsupported='acl').record()['verdict'] != 'unsupported':
+        test_fail('unprofiled unsupported result was reclassified')
+
+if __name__ == '__main__':
+    run(test)
diff --git a/testsuite/tests/harness/runner.py b/testsuite/tests/harness/runner.py
new file mode 100644
index 000000000..abb9430be
--- /dev/null
+++ b/testsuite/tests/harness/runner.py
@@ -0,0 +1,100 @@
+#!/usr/bin/env python3
+
+import json
+import os
+import subprocess
+import sys
+from types import SimpleNamespace
+from unittest.mock import patch
+
+from harness import runner
+from harness import Exit, TestContext, parse_peer_banner, requires, run, test_name
+from harness.rsync import rsync_command_binary, test_fail
+
+@requires(features={'remote-shell'}, transports={'pipe'}, mutates={'filesystem', 'process'}, tags={'harness'})
+def test(context: TestContext):
+    args = SimpleNamespace(log_level=9, timeout=300, use_tcp=False, race_timeout=None)
+    with patch.dict('os.environ', {'RSYNC_TEST_USE_TCP': '1', 'race_timeout': '5'}):
+        env = runner.build_test_environment(
+            args, str(context.tools), str(context.repository),
+            str(context.repository / 'testsuite'), str(context.scratch),
+            '/tmp/rsync', '/tmp/rsync', '',
+            {'RUNSHFLAGS': 'wrong', 'setfacl_nodef': 'wrong'}, ['setfacl', '-k'])
+    if 'RSYNC_TEST_USE_TCP' in env or 'race_timeout' in env:
+        test_fail('disabled runner options leaked from the environment')
+    if env['RUNSHFLAGS'] != '-e -x' or env['setfacl_nodef'] != 'setfacl -k':
+        test_fail('runner settings were overridden by shconfig')
+
+    tests = runner.collect_tests(str(context.repository / 'testsuite'), [])
+    try:
+        runner.collect_tests(str(context.repository / 'testsuite'), ['missing-test'])
+    except ValueError:
+        pass
+    else:
+        test_fail('an unmatched explicit test selector was accepted')
+    daemon, independent = runner.select_daemon_tests(tests)
+    daemon = {test_name(path) for path in daemon}
+    independent = {test_name(path) for path in independent}
+    if {'daemon-auth', 'idn', 'protocol-refusals'} > daemon:
+        test_fail('daemon test selection dropped coverage')
+    if {'filter-merge-content-echo', 'runner'} > independent:
+        test_fail('daemon test selection retained transport-independent tests')
+
+    daemon_call = 'start_test_daemon(None, 1)\n'
+    target = context.scratch / 'daemon-target.py'
+    alias = context.scratch / 'daemon-alias.py'
+    option = context.scratch / 'daemon-option.py'
+    target.write_text(daemon_call)
+    alias.write_text(target.name)
+    option.write_text("args = ['--" + "daemon']\n")
+    selected, _ = runner.select_daemon_tests([str(alias), str(option)])
+    if selected != [str(alias), str(option)]:
+        test_fail('daemon test selection missed an alias or option')
+
+    pipe_only = context.scratch / 'pipe-only.py'
+    tcp_only = context.scratch / 'tcp-only.py'
+    pipe_only.write_text("from harness import metadata\nmetadata(transports={'pipe'})\n" + daemon_call)
+    tcp_only.write_text("from harness import metadata\nmetadata(transports={'tcp'}, tags={'daemon'})\n")
+    selected, dropped = runner.select_daemon_tests([str(pipe_only), str(tcp_only)])
+    if selected != [str(tcp_only)] or dropped != [str(pipe_only)]:
+        test_fail('daemon test selection ignored transport metadata')
+
+    valgrind = SimpleNamespace(valgrind=True, valgrind_opts='', protocol=None)
+    command = runner.build_rsync_cmd('/tmp/rsync', valgrind, str(context.scratch / 'valgrind'))
+    suppression = context.scratch / 'valgrind' / 'valgrind-logs' / 'valgrind.supp'
+    if not suppression.is_file() or f'--suppressions={suppression}' not in command:
+        test_fail('the Valgrind suppression file is unavailable to dropped processes')
+
+    receipt = context.scratch / 'run.json'
+    nested_env = os.environ.copy()
+    nested_env['scratchbase'] = str(context.scratch / 'nested')
+    binary = rsync_command_binary()
+    banner = subprocess.run([binary, '--version'], capture_output=True, text=True, check=True).stdout
+    peer, protocol = parse_peer_banner(banner)
+    profile = context.scratch / f'peer-{peer}.json'
+    command = [sys.executable, str(context.repository / 'testsuite' / 'runtests.py'), 'smoke',
+               f'--rsync-bin={binary}', f'--rsync-bin2={binary}', f'--tooldir={context.tools}',
+               f'--srcdir={context.repository}', f'--profiles={profile}', f'--receipt={receipt}']
+    profile.write_text(json.dumps({'peer': peer, 'protocol': protocol + 1}))
+    mismatch = subprocess.run(command, env=nested_env, capture_output=True, text=True)
+    if mismatch.returncode != Exit.ERROR or 'profile protocol' not in mismatch.stderr:
+        test_fail('a mismatched peer protocol was accepted')
+
+    profile.write_text(json.dumps({'peer': peer, 'protocol': protocol,
+                                   'xfail': {'alt-dest': 'test-fixture'}}))
+    result = subprocess.run(command, env=nested_env, capture_output=True, text=True)
+    if result.returncode:
+        test_fail(f'nested runner failed: {result.stdout}{result.stderr}')
+    data = json.loads(receipt.read_text())
+    if (data['summary']['exit_code'] or data['run']['selected'] != ['smoke']
+            or data['run']['peer_version'] != peer or data['run']['protocol'] != protocol
+            or data['run']['profiles'] != [f'peer-{peer}']
+            or data['summary']['verdicts'] != {'pass': 1}):
+        test_fail('receipt summary or selection is wrong')
+    if (data['tests'][0]['name'] != 'smoke' or data['tests'][0]['outcome'] != 'pass'
+            or data['tests'][0]['expected'] != 'pass'
+            or list(context.scratch.glob(f'.{receipt.name}.*.tmp'))):
+        test_fail('receipt result is wrong')
+
+if __name__ == '__main__':
+    run(test)
diff --git a/testsuite/tests/harness/workflow-profile.py b/testsuite/tests/harness/workflow-profile.py
new file mode 100644
index 000000000..698a36cb3
--- /dev/null
+++ b/testsuite/tests/harness/workflow-profile.py
@@ -0,0 +1,120 @@
+#!/usr/bin/env python3
+
+import re
+from pathlib import Path
+
+from harness import runner
+from harness import metadata, test_name
+from harness.rsync import SRCDIR, test_fail
+
+metadata(transports={'pipe'}, tags={'harness'})
+
+src = Path(SRCDIR).resolve()
+
+assignment = re.compile(
+    r'RSYNC_TEST_PROFILES=(\S*\$\{\{\s*matrix\.profiles\s*\}\}\S*|\S+)')
+matrix_ref = re.compile(r'\$\{\{\s*matrix\.profiles\s*\}\}')
+matrix_value = re.compile(r'^\s+profiles:\s+(\S+)\s*$')
+common_profiles = {'non-asan', 'root', 'self-peer', 'no-idn', 'no-xxhash', 'no-zstd-threads'}
+required_profiles = {
+    'freebsd-build.yml': common_profiles | {'freebsd'},
+    'netbsd-build.yml': common_profiles | {'netbsd'},
+    'openbsd-build.yml': common_profiles | {'openbsd'},
+    'solaris-build.yml': common_profiles | {'solaris'},
+    'asan-build.yml': {'nonroot', 'self-peer', 'linux'},
+}
+valgrind_matrix = {
+    frozenset({'pipe', 'non-asan', 'nonroot', 'self-peer', 'linux', 'valgrind'}),
+    frozenset({'non-asan', 'nonroot', 'self-peer', 'linux', 'valgrind'}),
+    frozenset({'pipe', 'non-asan', 'root', 'self-peer', 'linux', 'valgrind'}),
+    frozenset({'non-asan', 'root', 'self-peer', 'linux', 'valgrind'}),
+}
+
+def expand_profiles(line, matrix):
+    match = assignment.search(line)
+    if not match:
+        test_fail('invalid RSYNC_TEST_PROFILES assignment')
+    value = match.group(1)
+    if not matrix_ref.search(value):
+        return [value]
+    if not matrix:
+        test_fail('matrix profile expression has no values')
+    return [matrix_ref.sub(profile, value) for profile in matrix]
+
+test_paths = runner.collect_tests(str(src / 'testsuite'), [])
+known_tests = {test_name(path) for path in test_paths}
+
+references = 0
+workflows = sorted((src / '.github' / 'workflows').glob('*.yml'))
+for path in workflows:
+    lines = path.read_text().splitlines()
+    workflow = '\n'.join(lines)
+    if (path.name == 'ubuntu-version-mix.yml'
+            and 'tcp=(--use-tcp --daemon-tests-only)' not in workflow):
+        test_fail('ubuntu-version-mix.yml: TCP pass repeats transport-independent tests')
+    matrix = sorted(match.group(1) for line in lines if (match := matrix_value.match(line)))
+    profile_lines = [line for line in lines if 'RSYNC_TEST_PROFILES=' in line]
+    specs = [value for line in profile_lines for value in expand_profiles(line, matrix)]
+    names = {name for value in specs for name in value.split(',')}
+    for value in specs:
+        for name in value.split(','):
+            runner.load_profile(src / 'testsuite' / 'profiles' / f'{name}.json', known_tests)
+        references += 1
+
+    required = required_profiles.get(path.name)
+    if required:
+        missing = required - names
+        if missing:
+            test_fail(f'{path.name}: missing profiles: {", ".join(sorted(missing))}')
+        if not any('test-results/*.json' in line for line in lines):
+            test_fail(f'{path.name}: profile receipts are not retained')
+        if not any('if: always()' in line for line in lines):
+            test_fail(f'{path.name}: failed profile receipts are not retained')
+
+    if path.name == 'valgrind.yml':
+        actual = {frozenset(value.split(',')) for value in matrix}
+        if actual != valgrind_matrix:
+            test_fail('valgrind.yml: incomplete profile matrix')
+        if ('VALGRIND_SCRATCH: /tmp/' not in workflow
+                or 'scratchbase="$VALGRIND_SCRATCH"' not in workflow):
+            test_fail('valgrind.yml: scratch is not accessible after dropping privileges')
+        if 'TCP=(--use-tcp --daemon-tests-only)' not in workflow:
+            test_fail('valgrind.yml: TCP pass repeats transport-independent tests')
+        if 'find testtmp' in workflow or 'testtmp/**/' in workflow:
+            test_fail('valgrind.yml: evidence collection traverses test fixtures')
+        if 'test-results/valgrind-logs/*.log' not in workflow:
+            test_fail('valgrind.yml: logs are not staged for artefact upload')
+        if 'mkdir -p test-results/valgrind-logs' not in workflow:
+            test_fail('valgrind.yml: root jobs own the evidence directory')
+        if not any('--receipt=' in line for line in lines):
+            test_fail('valgrind.yml: profile receipts are not written')
+        if not any('if: always()' in line for line in lines):
+            test_fail('valgrind.yml: diagnostic evidence is not retained')
+        continue
+
+    pipe = next((line for line in profile_lines
+                 if '--use-tcp' not in line and ('runtests.py' in line
+                                                  or line.rstrip().endswith('make check')
+                                                  or line.rstrip().endswith("make check'"))), None)
+    if not pipe:
+        continue
+    tcp = next((line for line in profile_lines if '--use-tcp' in line), None)
+    if not tcp:
+        test_fail(f'{path.name}: profiled pipe pass has no profiled TCP pass')
+    if '--daemon-tests-only' not in tcp:
+        test_fail(f'{path.name}: TCP pass repeats transport-independent tests')
+    expected = {
+        tuple(name for name in value.split(',')
+              if name != 'pipe' and not name.startswith('protocol-'))
+        for value in expand_profiles(pipe, matrix)
+    }
+    actual = {tuple(value.split(',')) for value in expand_profiles(tcp, matrix)}
+    if actual != expected:
+        test_fail(f'{path.name}: TCP profiles differ from pipe profiles')
+    if required and ('--receipt=' not in pipe or '--receipt=' not in tcp):
+        test_fail(f'{path.name}: profiled transport has no receipt')
+
+if workflows and not references:
+    test_fail('no workflow profile references found')
+
+print(f'ok: {references} workflow profile references')
diff --git a/testsuite/tests/metadata/acl-symlink-race.py b/testsuite/tests/metadata/acl-symlink-race.py
new file mode 100644
index 000000000..710186965
--- /dev/null
+++ b/testsuite/tests/metadata/acl-symlink-race.py
@@ -0,0 +1,109 @@
+#!/usr/bin/env python3
+
+import os
+import platform
+import shutil
+import subprocess
+import time
+
+from harness.mutation import race_budget, start_path_flipper, stop_flipper
+from harness.rsync import (
+    SCRATCHDIR, acl_get, acl_set, forced_protocol, get_rootgid, get_rootuid, get_testuid,
+    rmtree, rsync_argv, run_rsync, start_test_daemon, test_fail, test_skipped,
+)
+
+DAEMON_PORT = 12896
+MARKER_UID = 60001
+
+if platform.system() != 'Linux':
+    test_skipped("POSIX ACL race test is Linux-only (setfacl/getfacl semantics)",
+                 capability='linux_acl')
+if not shutil.which('setfacl') or not shutil.which('getfacl'):
+    test_skipped("setfacl/getfacl not available", capability='linux_acl')
+proto = forced_protocol()
+if proto is not None and proto < 30:
+    test_skipped(f"ACL transfer requires protocol 30+ (negotiated {proto})",
+                 capability='protocol_30')
+vv = run_rsync('-VV', check=True, capture_output=True)
+if '"ACLs": true' not in vv.stdout:
+    test_skipped("rsync built without ACL support", capability='linux_acl')
+if '"ACL_at": true' not in vv.stdout:
+    print("acl-symlink-race: no race-safe ACL primitive on this platform; "
+          "--acls is functional-but-racy here by policy (race not asserted)")
+    raise SystemExit(0)
+
+def facl_has_marker(path) -> bool:
+    return f'user:{MARKER_UID}:' in acl_get(path)
+
+mod = SCRATCHDIR / 'module'
+outside = SCRATCHDIR / 'outside'
+src = SCRATCHDIR / 'src_files'
+conf = SCRATCHDIR / 'test-rsyncd.conf'
+
+for d in (mod, outside, src):
+    rmtree(d)
+    d.mkdir(parents=True)
+
+priv = outside / 'privileged'
+priv.write_text("ROOT_OWNED_SECRET\n")
+os.chmod(priv, 0o600)
+if facl_has_marker(priv):
+    test_fail("baseline outside file already carries the marker ACL")
+
+victim_src = src / 'victim'
+os.mkfifo(victim_src, 0o600)
+if not acl_set(f'user:{MARKER_UID}:rwx', victim_src):
+    test_skipped('filesystem has ACLs disabled', capability='linux_acl')
+
+os.symlink(str(priv), mod / '.evil')
+
+my_uid = get_testuid()
+root_uid = get_rootuid()
+root_gid = get_rootgid()
+uid_line = f"uid = {root_uid}"
+gid_line = f"gid = {root_gid}"
+if my_uid != root_uid:
+    uid_line = '#' + uid_line
+    gid_line = '#' + gid_line
+
+conf.write_text(f"""\
+use chroot = no
+{uid_line}
+{gid_line}
+log file = {SCRATCHDIR}/rsyncd.log
+[upload]
+    path = {mod}
+    use chroot = no
+    read only = no
+""")
+
+url = start_test_daemon(conf, DAEMON_PORT)
+
+def push():
+    subprocess.run(
+        rsync_argv('-rtpA', '--specials', f'{src}/', f'{url}upload/'),
+        stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL,
+    )
+
+push()
+landed = mod / 'victim'
+if not facl_has_marker(landed):
+    test_fail("positive control: a normal push did not apply the FIFO's ACL in "
+              "the module -- the daemon isn't preserving special-file ACLs, so "
+              "the race scenario would be vacuous")
+landed.unlink()
+
+flip = start_path_flipper(mod / 'victim', mod / '.evil')
+deadline = time.monotonic() + race_budget(10.0)
+try:
+    while time.monotonic() < deadline:
+        push()
+        if facl_has_marker(priv):
+            test_fail(
+                f"ACL-set symlink race: the FIFO's user:{MARKER_UID}:rwx ACL was "
+                "applied to the outside privileged file -- the receiver's "
+                "set_acl() followed the leaf symlink (LPE). "
+                f"getfacl {priv}:\n" + getfacl(priv)
+            )
+finally:
+    stop_flipper(flip)
diff --git a/testsuite/acls-default_test.py b/testsuite/tests/metadata/acls-default.py
similarity index 68%
rename from testsuite/acls-default_test.py
rename to testsuite/tests/metadata/acls-default.py
index e780de66d..ffcff3789 100644
--- a/testsuite/acls-default_test.py
+++ b/testsuite/tests/metadata/acls-default.py
@@ -1,56 +1,41 @@
 #!/usr/bin/env python3
-# Python rewrite of testsuite/acls-default.test.
-#
-# Test that rsync obeys POSIX default ACLs on the destination's parent
-# directory when creating the transfer's container directory, even
-# though that parent is outside the transfer itself.
 
 import os
 import re
 import shlex
 import subprocess
 
-from rsyncfns import (
+from harness.rsync import (
     SCRATCHDIR,
     check_perms, run_rsync, test_fail, test_skipped,
 )
 
-
 vv = run_rsync('-VV', check=True, capture_output=True)
 if '"ACLs": true' not in vv.stdout:
-    test_skipped("Rsync is configured without ACL support")
+    test_skipped("Rsync is configured without ACL support", capability='linux_acl')
 
 setfacl_nodef = os.environ.get('setfacl_nodef', 'true')
 if setfacl_nodef == 'true':
-    test_skipped("I don't know how to use your setfacl command")
+    test_skipped("I don't know how to use your setfacl command", capability='linux_acl')
 
 if '-k' in setfacl_nodef.split():
     seed_opts = ['-dm', 'u::7,g::5,o:5']
 else:
     seed_opts = ['-m', 'd:u::7,d:g::5,d:o:5']
 
-# Seed the scratch dir with a default ACL so the upcoming testit() runs
-# inherit a known-base; if setfacl rejects this the FS doesn't have ACLs.
 proc = subprocess.run(['setfacl', *seed_opts, str(SCRATCHDIR)])
 if proc.returncode != 0:
-    test_skipped("Your filesystem has ACLs disabled")
-
+    test_skipped("Your filesystem has ACLs disabled", capability='linux_acl')
 
 def testit(dirname, default_acl, file_expected, prog_expected):
-    """Set a default ACL on a destination parent dir, then verify that
-    a transfer into a fresh subdir picks up the inherited perms."""
     todir = SCRATCHDIR / dirname
     todir.mkdir()
-    # Clear any inherited default ACL first -- and confirm it succeeded, so the
-    # no-default-ACL cases can't silently inherit the scratch dir's seeded
-    # default ACL and test the wrong base state.
     if subprocess.run(shlex.split(setfacl_nodef) + [str(todir)]).returncode != 0:
         test_fail(f"{dirname}: clearing the inherited default ACL failed")
     if default_acl:
         if '-k' in setfacl_nodef.split():
             opts = ['-dm', default_acl]
         else:
-            # Each "u:/g:/o:/m:" prefix becomes "d:u:/d:g:/d:o:/d:m:".
             translated = re.sub(r'([ugom]:)', r'd:\1', default_acl)
             opts = ['-m', translated]
         subprocess.run(['setfacl', *opts, str(todir)], check=True)
@@ -66,19 +51,16 @@ def testit(dirname, default_acl, file_expected, prog_expected):
     check_perms(todir / 'to' / 'file', file_expected)
     check_perms(todir / 'to' / 'program', prog_expected)
 
-    # get_local_name shouldn't mess up a single-file transfer.
     run_rsync('-rvv',
               str(SCRATCHDIR / 'file'),
               f'{todir}/to/anotherfile')
     check_perms(todir / 'to' / 'anotherfile', file_expected)
 
-    # And the no-regular-file case (sole-dir transfer).
     run_rsync('-rvv',
               f'{SCRATCHDIR / "dir"}/',
               f'{todir}/to/anotherdir/')
     check_perms(todir / 'to' / 'anotherdir', prog_expected)
 
-
 (SCRATCHDIR / 'dir').mkdir()
 (SCRATCHDIR / 'file').write_text("File!\n")
 (SCRATCHDIR / 'program').write_text("#!/bin/sh\n")
diff --git a/testsuite/acls-depth_test.py b/testsuite/tests/metadata/acls-depth.py
similarity index 60%
rename from testsuite/acls-depth_test.py
rename to testsuite/tests/metadata/acls-depth.py
index 308be7650..344319012 100644
--- a/testsuite/acls-depth_test.py
+++ b/testsuite/tests/metadata/acls-depth.py
@@ -1,17 +1,9 @@
 #!/usr/bin/env python3
-"""Coverage of -A (acls) at depth.
 
-acls_test.py exercises a shallow tree; this companion sets a distinctive POSIX
-ACL on a file AND a directory at every level of a >=3-deep tree and checks that
--A reproduces them (the ACL is applied per entry, on a name whose parent chain
-the resolver restructure rewrites).
-"""
-
-import os
 import shutil
 import subprocess
 
-from rsyncfns import (
+from harness.rsync import (
     FROMDIR, TODIR,
     make_tree, rmtree, run_rsync, test_fail, test_skipped,
     walk_dirs, walk_files,
@@ -19,9 +11,9 @@
 
 vv = run_rsync('-VV', check=True, capture_output=True).stdout
 if '"ACLs": true' not in vv:
-    test_skipped("rsync built without ACL support")
+    test_skipped("rsync built without ACL support", capability='linux_acl')
 if not (shutil.which('setfacl') and shutil.which('getfacl')):
-    test_skipped("setfacl/getfacl not available")
+    test_skipped("setfacl/getfacl not available", capability='linux_acl')
 
 src = FROMDIR
 rmtree(src)
@@ -31,29 +23,22 @@
 entries = [p.relative_to(src) for p in (walk_dirs(src) + walk_files(src))]
 entries.sort()
 
-# Grant uid 0 an explicit r-x ACL on every entry (valid for a non-root owner to
-# set on its own files; needs no extra accounts).
 for rel in entries:
     r = subprocess.run(['setfacl', '-m', 'u:0:r-x', str(src / rel)])
     if r.returncode != 0:
-        test_skipped("filesystem does not support setting ACLs")
-
+        test_skipped("filesystem does not support setting ACLs", capability='linux_acl')
 
 def getfacl(path):
-    # Strip the comment header (# file:/# owner:/# group:) so the comparison
-    # is path-independent; this getfacl doesn't accept the GNU -c flag.
     out = subprocess.check_output(['getfacl', str(path)], text=True,
                                   stderr=subprocess.DEVNULL)
     return ''.join(ln for ln in out.splitlines(keepends=True)
                    if not ln.startswith('#'))
 
-
 run_rsync('-aA', f'{src}/', f'{TODIR}/')
 
 for rel in entries:
     want = getfacl(src / rel)
     got = getfacl(TODIR / rel)
-    # getfacl renders uid 0 as "root"; accept either spelling.
     if 'user:root:r-x' not in got and 'user:0:r-x' not in got:
         test_fail(f"-A did not reproduce the named-user ACL on {rel}:\n{got}")
     if want != got:
diff --git a/testsuite/tests/metadata/acls-unpinnable.py b/testsuite/tests/metadata/acls-unpinnable.py
new file mode 100644
index 000000000..1afc88678
--- /dev/null
+++ b/testsuite/tests/metadata/acls-unpinnable.py
@@ -0,0 +1,54 @@
+#!/usr/bin/env python3
+
+import os
+import platform
+import shutil
+
+from harness.rsync import (
+    SCRATCHDIR, acl_get, acl_set, forced_protocol, rmtree, run_rsync,
+    test_fail, test_skipped,
+)
+
+NEW_UID = 60002
+STALE_UID = 60009
+
+if platform.system() != 'Linux':
+    test_skipped("POSIX ACL test is Linux-only (setfacl/getfacl semantics)",
+                 capability='linux_acl')
+if not shutil.which('setfacl') or not shutil.which('getfacl'):
+    test_skipped("setfacl/getfacl not available", capability='linux_acl')
+if '"ACLs": true' not in run_rsync('-VV', check=True, capture_output=True).stdout:
+    test_skipped("rsync built without ACL support", capability='linux_acl')
+proto = forced_protocol()
+if proto is not None and proto < 30:
+    test_skipped(f"ACL transfer requires protocol 30+ (negotiated {proto})",
+                 capability='protocol_30')
+
+base = SCRATCHDIR / 'acls-unpinnable'
+src = base / 'src'
+dest = base / 'dest'
+rmtree(base)
+(src / 'dropbox').mkdir(parents=True)
+(src / 'top.txt').write_text('top\n')
+(dest / 'dropbox').mkdir(parents=True)
+
+if not acl_set(f'user:{NEW_UID}:rwx', src / 'dropbox'):
+    test_skipped('filesystem has ACLs disabled', capability='linux_acl')
+os.chmod(src / 'dropbox', 0o300)
+acl_set(f'user:{STALE_UID}:rwx', dest / 'dropbox')
+os.chmod(dest / 'dropbox', 0o300)
+
+proc = run_rsync('-aA', f'{src}/', f'{dest}/', check=False, capture_output=True)
+if proc.returncode not in (0, 23):
+    test_fail(f"rsync exited {proc.returncode}:\n{proc.stderr}")
+
+acl = acl_get(dest / 'dropbox')
+if f'user:{NEW_UID}:' not in acl:
+    test_fail("--acls did not apply the source ACL to the un-pinnable (0300) "
+              f"destination directory (stale/missing ACL); getfacl:\n{acl}")
+if f'user:{STALE_UID}:' in acl:
+    test_fail("--acls left the stale destination ACL entry in place on the "
+              f"un-pinnable (0300) directory -- a revocation did not propagate; "
+              f"getfacl:\n{acl}")
+
+print("acls-unpinnable: --acls updates the ACL of a no-owner-read (0300) dir")
diff --git a/testsuite/acls_test.py b/testsuite/tests/metadata/acls.py
similarity index 76%
rename from testsuite/acls_test.py
rename to testsuite/tests/metadata/acls.py
index c24d7b00f..1e888d83a 100644
--- a/testsuite/acls_test.py
+++ b/testsuite/tests/metadata/acls.py
@@ -1,20 +1,13 @@
 #!/usr/bin/env python3
-# Python rewrite of testsuite/acls.test.
-#
-# Test that rsync -A preserves POSIX ACLs across a transfer. Skips on
-# binaries built without ACL support, on filesystems with ACLs disabled,
-# and on hosts that lack both setfacl(1) and a chmod that understands "+a".
 
 import os
-import platform
 import subprocess
 
-from rsyncfns import FROMDIR, SCRATCHDIR, TODIR, makepath, run_rsync, test_fail, test_skipped
-
+from harness.rsync import FROMDIR, SCRATCHDIR, TODIR, makepath, run_rsync, test_fail, test_skipped
 
 vv = run_rsync('-VV', check=True, capture_output=True)
 if '"ACLs": true' not in vv.stdout:
-    test_skipped("Rsync is configured without ACL support")
+    test_skipped("Rsync is configured without ACL support", capability='acl')
 
 makepath(FROMDIR / 'foo')
 (FROMDIR / 'file1').write_text("something\n")
@@ -22,35 +15,27 @@
 
 files = ['foo', 'file1', 'file2']
 
-# Decide which ACL command surface to use. Mirrors the shell test's
-# branching on $setfacl_nodef (set by runtests.py).
 setfacl_nodef = os.environ.get('setfacl_nodef', 'true')
 
-
 def _chmod_plus_a_supported() -> bool:
-    """macOS-style: chmod +a 'user allow ...'."""
     out = subprocess.run(['chmod', '--help'], capture_output=True, text=True)
     return '+a' in (out.stdout + out.stderr)
 
-
 use_chmod_plus_a = setfacl_nodef == 'true' and _chmod_plus_a_supported()
 
 if setfacl_nodef == 'true' and not use_chmod_plus_a:
-    test_skipped("I don't know how to use setfacl or chmod for ACLs")
-
+    test_skipped("I don't know how to use setfacl or chmod for ACLs", capability='acl')
 
 def _setfacl(*args) -> int:
     return subprocess.run(['setfacl', *args]).returncode
 
-
 def _chmod_acl(*args) -> int:
     return subprocess.run(['chmod', *args]).returncode
 
-
 if use_chmod_plus_a:
     if _chmod_acl('+a', 'root allow read,write,execute',
                   str(FROMDIR / 'foo')) != 0:
-        test_skipped("Your filesystem has ACLs disabled")
+        test_skipped("Your filesystem has ACLs disabled", capability='acl')
     _chmod_acl('+a', 'root allow read,execute', str(FROMDIR / 'file1'))
     _chmod_acl('+a', 'admin allow read', str(FROMDIR / 'file1'))
     _chmod_acl('+a', 'daemon allow read,write', str(FROMDIR / 'file1'))
@@ -60,7 +45,7 @@ def see_acls(paths):
         return subprocess.check_output(['ls', '-le', *paths], text=True)
 else:
     if _setfacl('-m', 'u:0:7', str(FROMDIR / 'foo')) != 0:
-        test_skipped("Your filesystem has ACLs disabled")
+        test_skipped("Your filesystem has ACLs disabled", capability='acl')
     _setfacl('-m', 'g:1:5', str(FROMDIR / 'foo'))
     _setfacl('-m', 'g:2:1', str(FROMDIR / 'foo'))
     _setfacl('-m', 'g:0:7', str(FROMDIR / 'foo'))
@@ -76,7 +61,6 @@ def see_acls(paths):
     def see_acls(paths):
         return subprocess.check_output(['getfacl', *paths], text=True)
 
-
 os.chdir(FROMDIR)
 run_rsync('-avvA', *files, f'{TODIR}/')
 
diff --git a/testsuite/tests/metadata/atimes.py b/testsuite/tests/metadata/atimes.py
new file mode 100644
index 000000000..5828aa127
--- /dev/null
+++ b/testsuite/tests/metadata/atimes.py
@@ -0,0 +1,23 @@
+#!/usr/bin/env python3
+
+import datetime
+import os
+
+from harness import rsync
+from harness.rsync import FROMDIR, TODIR, checkit, run_rsync, test_skipped
+
+vv = run_rsync('-VV', check=True, capture_output=True)
+if '"atimes": true' not in vv.stdout:
+    test_skipped("Rsync is configured without atimes support")
+
+FROMDIR.mkdir(parents=True, exist_ok=True)
+foo = FROMDIR / 'foo'
+foo.touch()
+
+atime = datetime.datetime(2001, 2, 3, 17, 17, 42).timestamp()
+mtime = foo.stat().st_mtime
+os.utime(foo, (atime, mtime))
+
+rsync.TLS_ARGS = '--atimes'
+
+checkit(['-rtUgvvv', f'{FROMDIR}/', f'{TODIR}/'], FROMDIR, TODIR)
diff --git a/testsuite/tests/metadata/backup-acl-xattr-cache.py b/testsuite/tests/metadata/backup-acl-xattr-cache.py
new file mode 100644
index 000000000..2aad48fbc
--- /dev/null
+++ b/testsuite/tests/metadata/backup-acl-xattr-cache.py
@@ -0,0 +1,52 @@
+#!/usr/bin/env python3
+
+import os
+
+from harness.rsync import (
+    SCRATCHDIR,
+    acls_supported, xattrs_supported, acl_set, xattr_set,
+    makepath, rmtree, rsync_argv, test_fail, test_skipped,
+)
+import subprocess
+
+if not acls_supported():
+    test_skipped("ACLs not supported on this filesystem", capability='linux_acl')
+if not xattrs_supported():
+    test_skipped("xattrs not supported on this filesystem", capability='backup_metadata')
+
+src = SCRATCHDIR / 'bak-src'
+dest = SCRATCHDIR / 'bak-dest'
+bak = SCRATCHDIR / 'bak-dir'
+rmtree(src)
+rmtree(dest)
+rmtree(bak)
+makepath(src / 'd1' / 'd2', dest / 'd1' / 'd2', bak)
+
+(src / 'd1' / 'd2' / 'file').write_bytes(b'NEW')
+(dest / 'd1' / 'd2' / 'file').write_bytes(b'OLD')
+os.utime(dest / 'd1' / 'd2' / 'file', (1_600_000_000, 1_600_000_000))
+
+for d in (dest / 'd1', dest / 'd1' / 'd2'):
+    if not acl_set('u:0:rwx', d):
+        test_skipped(f"setfacl failed on {d}", capability='linux_acl')
+    xattr_set('user.bak-cache', 'v', d)
+
+r = subprocess.run(
+    rsync_argv('-aAX', '--backup', f'--backup-dir={bak}', f'{src}/', f'{dest}/'),
+    capture_output=True, text=True,
+)
+if r.returncode != 0:
+    test_fail(f"-aAX --backup --backup-dir push -> rc={r.returncode}\n{r.stderr}")
+
+bf = bak / 'd1' / 'd2' / 'file'
+if not bf.is_file() or bf.read_bytes() != b'OLD':
+    test_fail(f"backup file missing or wrong content: {bf}")
+for d in (bak / 'd1', bak / 'd1' / 'd2'):
+    if not d.is_dir():
+        test_fail(f"backup intermediate dir not created: {d}")
+
+if (dest / 'd1' / 'd2' / 'file').read_bytes() != b'NEW':
+    test_fail("dest/d1/d2/file not updated to NEW")
+
+print("backup-acl-xattr-cache: make_backup_dir_tree cache_tmp_acl/xattr -> "
+      "bak/d1, bak/d2 created with propagated ACL+xattr")
diff --git a/testsuite/chgrp_test.py b/testsuite/tests/metadata/chgrp.py
similarity index 59%
rename from testsuite/chgrp_test.py
rename to testsuite/tests/metadata/chgrp.py
index ad20fc0e7..cf7740f77 100644
--- a/testsuite/chgrp_test.py
+++ b/testsuite/tests/metadata/chgrp.py
@@ -1,16 +1,10 @@
 #!/usr/bin/env python3
-# Python rewrite of testsuite/chgrp.test.
-#
-# Test that -g preserves group ownership when the user is a member of the
-# target group. Creates one file per supplementary group, chgrps each,
-# then verifies the destination listing matches.
 
 import os
 import shutil
 import time
 
-from rsyncfns import FROMDIR, TODIR, checkit, rsync_getgroups, test_fail
-
+from harness.rsync import FROMDIR, TODIR, checkit, rsync_getgroups, test_fail
 
 groups = rsync_getgroups()
 if not groups:
@@ -23,16 +17,12 @@
     chgrp = shutil.which('chgrp')
     if chgrp is None:
         test_fail("chgrp not found in PATH")
-    # The shell test treats chgrp failure as fatal.
     try:
         os.chown(fname, -1, int(g))
     except (ValueError, PermissionError):
-        # If g isn't numeric or we lack permission, fall back to chgrp(1).
         import subprocess
         proc = subprocess.run([chgrp, g, str(fname)])
         if proc.returncode != 0:
             test_fail("Can't chgrp")
 
-time.sleep(2)
-
 checkit(['-rtgpvvv', f'{FROMDIR}/', f'{TODIR}/'], FROMDIR, TODIR)
diff --git a/testsuite/chmod-option_test.py b/testsuite/tests/metadata/chmod-option.py
similarity index 65%
rename from testsuite/chmod-option_test.py
rename to testsuite/tests/metadata/chmod-option.py
index ad0fc77be..0d1a8f837 100644
--- a/testsuite/chmod-option_test.py
+++ b/testsuite/tests/metadata/chmod-option.py
@@ -1,24 +1,18 @@
 #!/usr/bin/env python3
-# Python rewrite of testsuite/chmod-option.test.
-#
-# Test --chmod and the daemon-side "incoming chmod = ..." setting.
-# Covers a 2.6.8 bug where pushing a new directory with --no-perms to a
-# daemon with an incoming chmod made the daemon mis-classify the dir as
-# a file for the purposes of applying the incoming chmod.
 
 import os
-import shutil
 
-from rsyncfns import (
+from harness.rsync import (
     FROMDIR, SCRATCHDIR, TODIR,
     build_rsyncd_conf, check_perms, checkit, makepath, rmtree,
     run_rsync, start_test_daemon, test_fail,
 )
+from harness import metadata
 
+metadata(features={'chmod', 'daemon'}, transports={'pipe', 'tcp'}, min_peer='2.6.0', mutates={'filesystem', 'process', 'socket'}, tags={'daemon', 'metadata', 'version-mix'})
 
 DAEMON_PORT = 12875
 
-
 checkdir = SCRATCHDIR / 'check'
 
 FROMDIR.mkdir(parents=True, exist_ok=True)
@@ -31,29 +25,17 @@
 os.chmod(FROMDIR / 'dir1', 0o700)
 os.chmod(FROMDIR / 'dir2', 0o770)
 
-# Baseline copy of source.
 checkit(['-avv', f'{FROMDIR}/', f'{checkdir}/'], FROMDIR, checkdir)
 
-# Pin umask to 002 for the rest of the test and DO NOT restore it: rsync's
-# --chmod `D+w` honours the process umask, so the expected tree (built just
-# below) and the rsync run that follows must use the same umask -- exactly
-# as the shell test did (it set `umask 002` and left it in effect). Without
-# this the test fails under a different ambient umask (e.g. 077).
 os.umask(0o002)
 
-# Manually apply the mode transform that --chmod ug-s,a+rX,D+w should
-# produce on the destination, then verify rsync's transform matches.
 for entry in checkdir.iterdir():
-    # ug-s,a+rX: clear setuid/setgid; add r everywhere; add x where
-    # any existing x or the entry is a dir.
     st = entry.stat()
     mode = st.st_mode & ~0o6000
-    mode |= 0o444  # a+r
+    mode |= 0o444
     if entry.is_dir() or (st.st_mode & 0o111):
-        mode |= 0o111  # a+X
+        mode |= 0o111
     os.chmod(entry, mode)
-# `chmod +w` with no explicit who: adds w for every category not masked by
-# the current umask. Under umask 002 that's u+w AND g+w.
 plus_w = 0o222 & ~0o002
 for d in (checkdir, checkdir / 'dir1', checkdir / 'dir2'):
     st = d.stat()
@@ -75,8 +57,6 @@ def check_permcopy(chmod_arg, start_mode, expected, is_dir=False):
     run_rsync('-avv', f'--chmod={chmod_arg}', f'{FROMDIR}/', f'{TODIR}/')
     check_perms(TODIR / 'permcopy', expected)
 
-
-# Exercise chmod(1)-style permission copies.
 check_permcopy('g=o,o=', 0o647, 'rw-rwx---')
 check_permcopy('g=u', 0o741, 'rwxrwx--x')
 check_permcopy('g-o', 0o775, 'rwx-w-r-x')
@@ -93,7 +73,6 @@ def check_permcopy(chmod_arg, start_mode, expected, is_dir=False):
 if proc.returncode == 0:
     test_fail('--chmod=g=ur was not rejected')
 
-# Now exercise the F-only chmod path.
 rmtree(FROMDIR)
 rmtree(checkdir)
 rmtree(TODIR)
@@ -101,12 +80,10 @@ def check_permcopy(chmod_arg, start_mode, expected, is_dir=False):
 (FROMDIR / 'bar').touch()
 
 checkit(['-avv', f'{FROMDIR}/', f'{checkdir}/'], FROMDIR, checkdir)
-os.chmod(FROMDIR / 'bar', (FROMDIR / 'bar').stat().st_mode | 0o001)  # o+x
+os.chmod(FROMDIR / 'bar', (FROMDIR / 'bar').stat().st_mode | 0o001)
 
 checkit(['-avv', '--chmod=Fo-x', f'{FROMDIR}/', f'{TODIR}/'], checkdir, TODIR)
 
-# 2.6.8 regression: pushing a new directory via --no-perms to a daemon
-# with an "incoming chmod" once mis-classified the directory as a file.
 conf = build_rsyncd_conf()
 with open(conf, 'a') as f:
     f.write(f"""
diff --git a/testsuite/chmod-setid_test.py b/testsuite/tests/metadata/chmod-setid.py
similarity index 75%
rename from testsuite/chmod-setid_test.py
rename to testsuite/tests/metadata/chmod-setid.py
index d9e36e94b..18e8a84eb 100644
--- a/testsuite/chmod-setid_test.py
+++ b/testsuite/tests/metadata/chmod-setid.py
@@ -1,11 +1,8 @@
 #!/usr/bin/env python3
-# Regression for KI-55: --chmod=a+s must set BOTH setuid and setgid (like
-# chmod(1)).  parse_chmod()'s 'a' clause used to leave the set-id bits unset, so
-# "a+s" fell through to setuid only.
 
 import os
 
-from rsyncfns import SCRATCHDIR, run_rsync, test_fail
+from harness.rsync import SCRATCHDIR, run_rsync, test_fail
 
 base = SCRATCHDIR / 'chmod_setid'
 src = base / 'src'
@@ -21,7 +18,6 @@
 if not (mode & 0o4000) or not (mode & 0o2000):
     test_fail(f'--chmod=a+s did not set both setuid+setgid (mode {mode:04o})')
 
-# Sanity: u+s is setuid only, g+s is setgid only.
 for spec, want, unwant in (('u+s', 0o4000, 0o2000), ('g+s', 0o2000, 0o4000)):
     d = base / spec.replace('+', '_')
     d.mkdir(exist_ok=True)
diff --git a/testsuite/tests/metadata/chmod-symlink-race.py b/testsuite/tests/metadata/chmod-symlink-race.py
new file mode 100644
index 000000000..7a1ef5d3f
--- /dev/null
+++ b/testsuite/tests/metadata/chmod-symlink-race.py
@@ -0,0 +1,35 @@
+#!/usr/bin/env python3
+
+import os
+import subprocess
+
+from harness.rsync import SCRATCHDIR, TOOLDIR, rmtree, test_fail
+
+mod = SCRATCHDIR / 'module'
+trap_outside = SCRATCHDIR / 'trap'
+rmtree(mod)
+rmtree(trap_outside)
+mod.mkdir(parents=True)
+(mod / 'realdir').mkdir(parents=True)
+trap_outside.mkdir(parents=True)
+
+(mod / 'realdir' / 'sentinel').write_text("bystander\n")
+os.chmod(mod / 'realdir' / 'sentinel', 0o600)
+(trap_outside / 'sentinel').write_text("target\n")
+os.chmod(trap_outside / 'sentinel', 0o600)
+os.symlink('realdir', mod / 'inside_link')
+os.symlink('../trap', mod / 'escape_link')
+(mod / 'topfile').write_text("top\n")
+os.chmod(mod / 'topfile', 0o600)
+os.symlink('../../trap/sentinel', mod / 'realdir' / 'leaflink')
+
+proc = subprocess.run([str(TOOLDIR / 't_chmod_secure'), str(mod)])
+if proc.returncode != 0:
+    test_fail("t_chmod_secure reported failures (see stderr above)")
+
+sentinel_mode = (trap_outside / 'sentinel').stat().st_mode & 0o777
+if sentinel_mode != 0o600:
+    test_fail(
+        f"outside sentinel mode changed from 600 to {oct(sentinel_mode)[2:]} "
+        "-- chmod escaped the module"
+    )
diff --git a/testsuite/tests/metadata/chmod-temp-dir.py b/testsuite/tests/metadata/chmod-temp-dir.py
new file mode 100644
index 000000000..12a2c7b82
--- /dev/null
+++ b/testsuite/tests/metadata/chmod-temp-dir.py
@@ -0,0 +1,43 @@
+#!/usr/bin/env python3
+
+import os
+import subprocess
+
+from harness.rsync import (FROMDIR, SCRATCHDIR, TODIR, TOOLDIR, checkit, hands_setup,
+                      set_supported_mode, test_skipped)
+
+def _fsdev(path: str) -> str:
+    return subprocess.check_output(
+        [str(TOOLDIR / 'getfsdev'), path], text=True,
+    ).strip()
+
+hands_setup()
+
+scratch_dev = _fsdev(str(SCRATCHDIR))
+tmpdir2 = None
+candidates = [
+    os.environ.get('RSYNC_TEST_TMP', '/override-tmp-not-specified'),
+    '/run/shm', '/var/tmp', '/tmp',
+]
+for cand in candidates:
+    if not (os.path.isdir(cand) and os.access(cand, os.W_OK)):
+        continue
+    if _fsdev(cand) != scratch_dev:
+        tmpdir2 = cand
+        break
+
+if tmpdir2 is None:
+    test_skipped("Can't find a tmp dir on a different file system", capability='cross_device')
+
+os.chmod(FROMDIR / 'text', 0o440)
+os.chmod(FROMDIR / 'dir' / 'text', 0o500)
+set_supported_mode(FROMDIR / 'dir' / 'subdir' / 'foobar.baz',
+                   [0o6450, 0o2450, 0o1450, 0o450])
+set_supported_mode(FROMDIR / 'dir' / 'subdir' / 'subsubdir' / 'etc-ltr-list',
+                   [0o2670, 0o1670, 0o670])
+
+checkit(['-avv', f'--temp-dir={tmpdir2}', f'{FROMDIR}/', str(TODIR)],
+        FROMDIR, TODIR)
+
+checkit(['-avvI', '--no-whole-file', f'--temp-dir={tmpdir2}',
+         f'{FROMDIR}/', str(TODIR)], FROMDIR, TODIR)
diff --git a/testsuite/tests/metadata/chmod.py b/testsuite/tests/metadata/chmod.py
new file mode 100644
index 000000000..319d0dc83
--- /dev/null
+++ b/testsuite/tests/metadata/chmod.py
@@ -0,0 +1,18 @@
+#!/usr/bin/env python3
+
+import os
+
+from harness.rsync import FROMDIR, TODIR, checkit, hands_setup, set_supported_mode
+
+hands_setup()
+
+os.chmod(FROMDIR / 'text', 0o440)
+os.chmod(FROMDIR / 'dir' / 'text', 0o500)
+set_supported_mode(FROMDIR / 'dir' / 'subdir' / 'foobar.baz',
+                   [0o6450, 0o2450, 0o1450, 0o450])
+set_supported_mode(FROMDIR / 'dir' / 'subdir' / 'subsubdir' / 'etc-ltr-list',
+                   [0o2670, 0o1670, 0o670])
+
+checkit(['-avv', f'{FROMDIR}/', str(TODIR)], FROMDIR, TODIR)
+
+checkit(['-avvI', '--no-whole-file', f'{FROMDIR}/', str(TODIR)], FROMDIR, TODIR)
diff --git a/testsuite/tests/metadata/chown-fake.py b/testsuite/tests/metadata/chown-fake.py
new file mode 120000
index 000000000..c13bd9eee
--- /dev/null
+++ b/testsuite/tests/metadata/chown-fake.py
@@ -0,0 +1 @@
+chown.py
\ No newline at end of file
diff --git a/testsuite/tests/metadata/chown.py b/testsuite/tests/metadata/chown.py
new file mode 100644
index 000000000..59c67b3d9
--- /dev/null
+++ b/testsuite/tests/metadata/chown.py
@@ -0,0 +1,54 @@
+#!/usr/bin/env python3
+
+import os
+import sys
+
+from harness import rsync
+from harness.rsync import (
+    FROMDIR, RSYNC_PREFIX, TODIR,
+    checkit, test_skipped, xattr_set, xattrs_supported,
+)
+
+script_name = os.path.basename(sys.argv[0] if sys.argv[0] else __file__)
+fake_variant = 'fake' in script_name
+
+if fake_variant:
+    if not xattrs_supported():
+        test_skipped("Rsync needs xattrs for fake device tests", capability='xattr_runtime')
+    rsync.RSYNC = rsync.RSYNC + ' --fake-super'
+    rsync.TLS_ARGS = (rsync.TLS_ARGS + ' --fake-super').strip()
+
+    def chown_or_fake(path, uid, gid):
+        mode = os.stat(path).st_mode
+        xattr_set(f'{RSYNC_PREFIX}.%stat', f"{mode:o} 0,0 {uid}:{gid}", path)
+        return True
+else:
+    rsync.RSYNC = rsync.RSYNC + ' --super'
+
+    my_uid = os.getuid()
+    if my_uid != 0:
+        fakeroot_path = os.environ.get('FAKEROOT_PATH')
+        if fakeroot_path and os.access(fakeroot_path, os.X_OK):
+            print("Let's try re-running the script under fakeroot...")
+            os.execv(fakeroot_path, [fakeroot_path, sys.executable, __file__])
+
+    def chown_or_fake(path, uid, gid):
+        try:
+            os.chown(path, uid, gid)
+            return True
+        except (PermissionError, OSError):
+            return False
+
+FROMDIR.mkdir(parents=True, exist_ok=True)
+name1 = FROMDIR / 'name1'
+name2 = FROMDIR / 'name2'
+name1.write_text("This is the file\n")
+name2.write_text("This is the other file\n")
+
+if not chown_or_fake(name1, 5000, 5002):
+    test_skipped("Can't chown (probably need root)", capability='ownership')
+if not chown_or_fake(name2, 5001, 5003):
+    test_skipped("Can't chown (probably need root)", capability='ownership')
+
+os.chdir(FROMDIR.parent)
+checkit(['-aHvv', 'from/', 'to/'], FROMDIR, TODIR)
diff --git a/testsuite/tests/metadata/crtimes.py b/testsuite/tests/metadata/crtimes.py
new file mode 100644
index 000000000..a44e319b2
--- /dev/null
+++ b/testsuite/tests/metadata/crtimes.py
@@ -0,0 +1,31 @@
+#!/usr/bin/env python3
+
+import datetime
+import os
+
+from harness import rsync
+from harness import TestContext, requires, run
+from harness.rsync import checkit, run_rsync, test_skipped
+
+@requires(features={'crtimes'}, transports={'pipe'}, mutates={'filesystem'}, tags={'metadata'})
+def test(context: TestContext):
+    if '"crtimes": true' not in run_rsync('-VV', capture_output=True).stdout:
+        test_skipped('crtimes is unavailable', capability='crtimes')
+
+    context.source.mkdir(parents=True)
+    source = context.source / 'foo'
+    source.write_text('hiho\n')
+
+    def set_time(path, value):
+        timestamp = value.timestamp()
+        os.utime(path, (timestamp, timestamp))
+
+    set_time(context.source, datetime.datetime(2001, 1, 1, 11, 11, 11))
+    set_time(context.source, datetime.datetime(2002, 2, 2, 22, 22, 22))
+    set_time(source, datetime.datetime(2001, 11, 11, 11, 11, 11))
+    set_time(source, datetime.datetime(2002, 12, 12, 22, 22, 22))
+    rsync.TLS_ARGS = '--crtimes'
+    checkit(['-rtgvvv', '--crtimes', f'{context.source}/', f'{context.destination}/'], context.source, context.destination)
+
+if __name__ == '__main__':
+    run(test)
diff --git a/testsuite/tests/metadata/devices-fake.py b/testsuite/tests/metadata/devices-fake.py
new file mode 120000
index 000000000..2183b4334
--- /dev/null
+++ b/testsuite/tests/metadata/devices-fake.py
@@ -0,0 +1 @@
+devices.py
\ No newline at end of file
diff --git a/testsuite/devices_test.py b/testsuite/tests/metadata/devices.py
similarity index 70%
rename from testsuite/devices_test.py
rename to testsuite/tests/metadata/devices.py
index 40c9419a9..d01060aba 100644
--- a/testsuite/devices_test.py
+++ b/testsuite/tests/metadata/devices.py
@@ -1,38 +1,38 @@
 #!/usr/bin/env python3
-# Python rewrite of testsuite/devices.test (and, via a Makefile-built
-# symlink, of devices-fake.test).
-#
-# Test rsync's handling of device nodes (char/block/fifo) plus the
-# fake-super variant that encodes device numbers in the
-# user.rsync.%stat xattr instead of mknod-ing real devices.
 
 import os
 import sys
 
-import rsyncfns
-from rsyncfns import (
-    CHKDIR, CHKFILE, FROMDIR, OUTFILE, RSYNC_PREFIX, TMPDIR, TODIR,
-    all_plus, allspace, dots,
-    checkdiff, hands_setup, makepath, rsync_ls_lR, run_rsync,
-    test_fail, test_skipped, v_filt, xattr_set, xattrs_supported,
+from harness import rsync
+from harness.rsync import (
+    CHKDIR,
+    FROMDIR,
+    RSYNC_PREFIX,
+    TODIR,
+    all_plus,
+    allspace,
+    dots,
+    checkdiff,
+    rsync_ls_lR,
+    run_rsync,
+    test_fail,
+    test_skipped,
+    v_filt,
+    xattr_set,
+    xattrs_supported,
 )
 
-
 script_name = os.path.basename(sys.argv[0] if sys.argv[0] else __file__)
 fake_variant = 'fake' in script_name
 
 if fake_variant:
     if not xattrs_supported():
-        test_skipped("Rsync needs xattrs for fake device tests")
+        test_skipped("Rsync needs xattrs for fake device tests", capability='xattr_runtime')
 
-    rsyncfns.RSYNC = rsyncfns.RSYNC + ' --fake-super'
-    rsyncfns.TLS_ARGS = (rsyncfns.TLS_ARGS + ' --fake-super').strip()
+    rsync.RSYNC = rsync.RSYNC + ' --fake-super'
+    rsync.TLS_ARGS = (rsync.TLS_ARGS + ' --fake-super').strip()
 
     def make_special(path, kind: str, major: int = 0, minor: int = 0) -> bool:
-        """Pretend to mknod `path` as kind {'p','c','b'} via rsync's
-        fake-super "%stat" xattr (name/namespace handled per-OS by
-        xattr_set). Returns True on success, False if the FS rejects it.
-        """
         mode = {'p': 0o10644, 'c': 0o20644, 'b': 0o60644}[kind]
         try:
             with open(path, 'w'):
@@ -45,12 +45,11 @@ def make_special(path, kind: str, major: int = 0, minor: int = 0) -> bool:
 else:
     my_uid = os.getuid()
     if my_uid != 0:
-        # Try fakeroot, mirroring the shell test.
         fakeroot_path = os.environ.get('FAKEROOT_PATH')
         if fakeroot_path and os.access(fakeroot_path, os.X_OK):
             print("Let's try re-running the script under fakeroot...")
             os.execv(fakeroot_path, [fakeroot_path, sys.executable, __file__])
-        test_skipped("Rsync needs root/fakeroot for device tests")
+        test_skipped("Rsync needs root/fakeroot for device tests", capability='device_nodes')
 
     def make_special(path, kind: str, major: int = 0, minor: int = 0) -> bool:
         try:
@@ -63,8 +62,6 @@ def make_special(path, kind: str, major: int = 0, minor: int = 0) -> bool:
         except OSError:
             return False
 
-
-# Does this build of rsync support hard-linking specials?
 vv = run_rsync('-VV', check=True, capture_output=True)
 can_hlink_special = '"hardlink_specials": true' in vv.stdout
 
@@ -72,33 +69,30 @@ def make_special(path, kind: str, major: int = 0, minor: int = 0) -> bool:
 TODIR.mkdir(parents=True, exist_ok=True)
 
 if not make_special(FROMDIR / 'char', 'c', 41, 67):
-    test_skipped("Can't create char device node")
+    test_skipped("Can't create char device node", capability='device_nodes')
 if not make_special(FROMDIR / 'char2', 'c', 42, 68):
-    test_skipped("Can't create char device node")
+    test_skipped("Can't create char device node", capability='device_nodes')
 if not make_special(FROMDIR / 'char3', 'c', 42, 69):
-    test_skipped("Can't create char device node")
+    test_skipped("Can't create char device node", capability='device_nodes')
 if not make_special(FROMDIR / 'block', 'b', 42, 69):
-    test_skipped("Can't create block device node")
+    test_skipped("Can't create block device node", capability='device_nodes')
 if not make_special(FROMDIR / 'block2', 'b', 42, 73):
-    test_skipped("Can't create block device node")
+    test_skipped("Can't create block device node", capability='device_nodes')
 if not make_special(FROMDIR / 'block3', 'b', 105, 73):
-    test_skipped("Can't create block device node")
+    test_skipped("Can't create block device node", capability='device_nodes')
 
 if can_hlink_special:
     try:
         os.link(FROMDIR / 'block3', FROMDIR / 'block3.5')
     except OSError:
-        # The shell test prints a "Skipping hard-linked device test..." line
-        # when it can't link the device; let it slide here, too.
         print("Skipping hard-linked device test... (link failed)")
         can_hlink_special = False
 else:
     print("Skipping hard-linked device test...")
 
 if not make_special(FROMDIR / 'fifo', 'p'):
-    test_skipped("Can't run mkfifo")
+    test_skipped("Can't run mkfifo", capability='device_nodes')
 
-# Match block/block2 timestamps so the diff doesn't drift.
 ref = (FROMDIR / 'block').stat()
 os.utime(FROMDIR / 'block', (ref.st_atime, ref.st_mtime), follow_symlinks=False)
 os.utime(FROMDIR / 'block2', (ref.st_atime, ref.st_mtime), follow_symlinks=False)
@@ -109,13 +103,19 @@ def make_special(path, kind: str, major: int = 0, minor: int = 0) -> bool:
 checkdiff(['-ai', f'{FROMDIR}/block2', f'{TODIR}/block'],
           f"cD{all_plus} block2\n")
 
-import time
-time.sleep(1)
+ref = (TODIR / 'block').stat()
+os.utime(FROMDIR / 'block3', (ref.st_atime, ref.st_mtime + 10),
+         follow_symlinks=False)
 
 checkdiff(['-Di', f'{FROMDIR}/block3', f'{TODIR}/block'],
           f"cDc.T.{dots} block3\n")
 
-# Build the expected -aiHvv listing.
+for source, destination in ((FROMDIR / 'block', TODIR / 'block'),
+                            (FROMDIR, TODIR)):
+    st = source.stat()
+    os.utime(destination, (st.st_atime, st.st_mtime + 10),
+             follow_symlinks=False)
+
 chkfile_lines = [
     f".d..t.{dots} ./",
     f"cDc.t.{dots} block",
diff --git a/testsuite/dir-sgid_test.py b/testsuite/tests/metadata/dir-sgid.py
similarity index 59%
rename from testsuite/dir-sgid_test.py
rename to testsuite/tests/metadata/dir-sgid.py
index bfa735ae8..1fc7a1fec 100644
--- a/testsuite/dir-sgid_test.py
+++ b/testsuite/tests/metadata/dir-sgid.py
@@ -1,38 +1,22 @@
 #!/usr/bin/env python3
-# Python rewrite of testsuite/dir-sgid.test.
-#
-# Check that rsync obeys the setgid bit on the destination's parent
-# directory when creating a new directory to hold the transferred files,
-# even though that parent directory is outside the transfer itself.
 
 import os
-import shutil
 import subprocess
 
-from rsyncfns import (
+from harness.rsync import (
     SCRATCHDIR, check_perms, run_rsync, test_fail, test_skipped,
 )
 
-
 old_umask = os.umask(0o077)
 
-# A secondary group (if the user has one) lets the gid checks below be
-# discriminating: a setgid parent makes new dirs inherit the PARENT's group,
-# whereas without setgid they get the process's own group.
 prim = os.getgid()
 alt_gid = next((g for g in os.getgroups() if g != prim), None)
 
-
 def testit(dirname, dirperms, file_expected, prog_expected, dir_expected, setgid):
-    """Mirror shell `testit dirname dirperms file_expected prog_expected dir_expected`."""
     todir = SCRATCHDIR / dirname
     todir.mkdir()
-    # For the setgid case, give the parent a distinct group (when available) so
-    # the inherited gid differs from the process's; chmod is applied after the
-    # chown so the setgid bit survives.
     if setgid and alt_gid is not None:
         os.chown(todir, -1, alt_gid)
-    # dirperms is either an octal int or the symbolic shell form we translate.
     if isinstance(dirperms, int):
         os.chmod(todir, dirperms)
     else:
@@ -48,12 +32,6 @@ def testit(dirname, dirperms, file_expected, prog_expected, dir_expected, setgid
     check_perms(todir / 'to' / 'file', file_expected)
     check_perms(todir / 'to' / 'program', prog_expected)
 
-    # With setgid set, new dirs must inherit the PARENT's group. We only assert
-    # the setgid case: it holds on both SysV/Linux and BSD, and (because the
-    # parent is given a secondary group above) still proves setgid took effect
-    # on Linux. The no-setgid case is deliberately not checked -- the inherited
-    # gid is OS-defined there (the process's group on Linux, but always the
-    # parent's on BSD), so it's not a portable assertion.
     if setgid:
         expect_gid = os.stat(todir).st_gid
         for sub in ('to', 'to/dir'):
@@ -62,17 +40,15 @@ def testit(dirname, dirperms, file_expected, prog_expected, dir_expected, setgid
                 test_fail(f"{dirname}: {sub} gid is {g}, expected {expect_gid} "
                           "(setgid inheritance)")
 
-
-# Cygwin's default dir ACL ruins this test; mimic the shell's getfacl skip.
 src_dir = SCRATCHDIR / 'dir'
 src_dir.mkdir()
 try:
     out = subprocess.run(['getfacl', str(src_dir)],
                          capture_output=True, text=True)
     if 'default:user::' in out.stdout:
-        test_skipped("The default ACL mode interferes with this test")
+        test_skipped("The default ACL mode interferes with this test", capability='directory_sgid')
 except FileNotFoundError:
-    pass  # No getfacl -- proceed.
+    pass
 
 (SCRATCHDIR / 'file').write_text("File!\n")
 (SCRATCHDIR / 'program').write_text("#!/bin/sh\n")
@@ -80,16 +56,17 @@ def testit(dirname, dirperms, file_expected, prog_expected, dir_expected, setgid
 try:
     subprocess.run(['chmod', 'u=rwx,g=rw,g+s,o=r', str(src_dir)], check=True)
 except subprocess.CalledProcessError:
-    test_skipped("Can't chmod")
+    test_skipped("Can't chmod", capability='directory_sgid')
 os.chmod(SCRATCHDIR / 'file', 0o664)
 os.chmod(SCRATCHDIR / 'program', 0o775)
 
 if not (os.stat(src_dir).st_mode & 0o2000):
-    test_skipped("The directory setgid bit vanished!")
+    test_skipped("The directory setgid bit vanished!", capability='directory_sgid')
 
 (src_dir / 'blah').mkdir()
 if not (os.stat(src_dir / 'blah').st_mode & 0o2000):
-    test_skipped("Your filesystem doesn't use directory setgid; maybe it's BSD.")
+    test_skipped("Your filesystem doesn't use directory setgid; maybe it's BSD.",
+                 capability='directory_sgid')
 
 testit('setgid-off', 0o700, 'rw-------', 'rwx------', 'rwx------', setgid=False)
 testit('setgid-on', 'u=rwx,g=rw,g+s,o-rwx', 'rw-------', 'rwx------', 'rwx--S---',
diff --git a/testsuite/executability_test.py b/testsuite/tests/metadata/executability.py
similarity index 56%
rename from testsuite/executability_test.py
rename to testsuite/tests/metadata/executability.py
index 13f7a77e6..67357ed09 100644
--- a/testsuite/executability_test.py
+++ b/testsuite/tests/metadata/executability.py
@@ -1,23 +1,14 @@
 #!/usr/bin/env python3
-# Python rewrite of testsuite/executability.test.
-#
-# Test --executability (-E): -E should propagate only the executable bits
-# from source to destination (other permission changes ignored), while a
-# normal copy without -E should leave the destination permissions alone.
 
 import errno
 import os
 
-from rsyncfns import FROMDIR, TODIR, check_perms, run_rsync, test_skipped
-
+from harness.rsync import FROMDIR, TODIR, check_perms, run_rsync, test_skipped
 
 FROMDIR.mkdir(parents=True, exist_ok=True)
 (FROMDIR / '1').write_text("#!/bin/sh\necho 'Program One!'\n")
 (FROMDIR / '2').write_text("#!/bin/sh\necho 'Program Two!'\n")
 
-# Setuid-and-rwx for owner, nothing else. Some platforms reject 1700 for
-# non-root callers (no permission to set sticky); FreeBSD rejects it with
-# EFTYPE rather than EPERM. Only skip on those; re-raise anything unexpected.
 _STICKY_SKIP_ERRNOS = {errno.EPERM, errno.EACCES, getattr(errno, 'EFTYPE', None)}
 try:
     os.chmod(FROMDIR / '1', 0o1700)
@@ -32,7 +23,6 @@
 check_perms(TODIR / '1', 'rwx------')
 check_perms(TODIR / '2', 'rw-------')
 
-# Permute the source/destination perms; without -E nothing should change.
 os.chmod(FROMDIR / '1', 0o600)
 os.chmod(FROMDIR / '2', 0o601)
 os.chmod(TODIR / '2', 0o604)
@@ -42,7 +32,6 @@
 check_perms(TODIR / '1', 'rwx------')
 check_perms(TODIR / '2', 'rw----r--')
 
-# Now with -E: 1 loses its x (source has 600), 2 gains x (source has 601).
 run_rsync('-rvvE', f'{FROMDIR}/', f'{TODIR}/')
 
 check_perms(TODIR / '1', 'rw-------')
diff --git a/testsuite/tests/metadata/fake-super-acl-xattr.py b/testsuite/tests/metadata/fake-super-acl-xattr.py
new file mode 100644
index 000000000..fd0c462ca
--- /dev/null
+++ b/testsuite/tests/metadata/fake-super-acl-xattr.py
@@ -0,0 +1,76 @@
+#!/usr/bin/env python3
+
+import os
+import platform
+import subprocess
+
+from harness.rsync import (
+    SCRATCHDIR, FROMDIR,
+    acls_supported, makepath, rmtree, rsync_argv,
+    test_fail, test_skipped, xattrs_supported,
+)
+
+if platform.system() != 'Linux':
+    test_skipped("fake-super ACL xattrs use the Linux user.rsync.* namespace",
+                 capability='linux_xattr')
+
+if not acls_supported():
+    test_skipped("ACLs not supported on this filesystem", capability='acl')
+if not xattrs_supported():
+    test_skipped("xattrs not supported on this filesystem", capability='xattr')
+
+src = FROMDIR
+dst = SCRATCHDIR / 'fakesuper-dst'
+dst2 = SCRATCHDIR / 'fakesuper-dst2'
+for d in (src, dst, dst2):
+    rmtree(d)
+makepath(src)
+
+(src / 'f').write_text('hello\n')
+sd = src / 'd'
+sd.mkdir()
+(sd / 'g').write_text('world\n')
+
+r = subprocess.run(['setfacl', '-m', f'u:{os.getuid()}:rwx', str(src / 'f')],
+                   capture_output=True, text=True)
+if r.returncode != 0:
+    test_skipped(f"setfacl on file failed: {r.stderr!r}", capability='acl')
+r = subprocess.run(['setfacl', '-d', '-m', f'u:{os.getuid()}:rwx', str(sd)],
+                   capture_output=True, text=True)
+if r.returncode != 0:
+    test_skipped(f"setfacl -d on dir failed: {r.stderr!r}", capability='acl')
+
+def has_xattr(path, name):
+    try:
+        os.getxattr(str(path), name, follow_symlinks=False)
+        return True
+    except OSError:
+        return False
+
+def sync(args, frm, to):
+    r = subprocess.run(rsync_argv(*args, f'{frm}/', f'{to}/'),
+                       capture_output=True, text=True)
+    if r.returncode != 0:
+        test_fail(f"rsync {' '.join(args)} {frm} -> {to} "
+                  f"(rc={r.returncode}):\n{r.stderr}")
+    return r
+
+sync(['-rA', '-M--fake-super'], src, dst)
+if not has_xattr(dst / 'f', 'user.rsync.%aacl'):
+    test_fail("--fake-super -A should have stored user.rsync.%aacl on dst/f")
+if not has_xattr(dst / 'd', 'user.rsync.%dacl'):
+    test_fail("--fake-super -A should have stored user.rsync.%dacl on dst/d")
+
+sync(['-rA', '--fake-super', '-M--fake-super'], dst, dst2)
+if not has_xattr(dst2 / 'f', 'user.rsync.%aacl'):
+    test_fail("fake-super -> fake-super -A round-trip lost %aacl on dst2/f")
+if not has_xattr(dst2 / 'd', 'user.rsync.%dacl'):
+    test_fail("fake-super -> fake-super -A round-trip lost %dacl on dst2/d")
+
+subprocess.run(['setfacl', '-k', str(sd)], check=True)
+sync(['-rA', '-M--fake-super'], src, dst)
+if has_xattr(dst / 'd', 'user.rsync.%dacl'):
+    test_fail("re-sync after `setfacl -k` should have removed %dacl from dst/d "
+              "(del_def_xattr_acl)")
+
+print("fake-super-acl-xattr: %aacl/%dacl set+get round-trip + del_def ok")
diff --git a/testsuite/fake-super-backup-fifo-regression_test.py b/testsuite/tests/metadata/fake-super-backup-fifo.py
similarity index 93%
rename from testsuite/fake-super-backup-fifo-regression_test.py
rename to testsuite/tests/metadata/fake-super-backup-fifo.py
index d99030816..9896d745b 100644
--- a/testsuite/fake-super-backup-fifo-regression_test.py
+++ b/testsuite/tests/metadata/fake-super-backup-fifo.py
@@ -1,23 +1,22 @@
 #!/usr/bin/env python3
-"""Fake-super backup fallback must retain an inert FIFO placeholder."""
 
 import os
 import platform
 import stat
 import subprocess
 
-from rsyncfns import (
+from harness.rsync import (
     SCRATCHDIR, rmtree, rsync_argv, test_fail, test_skipped, xattrs_supported,
 )
 
-
 system = platform.system()
 if system not in ('Darwin', 'Linux'):
-    test_skipped('deterministic fast-path failure needs dyld/ELF interposing')
+    test_skipped('deterministic fast-path failure needs dyld/ELF interposing',
+                 capability='interpose')
 if not xattrs_supported():
     test_skipped('fake-super FIFO setup requires xattr support')
 
-base = (SCRATCHDIR / 'fake-super-backup-fifo-regression').resolve()
+base = (SCRATCHDIR / 'fake-super-backup-fifo').resolve()
 rmtree(base)
 src = base / 'src'
 mod = base / 'mod'
@@ -32,9 +31,6 @@
 source_victim = src / 'slot' / 'victim'
 os.mkfifo(source_victim, 0o600)
 
-# Force both backup fast paths to fail so production code must reconstruct the
-# existing fake-super FIFO in --backup-dir.  The interposer changes only this
-# scheduling/error precondition; rsync itself chooses and creates the result.
 hook_src = base / 'fake-super-backup-hook.c'
 hook_lib = base / ('fake-super-backup-hook.dylib'
                    if system == 'Darwin' else 'fake-super-backup-hook.so')
@@ -168,7 +164,7 @@
     [*build_args, '-o', str(hook_lib), str(hook_src)],
     stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True)
 if build.returncode != 0:
-    test_skipped(f'cannot build dyld interposer: {build.stdout!r}')
+    test_skipped(f'cannot build dyld interposer: {build.stdout!r}', capability='interpose')
 
 seed = subprocess.run(
     rsync_argv('-rtI', '--specials', '--fake-super', f'{src}/', f'{mod}/'),
diff --git a/testsuite/hardlinks-deep_test.py b/testsuite/tests/metadata/hardlinks-deep.py
similarity index 54%
rename from testsuite/hardlinks-deep_test.py
rename to testsuite/tests/metadata/hardlinks-deep.py
index def0aa26b..f9e4ba76d 100644
--- a/testsuite/hardlinks-deep_test.py
+++ b/testsuite/tests/metadata/hardlinks-deep.py
@@ -1,20 +1,15 @@
 #!/usr/bin/env python3
-"""Coverage of -H across directory boundaries.
 
-hardlinks_test.py exercises -H on sibling files at the tree root; this
-companion checks that -H preserves a hard link whose two names live in
-DIFFERENT directories several levels deep (the cross-directory case the
-resolver restructure touches), and that without -H the names become
-independent inodes.
-"""
+import os
 
-from rsyncfns import (
+from harness import metadata
+from harness.rsync import (
     FROMDIR, TODIR,
     assert_hardlinked, assert_not_hardlinked, makepath, rmtree, run_rsync,
 )
-import os
 
 src = FROMDIR
+metadata(features={'hardlinks'}, cost='expensive', mutates={'filesystem'}, tags={'metadata'})
 a = os.path.join('a', 'aa', 'orig')
 b = os.path.join('b', 'bb', 'hardlink')
 
@@ -22,13 +17,11 @@
 rmtree(TODIR)
 makepath(src / 'a' / 'aa', src / 'b' / 'bb')
 (src / a).write_text("shared content across directories\n")
-os.link(src / a, src / b)            # one inode, two names in different dirs
+os.link(src / a, src / b)
 
-# -H preserves the cross-directory hard link.
 run_rsync('-aH', f'{src}/', f'{TODIR}/')
 assert_hardlinked(TODIR / a, TODIR / b, label='-H cross-dir hardlink')
 
-# Without -H the two names are copied as independent files.
 rmtree(TODIR)
 run_rsync('-a', f'{src}/', f'{TODIR}/')
 assert_not_hardlinked(TODIR / a, TODIR / b, label='no -H => separate inodes')
diff --git a/testsuite/hardlinks_test.py b/testsuite/tests/metadata/hardlinks.py
similarity index 68%
rename from testsuite/hardlinks_test.py
rename to testsuite/tests/metadata/hardlinks.py
index 728264f01..99771b117 100644
--- a/testsuite/hardlinks_test.py
+++ b/testsuite/tests/metadata/hardlinks.py
@@ -1,21 +1,26 @@
 #!/usr/bin/env python3
-# Python rewrite of testsuite/hardlinks.test.
-#
-# Verify rsync -H detects hard links and re-creates them on the receiver.
-# Also covers the incremental-recursion path (lots of small files), the
-# remote (lsh.sh) path, --link-dest / --copy-dest, --checksum without
-# slipping HLINK_BUMP boundaries, and the single-file / single-directory
-# corner cases that have broken in the past.
 
 import os
 import shutil
 import subprocess
 
-from rsyncfns import (
-    CHKDIR, FROMDIR, OUTFILE, RSYNC, RSYNC_PEER, SRCDIR, TODIR,
-    checkit, makepath, rsync_argv, test_fail, test_skipped, rsync_path_arg, rsh_cmd,
+from harness.rsync import (
+    CHKDIR,
+    FROMDIR,
+    OUTFILE,
+    SRCDIR,
+    TODIR,
+    checkit,
+    makepath,
+    rsync_argv,
+    test_fail,
+    test_skipped,
+    rsync_path_arg,
+    rsh_cmd,
 )
+from harness import metadata
 
+metadata(features={'hardlinks', 'remote-shell'}, transports={'pipe', 'tcp'}, min_peer='2.6.0', cost='expensive', mutates={'filesystem', 'process'}, tags={'compatibility', 'metadata', 'transfer', 'version-mix'})
 
 SSH = rsh_cmd()
 
@@ -42,17 +47,12 @@
 
 checkit(['-aHivv', '--debug=HLINK5', f'{FROMDIR}/', f'{TODIR}/'], FROMDIR, TODIR)
 
-# Force a delta-overwrite on one of the linked names; -H should still
-# leave name1..name3 hard-linked on the destination.
 with open(TODIR / 'name1', 'a') as f:
     f.write("extra extra\n")
 
 checkit(['-aHivv', '--debug=HLINK5', '--no-whole-file',
          f'{FROMDIR}/', f'{TODIR}/'], FROMDIR, TODIR)
 
-# Add a new link under a subdir that doesn't exist on the dest yet, plus
-# pile on lots of small files to exercise incremental recursion's link
-# bookkeeping across batches.
 makepath(FROMDIR / 'subdir' / 'down' / 'deep')
 
 cdir = FROMDIR / 'subdir'
@@ -67,7 +67,6 @@
 checkit(['-aHivve', SSH, '--debug=HLINK5', f'--rsync-path={rsync_path_arg()}',
          f'{FROMDIR}/', f'localhost:{TODIR}/'], FROMDIR, TODIR)
 
-# --link-dest and --copy-dest should also keep hard-linked entries.
 checkit(['-aHivv', '--debug=HLINK5', f'--link-dest={TODIR}',
          f'{FROMDIR}/', f'{CHKDIR}/'], TODIR, CHKDIR)
 
@@ -75,15 +74,12 @@
 checkit(['-aHivv', '--debug=HLINK5', f'--copy-dest={TODIR}',
          f'{FROMDIR}/', f'{CHKDIR}/'], FROMDIR, CHKDIR)
 
-# Make a hard link whose other end is outside the source -- the dest
-# stays single-linked -- and re-sync with --checksum.
 (FROMDIR / 'solo').write_text("This is another file\n")
 try:
     os.link(FROMDIR / 'solo', CHKDIR / 'solo')
 except OSError:
     test_fail("Can't create hardlink")
 
-# Make sure --checksum doesn't slip the offset due to an HLINK_BUMP() change.
 proc = subprocess.run(
     rsync_argv('-aHivc', '--debug=HLINK5', f'{FROMDIR}/', f'{CHKDIR}/'),
     capture_output=True, text=True,
@@ -95,7 +91,6 @@
 if 'solo' in proc.stdout:
     test_fail("Erroneous copy of solo file occurred!")
 
-# Single-file with -H is a regression-prone path; just confirm it copies.
 shutil.rmtree(TODIR, ignore_errors=True)
 TODIR.mkdir(parents=True, exist_ok=True)
 subprocess.run(rsync_argv('-aHivv', '--debug=HLINK5', str(name1), f'{TODIR}/'))
@@ -103,7 +98,6 @@
 if diff.returncode != 0:
     test_fail("solo copy of name1 failed")
 
-# Single-directory with -H is the 3.4.0 regression.
 shutil.rmtree(FROMDIR, ignore_errors=True)
 shutil.rmtree(TODIR, ignore_errors=True)
 makepath(FROMDIR / 'sym', TODIR)
diff --git a/testsuite/macos-setgid-ordinary-mode-regression_test.py b/testsuite/tests/metadata/macos-setgid-ordinary-mode.py
similarity index 58%
rename from testsuite/macos-setgid-ordinary-mode-regression_test.py
rename to testsuite/tests/metadata/macos-setgid-ordinary-mode.py
index 167373e28..f5d644396 100644
--- a/testsuite/macos-setgid-ordinary-mode-regression_test.py
+++ b/testsuite/tests/metadata/macos-setgid-ordinary-mode.py
@@ -1,12 +1,4 @@
 #!/usr/bin/env python3
-"""A failed setgid request must not discard the ordinary directory mode.
-
-On macOS, mkdir(..., 02750) for a caller-owned directory whose inherited group
-is not one of the caller's groups succeeds with setgid cleared and mode 0750.
-The hardened 3.5 receiver stages a new directory and later uses
-fchmodat(..., AT_SYMLINK_NOFOLLOW), which returns EPERM without applying any of
-the ordinary bits.  A pinned-descriptor fchmod preserves the former semantics.
-"""
 
 import ctypes
 import errno
@@ -18,39 +10,21 @@
 import platform
 import subprocess
 
-from rsyncfns import SCRATCHDIR, rmtree, rsync_argv, test_fail, test_skipped
-
+from harness.rsync import SCRATCHDIR, rmtree, rsync_argv, test_fail, test_skipped
 
 if platform.system() != "Darwin":
-    test_skipped("macOS-specific fchmodat setgid behavior")
+    test_skipped("macOS-specific fchmodat setgid behaviour", capability='darwin')
 
 AT_FDCWD = -2
 AT_SYMLINK_NOFOLLOW = 0x0020
 libc = ctypes.CDLL(None, use_errno=True)
 libc.fchmodat.argtypes = [ctypes.c_int, ctypes.c_char_p, ctypes.c_uint, ctypes.c_int]
 
-
 def mode(path):
     return path.stat().st_mode & 0o7777
 
-
-# macOS gives a new directory its parent's group, and the bug only shows when
-# that group is one the caller cannot grant.  The build tree usually satisfies
-# that, but not always -- a checkout under a home directory inherits a group the
-# user IS in, and the test then skipped silently.  Fall back to /private/tmp,
-# which is group wheel, so this runs rather than skipping wherever it can.
 def _scratch_with_ungrantable_group():
-    """A scratch dir whose group we cannot grant, else None.
-
-    The build tree is tried first; a checkout under a home directory
-    inherits a group the user IS in, so /private/tmp (group wheel) is the
-    fallback.  That one is outside SCRATCHDIR, which the harness cleans, so
-    it gets a unique name and an atexit hook -- a fixed name in a sticky
-    world-writable directory would let concurrent runs delete each other's
-    live fixture, and a leftover owned by another user would make every
-    later run skip.
-    """
-    cand = SCRATCHDIR / "macos-setgid-ordinary-mode-regression"
+    cand = SCRATCHDIR / 'macos-setgid-ordinary-mode'
     rmtree(cand)
     cand.mkdir(parents=True)
     if cand.stat().st_gid not in os.getgroups():
@@ -66,16 +40,17 @@ def _scratch_with_ungrantable_group():
         return tmp
     return None
 
-
 base = _scratch_with_ungrantable_group()
 if base is None:
     test_skipped("no scratch parent whose group this user cannot grant "
-                 "(running as root, or every candidate group is granted)")
+                 "(running as root or every candidate group is granted)",
+                 capability='ungrantable_group')
 
 mprobe = base / "mprobe"
 mprobe.mkdir(mode=0o2750)
 if mode(mprobe) != 0o750:
-    test_skipped("mkdir does not apply ordinary bits while clearing setgid")
+    test_skipped("mkdir does not apply ordinary bits while clearing setgid",
+                 capability='setgid_semantics')
 
 faprobe = base / "fchmodat-probe"
 faprobe.mkdir(mode=0o700)
@@ -83,7 +58,8 @@ def _scratch_with_ungrantable_group():
 frc = libc.fchmodat(AT_FDCWD, os.fsencode(faprobe), 0o2750,
                     AT_SYMLINK_NOFOLLOW)
 if frc == 0 or ctypes.get_errno() != errno.EPERM or mode(faprobe) != 0o700:
-    test_skipped("fchmodat no-follow does not expose the macOS differential")
+    test_skipped("fchmodat no-follow does not expose the macOS differential",
+                 capability='setgid_semantics')
 
 fdprobe = base / "fchmod-probe"
 fdprobe.mkdir(mode=0o700)
@@ -93,7 +69,8 @@ def _scratch_with_ungrantable_group():
 finally:
     os.close(fd)
 if mode(fdprobe) != 0o750:
-    test_skipped("descriptor chmod does not preserve the legacy mkdir semantics")
+    test_skipped("descriptor chmod does not preserve the legacy mkdir semantics",
+                 capability='setgid_semantics')
 
 src = base / "src"
 dest = base / "dest"
diff --git a/testsuite/metadata-depth_test.py b/testsuite/tests/metadata/metadata-depth.py
similarity index 57%
rename from testsuite/metadata-depth_test.py
rename to testsuite/tests/metadata/metadata-depth.py
index f8ba7a077..0d9522b10 100644
--- a/testsuite/metadata-depth_test.py
+++ b/testsuite/tests/metadata/metadata-depth.py
@@ -1,26 +1,23 @@
 #!/usr/bin/env python3
-"""Coverage of -p (perms), -t (times) and --chmod at depth.
-
-Each attribute is set distinctively on a file AND a directory at every level of
-a >=3-deep tree, then checked per entry after the transfer -- the metadata is
-applied as a single-component operation on an entry whose parent chain the
-resolver restructure rewrites, so it must be verified deep, not just at the
-root.
-"""
 
 import os
 
-from rsyncfns import (
-    FROMDIR, TODIR,
-    assert_mode, assert_mtime_close, make_tree, rmtree, run_rsync, test_fail,
-    walk_dirs, walk_files,
+from harness.rsync import (
+    FROMDIR,
+    TODIR,
+    assert_mode,
+    assert_mtime_close,
+    make_tree,
+    rmtree,
+    run_rsync,
+    walk_dirs,
+    walk_files,
 )
 
 src = FROMDIR
 FILE_MODE = 0o640
 DIR_MODE = 0o750
-BASE_MTIME = 1_400_000_000          # a fixed, clearly-old timestamp
-
+BASE_MTIME = 1_400_000_000
 
 def seed():
     rmtree(src)
@@ -32,8 +29,6 @@ def seed():
     for d in walk_dirs(src):
         os.chmod(d, DIR_MODE)
 
-
-# --- -p preserves exact file and directory modes at every level -------------
 seed()
 run_rsync('-rlpt', f'{src}/', f'{TODIR}/')
 for f in walk_files(src):
@@ -41,12 +36,10 @@ def seed():
 for d in walk_dirs(src):
     assert_mode(TODIR / d.relative_to(src), DIR_MODE, label=f'-p dir {d.name}')
 
-# --- -t preserves file mtimes at every level --------------------------------
 for f in walk_files(src):
     rel = f.relative_to(src)
     assert_mtime_close(TODIR / rel, f.stat().st_mtime, label=f'-t {rel}')
 
-# --- --chmod rewrites modes at every level ----------------------------------
 seed()
 run_rsync('-a', '--chmod=D710,F600', f'{src}/', f'{TODIR}/')
 for f in walk_files(src):
diff --git a/testsuite/tests/metadata/nested-socket-specials.py b/testsuite/tests/metadata/nested-socket-specials.py
new file mode 100644
index 000000000..377410e4c
--- /dev/null
+++ b/testsuite/tests/metadata/nested-socket-specials.py
@@ -0,0 +1,40 @@
+#!/usr/bin/env python3
+
+import os
+import socket as _socket
+
+from harness.rsync import (
+    SCRATCHDIR, assert_same, rmtree, run_rsync, test_fail, test_skipped,
+)
+
+base = SCRATCHDIR / 'nested-socket'
+src = base / 'src'
+dest = base / 'dest'
+rmtree(base)
+(src / 'sub').mkdir(parents=True)
+(src / 'sub' / 'f.txt').write_text('regular\n')
+(src / 'top.txt').write_text('top\n')
+
+s = _socket.socket(_socket.AF_UNIX)
+prev = os.getcwd()
+try:
+    os.chdir(src / 'sub')
+    s.bind('thesock')
+except OSError as e:
+    test_skipped(f"cannot create a unix socket fixture ({e})")
+finally:
+    try:
+        os.chdir(prev)
+    except OSError:
+        pass
+    s.close()
+
+run_rsync('-a', f'{src}/', f'{dest}/')
+
+for rel in ('sub/f.txt', 'top.txt'):
+    got = dest / rel
+    if not got.is_file():
+        test_fail(f"a regular file was lost alongside the nested socket: {got}")
+    assert_same(src / rel, got, label=rel)
+
+print("nested-socket-specials: a nested unix socket does not fail the transfer")
diff --git a/testsuite/nonroot-restrictive-perms_test.py b/testsuite/tests/metadata/nonroot-restrictive-perms.py
similarity index 59%
rename from testsuite/nonroot-restrictive-perms_test.py
rename to testsuite/tests/metadata/nonroot-restrictive-perms.py
index 4fce24101..4e2eee007 100644
--- a/testsuite/nonroot-restrictive-perms_test.py
+++ b/testsuite/tests/metadata/nonroot-restrictive-perms.py
@@ -1,25 +1,11 @@
 #!/usr/bin/env python3
-"""Coverage: the generator/delete chmod-around-restrictive-perms paths.
-
-generator.c gen_entry_chmod() and delete.c del_chmod() only fire when
-`!am_root`: a non-root receiver creating files inside a directory whose
-incoming mode lacks S_IRWXU has to temporarily widen it
-(generator.c:~1725, restored at ~2387 in the retouch pass), and a
-non-root receiver deleting a non-writable file it owns adds S_IWUSR
-first (delete.c:~156).  Every other test runs the receiver as root in
-the container, so these never trip.
-
-Uses a daemon module with `uid = <non-root>` so the receiver child is
-non-root; the dest tree is chowned to that uid up front.  Skips when
-chown is unavailable.
-"""
 
 import os
 import pwd
 import stat
 import subprocess
 
-from rsyncfns import (
+from harness.rsync import (
     SCRATCHDIR,
     makepath, owners_supported, rmtree, rsync_argv, start_test_daemon,
     test_fail, test_skipped, write_daemon_conf,
@@ -28,15 +14,17 @@
 DAEMON_PORT = 12893
 
 if not owners_supported():
-    test_skipped("needs chown to set up a non-root-owned dest tree")
+    test_skipped("needs chown to set up a non-root-owned dest tree", capability='ownership')
 
 U = next((p for p in pwd.getpwall() if p.pw_uid != 0), None)
 if U is None:
-    test_skipped("no non-root passwd entry")
+    test_skipped("no non-root passwd entry", capability='ownership')
 
 src = SCRATCHDIR / 'nrp-src'
 dest = SCRATCHDIR / 'nrp-dest'
-rmtree(src); rmtree(dest); makepath(src, dest)
+rmtree(src)
+rmtree(dest)
+makepath(src, dest)
 os.chown(dest, U.pw_uid, U.pw_gid)
 
 conf = write_daemon_conf([
@@ -47,7 +35,6 @@
 ], name='nonroot-perms.conf')
 url = start_test_daemon(conf, DAEMON_PORT)
 
-
 def push(*extra):
     r = subprocess.run(
         rsync_argv('-rp', *extra, f'{src}/', f'{url}nrp/'),
@@ -57,10 +44,6 @@ def push(*extra):
         test_fail(f"push -rp {' '.join(extra)} -> rc={r.returncode}\n{r.stderr}")
     return r
 
-
-# --- A. gen_entry_chmod: receive into a dir whose mode lacks write ----------
-# Source dir mode 0500 (r-x------): the non-root generator widens it to 0700
-# while writing `inner`, then the retouch pass restores 0500.
 (src / 'restricted').mkdir()
 (src / 'restricted' / 'inner').write_bytes(b'x')
 os.chmod(src / 'restricted', 0o500)
@@ -76,12 +59,6 @@ def push(*extra):
 if st.st_uid != U.pw_uid:
     test_fail(f"restricted/ not owned by the module uid ({st.st_uid} != {U.pw_uid})")
 
-
-# --- B. del_chmod: --delete a non-writable file the receiver owns -----------
-# Dest already has restricted/inner (mode set by previous push).  Seed a
-# second dir `gone/` with a 0444 file in it, owned by U; remove `gone/` from
-# src and push --delete.  delete_dir_contents() walks gone/, sees ro_file
-# with !(mode & S_IWUSR) && !am_root && FLAG_OWNED_BY_US -> del_chmod first.
 gone = dest / 'gone'
 gone.mkdir()
 ro = gone / 'ro_file'
@@ -89,8 +66,6 @@ def push(*extra):
 os.chmod(ro, 0o444)
 os.chown(ro, U.pw_uid, U.pw_gid)
 os.chown(gone, U.pw_uid, U.pw_gid)
-# Widen restricted/ on the src side again so the generator re-exercises the
-# 1725 widen + 2387 restore on a SECOND pass too (idempotence under -p).
 os.chmod(src / 'restricted', 0o500)
 
 push('--delete')
@@ -102,6 +77,5 @@ def push(*extra):
 if stat.S_IMODE(os.stat(dest / 'restricted').st_mode) != 0o500:
     test_fail("restricted/ perms not re-restored on the second pass")
 
-
 print(f"nonroot-restrictive-perms: gen_entry_chmod widen+restore (0500 dir), "
       f"del_chmod on 0444 file, as uid={U.pw_uid}({U.pw_name})")
diff --git a/testsuite/omit-times_test.py b/testsuite/tests/metadata/omit-times.py
similarity index 68%
rename from testsuite/omit-times_test.py
rename to testsuite/tests/metadata/omit-times.py
index b994b9d63..3ba984c7c 100644
--- a/testsuite/omit-times_test.py
+++ b/testsuite/tests/metadata/omit-times.py
@@ -1,14 +1,8 @@
 #!/usr/bin/env python3
-"""Coverage of -O (--omit-dir-times) and -J (--omit-link-times) at depth.
-
--O preserves file mtimes but leaves directory mtimes alone; -J does the same
-for symlinks. Verify the distinction deep in the tree: the preserved entries
-match the source, the omitted ones do not.
-"""
 
 import os
 
-from rsyncfns import (
+from harness.rsync import (
     FROMDIR, TODIR,
     assert_mtime_close, make_tree, rmtree, run_rsync, test_fail,
     walk_dirs, walk_files,
@@ -17,7 +11,6 @@
 src = FROMDIR
 OLD = 1_400_000_000
 
-
 def seed():
     rmtree(src)
     rmtree(TODIR)
@@ -25,21 +18,16 @@ def seed():
     for p in list(walk_files(src)) + list(walk_dirs(src)):
         os.utime(p, (OLD, OLD))
 
-
-# --- -O: file mtimes preserved, directory mtimes omitted --------------------
 seed()
 run_rsync('-rlt', '-O', f'{src}/', f'{TODIR}/')
 for f in walk_files(src):
     assert_mtime_close(TODIR / f.relative_to(src), OLD, label=f'-O file {f.name}')
-# Every directory mtime must be omitted (left at ~now), not just one of them:
-# the old "at least one differs" check would miss a bug that preserved some.
 for d in walk_dirs(src):
     rel = d.relative_to(src)
     if abs(os.stat(TODIR / rel).st_mtime - OLD) <= 1:
         test_fail(f"-O preserved the mtime of directory {rel} instead of "
                   "omitting it")
 
-# --- -J: symlink mtime omitted (where the platform records symlink mtimes) --
 seed()
 deep = os.path.join('d1', 'd2', 'd3')
 os.symlink('f3', src / deep / 'sl')
diff --git a/testsuite/open-noatime_test.py b/testsuite/tests/metadata/open-noatime.py
similarity index 55%
rename from testsuite/open-noatime_test.py
rename to testsuite/tests/metadata/open-noatime.py
index fd267ec54..f2ac72d70 100644
--- a/testsuite/open-noatime_test.py
+++ b/testsuite/tests/metadata/open-noatime.py
@@ -1,9 +1,4 @@
 #!/usr/bin/env python3
-# Python rewrite of testsuite/open-noatime.test.
-#
-# Test that rsync --open-noatime keeps the source atime intact across the
-# transfer.  --open-noatime did not work properly on files with size > 0
-# at one point, so the test uses a non-empty source file.
 
 import datetime
 import os
@@ -11,40 +6,33 @@
 import shlex
 import subprocess
 
-import rsyncfns
-from rsyncfns import FROMDIR, TMPDIR, TODIR, TOOLDIR, run_rsync, test_fail, test_skipped
-
+from harness import rsync
+from harness.rsync import FROMDIR, TMPDIR, TODIR, TOOLDIR, run_rsync, test_fail, test_skipped
 
 vv = run_rsync('-VV', check=True, capture_output=True)
 if '"atimes": true' not in vv.stdout:
-    test_skipped("Rsync is configured without atimes support")
+    test_skipped("Rsync is configured without atimes support", capability='noatime')
 
-# O_NOATIME is Linux-specific.
 if platform.system() != 'Linux':
-    test_skipped("O_NOATIME is only supported on Linux")
+    test_skipped("O_NOATIME is only supported on Linux", capability='noatime')
 
 FROMDIR.mkdir(parents=True, exist_ok=True)
 foo = FROMDIR / 'foo'
 foo.write_text("content\n")
 
-# Pin the source atime to a known historical value (mtime preserved).
 atime = datetime.datetime(2001, 2, 3, 17, 17, 42).timestamp()
 mtime = foo.stat().st_mtime
 os.utime(foo, (atime, mtime))
 
-rsyncfns.TLS_ARGS = '--atimes'
+rsync.TLS_ARGS = '--atimes'
 
-# Capture the atime of the source via tls BEFORE the rsync run.
 def _tls_listing(path: str) -> str:
-    cmd = [str(TOOLDIR / 'tls')] + shlex.split(rsyncfns.TLS_ARGS) + [str(path)]
+    cmd = [str(TOOLDIR / 'tls')] + shlex.split(rsync.TLS_ARGS) + [str(path)]
     return subprocess.check_output(cmd, text=True)
 
-
 before = _tls_listing(foo)
 (TMPDIR / 'atime-from-before').write_text(before)
 
-# Don't use checkit() here -- the file-content diff it does would update
-# atimes on the source and defeat the test.
 run_rsync('--open-noatime', '--archive', '--recursive', '--times',
           '--atimes', '-vvv', f'{FROMDIR}/', f'{TODIR}/')
 
diff --git a/testsuite/ownership-depth_test.py b/testsuite/tests/metadata/ownership-depth.py
similarity index 82%
rename from testsuite/ownership-depth_test.py
rename to testsuite/tests/metadata/ownership-depth.py
index f4df789af..318859324 100644
--- a/testsuite/ownership-depth_test.py
+++ b/testsuite/tests/metadata/ownership-depth.py
@@ -1,20 +1,9 @@
 #!/usr/bin/env python3
-"""Coverage of --groupmap / --chown / --usermap / -o at depth.
-
-Remapping is applied to a file AND a directory at every level. As root we can
-remap to an arbitrary uid/gid (root may always chown/chgrp), so the uid side is
-covered too. As a normal user we can still remap the group to a secondary group
-we belong to; the uid side then needs root and is skipped.
-"""
-
-# Rerun under the fleet harness's non-root pass (testsuite/fleettest.py): the uid
-# remap only runs as root, so a non-root run exercises the group-only path too.
-fleet_nonroot = True
 
 import grp
 import os
 
-from rsyncfns import (
+from harness.rsync import (
     FROMDIR, TODIR,
     get_rootuid, get_testuid, make_tree, rmtree, rsync_getgroups, run_rsync,
     test_fail, test_skipped, walk_dirs, walk_files,
@@ -24,19 +13,16 @@
 is_root = get_testuid() == get_rootuid()
 prim = os.getgid()
 
-
 def seed():
     rmtree(src)
     rmtree(TODIR)
     make_tree(src, depth=3)
     entries = [p.relative_to(src) for p in (walk_dirs(src) + walk_files(src))]
-    # Normalise the source group so a prim->target remap is observable.
     for rel in entries:
         if os.stat(src / rel).st_gid != prim:
             os.chown(src / rel, -1, prim)
     return entries
 
-
 def assert_all(entries, *, gid=None, uid=None, label=''):
     for rel in entries:
         st = os.stat(TODIR / rel)
@@ -45,17 +31,13 @@ def assert_all(entries, *, gid=None, uid=None, label=''):
         if uid is not None and st.st_uid != uid:
             test_fail(f"{label}: owner of {rel} is {st.st_uid}, expected {uid}")
 
-
 try:
     grp.getgrgid(prim)
     prim_has_name = True
 except KeyError:
     prim_has_name = False
 
-
 if is_root:
-    # Root may assign any numeric id (it need not exist); pick targets that
-    # differ from the source's ids so the remap is observable.
     target_gid = 1 if prim == 0 else 0
     target_uid = 1 if get_testuid() == 0 else 0
 
diff --git a/testsuite/tests/metadata/symlink-unix-perms.py b/testsuite/tests/metadata/symlink-unix-perms.py
new file mode 100644
index 000000000..50427c54a
--- /dev/null
+++ b/testsuite/tests/metadata/symlink-unix-perms.py
@@ -0,0 +1,68 @@
+#!/usr/bin/env python3
+
+import errno
+import os
+import stat
+
+from harness.rsync import FROMDIR, SCRATCHDIR, TODIR, assert_mode, run_rsync, test_fail, test_skipped
+
+error = 'error occurred during test of symlink access change capability: '
+notimplemented = 'symlink Unix access change is not implemented on this system'
+notsupported = 'symlink Unix access change is not supported on this system'
+
+os.chdir(SCRATCHDIR)
+
+FROMDIR.mkdir(parents=True, exist_ok=True)
+TODIR.mkdir(parents=True, exist_ok=True)
+
+testdirectory = 'testdirectory'
+testfile = 'testfile'
+
+(FROMDIR / testdirectory).mkdir(parents=True)
+(FROMDIR / testfile).touch()
+
+os.chdir(FROMDIR)
+
+os.symlink(testdirectory, 'symlink', target_is_directory=True)
+
+try:
+    os.chmod('symlink', stat.S_IREAD + stat.S_IXOTH, follow_symlinks=False)
+
+except NotImplementedError:
+    test_skipped(notimplemented, capability='symlink_mode')
+
+except OSError as e:
+    if (e.errno == errno.ENOTSUP):
+        test_skipped(notsupported, capability='symlink_mode')
+    test_fail('OS' + error + f'{e}')
+
+assert_mode('symlink', stat.S_IREAD + stat.S_IXOTH)
+
+os.remove('symlink')
+
+os.chdir(SCRATCHDIR)
+
+symlinks = [
+    [ testdirectory, 0o770 ],
+    [ testfile, 0o0444 ],
+    [ testfile, 0o0711 ],
+    [ testfile, 0o0777 ],
+    [ testdirectory, 0o7777 ],
+    [ testfile, 0o0400 ],
+    [ testdirectory, 0o1407 ],
+    [ testdirectory, 0o2470 ],
+    [ testdirectory, 0o4777 ],
+    [ testfile, 0o7777 ],
+]
+
+for n, symlink in enumerate(symlinks):
+    target, access = symlink
+
+    os.symlink(target, FROMDIR / f'symlink-{n}', target_is_directory=(target == testdirectory))
+    os.chmod(FROMDIR / f'symlink-{n}', access, follow_symlinks=False)
+
+run_rsync('-av', f'{FROMDIR}/', f'{TODIR}/')
+
+for n, symlink in enumerate(symlinks):
+    expected = stat.S_IMODE(os.stat(FROMDIR / f'symlink-{n}', follow_symlinks=False).st_mode)
+    assert_mode(TODIR / f'symlink-{n}', expected)
diff --git a/testsuite/uidlist-id0-name-leak_test.py b/testsuite/tests/metadata/uidlist-id0-name-leak.py
similarity index 50%
rename from testsuite/uidlist-id0-name-leak_test.py
rename to testsuite/tests/metadata/uidlist-id0-name-leak.py
index 31bf2293f..bd705b8eb 100644
--- a/testsuite/uidlist-id0-name-leak_test.py
+++ b/testsuite/tests/metadata/uidlist-id0-name-leak.py
@@ -1,21 +1,10 @@
 #!/usr/bin/env python3
-"""KI-25: send_one_list leaks the id-0 (root) name string.
-
-uidlist.c:send_one_list, when xmit_id0_names is negotiated, passes
-uid_to_user(0)/gid_to_group(0) straight to send_one_name(); those return a
-strdup'd name (uidlist.c:120/137) whose pointer is never stored or freed.  Up
-to two small strings leak per transfer.
-
-ASan/LSan reproducer: run an owner/group-preserving transfer (which sends the
-uid+gid lists with the id-0 name) and assert no leak report names send_one_list.
-Gated on an AddressSanitizer build.
-"""
 
 import glob
 import os
 import subprocess
 
-from rsyncfns import (
+from harness.rsync import (
     FROMDIR, SCRATCHDIR, RSYNC,
     require_asan, rmtree, rsync_argv, test_fail,
 )
@@ -34,16 +23,9 @@
     f"detect_leaks=1:abort_on_error=0:log_path={asan_log}"
 )
 
-# -o/-g make the sender transmit the uid+gid lists; a modern<->modern transfer
-# negotiates xmit_id0_names, so send_one_list emits the id-0 name.  --list-only
-# makes the client exit via exit() (so LSan runs) rather than the _exit() of the
-# normal receiver/generator shutdown that would otherwise hide the leak.
 p = subprocess.run(rsync_argv('-og', '--list-only', f'{src}/'),
                    capture_output=True, text=True)
 
-# Non-vacuity: the listing must have actually run (proving send_id_lists ->
-# send_one_list executed).  We can't check the exit code: under detect_leaks=1
-# rsync's intentional at-exit leaks already force a nonzero status.
 if 'f.txt' not in p.stdout:
     test_fail(f"--list-only did not list the source file; leak path not exercised:\n{p.stdout}{p.stderr}")
 
diff --git a/testsuite/xattrs-depth_test.py b/testsuite/tests/metadata/xattrs-depth.py
similarity index 76%
rename from testsuite/xattrs-depth_test.py
rename to testsuite/tests/metadata/xattrs-depth.py
index c090286c6..0dac70f80 100644
--- a/testsuite/xattrs-depth_test.py
+++ b/testsuite/tests/metadata/xattrs-depth.py
@@ -1,23 +1,17 @@
 #!/usr/bin/env python3
-"""Coverage of -X (xattrs) at depth.
-
-xattrs_test.py exercises a shallow tree; this companion sets a distinctive user
-xattr on a file AND a directory at every level of a >=3-deep tree and checks
-that -X reproduces them all (the xattr is applied per entry, on a name whose
-parent chain the resolver restructure rewrites).
-"""
 
 import os
 import sys
 
-from rsyncfns import (
+from harness.rsync import (
     FROMDIR, TODIR,
     make_tree, rmtree, run_rsync, test_fail, test_skipped,
     walk_dirs, walk_files, xattr_dump, xattr_set, xattrs_supported,
 )
 
 if not xattrs_supported():
-    test_skipped("rsync built without xattr support (or no xattr tooling here)")
+    test_skipped("rsync built without xattr support (or no xattr tooling here)",
+                 capability='xattr_runtime')
 
 src = FROMDIR
 rmtree(src)
@@ -32,7 +26,8 @@
     for i, rel in enumerate(entries):
         xattr_set('depth', f'value-{i}-{rel}', str(rel))
 except OSError as e:
-    test_skipped(f"unable to set an xattr on this filesystem: {e}")
+    test_skipped(f"unable to set an xattr on this filesystem: {e}",
+                 capability='xattr_runtime')
 
 want = xattr_dump(*[str(r) for r in entries])
 
diff --git a/testsuite/tests/metadata/xattrs-hlink.py b/testsuite/tests/metadata/xattrs-hlink.py
new file mode 120000
index 000000000..376221a35
--- /dev/null
+++ b/testsuite/tests/metadata/xattrs-hlink.py
@@ -0,0 +1 @@
+xattrs.py
\ No newline at end of file
diff --git a/testsuite/xattrs_test.py b/testsuite/tests/metadata/xattrs.py
similarity index 84%
rename from testsuite/xattrs_test.py
rename to testsuite/tests/metadata/xattrs.py
index 18e317f52..b284b25f4 100644
--- a/testsuite/xattrs_test.py
+++ b/testsuite/tests/metadata/xattrs.py
@@ -1,27 +1,20 @@
 #!/usr/bin/env python3
-# Python rewrite of testsuite/xattrs.test (and, via a Makefile-built
-# symlink, of xattrs-hlink.test).
-#
-# Test that rsync -X preserves extended attributes through a transfer,
-# plus the --link-dest / --copy-dest / --fake-super interactions.
-# The hlink variant additionally enables -H and tests that hard links
-# survive alongside xattrs.
 
 import os
+import re
+import shutil
 import subprocess
 import sys
 
-from rsyncfns import (
+from harness.rsync import (
     CHKDIR, FROMDIR, RSYNC_PREFIX, RUSR, SCRATCHDIR, TMPDIR, TODIR, TOOLDIR,
     checkit, cp_touch, makepath, run_rsync, test_fail, test_skipped,
-    xattr_set as xset, xattr_dump, xattrs_supported,
+    xattr_get, xattr_set as xset, xattr_dump, xattrs_supported,
 )
 
-
 if not xattrs_supported():
     test_skipped("Rsync is configured without xattr support (or no xattr "
-                 "tooling on this platform)")
-
+                 "tooling on this platform)", capability='xattr_runtime')
 
 script_name = os.path.basename(sys.argv[0] if sys.argv[0] else __file__)
 hlink_variant = 'hlink' in script_name
@@ -43,13 +36,9 @@
 dirs = ['foo', 'foo/bar']
 files = ['file0', 'file1', 'file2', 'foo/file3', 'file4', 'foo/bar/file5']
 
-# Read the source dir's tls listing to extract its uid:gid -- used in
-# the fake-super %stat encoding below. Format: "MODE SIZE UID.GID ..."
 tls_out = subprocess.check_output(
     [str(TOOLDIR / 'tls'), str(FROMDIR / 'foo')], text=True,
 ).strip()
-# Extract "UID.GID" -> "UID:GID"
-import re
 m = re.search(r' (\d+)\.(\d+) ', tls_out)
 if not m:
     test_fail(f"can't parse uid/gid from tls output: {tls_out!r}")
@@ -60,7 +49,9 @@
 try:
     xset('foo', 'foo', 'file0')
 except OSError:
-    test_skipped("Unable to set an xattr")
+    test_skipped("Unable to set an xattr", capability='xattr_runtime')
+if xattr_get('foo', 'file0') != b'foo':
+    test_fail('Unable to read an xattr')
 xset('bar', 'bar', 'file0')
 
 xset('short', 'this is short', 'file1')
@@ -115,17 +106,13 @@
     dashH = []
     altDest = '--copy-dest'
 
-
 def _save_xattrs(paths, dest_file):
-    """Snapshot the xattrs of `paths` (relative to cwd) into dest_file."""
     dest_file.write_text(xattr_dump(*paths))
 
-
 _save_xattrs(dirs + files, SCRATCHDIR / 'xattrs.txt')
 
 XFILT = ['-f-x_system.*', '-f-x_security.*']
 
-# Simple xattr copy.
 checkit(['-avX', *XFILT, *dashH, '--super', '.', f'{CHKDIR}/'], FROMDIR, CHKDIR)
 
 os.chdir(CHKDIR)
@@ -156,11 +143,9 @@ def _save_xattrs(paths, dest_file):
     test_fail("xattr listing differs after --copy-dest / --link-dest copy")
 
 if dashH:
-    import shutil
     shutil.rmtree(lnkdir, ignore_errors=True)
 
 os.chdir(FROMDIR)
-import shutil
 shutil.rmtree(TODIR, ignore_errors=True)
 
 xset('nice', 'this is nice, but different', 'file1')
@@ -176,17 +161,12 @@ def _save_xattrs(paths, dest_file):
 if got != expected:
     test_fail("xattr listing differs after --fake-super --link-dest copy")
 
-# Hard-link sanity for the hlink variant: file1 should be alone, every
-# other file should share its inode with at least one peer.
 if dashH:
     ls_to = SCRATCHDIR / 'ls-to'
-    from rsyncfns import rsync_ls_lR
+    from harness.rsync import rsync_ls_lR
     ls_to.write_text(rsync_ls_lR(TODIR))
     one_link = []
     for line in ls_to.read_text().splitlines():
-        # tls prints "mode size uid.gid links date time path" -- column
-        # index 3 (zero-based) is the link count; we collect non-directory
-        # entries whose link count is exactly 1.
         if line.startswith('d') or not line.strip():
             continue
         cols = line.split()
@@ -214,8 +194,6 @@ def _save_xattrs(paths, dest_file):
 os.chdir(FROMDIR)
 shutil.rmtree(TODIR, ignore_errors=True)
 
-# When run by a non-root tester, this verifies no-user-perm files/dirs
-# can still be transferred.
 checkit(['-aiX', *XFILT, *dashH, '--fake-super', '--chmod=a=', '.', '../to'],
         CHKDIR, TODIR)
 
diff --git a/testsuite/tests/path/alt-dest-deep.py b/testsuite/tests/path/alt-dest-deep.py
new file mode 100644
index 000000000..1284e43de
--- /dev/null
+++ b/testsuite/tests/path/alt-dest-deep.py
@@ -0,0 +1,57 @@
+#!/usr/bin/env python3
+
+import os
+
+from harness.rsync import (
+    FROMDIR, SCRATCHDIR, TODIR, assert_exists, assert_hardlinked, assert_not_exists, assert_not_hardlinked, assert_same, make_tree, rmtree, run_rsync, walk_files, test_fail,
+)
+
+src = FROMDIR
+ref = SCRATCHDIR / 'altref'
+
+rmtree(src)
+rmtree(ref)
+rmtree(TODIR)
+
+make_tree(src, depth=3, data=True)
+
+run_rsync('-a', f'{src}/', f'{ref}/')
+
+changed = os.path.join('d1', 'd2', 'd3', 'f3')
+with open(src / changed, 'ab') as f:
+    f.write(b'a changed deep tail\n')
+
+rels = [p.relative_to(src) for p in walk_files(src)]
+if os.path.join('d1', 'd2', 'd3', 'f3') not in [str(r) for r in rels]:
+    test_fail('deep alternate-destination fixture is incomplete')
+
+def run_to(opt):
+    rmtree(TODIR)
+    run_rsync('-a', f'--{opt}={ref}', f'{src}/', f'{TODIR}/')
+
+run_to('link-dest')
+for rel in rels:
+    d, r = TODIR / rel, ref / rel
+    if str(rel) == changed:
+        assert_not_hardlinked(d, r, label=f'link-dest changed {rel}')
+        assert_same(d, src / rel, label=f'link-dest changed {rel}')
+    else:
+        assert_hardlinked(d, r, label=f'link-dest unchanged {rel}')
+
+run_to('copy-dest')
+for rel in rels:
+    d, r = TODIR / rel, ref / rel
+    assert_exists(d, label=f'copy-dest {rel}')
+    assert_same(d, src / rel, label=f'copy-dest {rel}')
+    assert_not_hardlinked(d, r, label=f'copy-dest {rel}')
+
+run_to('compare-dest')
+for rel in rels:
+    d = TODIR / rel
+    if str(rel) == changed:
+        assert_exists(d, label=f'compare-dest changed {rel}')
+        assert_same(d, src / rel, label=f'compare-dest changed {rel}')
+    else:
+        assert_not_exists(d, label=f'compare-dest unchanged {rel}')
+
+print("alt-dest-deep: link-dest/copy-dest/compare-dest verified at depth")
diff --git a/testsuite/tests/path/alt-dest-module-escape.py b/testsuite/tests/path/alt-dest-module-escape.py
new file mode 100644
index 000000000..1eb772da1
--- /dev/null
+++ b/testsuite/tests/path/alt-dest-module-escape.py
@@ -0,0 +1,64 @@
+#!/usr/bin/env python3
+
+import os
+import shutil
+import subprocess
+
+from harness.rsync import (
+    SCRATCHDIR, make_data_file, makepath, rmtree, rsync_argv, start_test_daemon,
+    test_fail, write_daemon_conf,
+)
+
+DAEMON_PORT = 12916
+DATA_SIZE = 40000
+
+mod = SCRATCHDIR / 'escmod'
+src = SCRATCHDIR / 'escsrc'
+copy_src = SCRATCHDIR / 'copy-src'
+outside = SCRATCHDIR / 'OUTSIDE'
+for d in (mod, src, copy_src, outside):
+    rmtree(d)
+makepath(mod / '00', src, copy_src, outside)
+
+make_data_file(src / 'f.dat', DATA_SIZE)
+shutil.copy2(src / 'f.dat', outside / 'f.dat')
+(copy_src / 'copy.dat').write_text('SOURCE-CONTENT\n')
+(outside / 'copy.dat').write_text('SECRET-CONTENT\n')
+timestamp = 1_234_567_890
+for path in (copy_src / 'copy.dat', outside / 'copy.dat'):
+    path.chmod(0o644)
+    os.utime(path, (timestamp, timestamp))
+(mod / 'copy-basis').symlink_to(outside, target_is_directory=True)
+
+conf = write_daemon_conf([
+    ('bak', {'path': str(mod), 'read only': 'no'}),
+])
+url = start_test_daemon(conf, DAEMON_PORT)
+
+proc = subprocess.run(
+    rsync_argv('-a', '--link-dest=../../OUTSIDE', f'{src}/', f'{url}bak/00/'),
+    stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True)
+out = proc.stdout or ''
+if proc.returncode not in (0, 23):
+    test_fail(f"escape push failed unexpectedly (rc={proc.returncode}):\n{out}")
+
+dest = mod / '00' / 'f.dat'
+secret = outside / 'f.dat'
+if not dest.is_file():
+    test_fail(f"destination file missing ({dest})")
+
+ds, ss = dest.stat(), secret.stat()
+if (ds.st_dev, ds.st_ino) == (ss.st_dev, ss.st_ino):
+    test_fail(
+        "MODULE ESCAPE: the dest was hard-linked to a file OUTSIDE the module "
+        f"via --link-dest=../../OUTSIDE -- the confined resolver let a `..` "
+        f"climb escape the module root.\n{out}")
+
+proc = subprocess.run(
+    rsync_argv('-rtp', '--copy-dest=copy-basis', f'{copy_src}/', f'{url}bak/'),
+    stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True)
+copied = mod / 'copy.dat'
+if proc.returncode not in (0, 23) or not copied.is_file():
+    test_fail(f'confined --copy-dest transfer failed: {proc.stdout}')
+if copied.read_text() != 'SOURCE-CONTENT\n':
+    test_fail('--copy-dest read outside module through a trusted symlink')
diff --git a/testsuite/tests/path/alt-dest-symlink-race.py b/testsuite/tests/path/alt-dest-symlink-race.py
new file mode 100644
index 000000000..3485f023c
--- /dev/null
+++ b/testsuite/tests/path/alt-dest-symlink-race.py
@@ -0,0 +1,48 @@
+#!/usr/bin/env python3
+
+import os
+
+from harness import metadata
+from harness.rsync import (SCRATCHDIR, get_rootgid, get_rootuid, get_testuid, makepath, rmtree,
+                      run_rsync, start_test_daemon, test_fail, write_daemon_conf)
+
+metadata(features={'alt-dest', 'daemon', 'symlink'}, transports={'pipe', 'tcp'}, min_peer='2.6.0', cost='expensive', mutates={'filesystem', 'process', 'socket'}, tags={'daemon', 'security', 'version-mix'})
+
+base = SCRATCHDIR / 'alt-dest-symlink'
+rmtree(base)
+modules = []
+cases = []
+timestamp = 1_234_567_890
+
+for option in ('link', 'copy'):
+    root = base / option
+    outside = base / f'{option}-outside'
+    source = base / f'{option}-source'
+    makepath(root, outside, source)
+    source_file = source / 'target'
+    outside_file = outside / 'target'
+    source_file.write_text('source00\n' if option == 'copy' else 'matching\n')
+    outside_file.write_text('outside0\n' if option == 'copy' else 'matching\n')
+    os.utime(source_file, (timestamp, timestamp))
+    os.utime(outside_file, (timestamp, timestamp))
+    os.chmod(source_file, 0o644)
+    os.chmod(outside_file, 0o644)
+    (root / 'cd').symlink_to(outside)
+    modules.append((option, {'path': str(root), 'read only': 'no'}))
+    cases.append((option, root, outside_file, source, source_file))
+
+globals = {'use chroot': 'no', 'log file': str(base / 'rsyncd.log')}
+if get_testuid() == get_rootuid():
+    globals.update({'uid': str(get_rootuid()), 'gid': str(get_rootgid())})
+url = start_test_daemon(write_daemon_conf(modules, globals=globals,
+                                          name='alt-dest-symlink.conf'), 12882)
+
+for option, root, outside, source, expected in cases:
+    run_rsync('-rtp', f'--{option}-dest=cd', f'{source}/', f'{url}{option}/', check=False)
+    result = root / 'target'
+    if not result.is_file():
+        test_fail(f'{option}-dest: destination was not created')
+    if option == 'link' and result.stat().st_ino == outside.stat().st_ino:
+        test_fail('link-dest followed an escaping basis symlink')
+    if option == 'copy' and result.read_bytes() != expected.read_bytes():
+        test_fail('copy-dest read through an escaping basis symlink')
diff --git a/testsuite/alt-dest_test.py b/testsuite/tests/path/alt-dest.py
similarity index 53%
rename from testsuite/alt-dest_test.py
rename to testsuite/tests/path/alt-dest.py
index 19bce222e..7d9667786 100644
--- a/testsuite/alt-dest_test.py
+++ b/testsuite/tests/path/alt-dest.py
@@ -1,20 +1,23 @@
 #!/usr/bin/env python3
-# Python rewrite of testsuite/alt-dest.test.
-#
-# Exercise rsync's --compare-dest, --copy-dest and --link-dest
-# alternative-destination options, both locally and across the lsh.sh
-# remote-shell stand-in. Also covers the tmpfile path in copy_file() by
-# pointing --copy-dest at a directory holding a same-name candidate.
 
 import os
-import shutil
-import time
 
-from rsyncfns import (
-    CHKDIR, FROMDIR, RSYNC, RSYNC_PEER, SCRATCHDIR, SRCDIR, TMPDIR, TODIR,
-    checkit, hands_setup, rmtree, run_rsync, test_fail, rsync_path_arg, rsh_cmd,
+from harness.rsync import (
+    CHKDIR,
+    FROMDIR,
+    TMPDIR,
+    TODIR,
+    checkit,
+    hands_setup,
+    rmtree,
+    run_rsync,
+    test_fail,
+    rsync_path_arg,
+    rsh_cmd,
 )
+from harness import metadata
 
+metadata(features={'alt-dest', 'remote-shell'}, transports={'pipe', 'tcp'}, min_peer='2.6.0', mutates={'filesystem', 'process'}, tags={'compatibility', 'transfer', 'version-mix'})
 
 alt1dir = TMPDIR / 'alt1'
 alt2dir = TMPDIR / 'alt2'
@@ -24,48 +27,35 @@
 
 hands_setup()
 
-# Seed alt1 and alt2 with disjoint single-file subtrees of fromdir.
 run_rsync('-av', '--include=text', '--include=*/', '--exclude=*',
           f'{FROMDIR}/', f'{alt1dir}/')
 run_rsync('-av', '--include=etc-ltr-list', '--include=*/', '--exclude=*',
           f'{FROMDIR}/', f'{alt2dir}/')
 
-# Create a side dir with one identically-named candidate so copy_file()'s
-# tmpfile path gets exercised.
 (FROMDIR / 'likely').write_text("This is a test file\n")
 alt3dir.mkdir()
 (alt3dir / 'likely').write_text("This is a test file\n")
 
-time.sleep(1)
-os.utime(FROMDIR / 'dir' / 'text')
-os.utime(FROMDIR / 'likely')
+for path in (FROMDIR / 'dir' / 'text', FROMDIR / 'likely'):
+    st = path.stat()
+    os.utime(path, (st.st_atime, st.st_mtime + 10))
 
-# chkdir: what a vanilla copy would produce, minus /text and etc-ltr-list.
 run_rsync('-av', '--exclude=/text', '--exclude=etc-ltr-list',
           f'{FROMDIR}/', f'{CHKDIR}/')
 
-# Stacked --compare-dest: dest grows just the deltas alt1+alt2 don't have.
 checkit(['-avv', '--no-whole-file',
          f'--compare-dest={alt1dir}', f'--compare-dest={alt2dir}',
          f'{FROMDIR}/', f'{TODIR}/'], CHKDIR, TODIR)
 
 rmtree(TODIR)
-# Stacked --copy-dest: dest gets full copy because content can be hardlinked
-# from the alt dirs where available.
 checkit(['-avv', '--no-whole-file',
          f'--copy-dest={alt1dir}', f'--copy-dest={alt2dir}',
          f'{FROMDIR}/', f'{TODIR}/'], FROMDIR, TODIR)
 
-# Test that copy_file() works correctly with tmpfiles. Combine each of
-# {direct, --inplace} with each of {local, remote-source, remote-dest}.
 for maybe_inplace in ([], ['--inplace']):
     rmtree(TODIR)
     checkit(['-av', *maybe_inplace, f'--copy-dest={alt3dir}',
              f'{FROMDIR}/', f'{TODIR}/'], FROMDIR, TODIR)
-    # --copy-dest must COPY the unchanged candidate, not hard-link it: the
-    # result is a distinct inode from the alt-dir source (this is the property
-    # that distinguishes --copy-dest from --link-dest, which checkit's tree
-    # comparison alone does not capture).
     if os.stat(TODIR / 'likely').st_ino == os.stat(alt3dir / 'likely').st_ino:
         test_fail(f"--copy-dest{' --inplace' if maybe_inplace else ''} "
                   "hard-linked 'likely' instead of copying it")
diff --git a/testsuite/backup-dir-relative_test.py b/testsuite/tests/path/backup-dir-relative.py
similarity index 57%
rename from testsuite/backup-dir-relative_test.py
rename to testsuite/tests/path/backup-dir-relative.py
index 8d89f8937..7834f7830 100644
--- a/testsuite/backup-dir-relative_test.py
+++ b/testsuite/tests/path/backup-dir-relative.py
@@ -1,17 +1,8 @@
-"""Pin that a relative `--backup-dir` is relative to the DESTINATION dir.
-
-The rsync(1) `--backup-dir` entry says "if you specify a relative path, the
-backup directory will be relative to the destination directory".  This test
-measures it: with `--backup-dir=bak` and a destination `d`, the replaced file's
-backup lands at `d/bak/...`, not under the invoking cwd.
-
-Pure local client behaviour: no daemon/root/tcp.  Cross-version: expected
-identical against --rsync-bin=old_versions/rsync_3.2.7.
-"""
+#!/usr/bin/env python3
 
 import subprocess
 
-from rsyncfns import SCRATCHDIR, rmtree, rsync_argv, test_fail
+from harness.rsync import SCRATCHDIR, rmtree, rsync_argv, test_fail
 
 base = SCRATCHDIR / 'backup-dir-rel'
 rmtree(base)
@@ -21,12 +12,9 @@
 dst = base / 'dst'
 src.mkdir()
 dst.mkdir()
-# Different sizes so the quick-check always updates (and thus backs up).
 (dst / 'file').write_text('OLD\n')
 (src / 'file').write_text('NEWER-CONTENT\n')
 
-# Run from `base` so a cwd-relative interpretation would put the backup at
-# base/bak -- distinguishable from the dest-relative base/dst/bak.
 subprocess.run(
     rsync_argv('-a', '-b', '--backup-dir=bak', f'{src}/', f'{dst}/'),
     cwd=str(base), stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
diff --git a/testsuite/backup-dir-repeated-separator-delete_test.py b/testsuite/tests/path/backup-dir-repeated-separator-delete.py
similarity index 92%
rename from testsuite/backup-dir-repeated-separator-delete_test.py
rename to testsuite/tests/path/backup-dir-repeated-separator-delete.py
index 820efcecc..90c5a5f72 100644
--- a/testsuite/backup-dir-repeated-separator-delete_test.py
+++ b/testsuite/tests/path/backup-dir-repeated-separator-delete.py
@@ -1,11 +1,9 @@
 #!/usr/bin/env python3
-"""Repeated backup-dir separators must not replace the backup directory."""
 
 import os
 import subprocess
 
-from rsyncfns import SCRATCHDIR, makepath, rmtree, rsync_argv, test_fail
-
+from harness.rsync import SCRATCHDIR, makepath, rmtree, rsync_argv, test_fail
 
 OLD = b'old destination bytes\n'
 NEW = b'new source bytes with a different length\n'
diff --git a/testsuite/tests/path/backup-dir-symlink-race.py b/testsuite/tests/path/backup-dir-symlink-race.py
new file mode 100644
index 000000000..8ba0534cb
--- /dev/null
+++ b/testsuite/tests/path/backup-dir-symlink-race.py
@@ -0,0 +1,78 @@
+#!/usr/bin/env python3
+
+import os
+import stat
+import subprocess
+import time
+
+from harness.mutation import find_attacker_uid, race_budget, start_c_flipper, stop_flipper
+from harness.rsync import SCRATCHDIR, rmtree, rsync_argv, test_fail, test_skipped
+
+if os.geteuid() != 0:
+    test_skipped("requires root to plant a backup-dir symlink owned by a non-self uid",
+                 capability='cross_uid')
+ATT_UID = find_attacker_uid()
+if ATT_UID is None:
+    test_skipped("no untrusted-uid user available for cross-uid plant", capability='cross_uid')
+
+NFILES = 95
+
+base = SCRATCHDIR / 'bdir-race'
+src = base / 'src'
+dest = base / 'dest'
+backup = base / 'backup'
+outside = base / 'outside'
+sub = backup / 'sub'
+sublink = backup / '.sublink'
+
+def build():
+    rmtree(base)
+    for d in (src / 'sub', dest / 'sub', backup, outside):
+        d.mkdir(parents=True)
+    for i in range(NFILES):
+        (src / 'sub' / f'f{i}').write_text('payload\n')
+        os.chmod(src / 'sub' / f'f{i}', 0o777)
+        (dest / 'sub' / f'f{i}').write_text('different\n')
+        os.chmod(dest / 'sub' / f'f{i}', 0o777)
+        (outside / f'f{i}').write_text('do-not-touch\n')
+        os.chmod(outside / f'f{i}', 0o600)
+    sub.mkdir()
+    os.symlink(str(outside), sublink)
+    os.lchown(sublink, ATT_UID, ATT_UID)
+
+def push():
+    subprocess.run(
+        rsync_argv('-a', '-b', '--chmod=777', f'--backup-dir={backup}',
+                   f'{src}/', f'{dest}/'),
+        stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL,
+    )
+
+def escaped() -> bool:
+    with os.scandir(outside) as it:
+        for e in it:
+            if e.is_file() and stat.S_IMODE(e.stat().st_mode) == 0o777:
+                return True
+    return False
+
+build()
+push()
+if not (sub / 'f0').is_file():
+    test_fail("positive control: a normal push did not create backup/sub/f0 -- "
+              "backups are not happening, so the race scenario would be vacuous")
+if escaped():
+    test_fail("positive control: a sentinel was already 0777 before the race")
+
+flip = start_c_flipper(sub, sublink)
+try:
+    deadline = time.monotonic() + race_budget(10.0)
+    while time.monotonic() < deadline:
+        for i in range(80):
+            (dest / 'sub' / f'f{i}').write_text('changed\n')
+        push()
+        if escaped():
+            test_fail(
+                "backup-dir parent symlink race: a 0777 dest file was backed up "
+                f"into {outside} through the flipped backup/sub symlink -- "
+                "make_backup followed a foreign-owned parent component (escape).")
+finally:
+    stop_flipper(flip)
diff --git a/testsuite/bare-do-open-symlink-race_test.py b/testsuite/tests/path/bare-do-open-symlink-race.py
similarity index 76%
rename from testsuite/bare-do-open-symlink-race_test.py
rename to testsuite/tests/path/bare-do-open-symlink-race.py
index f3fc2d5f1..74a20c8ff 100644
--- a/testsuite/bare-do-open-symlink-race_test.py
+++ b/testsuite/tests/path/bare-do-open-symlink-race.py
@@ -1,10 +1,4 @@
 #!/usr/bin/env python3
-# Python rewrite of testsuite/bare-do-open-symlink-race.test.
-#
-# Codex audit Findings 3b, 3c-symlink and 3c-mknod: bare do_open /
-# do_symlink / do_mknod paths on the receiver follow parent symlinks
-# unrestrictedly.  Three scenarios are exercised; each must leave the
-# outside-the-module sentinel unchanged.
 
 import filecmp
 import os
@@ -12,23 +6,23 @@
 import stat
 import subprocess
 
-from rsyncfns import (
+from harness.rsync import (
     SCRATCHDIR,
     get_rootgid, get_rootuid, get_testuid,
     rmtree, rsync_argv, start_test_daemon, test_fail, test_skipped,
 )
+from harness import metadata
 
+metadata(features={'daemon', 'symlink'}, transports={'pipe', 'tcp'}, min_peer='2.6.0', cost='expensive', mutates={'filesystem', 'process', 'socket'}, tags={'daemon', 'security', 'version-mix'})
 
 DAEMON_PORT = 12884
 
-
 mod = SCRATCHDIR / 'module'
 outside = SCRATCHDIR / 'outside'
 src = SCRATCHDIR / 'src_files'
 conf = SCRATCHDIR / 'test-rsyncd.conf'
 outside_pristine = SCRATCHDIR / 'outside-pristine.txt'
 
-
 def setup():
     for d in (mod, outside, src):
         rmtree(d)
@@ -38,7 +32,6 @@ def setup():
     shutil.copy2(outside / 'target.txt', outside_pristine)
     os.symlink(str(outside), mod / 'cd')
 
-
 def verify_outside_unchanged(label: str) -> None:
     mode = (outside / 'target.txt').stat().st_mode & 0o777
     if mode != 0o644:
@@ -46,12 +39,10 @@ def verify_outside_unchanged(label: str) -> None:
     if not filecmp.cmp(outside / 'target.txt', outside_pristine, shallow=False):
         test_fail(f"{label}: outside/target.txt content changed -- daemon followed the cd symlink")
 
-
 def verify_outside_unchanged_or_absent(label: str, target: str) -> None:
     if (outside / target).exists() or (outside / target).is_symlink():
         test_fail(f"{label}: outside/{target} was created -- daemon followed the cd symlink")
 
-
 my_uid = get_testuid()
 root_uid = get_rootuid()
 root_gid = get_rootgid()
@@ -61,10 +52,6 @@ def verify_outside_unchanged_or_absent(label: str, target: str) -> None:
     uid_line = '#' + uid_line
     gid_line = '#' + gid_line
 
-
-# All three scenarios use the same daemon -- they just target a different
-# module. Write both modules up-front so the daemon doesn't need to be
-# restarted between scenarios.
 conf.write_text(f"""\
 use chroot = no
 {uid_line}
@@ -83,21 +70,13 @@ def verify_outside_unchanged_or_absent(label: str, target: str) -> None:
 """)
 daemon_url = start_test_daemon(conf, DAEMON_PORT).rstrip('/')
 
-
 def run_attack(args):
-    """Run the (expected-to-be-contained) attack transfer and return its exit
-    code; output is discarded since the security assertion is on the filesystem."""
     return subprocess.run(
         rsync_argv(*args),
         stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL,
     ).returncode
 
-
 def positive_control():
-    """Confirm the upload module accepts an ordinary write. Without this, every
-    scenario below would also pass if the daemon refused (or failed) before the
-    vulnerable code ran -- the sentinel-unchanged check alone can't tell a
-    securely-contained attack from one that never reached the receiver path."""
     for d in (mod, src):
         rmtree(d)
         d.mkdir(parents=True)
@@ -108,11 +87,8 @@ def positive_control():
         test_fail(f"positive control: upload module did not accept a normal "
                   f"write (rc={rc}); attack scenarios would be vacuous")
 
-
 positive_control()
 
-
-# Scenario 3b: --inplace --backup --backup-dir=cd
 setup()
 (mod / 'target.txt').write_text("EXISTING_MODULE_DATA\n")
 os.chmod(mod / 'target.txt', 0o666)
@@ -127,8 +103,6 @@ def positive_control():
     test_fail(f"3b inplace+backup-dir=cd: rsync died from a signal (rc={rc})")
 verify_outside_unchanged("3b inplace+backup-dir=cd")
 
-
-# Scenario 3c-symlink: fake-super symlink push, parent-symlinked path
 setup()
 (src / 'cd').mkdir()
 os.symlink('/etc/passwd', src / 'cd' / 'sym')
@@ -138,8 +112,6 @@ def positive_control():
     test_fail(f"3c-symlink: rsync died from a signal (rc={rc})")
 verify_outside_unchanged_or_absent("3c-symlink fake-super symlink push", "sym")
 
-
-# Scenario 3c-mknod: fake-super FIFO push, parent-symlinked path
 setup()
 (src / 'cd').mkdir()
 try:
diff --git a/testsuite/tests/path/basis-xname-traversal.py b/testsuite/tests/path/basis-xname-traversal.py
new file mode 100644
index 000000000..6af5aebd2
--- /dev/null
+++ b/testsuite/tests/path/basis-xname-traversal.py
@@ -0,0 +1,99 @@
+#!/usr/bin/env python3
+
+import os
+import shlex
+import subprocess
+
+from harness.rsync import (
+    SCRATCHDIR, build_patched_rsync, forced_protocol, makepath, rmtree,
+    rsync_argv_for, test_fail, test_skipped, write_daemon_conf,
+)
+
+_proto = forced_protocol()
+if _proto is not None and _proto < 29:
+    test_skipped("basis-xname-traversal: xname/item flags need protocol >= 29")
+PATCH_OLD = ("\t\twrite_ndx_and_attrs(f_out, ndx, iflags, fname, file, fnamecmp_type, xname, xlen);\n"
+             "\t\twrite_sum_head(f_xfer, s);")
+PATCH_NEW = ("\t\tif (getenv(\"RSYNC_MAL_XNAME\")) { /* basis-xname-traversal PoC */\n"
+             "\t\t\tiflags |= ITEM_XNAME_FOLLOWS | ITEM_BASIS_TYPE_FOLLOWS;\n"
+             "\t\t\tfnamecmp_type = FNAMECMP_FUZZY + 1;\n"
+             "\t\t\txlen = strlcpy(xname, getenv(\"RSYNC_MAL_XNAME\"), MAXPATHLEN);\n"
+             "\t\t}\n"
+             "\t\twrite_ndx_and_attrs(f_out, ndx, iflags, fname, file, fnamecmp_type, xname, xlen);\n"
+             "\t\twrite_sum_head(f_xfer, s);")
+TRACE_OLD = ("static int secure_basis_open(const char *basedir, const char *relpath, int flags, mode_t mode)\n"
+             "{\n"
+             "\textern int am_daemon, am_chrooted;")
+TRACE_NEW = ("static int secure_basis_open(const char *basedir, const char *relpath, int flags, mode_t mode)\n"
+             "{\n"
+             "\tconst char *trace_path = getenv(\"RSYNC_BASIS_TRACE\");\n"
+             "\tif (trace_path) {\n"
+             "\t\tFILE *trace = fopen(trace_path, \"a\");\n"
+             "\t\tif (trace) {\n"
+             "\t\t\tfprintf(trace, \"%s\\t%s\\n\", basedir ? basedir : \"\", relpath);\n"
+             "\t\t\tfclose(trace);\n"
+             "\t\t}\n"
+             "\t}\n"
+             "\textern int am_daemon, am_chrooted;")
+mal_rsync = build_patched_rsync(
+    'mal-xname-rsync',
+    [('sender.c', PATCH_OLD, PATCH_NEW),
+     ('receiver.c', TRACE_OLD, TRACE_NEW)],
+)
+
+base = SCRATCHDIR / 'xname-race'
+rmtree(base)
+serversrc = base / 'serversrc'
+linkdest = base / 'linkdest'
+dest = base / 'dest'
+escape = base / 'secret'
+decoy = linkdest / 'secret'
+trace_file = base / 'basis.trace'
+makepath(serversrc)
+makepath(linkdest)
+makepath(dest)
+(serversrc / 'file').write_text("from the server\n")
+escape.write_text("escaped basis\n")
+decoy.write_text("confined basis\n")
+
+conf = write_daemon_conf(
+    [('m', {'path': str(serversrc), 'read only': 'yes', 'use chroot': 'no'})],
+    name='mal-xname-rsyncd.conf')
+os.environ['RSYNC_CONNECT_PROG'] = f'{shlex.quote(str(mal_rsync))} --config={shlex.quote(str(conf))} --daemon'
+os.environ['RSYNC_MAL_XNAME'] = '../secret'
+os.environ['RSYNC_BASIS_TRACE'] = str(trace_file)
+try:
+    argv = rsync_argv_for(mal_rsync, '-a', f'--link-dest={linkdest}',
+                          'rsync://localhost/m/file', str(dest) + '/')
+    proc = subprocess.run(
+        argv,
+        stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True, timeout=120)
+finally:
+    os.environ.pop('RSYNC_BASIS_TRACE', None)
+    os.environ.pop('RSYNC_MAL_XNAME', None)
+    os.environ.pop('RSYNC_CONNECT_PROG', None)
+
+out_tail = '\n'.join(proc.stdout.splitlines()[-20:])
+trace = trace_file.read_text().splitlines() if trace_file.is_file() else []
+escaped = f'{linkdest}\t../secret'
+confined = f'{linkdest}\tsecret'
+
+if escaped in trace:
+    test_fail(
+        f"server-supplied alt-dest name escaped to {escape}\n{out_tail}")
+
+if confined not in trace:
+    test_fail(
+        "the crafted xname never reached the receiver's confined basis open; "
+        "the instrumented injection did not take effect, so this run is "
+        f"vacuous. Trace={trace!r}. Receiver rc={proc.returncode}. "
+        f"Output tail:\n{out_tail}")
+
+if proc.returncode != 0:
+    test_fail(
+        f"xname confined to the basedir, but the pull failed (rc={proc.returncode}).  "
+        f"Output tail:\n{out_tail}")
+
+print("basis-xname-traversal: receiver confined the server-supplied alt-dest "
+      "xname to the --link-dest dir; '../secret' resolved to linkdest/secret, "
+      "not the out-of-tree sibling.")
diff --git a/testsuite/tests/path/batch-file-symlink.py b/testsuite/tests/path/batch-file-symlink.py
new file mode 100644
index 000000000..631e70fbc
--- /dev/null
+++ b/testsuite/tests/path/batch-file-symlink.py
@@ -0,0 +1,127 @@
+#!/usr/bin/env python3
+
+import os
+import pwd
+import stat
+import subprocess
+
+from harness.rsync import SCRATCHDIR, rmtree, rsync_argv, test_fail, test_skipped
+
+if os.geteuid() != 0:
+    test_skipped("requires root to plant a symlink owned by a non-self uid "
+                 "(the attacker simulation)", capability='cross_uid')
+
+NOBODY_UID = None
+for name in ('nobody', 'nfsnobody', 'daemon'):
+    try:
+        u = pwd.getpwnam(name).pw_uid
+        if u != 0 and u != os.geteuid():
+            NOBODY_UID = u
+            break
+    except KeyError:
+        continue
+if NOBODY_UID is None:
+    test_skipped("no untrusted-uid user available for cross-uid plant", capability='cross_uid')
+
+base = SCRATCHDIR / 'batch'
+src = base / 'src'
+dest = base / 'dest'
+plants = base / 'plants'
+
+rmtree(base)
+src.mkdir(parents=True)
+(src / 'f').write_text("payload\n")
+dest.mkdir(parents=True)
+plants.mkdir(parents=True)
+
+def run_write_batch(batch_plant_path):
+    rmtree(dest)
+    dest.mkdir(parents=True)
+    return subprocess.run(
+        rsync_argv('-a', '--write-batch=' + str(batch_plant_path),
+                   f'{src}/', f'{dest}/'),
+        stdout=subprocess.DEVNULL, stderr=subprocess.PIPE, text=True)
+
+victim = plants / 'sentinel_leaf'
+INITIAL_BYTES = b"VICTIM_INITIAL_CONTENTS\n"
+victim.write_bytes(INITIAL_BYTES)
+os.chmod(victim, 0o600)
+
+leaf_plant = plants / 'write_batch_leaf'
+os.symlink(victim, leaf_plant)
+os.lchown(leaf_plant, NOBODY_UID, NOBODY_UID)
+
+run_write_batch(leaf_plant)
+
+leaf_after = victim.read_bytes()
+if leaf_after != INITIAL_BYTES:
+    test_fail(
+        f'--write-batch replaced {victim} through untrusted uid {NOBODY_UID} '
+        f'symlink: {len(INITIAL_BYTES)} bytes became {len(leaf_after)}')
+
+real_target = plants / 'parent_real_target'
+real_target.mkdir()
+
+parent_plant = plants / 'parent_link'
+os.symlink(real_target, parent_plant)
+os.lchown(parent_plant, NOBODY_UID, NOBODY_UID)
+
+run_write_batch(parent_plant / 'batchfile')
+
+created = sorted(p.name for p in real_target.iterdir())
+if created:
+    test_fail(
+        f'--write-batch traversed untrusted uid {NOBODY_UID} parent symlink '
+        f'{parent_plant} -> {real_target} and created {created}')
+
+legit_src = base / 'rb_src'
+legit_src.mkdir()
+(legit_src / 'rb_canary').write_bytes(b'AUDIT_READ_BATCH_LEAK_PAYLOAD')
+
+legit_batch_dir = base / 'rb_legit_batch'
+legit_batch_dir.mkdir()
+legit_batch = legit_batch_dir / 'batch'
+subprocess.run(
+    rsync_argv('-a', f'--write-batch={legit_batch}',
+               f'{legit_src}/', f'{dest}/rb_setup_unused/'),
+    stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
+
+rb_dest = base / 'rb_dest'
+rmtree(rb_dest)
+rb_dest.mkdir()
+rb_leaf_plant = plants / 'read_batch_leaf'
+os.symlink(legit_batch, rb_leaf_plant)
+os.lchown(rb_leaf_plant, NOBODY_UID, NOBODY_UID)
+
+subprocess.run(
+    rsync_argv('-a', f'--read-batch={rb_leaf_plant}', str(rb_dest) + '/'),
+    stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
+
+if (rb_dest / 'rb_canary').exists():
+    test_fail(
+        f'--read-batch replayed data through untrusted uid {NOBODY_UID} '
+        f'symlink and created {rb_dest}/rb_canary')
+
+rb_dev = plants / 'read_batch_dev'
+try:
+    os.mknod(rb_dev, 0o600 | stat.S_IFCHR, os.stat('/dev/null').st_rdev)
+except OSError as e:
+    test_skipped(
+        f"cannot mknod a char device for S_ISREG sub-test ({e}); "
+        "likely no CAP_MKNOD or the filesystem disallows devnodes")
+
+rb_dev_dest = base / 'rb_dev_dest'
+rmtree(rb_dev_dest)
+rb_dev_dest.mkdir()
+proc = subprocess.run(
+    rsync_argv('-a', f'--read-batch={rb_dev}', str(rb_dev_dest) + '/'),
+    stdout=subprocess.DEVNULL, stderr=subprocess.PIPE, text=True)
+
+refused = ('is neither a regular file nor a FIFO' in proc.stderr
+           or ('open error' in proc.stderr and proc.returncode != 0))
+if not refused:
+    test_fail(
+        f"--read-batch did not refuse a non-regular batch path (char device at "
+        f"{rb_dev}). rsync returncode {proc.returncode}, stderr: "
+        f"{proc.stderr!r}. Fix: after the safe open, fstat() the fd and "
+        "refuse !S_ISREG.")
diff --git a/testsuite/chdir-symlink-race_test.py b/testsuite/tests/path/chdir-symlink-race.py
similarity index 64%
rename from testsuite/chdir-symlink-race_test.py
rename to testsuite/tests/path/chdir-symlink-race.py
index 01cb3f37f..d19fb5456 100644
--- a/testsuite/chdir-symlink-race_test.py
+++ b/testsuite/tests/path/chdir-symlink-race.py
@@ -1,23 +1,14 @@
 #!/usr/bin/env python3
-# Python rewrite of testsuite/chdir-symlink-race.test.
-#
-# Regression test for the symlink-TOCTOU bug at the receiver's chdir().
-# Post-CVE-2026-29518 an attack remained where the receiver's chdir()
-# into a destination subdirectory followed an attacker-planted symlink,
-# escaping the module. Each of four transfer flavours must leave the
-# outside-the-module sentinel's mode AND content unchanged.
 
 import filecmp
 import os
+import shutil
 import subprocess
 
-from rsyncfns import (
-    SCRATCHDIR,
-    get_rootgid, get_rootuid, get_testuid,
-    make_data_file, rmtree, rsync_argv, start_test_daemon,
-    test_fail,
-)
+from harness.rsync import SCRATCHDIR, make_data_file, rmtree, rsync_argv, start_test_daemon, test_fail
+from harness import metadata
 
+metadata(features={'daemon', 'symlink'}, transports={'pipe', 'tcp'}, min_peer='2.6.0', cost='expensive', mutates={'filesystem', 'process', 'socket'}, tags={'daemon', 'security', 'version-mix'})
 
 DAEMON_PORT = 12885
 
@@ -31,17 +22,13 @@
     d.mkdir(parents=True)
 (src / 'subdir').mkdir()
 
-# Secret sentinel; keep a pristine copy alongside for cmp(1)-style compares.
 (outside / 'target.txt').write_text("OUTSIDE_SECRET_DATA\n")
 os.chmod(outside / 'target.txt', 0o600)
 outside_pristine = SCRATCHDIR / 'outside-pristine.txt'
-import shutil
 shutil.copy2(outside / 'target.txt', outside_pristine)
 
-# Symlink trap planted by the local attacker.
 os.symlink(str(outside), mod / 'subdir')
 
-# Source files: same size as outside target, different content, mode 0666.
 sz = (outside / 'target.txt').stat().st_size
 make_data_file(src / 'target.txt', sz)
 make_data_file(src / 'subdir' / 'target.txt', sz)
@@ -57,13 +44,11 @@
     read only = no
 """)
 
-
 def reset_outside() -> None:
     os.chmod(outside / 'target.txt', 0o600)
     (outside / 'target.txt').write_text("OUTSIDE_SECRET_DATA\n")
     os.chmod(outside / 'target.txt', 0o600)
 
-
 def verify_unchanged(label: str) -> None:
     mode = (outside / 'target.txt').stat().st_mode & 0o777
     if mode != 0o600:
@@ -74,10 +59,8 @@ def verify_unchanged(label: str) -> None:
     if not filecmp.cmp(outside / 'target.txt', outside_pristine, shallow=False):
         test_fail(f"{label}: outside file content changed (write escape)")
 
-
 url = start_test_daemon(conf, DAEMON_PORT)
 
-
 def run_attack(label: str, *args) -> None:
     reset_outside()
     rc = subprocess.run(
@@ -88,18 +71,10 @@ def run_attack(label: str, *args) -> None:
         test_fail(f"{label}: rsync died from a signal (rc={rc})")
     verify_unchanged(label)
 
-
 def positive_control() -> None:
-    """Confirm the receiver writes into an ordinary in-module subdirectory, so
-    the symlink-escape scenarios below genuinely exercise the chdir path rather
-    than passing because the daemon refused (or failed) before reaching it."""
     real = mod / 'realdir'
     rmtree(real)
     real.mkdir()
-    # When this test runs as root the daemon serves as 'nobody' (the module
-    # sets no uid), so make the control target world-writable; push a single
-    # file with no attribute preservation so the write never needs to own/chmod
-    # the dir -- it should land purely on the receiver's normal write path.
     os.chmod(real, 0o777)
     rc = subprocess.run(
         rsync_argv(f'{src}/subdir/target.txt', f'{url}upload/realdir/'),
@@ -111,32 +86,23 @@ def positive_control() -> None:
         test_fail(f"positive control: receiver did not write into an ordinary "
                   f"in-module subdir (rc={rc}); attack scenarios would be vacuous")
 
-
 positive_control()
 
-
-# 1. Single file with --size-only -- receiver normally skips basis open and
-# goes straight to chmod; only the chdir-escape blocks it.
 run_attack("single-file --size-only",
            '-tp', '--size-only',
            f'{src}/target.txt',
            f'{url}upload/subdir/target.txt')
 
-# 2. -r push INTO the symlinked subdir -- receiver chdir's into "subdir",
-# follows the symlink, ends up in outside.
 run_attack("-r --size-only into subdir/",
            '-rtp', '--size-only',
            f'{src}/subdir/',
            f'{url}upload/subdir/')
 
-# 3. Same but with delta+rename (read-disclosure + write-escape together).
 run_attack("-r without --size-only into subdir/",
            '-rtp',
            f'{src}/subdir/',
            f'{url}upload/subdir/')
 
-# 4. -r into the module root -- already covered by the original CVE fix;
-# regression-check.
 run_attack("-r --size-only into upload/ root",
            '-rtp', '--size-only',
            f'{src}/',
diff --git a/testsuite/clean-fname-collapse_test.py b/testsuite/tests/path/clean-fname-collapse.py
similarity index 61%
rename from testsuite/clean-fname-collapse_test.py
rename to testsuite/tests/path/clean-fname-collapse.py
index b9dd72f35..f4578ca11 100644
--- a/testsuite/clean-fname-collapse_test.py
+++ b/testsuite/tests/path/clean-fname-collapse.py
@@ -1,12 +1,8 @@
 #!/usr/bin/env python3
-# Regression test for KI-50: clean_fname(name, CFN_COLLAPSE_DOT_DOT_DIRS) must
-# collapse ".." components.  An off-by-one (*s=='/' should be s[-1]=='/'; s+1
-# should be s) left the collapse dead for every multi-component/absolute path.
-# The t_clean_fname helper links the real util1.o and checks the collapse.
 
 import subprocess
 
-from rsyncfns import TOOLDIR, test_fail, test_skipped
+from harness.rsync import TOOLDIR, test_fail, test_skipped
 
 helper = TOOLDIR / 't_clean_fname'
 if not helper.is_file():
diff --git a/testsuite/tests/path/clean-fname-underflow.py b/testsuite/tests/path/clean-fname-underflow.py
new file mode 100644
index 000000000..7c93c08fd
--- /dev/null
+++ b/testsuite/tests/path/clean-fname-underflow.py
@@ -0,0 +1,24 @@
+#!/usr/bin/env python3
+
+import os
+import subprocess
+
+from harness.rsync import TMPDIR, rsync_argv, test_fail
+
+workdir = TMPDIR / 'workdir'
+(workdir / 'mod').mkdir(parents=True, exist_ok=True)
+os.chdir(workdir)
+
+proc = subprocess.run(
+    rsync_argv('--server', '--sender', '-vlr',
+               '--filter=merge a/../test', '.', 'mod/'),
+    stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL,
+)
+
+if proc.returncode >= 128:
+    test_fail(f"rsync exited due to a signal (status={proc.returncode})")
+if proc.returncode == 0:
+    test_fail("rsync accepted the bogus 'a/../test' merge filter (expected a "
+              "non-zero rejection); clean_fname() may have mis-collapsed it")
+
+print("OK: clean_fname() handled 'a/../test' without crashing, and rejected it")
diff --git a/testsuite/copy-dest-symlink-readleak_test.py b/testsuite/tests/path/copy-dest-symlink-read-leak.py
similarity index 59%
rename from testsuite/copy-dest-symlink-readleak_test.py
rename to testsuite/tests/path/copy-dest-symlink-read-leak.py
index 654f8a9bf..ebe744fc6 100644
--- a/testsuite/copy-dest-symlink-readleak_test.py
+++ b/testsuite/tests/path/copy-dest-symlink-read-leak.py
@@ -1,48 +1,32 @@
 #!/usr/bin/env python3
-# --copy-dest parent-component symlink-race: out-of-tree basis read-leak.
-#
-# With --copy-dest, rsync stats the alt-dest basis and, on an exact match, copies
-# it into the destination instead of transferring.  basis_link_stat() refuses a
-# foreign-owned basis symlink at stat time, but copy_file() opened an ABSOLUTE
-# basis with bare do_open_nofollow (leaf-only -- parents followed).  A non-root
-# attacker who flips a basis parent between a real dir and a foreign-owned symlink
-# -> outside wins the window between the stat and the open: the copy then reads an
-# out-of-tree file and writes its content into the destination (an attacker can
-# read a root-readable file's content into a place they control).
-#
-# The fix re-resolves an absolute source's parents through the ownership walk in
-# copy_file(), refusing the flipped foreign parent at open time.  RED on stock
-# 3.4.x / --insecure-links, GREEN here.  Root+nobody gated.
 
 import os
 import subprocess
 import time
 
-from rsyncfns import (
-    SCRATCHDIR, race_budget, find_attacker_uid,
-    rmtree, rsync_argv, start_c_flipper, stop_flipper, test_fail, test_skipped,
-)
+from harness.mutation import find_attacker_uid, race_budget, start_c_flipper, stop_flipper
+from harness.rsync import SCRATCHDIR, rmtree, rsync_argv, test_fail, test_skipped
 
 if os.geteuid() != 0:
-    test_skipped("requires root to plant a copy-dest symlink owned by a non-self uid")
+    test_skipped("requires root to plant a copy-dest symlink owned by a non-self uid",
+                 capability='cross_uid')
 ATT_UID = find_attacker_uid()
 if ATT_UID is None:
-    test_skipped("no untrusted-uid user available for cross-uid plant")
+    test_skipped("no untrusted-uid user available for cross-uid plant", capability='cross_uid')
 
 NFILES = 60
-PINNED = 1000000000   # identical mtime so the basis is an exact match
+PINNED = 1000000000
 
 base = SCRATCHDIR / 'copydest-readleak'
 src = base / 'src'
 dest = base / 'dest'
 cdroot = base / 'cdroot'
-cd = cdroot / 'cd'            # the basis dir the attacker flips
-cdlink = cdroot / '.cdlink'   # symlink -> outside, swapped in for cd
+cd = cdroot / 'cd'
+cdlink = cdroot / '.cdlink'
 outside = base / 'outside'
 
 SECRET = 'OUT-OF-TREE-SECRET\n'
 
-
 def build():
     rmtree(base)
     for d in (src, dest, cdroot, outside):
@@ -50,20 +34,18 @@ def build():
     cd.mkdir()
     for i in range(NFILES):
         (src / f'f{i}').write_text('SRC\n')
-        (cd / f'f{i}').write_text('BAS\n')          # in-tree basis (exact match)
-        (outside / f'f{i}').write_text(SECRET)        # out-of-tree content to leak
+        (cd / f'f{i}').write_text('BAS\n')
+        (outside / f'f{i}').write_text(SECRET)
         for p in (src / f'f{i}', cd / f'f{i}', outside / f'f{i}'):
             os.utime(p, (PINNED, PINNED))
     os.symlink(str(outside), cdlink)
     os.lchown(cdlink, ATT_UID, ATT_UID)
 
-
 def push():
     return subprocess.run(
         rsync_argv('-rt', f'--copy-dest={cd}', f'{src}/', f'{dest}/'),
         stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True)
 
-
 def leaked():
     for i in range(NFILES):
         try:
@@ -73,8 +55,6 @@ def leaked():
             pass
     return None
 
-
-# Positive control: a clean push with cd a real dir copies the in-tree basis.
 build()
 proc = push()
 if proc.returncode != 0:
@@ -106,5 +86,3 @@ def leaked():
                 "flipped foreign-owned --copy-dest parent symlink (read-leak).")
 finally:
     stop_flipper(flip)
-
-# No read-leak within the race budget.
diff --git a/testsuite/tests/path/copy-xattrs-symlink-race.py b/testsuite/tests/path/copy-xattrs-symlink-race.py
new file mode 100644
index 000000000..adefc7a1f
--- /dev/null
+++ b/testsuite/tests/path/copy-xattrs-symlink-race.py
@@ -0,0 +1,116 @@
+#!/usr/bin/env python3
+
+import os
+import platform
+import subprocess
+import time
+
+from harness.mutation import race_budget
+from harness.rsync import (
+    SCRATCHDIR, rmtree, rsync_argv, test_fail, test_skipped, xattr_set, xattrs_supported,
+)
+
+MARKER = 'user.marker'
+N = 120
+
+if platform.system() != 'Linux':
+    test_skipped("parent-flip xattr race is checked on Linux (os.*xattr)",
+                 capability='linux_xattr')
+if not xattrs_supported():
+    test_skipped("rsync built without xattr support (or no xattr tooling)", capability='xattr')
+
+base = SCRATCHDIR / 'copy-xattrs-race'
+src = base / 'src'
+cdbasis = base / 'cdbasis'
+dest = base / 'dest'
+outside = base / 'outside'
+DEEP = '/'.join(['d'] * 70)
+
+rmtree(base)
+(src / DEEP / 'sub').mkdir(parents=True)
+(cdbasis / DEEP / 'sub').mkdir(parents=True)
+(dest / DEEP).mkdir(parents=True)
+outside.mkdir()
+
+payload = ('x' * 4096 + '\n') * 16
+try:
+    for i in range(N):
+        s = src / DEEP / 'sub' / f'f{i}'
+        b = cdbasis / DEEP / 'sub' / f'f{i}'
+        s.write_text(payload)
+        b.write_text(payload)
+        os.chmod(s, 0o644)
+        os.chmod(b, 0o644)
+        st = s.stat()
+        os.utime(b, (st.st_atime, st.st_mtime))
+        xattr_set('marker', 'PWNED', s, b)
+        (outside / f'f{i}').write_text('')
+except OSError as e:
+        test_skipped(f"filesystem does not support user xattrs ({e})", capability='xattr')
+
+sub = dest / DEEP / 'sub'
+link = dest / DEEP / '.sublink'
+link.symlink_to(outside)
+
+def push():
+    subprocess.run(
+        rsync_argv('-rtpX', '--inplace', f'--copy-dest={cdbasis}',
+                   f'{src}/', f'{dest}/'),
+        stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL,
+    )
+
+def outside_marked():
+    return sorted(p.name for p in outside.iterdir()
+                  if p.is_file() and not p.is_symlink()
+                  and MARKER in os.listxattr(str(p)))
+
+rmtree(sub)
+sub.mkdir()
+push()
+if MARKER not in os.listxattr(str(sub / 'f0')):
+    test_fail("positive control: a normal --copy-dest -X push did not copy the "
+              "basis marker xattr into dest/sub/f0, so the copy_xattrs race "
+              "window would be vacuous")
+for i in range(N):
+    try:
+        os.removexattr(str(outside / f'f{i}'), MARKER)
+    except OSError:
+        pass
+
+flip_code = (
+    "import os, sys, time\n"
+    "sub, link = sys.argv[1], sys.argv[2]\n"
+    "scratch = sub + '.flip'\n"
+    "parent = os.getppid()\n"
+    "deadline = time.time() + 120\n"
+    "while time.time() < deadline and os.getppid() == parent:\n"
+    "    try:\n"
+    "        os.makedirs(sub, exist_ok=True)\n"
+    "        os.rename(sub, scratch); os.rename(link, sub); os.rename(scratch, link)\n"
+    "        os.rename(sub, scratch); os.rename(link, sub); os.rename(scratch, link)\n"
+    "    except OSError:\n"
+    "        pass\n"
+)
+flip = subprocess.Popen(['python3', '-c', flip_code, str(sub), str(link)])
+try:
+    deadline = time.monotonic() + race_budget(10.0)
+    while time.monotonic() < deadline:
+        rmtree(sub)
+        try:
+            sub.unlink()
+        except OSError:
+            pass
+        push()
+        marked = outside_marked()
+        if marked:
+            test_fail(
+                "metadata xattr parent-symlink race: the attacker-chosen marker "
+                f"xattr was written onto files OUTSIDE the destination tree "
+                f"({marked}) -- a confined receiver's set_file_attrs() fell back to "
+                "a path-based lsetxattr and followed a flipped dest/sub symlink.")
+finally:
+    flip.terminate()
+    try:
+        flip.wait(timeout=5)
+    except subprocess.TimeoutExpired:
+        flip.kill()
diff --git a/testsuite/tests/path/deep-path.py b/testsuite/tests/path/deep-path.py
new file mode 100644
index 000000000..e526a0875
--- /dev/null
+++ b/testsuite/tests/path/deep-path.py
@@ -0,0 +1,38 @@
+#!/usr/bin/env python3
+
+from harness.rsync import (
+    SCRATCHDIR, checkit, make_tree, rmtree, start_test_daemon, test_fail,
+    test_skipped, walk_files, write_daemon_conf,
+)
+
+DEPTH = 70
+DAEMON_PORT = 12905
+
+base = SCRATCHDIR / 'deep-path'
+src = base / 'src'
+rmtree(base)
+
+try:
+    make_tree(src, depth=DEPTH, data=True)
+except OSError as e:
+    test_skipped(f"cannot build a {DEPTH}-deep tree ({e})")
+
+deepest = max(walk_files(src), key=lambda p: len(p.relative_to(src).parts))
+parent_components = len(deepest.relative_to(src).parts) - 1
+if parent_components <= 64:
+    test_fail(f"deep tree only {parent_components} components deep -- "
+              "does not cross DPC_MAXDEPTH (64); test is ineffective")
+
+dest = base / 'dest'
+checkit(['-a', f'{src}/', str(dest)], src, dest)
+
+mod = base / 'module'
+mod.mkdir(parents=True, exist_ok=True)
+conf = write_daemon_conf([
+    ('deep', {'path': str(mod), 'use chroot': 'no', 'read only': 'no'}),
+])
+daemon_url = start_test_daemon(conf, DAEMON_PORT).rstrip('/')
+checkit(['-a', f'{src}/', f'{daemon_url}/deep/'], src, mod, allowed_codes=(0, 23))
+
+print(f"deep-path: {DEPTH}-deep tree round-trips past the dir-fd cache cap "
+      "(local + daemon)")
diff --git a/testsuite/tests/path/dest-symlinked-dir.py b/testsuite/tests/path/dest-symlinked-dir.py
new file mode 100644
index 000000000..83b99d494
--- /dev/null
+++ b/testsuite/tests/path/dest-symlinked-dir.py
@@ -0,0 +1,28 @@
+#!/usr/bin/env python3
+
+import os
+
+from harness.rsync import SCRATCHDIR, assert_same, rmtree, run_rsync, test_fail
+
+base = SCRATCHDIR / 'dest-symlinked'
+src = base / 'src'
+real = base / 'realdest'
+link = base / 'backup'
+rmtree(base)
+src.mkdir(parents=True)
+real.mkdir(parents=True)
+(src / 'f.txt').write_text('content\n')
+(src / 'sub').mkdir()
+(src / 'sub' / 'g.txt').write_text('deep\n')
+os.symlink(str(real), str(link))
+
+run_rsync('-a', f'{src}/', f'{link}/')
+
+for rel in ('f.txt', 'sub/g.txt'):
+    got = real / rel
+    if not got.is_file():
+        test_fail("transfer through an absolute symlinked dest did not land in "
+                  f"the real directory: {got} missing")
+    assert_same(src / rel, got, label=rel)
+
+print("dest-symlinked-dir: a non-daemon receiver follows an absolute symlinked dest")
diff --git a/testsuite/early-input-symlink_test.py b/testsuite/tests/path/early-input-symlink.py
similarity index 52%
rename from testsuite/early-input-symlink_test.py
rename to testsuite/tests/path/early-input-symlink.py
index 65fb0fbf5..92462b4a6 100644
--- a/testsuite/early-input-symlink_test.py
+++ b/testsuite/tests/path/early-input-symlink.py
@@ -1,25 +1,4 @@
 #!/usr/bin/env python3
-# Client --early-input=PATH must not follow planted symlinks at attacker-
-# controlled path components.
-#
-# --early-input is an operator-supplied input file on the CLIENT: rsync reads it
-# during the in-band daemon handshake (clientserver.c start_inband_exchange) and
-# forwards its bytes to the daemon, which feeds them to the module's "early exec"
-# hook on stdin. A symlink planted at the path (or a parent component) by another
-# uid redirects the read to an attacker-chosen file, whose contents are then sent
-# on the wire to (a possibly malicious) daemon -- a content-disclosure primitive,
-# the same class as --password-file (item-1 companion).
-#
-# Leak signal: the daemon's "early exec" hook captures its stdin to a file. The
-# planted symlink points at a victim file containing a unique marker. If the
-# client follows the symlink, the marker reaches the daemon and lands in the
-# capture -> leak observed. With the fix the open is refused ("failed to open"),
-# the handshake aborts before the module request, and the marker never appears.
-#
-# Both leaf and parent-component variants are exercised.
-#
-# Requires root (to lchown the planted symlink to a non-self uid -- the attacker
-# simulation); skips otherwise.
 
 import os
 import shlex
@@ -27,19 +6,25 @@
 import subprocess
 import time
 
-from rsyncfns import (
-    FROMDIR, SCRATCHDIR, make_tree, makepath, rmtree, rsync_argv,
-    start_test_daemon, test_fail, test_skipped, write_daemon_conf,
+from harness.rsync import (
+    FROMDIR,
+    SCRATCHDIR,
+    make_tree,
+    rmtree,
+    rsync_argv,
+    start_test_daemon,
+    test_fail,
+    test_skipped,
+    write_daemon_conf,
 )
 
 DAEMON_PORT = 12904
 SANITY_MARKER = "EARLY_INPUT_SANITY_DELIVERED"
 LEAK_MARKER = "EARLY_INPUT_LEAK_MARKER_DO_NOT_DISCLOSE"
 
-
 if os.geteuid() != 0:
     test_skipped("requires root to plant a symlink owned by a non-self uid "
-                 "(the attacker simulation)")
+                 "(the attacker simulation)", capability='cross_uid')
 
 NOBODY_UID = None
 for name in ('nobody', 'nfsnobody', 'daemon'):
@@ -51,7 +36,7 @@
     except KeyError:
         continue
 if NOBODY_UID is None:
-    test_skipped("no untrusted-uid user available for cross-uid plant")
+    test_skipped("no untrusted-uid user available for cross-uid plant", capability='cross_uid')
 
 src = FROMDIR
 rmtree(src)
@@ -63,8 +48,6 @@
 moddir = base / 'mod'
 moddir.mkdir()
 
-# The "early exec" hook records its stdin (which carries the forwarded early
-# input after the NUL-terminated arg list) to a capture file we can inspect.
 capture = base / 'early_capture'
 hook = base / 'earlyhook.sh'
 hook.write_text(f'#!/bin/sh\ncat > {shlex.quote(str(capture))} 2>/dev/null\nexit 0\n')
@@ -75,16 +58,13 @@
 ])
 url = start_test_daemon(conf, DAEMON_PORT)
 
-
 def list_with_early_input(path):
-    """List the module with --early-input=path; return the CompletedProcess."""
     if capture.exists():
         capture.unlink()
     return subprocess.run(
         rsync_argv('--early-input=' + str(path), f'{url}mod/'),
         stdout=subprocess.DEVNULL, stderr=subprocess.PIPE, text=True)
 
-
 def captured_contains(marker, secs=5):
     deadline = time.monotonic() + secs
     while time.monotonic() < deadline:
@@ -97,8 +77,6 @@ def captured_contains(marker, secs=5):
         time.sleep(0.05)
     return False
 
-
-# Sanity: a real (non-symlinked) early-input file is delivered to the hook.
 real = base / 'real_early'
 real.write_text(SANITY_MARKER + '\n')
 real.chmod(0o600)
@@ -109,25 +87,19 @@ def captured_contains(marker, secs=5):
         "delivered to the daemon's early-exec hook; the test machinery is "
         f"broken. stderr/capture: {capture.read_text(errors='replace') if capture.exists() else '(none)'!r}")
 
-# The victim file the attacker wants the client to read and forward.
 victim = base / 'victim_early'
 victim.write_text(LEAK_MARKER + '\n')
 os.chmod(victim, 0o600)
 
-# Leaf plant.
 leaf_plant = base / 'early_leaf'
 os.symlink(victim, leaf_plant)
 os.lchown(leaf_plant, NOBODY_UID, NOBODY_UID)
 list_with_early_input(leaf_plant)
 if captured_contains(LEAK_MARKER, secs=2):
     test_fail(
-        f"--early-input followed a planted LEAF symlink (owned by uid "
-        f"{NOBODY_UID}): the client read {victim} via the symlink and forwarded "
-        f"its contents to the daemon, where the marker {LEAK_MARKER!r} landed in "
-        f"the early-exec hook's stdin. This is a content-disclosure primitive. "
-        f"Fix: refuse planted symlinks at the --early-input open.")
+        f'--early-input leaked {LEAK_MARKER!r} from {victim} through '
+        f'untrusted uid {NOBODY_UID} symlink')
 
-# Parent-component plant.
 parent_real = base / 'parent_real'
 parent_real.mkdir()
 (parent_real / 'victim_in_target').write_text(LEAK_MARKER + '\n')
@@ -138,11 +110,7 @@ def captured_contains(marker, secs=5):
 list_with_early_input(parent_plant / 'victim_in_target')
 if captured_contains(LEAK_MARKER, secs=2):
     test_fail(
-        f"--early-input followed a planted PARENT-component symlink (owned by "
-        f"uid {NOBODY_UID}): {parent_plant} -> {parent_real} was traversed and "
-        f"victim_in_target forwarded to the daemon ({LEAK_MARKER!r} in the "
-        f"early-exec capture). This is the /tmp/somedir/-class parent-flip case. "
-        f"Fix: per-component path walk refusing parent symlinks owned by "
-        f"untrusted uids.")
+        f'--early-input leaked {LEAK_MARKER!r} through untrusted uid '
+        f'{NOBODY_UID} parent symlink {parent_plant} -> {parent_real}')
 
 print("early-input-symlink: leaf + parent plants refused")
diff --git a/testsuite/tests/path/exclude-from-symlink.py b/testsuite/tests/path/exclude-from-symlink.py
new file mode 100644
index 000000000..a140d458b
--- /dev/null
+++ b/testsuite/tests/path/exclude-from-symlink.py
@@ -0,0 +1,76 @@
+#!/usr/bin/env python3
+
+import os
+import pwd
+import subprocess
+
+from harness.rsync import SCRATCHDIR, rmtree, rsync_argv, test_fail, test_skipped
+
+if os.geteuid() != 0:
+    test_skipped("requires root to plant a symlink owned by a non-self uid "
+                 "(the attacker simulation)", capability='cross_uid')
+
+NOBODY_UID = None
+for name in ('nobody', 'nfsnobody', 'daemon'):
+    try:
+        u = pwd.getpwnam(name).pw_uid
+        if u != 0 and u != os.geteuid():
+            NOBODY_UID = u
+            break
+    except KeyError:
+        continue
+if NOBODY_UID is None:
+    test_skipped("no untrusted-uid user available for cross-uid plant", capability='cross_uid')
+
+base = SCRATCHDIR / 'excludefrom'
+src = base / 'src'
+dest = base / 'dest'
+outside = base / 'outside'
+
+rmtree(base)
+src.mkdir(parents=True)
+(src / 'canary_file').write_text("would-be-transferred\n")
+(src / 'other_file').write_text("noise\n")
+dest.mkdir(parents=True)
+outside.mkdir(parents=True)
+
+(outside / 'exclude_list').write_text("canary_file\n")
+
+def run_excludefrom(plant_path):
+    rmtree(dest)
+    dest.mkdir(parents=True)
+    return subprocess.run(
+        rsync_argv('-a', '--exclude-from=' + str(plant_path),
+                   f'{src}/', f'{dest}/'),
+        stdout=subprocess.DEVNULL, stderr=subprocess.PIPE, text=True)
+
+plants = base / 'plants'
+plants.mkdir()
+
+leaf_plant = plants / 'exclude_leaf'
+os.symlink(outside / 'exclude_list', leaf_plant)
+os.lchown(leaf_plant, NOBODY_UID, NOBODY_UID)
+
+leaf = run_excludefrom(leaf_plant)
+canary = dest / 'canary_file'
+if leaf.returncode == 0 and not canary.exists():
+    test_fail(
+        f"--exclude-from followed a planted LEAF symlink (owned by uid "
+        f"{NOBODY_UID}): rsync read the symlink's target as filter rules and "
+        f"applied the leaked pattern, dropping src/canary_file from the "
+        f"transfer. Fix: refuse planted symlinks at --exclude-from.")
+
+real_target = plants / 'parent_real_target'
+real_target.mkdir()
+(real_target / 'exclude_list').write_text("canary_file\n")
+
+parent_plant = plants / 'parent_link'
+os.symlink(real_target, parent_plant)
+os.lchown(parent_plant, NOBODY_UID, NOBODY_UID)
+
+parent = run_excludefrom(parent_plant / 'exclude_list')
+canary = dest / 'canary_file'
+if parent.returncode == 0 and not canary.exists():
+    test_fail(
+        f'--exclude-from traversed untrusted uid {NOBODY_UID} parent symlink '
+        f'{parent_plant} -> {real_target} and excluded canary_file')
diff --git a/testsuite/file-to-file-mkpath-dry-run_test.py b/testsuite/tests/path/file-to-file-mkpath-dry-run.py
similarity index 52%
rename from testsuite/file-to-file-mkpath-dry-run_test.py
rename to testsuite/tests/path/file-to-file-mkpath-dry-run.py
index dd340b4b9..bd2c68dc1 100644
--- a/testsuite/file-to-file-mkpath-dry-run_test.py
+++ b/testsuite/tests/path/file-to-file-mkpath-dry-run.py
@@ -1,31 +1,14 @@
 #!/usr/bin/env python3
-# Regression test for issue #880 (and the dry-run itemize regression that the
-# first proposed fix, PR #952, would have introduced).
-#
-# (1) Copying file-to-file with --mkpath and --dry-run used to abort with
-#     "change_dir#3 ... failed", because make_path() only *reports* (does not
-#     create) directories in a dry run, so the later chdir found no parent.
-#
-# (2) The fix must stay scoped to the missing-parent case: a plain
-#     file-to-file --dry-run onto an *existing*, differing destination must
-#     still itemize the real change, not report the file as brand new (PR #952
-#     bumped dry_run unconditionally, which broke this).
-#
-# In both cases a "--dry-run -i" must produce the same itemized output as the
-# real run.  Based on the test from PR #952 by Stiliyan Tonev.
 
 import os
 import subprocess
 
-from rsyncfns import SCRATCHDIR, makepath, rmtree, rsync_argv, test_fail
-
+from harness.rsync import SCRATCHDIR, makepath, rmtree, rsync_argv, test_fail
 
 def itemize(*args):
     p = subprocess.run(rsync_argv('-ai', *args), capture_output=True, text=True)
     return p.returncode, p.stdout + p.stderr
 
-
-# (1) --mkpath file-to-file: the dry run must succeed and match the real run.
 mk = SCRATCHDIR / 'mk'
 rmtree(mk)
 makepath(mk / 'from')
@@ -43,9 +26,6 @@ def itemize(*args):
     test_fail(f"--mkpath dry-run output differs from the real run:\n"
               f" dry : {dry!r}\n real: {real!r}")
 
-# (2) Plain file-to-file onto an existing, differing destination: the dry run
-# must itemize the same change as the real run (a/dst and b/dst share the
-# basename 'dst', so the itemized lines are directly comparable).
 ex = SCRATCHDIR / 'ex'
 rmtree(ex)
 makepath(ex / 'a')
@@ -53,7 +33,7 @@ def itemize(*args):
 (ex / 'src').write_text("brand new content\n")
 for d in ('a', 'b'):
     (ex / d / 'dst').write_text("old\n")
-    os.utime(ex / d / 'dst', (0, 0))        # make size + mtime differ
+    os.utime(ex / d / 'dst', (0, 0))
 
 _, dry2 = itemize('--dry-run', str(ex / 'src'), str(ex / 'a' / 'dst'))
 _, real2 = itemize(str(ex / 'src'), str(ex / 'b' / 'dst'))
diff --git a/testsuite/tests/path/files-from-path-clamp.py b/testsuite/tests/path/files-from-path-clamp.py
new file mode 100644
index 000000000..39a2dd8da
--- /dev/null
+++ b/testsuite/tests/path/files-from-path-clamp.py
@@ -0,0 +1,44 @@
+#!/usr/bin/env python3
+
+import subprocess
+
+from harness.rsync import SCRATCHDIR, rmtree, rsync_argv, test_fail
+
+base = SCRATCHDIR / 'files-from-clamp'
+rmtree(base)
+base.mkdir(parents=True)
+
+src = base / 'src'
+src.mkdir()
+(src / 'file').write_text('INSRC-FILE\n')
+(src / 'keep').write_text('INSRC-KEEP\n')
+(base / 'keep').write_text('OUTSIDE-KEEP-MUST-NOT-APPEAR\n')
+
+listf = base / 'list'
+listf.write_text('/file\nkeep\n../keep\n')
+
+dst = base / 'dst'
+rmtree(dst)
+dst.mkdir()
+proc = subprocess.run(
+    rsync_argv('-a', f'--files-from={listf}', f'{src}/', f'{dst}/'),
+    stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
+
+f = dst / 'file'
+if not f.is_file() or f.read_text() != 'INSRC-FILE\n':
+    test_fail("--files-from: leading-slash '/file' was not transferred relative "
+              "to the source dir")
+
+k = dst / 'keep'
+if not k.is_file():
+    test_fail("--files-from: 'keep' did not transfer")
+if k.read_text() != 'INSRC-KEEP\n':
+    test_fail(f"--files-from: '../keep' escaped the source dir -- dst/keep is "
+              f"{k.read_text()!r}, expected the in-source 'INSRC-KEEP'")
+
+if (base / 'keep').read_text() != 'OUTSIDE-KEEP-MUST-NOT-APPEAR\n':
+    test_fail("--files-from: the outside 'keep' was modified")
+
+print("files-from-path-clamp: leading '/' stripped (entry taken relative to the "
+      "source); '..' is clamped within the source dir so '../keep' resolves to "
+      "<source>/keep and cannot reach a sibling of the source")
diff --git a/testsuite/tests/path/filter-merge-symlink.py b/testsuite/tests/path/filter-merge-symlink.py
new file mode 100644
index 000000000..bbda002ea
--- /dev/null
+++ b/testsuite/tests/path/filter-merge-symlink.py
@@ -0,0 +1,52 @@
+#!/usr/bin/env python3
+
+import os
+import pwd
+import subprocess
+
+from harness.rsync import SCRATCHDIR, rmtree, rsync_argv, test_fail, test_skipped
+
+if os.geteuid() != 0:
+    test_skipped("requires root to plant a symlink owned by a non-self uid "
+                 "(simulates the 'root runs `rsync -a /home /backup`' case)",
+                 capability='cross_uid')
+
+NOBODY_UID = None
+for name in ('nobody', 'nfsnobody', 'daemon'):
+    try:
+        u = pwd.getpwnam(name).pw_uid
+        if u != 0 and u != os.geteuid():
+            NOBODY_UID = u
+            break
+    except KeyError:
+        continue
+if NOBODY_UID is None:
+    test_skipped("no untrusted-uid user available for cross-uid plant", capability='cross_uid')
+
+base = SCRATCHDIR / 'filtermerge'
+src = base / 'src'
+dest = base / 'dest'
+outside = base / 'outside'
+
+rmtree(base)
+(src / 'sub').mkdir(parents=True)
+(src / 'sub' / 'canary_file').write_text("would-be-transferred\n")
+
+outside.mkdir(parents=True)
+(outside / 'attacker_target').write_text("canary_file\n")
+
+plant = src / 'sub' / '.cvsignore'
+os.symlink('../../outside/attacker_target', plant)
+os.lchown(plant, NOBODY_UID, NOBODY_UID)
+
+dest.mkdir(parents=True)
+
+subprocess.run(
+    rsync_argv('-aC', f'{src}/', f'{dest}/'),
+    stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
+
+if not (dest / 'sub' / 'canary_file').exists():
+    test_fail(
+        f'.cvsignore symlink owned by uid {NOBODY_UID} excluded '
+        'src/sub/canary_file through an outside target'
+    )
diff --git a/testsuite/tests/path/insecure-links-admin-optout.py b/testsuite/tests/path/insecure-links-admin-optout.py
new file mode 100644
index 000000000..8d362a85c
--- /dev/null
+++ b/testsuite/tests/path/insecure-links-admin-optout.py
@@ -0,0 +1,64 @@
+#!/usr/bin/env python3
+
+import os
+import subprocess
+
+from harness.mutation import find_attacker_uid
+from harness.rsync import (
+    SCRATCHDIR, rmtree, rsync_argv, rsync_supports, start_test_daemon, test_fail, test_skipped,
+    write_daemon_conf,
+)
+
+DAEMON_PORT = 12906
+MARKER = "OUT-OF-MODULE-SECRET\n"
+
+if os.geteuid() != 0:
+    test_skipped("requires root to plant a foreign-owned symlink and serve as root",
+                 capability='cross_uid')
+ATT = find_attacker_uid()
+if ATT is None:
+    test_skipped("no untrusted-uid user available for cross-uid plant", capability='cross_uid')
+if not rsync_supports('--copy-dirlinks'):
+    test_skipped("rsync lacks --copy-dirlinks")
+
+base = SCRATCHDIR / 'insecure-admin'
+rmtree(base)
+mod = base / 'mod'
+outside = base / 'outside'
+mod.mkdir(parents=True)
+outside.mkdir(parents=True)
+
+(mod / 'intree.txt').write_text("in-module\n")
+(outside / 'secret.txt').write_text(MARKER)
+os.symlink('../outside', mod / 'sub')
+os.lchown(mod / 'sub', ATT, ATT)
+
+conf = write_daemon_conf([
+    ('mod_secure', {'path': str(mod), 'use chroot': 'no', 'read only': 'yes',
+                    'uid': '0', 'gid': '0'}),
+    ('mod_insecure', {'path': str(mod), 'use chroot': 'no', 'read only': 'yes',
+                      'uid': '0', 'gid': '0', 'insecure links': 'yes'}),
+])
+url = start_test_daemon(conf, DAEMON_PORT)
+
+def pull(modname):
+    out = base / f'dest_{modname}'
+    rmtree(out)
+    out.mkdir()
+    subprocess.run(
+        rsync_argv('-r', '--copy-dirlinks', f'{url}{modname}/', f'{out}/'),
+        stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
+    served = out / 'sub' / 'secret.txt'
+    return served.is_file() and served.read_text() == MARKER
+
+if pull('mod_secure'):
+    test_fail("mod_secure served the out-of-module file through the planted "
+              "directory symlink: the daemon followed it without `insecure "
+              "links = yes` -- confinement failed.")
+
+if not pull('mod_insecure'):
+    test_fail("mod_insecure did NOT serve the out-of-module file even with "
+              "`insecure links = yes`: the per-module admin opt-out was not "
+              "honoured by the sender enumeration/content gates.")
+
+print("insecure links = yes: refused by default, honoured as an admin opt-out")
diff --git a/testsuite/keep-dirlinks-rule_test.py b/testsuite/tests/path/keep-dirlinks-rule.py
similarity index 55%
rename from testsuite/keep-dirlinks-rule_test.py
rename to testsuite/tests/path/keep-dirlinks-rule.py
index 897775de2..4f4166855 100644
--- a/testsuite/keep-dirlinks-rule_test.py
+++ b/testsuite/tests/path/keep-dirlinks-rule.py
@@ -1,58 +1,33 @@
-"""Pin the concrete rule behind `--keep-dirlinks` (-K).
-
-The rsync(1) `--keep-dirlinks` entry leads with a clear rule -- "treat a symlink
-to a directory as though it were a real directory, but only if it matches a real
-directory from the sender" -- but then a vague security caution ("you must trust
-all the symlinks ... the user could then (on a subsequent copy) replace the
-symlink ...").  This test pins the deterministic part of the behaviour so the
-caution can be tied to a concrete mechanism:
-
-  - sender has a real dir of that name  -> dest symlink-to-dir is KEPT and the
-    contents land THROUGH it (this is the followed-into-target behaviour the
-    caution warns about);
-  - sender has a non-dir (file) of that name -> -K does not apply, the dest
-    symlink is replaced by the file;
-  - default (no -K) -> the dest symlink is deleted and recreated as a real dir.
-
-Pure local client behaviour: no daemon/root/tcp.  Cross-version: expected
-identical against --rsync-bin=old_versions/rsync_3.2.7.
-"""
+#!/usr/bin/env python3
 
 import os
 import subprocess
 
-from rsyncfns import SCRATCHDIR, rmtree, rsync_argv, test_fail
+from harness.rsync import SCRATCHDIR, rmtree, rsync_argv, test_fail
 
 base = SCRATCHDIR / 'keep-dirlinks'
 rmtree(base)
 base.mkdir(parents=True)
 
-
 def dest_with_symlink(name):
-    """Fresh dest where `name` is a symlink to a real 'target' dir."""
     d = base / name
     rmtree(d)
     (d / 'target').mkdir(parents=True)
     os.symlink('target', d / 'd')
     return d
 
-
 def run(src, dst, *opts):
     subprocess.run(rsync_argv('-a', *opts, f'{src}/', f'{dst}/'),
                    stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
 
-
-# sender with a real directory 'd' containing a file.
 sdir = base / 'src_dir'
 (sdir / 'd').mkdir(parents=True)
 (sdir / 'd' / 'f').write_text('X\n')
 
-# sender with 'd' as a plain FILE.
 sfile = base / 'src_file'
 sfile.mkdir()
 (sfile / 'd').write_text('FILE\n')
 
-# 1) -K + sender dir match: symlink kept, contents land through it.
 d = dest_with_symlink('case_match')
 run(sdir, d, '--keep-dirlinks')
 if not (d / 'd').is_symlink():
@@ -61,7 +36,6 @@ def run(src, dst, *opts):
 if not through.is_file() or through.read_text() != 'X\n':
     test_fail("--keep-dirlinks: contents did not land THROUGH the kept symlink")
 
-# 2) -K + sender is a file: -K doesn't apply, symlink replaced by the file.
 d = dest_with_symlink('case_file')
 run(sfile, d, '--keep-dirlinks')
 if (d / 'd').is_symlink():
@@ -69,7 +43,6 @@ def run(src, dst, *opts):
 if not (d / 'd').is_file() or (d / 'd').read_text() != 'FILE\n':
     test_fail("--keep-dirlinks: sender file did not replace the dest symlink")
 
-# 3) default (no -K): symlink deleted and recreated as a real directory.
 d = dest_with_symlink('case_default')
 run(sdir, d)
 if (d / 'd').is_symlink():
diff --git a/testsuite/tests/path/keep-dirlinks-symlinked-dest.py b/testsuite/tests/path/keep-dirlinks-symlinked-dest.py
new file mode 100644
index 000000000..3365be1d7
--- /dev/null
+++ b/testsuite/tests/path/keep-dirlinks-symlinked-dest.py
@@ -0,0 +1,25 @@
+#!/usr/bin/env python3
+
+import os
+
+from harness.rsync import SCRATCHDIR, assert_same, makepath, rmtree, run_rsync, test_fail
+
+base = SCRATCHDIR / 'kdl'
+src = base / 'src'
+dest = base / 'dest'
+rmtree(base)
+makepath(src / 'dir', dest / 'realdir')
+(src / 'dir' / 'f1').write_text('one\n')
+(src / 'dir' / 'f2').write_text('two\n')
+(src / 'top.txt').write_text('top\n')
+os.symlink('realdir', dest / 'dir')
+
+run_rsync('-aK', f'{src}/', f'{dest}/')
+
+real = dest / 'realdir'
+for n in ('f1', 'f2'):
+    if not (real / n).is_file():
+        test_fail(f"-K did not follow the symlinked dest dir: {real / n} missing")
+    assert_same(src / 'dir' / n, real / n, label=f'-K content {n}')
+
+print("keep-dirlinks-symlinked-dest: -K follows a symlinked destination directory")
diff --git a/testsuite/link-dest-pathroot_test.py b/testsuite/tests/path/link-dest-path-root.py
similarity index 54%
rename from testsuite/link-dest-pathroot_test.py
rename to testsuite/tests/path/link-dest-path-root.py
index f6adb58de..61c8b936d 100644
--- a/testsuite/link-dest-pathroot_test.py
+++ b/testsuite/tests/path/link-dest-path-root.py
@@ -1,21 +1,9 @@
 #!/usr/bin/env python3
-# Functional regression: a relative --link-dest=../sibling against a daemon
-# module with `path = /` (the intersection of #897 and #915).
-#
-# #915 re-anchors the receiver's basis open at the module root so an in-module
-# "../01" climb is honoured.  The gate keyed on a nonzero module_dirlen, but a
-# `path = /` module has module_dirlen == 0 (clientserver.c), so the re-anchor
-# was skipped there and --link-dest=../01 was silently ignored (every file
-# re-transferred) even though plain #915 modules were fixed.
-#
-# Like link-dest-relative-basis, the secure per-component walk now honours the
-# in-module `..` climb on every platform (it pops `..` to the held parent), so a
-# `path = /` module uses the relative basis too.  Runs at any uid.
 
 import shutil
 import subprocess
 
-from rsyncfns import (
+from harness.rsync import (
     SCRATCHDIR, make_data_file, makepath, rmtree, rsync_argv, start_test_daemon,
     test_fail, write_daemon_conf,
 )
@@ -23,9 +11,6 @@
 DAEMON_PORT = 12931
 DATA_SIZE = 40000
 
-# dest 00 and basis 01 live side by side under `base`; the module is rooted at
-# "/", so the served subtree is addressed by its absolute path minus the leading
-# slash, and --link-dest=../01 climbs dest 00 -> sibling 01 (both inside /).
 base = SCRATCHDIR / 'bakroot'
 src = SCRATCHDIR / 'srcroot'
 rmtree(base)
@@ -39,7 +24,7 @@
 ])
 url = start_test_daemon(conf, DAEMON_PORT)
 
-base_rel = str(base).lstrip('/')          # address `base` via the path=/ module
+base_rel = str(base).lstrip('/')
 rmtree(base / '00')
 proc = subprocess.run(
     rsync_argv('-a', '--link-dest=../01', f'{src}/', f'{url}root/{base_rel}/00/'),
@@ -59,4 +44,3 @@
         "#915 (path=/ case): a `path = /` daemon module ignored --link-dest=../01 "
         "(module_dirlen==0 skipped the re-anchor) -- the file was re-transferred "
         "instead of hard-linked.  The secure walk must honour the in-module climb.")
-# Honoured: the dest is hard-linked to the in-module sibling basis.
diff --git a/testsuite/link-dest-relative-basis_test.py b/testsuite/tests/path/link-dest-relative-basis.py
similarity index 50%
rename from testsuite/link-dest-relative-basis_test.py
rename to testsuite/tests/path/link-dest-relative-basis.py
index d1410d8b3..160b15667 100644
--- a/testsuite/link-dest-relative-basis_test.py
+++ b/testsuite/tests/path/link-dest-relative-basis.py
@@ -1,37 +1,10 @@
 #!/usr/bin/env python3
-# Functional regression: a RELATIVE alt-basis dir (--link-dest / --copy-dest /
-# --compare-dest = ../sibling) is silently ignored by a daemon receiver, so the
-# basis is never used -- every file is re-transferred instead of hard-linked /
-# copied / skipped.  No error is printed; backups silently stop de-duplicating.
-#
-# Reported as #915 ("Security fix breaks --link-dest via rsync daemon": a
-# `use chroot = no` daemon with `--link-dest=../01` re-transfers everything and
-# fills the backup disk).  The closely-related #928 is the same family over a
-# remote shell with a relative `--link-dest=../snap.1`.
-#
-# Root cause: the 3.4.x symlink-race hardening resolves the receiver's basis
-# through the confined resolver, which rejects the `..` that climbs from the
-# destination (00) to its sibling basis (01); no basis is found, so the file is
-# treated as new.  Works in 3.4.1 (basis honoured).
-#
-# We exercise all three alt-basis forms because they are NOT obviously identical
-# even though they share check_alt_basis_dirs():
-#   * --link-dest=../01   : the matched file must be HARD-LINKED to the basis.
-#   * --copy-dest=../01   : the matched file is COPIED from the basis, so its
-#                           data is NOT sent over the wire (literal data ~ 0).
-#   * --compare-dest=../01 : a matched file is skipped entirely -- NOT created
-#                           in the destination at all.
-# Each signal cleanly separates "basis honoured" (fixed/3.4.1) from "basis
-# ignored" (the regression).
-#
-# Fixed (#915/#930): the secure resolver honours an in-module relative `..` climb
-# to a sibling basis on every platform (the per-component walk pops `..` to the
-# held parent), so all three relative alt-basis forms use the basis. Runs at any uid.
 
 import re
+import shutil
 import subprocess
 
-from rsyncfns import (
+from harness.rsync import (
     SCRATCHDIR, make_data_file, makepath, rmtree, rsync_argv, start_test_daemon,
     test_fail, write_daemon_conf,
 )
@@ -39,15 +12,12 @@
 DAEMON_PORT = 12915
 DATA_SIZE = 40000
 
-mod = SCRATCHDIR / 'bakmod'        # daemon module root: holds basis 01 and dest 00
+mod = SCRATCHDIR / 'bakmod'
 src = SCRATCHDIR / 'src915'
 rmtree(mod)
 rmtree(src)
 makepath(mod / '01', src)
 make_data_file(src / 'f.dat', DATA_SIZE)
-# Basis 01 holds a byte-identical copy of the file (same name/size/mtime so the
-# quick-check treats it as a match and the basis is eligible).
-import shutil
 shutil.copy2(src / 'f.dat', mod / '01' / 'f.dat')
 
 conf = write_daemon_conf([
@@ -55,31 +25,24 @@
 ])
 url = start_test_daemon(conf, DAEMON_PORT)
 
-
 def push(opt):
-    """Fresh dest 00, push src/ into bak/00/ with the given alt-basis option.
-    Returns (rc, stdout)."""
     rmtree(mod / '00')
     proc = subprocess.run(
         rsync_argv('-a', '--stats', opt, f'{src}/', f'{url}bak/00/'),
         stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True)
     return proc.returncode, (proc.stdout or '')
 
-
 def same_inode(a, b):
     sa, sb = a.stat(), b.stat()
     return (sa.st_dev, sa.st_ino) == (sb.st_dev, sb.st_ino)
 
-
 def literal_bytes(out):
     m = re.search(r'Literal data:\s*([\d,]+)', out)
     return int(m.group(1).replace(',', '')) if m else -1
 
-
 regressions = []
 basis = mod / '01' / 'f.dat'
 
-# --- 1. --link-dest=../01 : matched file must be hard-linked to the basis ----
 rc, out = push('--link-dest=../01')
 if rc != 0:
     test_fail(f"--link-dest push failed unexpectedly (rc={rc}):\n{out}")
@@ -90,7 +53,6 @@ def literal_bytes(out):
     regressions.append("--link-dest=../01 did not hard-link to the basis "
                        "(file re-transferred)")
 
-# --- 2. --copy-dest=../01 : matched file copied locally, NOT sent on the wire -
 rc, out = push('--copy-dest=../01')
 if rc != 0:
     test_fail(f"--copy-dest push failed unexpectedly (rc={rc}):\n{out}")
@@ -102,7 +64,6 @@ def literal_bytes(out):
     regressions.append(f"--copy-dest=../01 re-sent the data over the wire "
                        f"(Literal data={lit}, basis not used)")
 
-# --- 3. --compare-dest=../01 : matched file skipped, NOT created in dest ------
 rc, out = push('--compare-dest=../01')
 if rc != 0:
     test_fail(f"--compare-dest push failed unexpectedly (rc={rc}):\n{out}")
@@ -115,4 +76,3 @@ def literal_bytes(out):
         "#915/#930: a daemon receiver ignored a RELATIVE alt-basis dir (../01) -- "
         "the secure resolver must honour an in-module `..` climb to the sibling "
         "basis on every platform:\n  - " + "\n  - ".join(regressions))
-# No regressions -> all three relative alt-basis forms honoured the basis.
diff --git a/testsuite/link-dest-symlink-enotsup_test.py b/testsuite/tests/path/link-dest-symlink-enotsup.py
similarity index 59%
rename from testsuite/link-dest-symlink-enotsup_test.py
rename to testsuite/tests/path/link-dest-symlink-enotsup.py
index 864a81f24..759257852 100644
--- a/testsuite/link-dest-symlink-enotsup_test.py
+++ b/testsuite/tests/path/link-dest-symlink-enotsup.py
@@ -1,36 +1,22 @@
 #!/usr/bin/env python3
-"""--link-dest must fall back to a copy when the destination refuses to
-hard-link a symlink, whatever the errno, and must report it only once.
-
-CAN_HARDLINK_SYMLINK is decided by configure running linkat() on whatever
-filesystem the build tree sat on.  The destination is free to disagree -- macOS
-builds on APFS and backs up to HFS+, which answers ENOTSUP -- and a build that
-says yes had no fallback left, so the transfer died with exit 23 even though the
-symlink was then created correctly.  Every neighbouring case copes: a regular
-file whose link() fails falls back, and so does a build compiled without the
-capability.
-
-Forcing the errno with LD_PRELOAD reaches that arm on a filesystem that can
-hard-link symlinks perfectly well.
-"""
 
 import os
 import re
 import platform
 import subprocess
 
-from rsyncfns import (
+from harness.rsync import (
     SCRATCHDIR, makepath, rmtree, run_rsync, rsync_argv, test_fail,
     test_skipped,
 )
 
 if platform.system() != 'Linux':
-    test_skipped('the LD_PRELOAD linkat hook is Linux-only')
+    test_skipped('the LD_PRELOAD linkat hook is Linux-only', capability='linux_interpose')
 
 vv = run_rsync('-VV', check=True, capture_output=True).stdout
 if '"hardlink_symlinks": true' not in vv:
     test_skipped('build cannot hard-link symlinks, so it already falls back '
-                 'at compile time and this arm is unreachable')
+                 'at compile time and this arm is unreachable', capability='linux_interpose')
 
 hook_code = r'''
 #define _GNU_SOURCE
@@ -120,8 +106,6 @@
 ldest = base / 'ldest'
 makepath(src, ldest)
 
-# The basis must match exactly (match_level 3) or try_dests_non() never
-# reaches the hard-link at all.
 for d in (src, ldest):
     (d / 'reg').write_bytes(b'REGULAR-CONTENT')
     os.symlink('some-target', d / 'sym')
@@ -133,8 +117,8 @@
     ['cc', '-shared', '-fPIC', '-o', str(hook_lib), str(hook_src), '-ldl'],
     stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True)
 if build.returncode != 0:
-    test_skipped(f'cannot build the LD_PRELOAD linkat hook: {build.stdout!r}')
-
+    test_skipped(f'cannot build the LD_PRELOAD linkat hook: {build.stdout!r}',
+                 capability='linux_interpose')
 
 def run(dest, refuse, args=('-a',)):
     marker = base / f'fired-{refuse}-{dest.name}'
@@ -152,51 +136,32 @@ def run(dest, refuse, args=('-a',)):
                   f'output={r.stdout!r}')
     if not marker.exists():
         test_skipped(f'the LD_PRELOAD hook never fired (rc={r.returncode}, '
-                     f'output={r.stdout!r})')
+                     f'output={r.stdout!r})', capability='linux_interpose')
     return r
 
-
 def check_fallback(dest, refuse):
     got = run(dest, refuse)
     ctx = f'refuse={refuse}, rc={got.returncode}, output={got.stdout!r}'
-    assert got.returncode == 0, (
-        'a destination that refused to hard-link a symlink failed the transfer '
-        f'instead of falling back to a copy: {ctx}')
-    assert 'failed to hard-link' not in got.stdout, (
-        f'the fallback still reported a hard-link failure: {ctx}')
-    assert (dest / 'sym').is_symlink() and os.readlink(dest / 'sym') == 'some-target', (
-        f'the symlink was not recreated by the fallback: {ctx}')
-    # The regular file must still be hard-linked, or "it fell back" would also
-    # be satisfied by --link-dest having been abandoned altogether.
-    assert (dest / 'reg').stat().st_ino == (ldest / 'reg').stat().st_ino, (
-        f'the regular file stopped being hard-linked to the basis: {ctx}')
-
-
-# ENOTSUP is the answer configure would have given, arriving late.
+    if got.returncode != 0:
+        test_fail(f'a destination that refused to hard-link a symlink failed the transfer instead of falling back to a copy: {ctx}')
+    if 'failed to hard-link' in got.stdout:
+        test_fail(f'the fallback still reported a hard-link failure: {ctx}')
+    if not ((dest / 'sym').is_symlink() and os.readlink(dest / 'sym') == 'some-target'):
+        test_fail(f'the symlink was not recreated by the fallback: {ctx}')
+    if (dest / 'reg').stat().st_ino != (ldest / 'reg').stat().st_ino:
+        test_fail(f'the regular file stopped being hard-linked to the basis: {ctx}')
+
 check_fallback(base / 'dest-enotsup', 'ENOTSUP')
 
-# EPERM and ENOSYS reach the same place.  errno cannot separate "this
-# filesystem has no hard links" from "you may not": link(2) documents EPERM for
-# both, and FUSE reports ENOSYS for a filesystem that omits the callback.  The
-# regular-file path next door has always fallen back on every errno, so these
-# do too -- the entry is created correctly either way.
 check_fallback(base / 'dest-eperm', 'EPERM')
 check_fallback(base / 'dest-enosys', 'ENOSYS')
 
-# The fallback must report the entry ONCE.  try_dests_non() itemises the basis
-# match itself, so a caller that then creates the entry with itemising still on
-# prints it twice -- which is what a plain -a run cannot see, and what an
-# itemised --link-dest backup on such a filesystem would show.
 dest = base / 'dest-itemize'
 got = run(dest, 'ENOTSUP', args=('-ivvplrtH',))
 ctx = f'rc={got.returncode}, output={got.stdout!r}'
-assert got.returncode == 0, (
-    f'the itemised run did not succeed, so its output proves nothing: {ctx}')
-# Anchored on the change-type letters as well as the name: counting lines that
-# merely contain "sym" and "->" would also be satisfied by one warning line, or
-# by a single line from a run that then failed.
+if got.returncode != 0:
+    test_fail(f'the itemised run did not succeed, so its output proves nothing: {ctx}')
 sym_lines = [ln for ln in got.stdout.splitlines()
              if re.match(r'^cL\S*\s+sym -> some-target$', ln)]
-assert len(sym_lines) == 1, (
-    f'expected exactly one "cL... sym -> some-target" itemisation, got '
-    f'{len(sym_lines)}: {sym_lines} ({ctx})')
+if len(sym_lines) != 1:
+    test_fail(f'expected exactly one "cL... sym -> some-target" itemisation, got {len(sym_lines)}: {sym_lines} ({ctx})')
diff --git a/testsuite/links_test.py b/testsuite/tests/path/links.py
similarity index 63%
rename from testsuite/links_test.py
rename to testsuite/tests/path/links.py
index f7b412def..0cf236a51 100644
--- a/testsuite/links_test.py
+++ b/testsuite/tests/path/links.py
@@ -1,19 +1,8 @@
 #!/usr/bin/env python3
-"""Coverage of symlink-handling options -l / -L / -k at depth.
-
-  -l (--links)         copy a symlink as a symlink (target preserved);
-  -L (--copy-links)    replace a symlink with the file/dir it points to;
-  -k (--copy-dirlinks) treat a symlink-to-directory as the real directory.
-
-(-K --keep-dirlinks -- the receiver-side follow of an in-tree directory
-symlink, issue #715 -- is covered by symlink-dirlink-basis_test.py and needs
-the secure resolver; here we cover the portable source-side options, all on a
-symlink that lives several directory levels deep.)
-"""
 
 import os
 
-from rsyncfns import (
+from harness.rsync import (
     FROMDIR, TODIR,
     assert_is_symlink, assert_same, make_tree, rmtree, run_rsync, test_fail,
 )
@@ -21,25 +10,21 @@
 src = FROMDIR
 deepdir = os.path.join('d1', 'd2', 'd3')
 
-
 def seed():
     rmtree(src)
     rmtree(TODIR)
     make_tree(src, depth=3)
-    os.symlink('f3', src / deepdir / 'sl')          # file symlink, deep
+    os.symlink('f3', src / deepdir / 'sl')
     (src / deepdir / 'realdir').mkdir()
     (src / deepdir / 'realdir' / 'inside').write_text("inside\n")
-    os.symlink('realdir', src / deepdir / 'dirlink')  # dir symlink, deep
-
+    os.symlink('realdir', src / deepdir / 'dirlink')
 
-# --- -l: symlinks preserved as symlinks at depth ----------------------------
 seed()
 run_rsync('-rl', f'{src}/', f'{TODIR}/')
 assert_is_symlink(TODIR / deepdir / 'sl', target='f3', label='-l file symlink')
 assert_is_symlink(TODIR / deepdir / 'dirlink', target='realdir',
                   label='-l dir symlink')
 
-# --- -L: symlinks dereferenced into their referents at depth -----------------
 seed()
 run_rsync('-rL', f'{src}/', f'{TODIR}/')
 if os.path.islink(TODIR / deepdir / 'sl'):
@@ -50,7 +35,6 @@ def seed():
 assert_same(TODIR / deepdir / 'dirlink' / 'inside',
             src / deepdir / 'realdir' / 'inside', label='-L deref dir')
 
-# --- -k: only the dir-symlink is followed; the file symlink stays a symlink --
 seed()
 run_rsync('-rlk', f'{src}/', f'{TODIR}/')
 if os.path.islink(TODIR / deepdir / 'dirlink'):
diff --git a/testsuite/tests/path/log-file-symlink.py b/testsuite/tests/path/log-file-symlink.py
new file mode 100644
index 000000000..6f2c14a70
--- /dev/null
+++ b/testsuite/tests/path/log-file-symlink.py
@@ -0,0 +1,72 @@
+#!/usr/bin/env python3
+
+import os
+import pwd
+import subprocess
+
+from harness.rsync import SCRATCHDIR, rmtree, rsync_argv, test_fail, test_skipped
+
+if os.geteuid() != 0:
+    test_skipped("requires root to plant a symlink owned by a non-root, "
+                 "non-self uid (the attacker simulation)", capability='cross_uid')
+
+NOBODY_UID = None
+for name in ('nobody', 'nfsnobody', 'daemon'):
+    try:
+        NOBODY_UID = pwd.getpwnam(name).pw_uid
+        if NOBODY_UID != 0 and NOBODY_UID != os.geteuid():
+            break
+    except KeyError:
+        continue
+if NOBODY_UID is None or NOBODY_UID == 0 or NOBODY_UID == os.geteuid():
+    test_skipped("no untrusted-uid user available for cross-uid plant "
+                 "(tried nobody, nfsnobody, daemon)", capability='cross_uid')
+
+base = SCRATCHDIR / 'logfile'
+src = base / 'src'
+dest = base / 'dest'
+plants = base / 'plants'
+
+rmtree(base)
+src.mkdir(parents=True)
+(src / 'f').write_text("payload\n")
+dest.mkdir(parents=True)
+plants.mkdir(parents=True)
+
+sentinel = plants / 'sentinel_leaf'
+sentinel.write_text("LEAF_SENTINEL_INITIAL\n")
+os.chmod(sentinel, 0o600)
+
+leaf_path = plants / 'log_leaf'
+os.symlink(sentinel, leaf_path)
+os.lchown(leaf_path, NOBODY_UID, NOBODY_UID)
+
+subprocess.run(
+    rsync_argv('-a', '--log-file=' + str(leaf_path), f'{src}/', f'{dest}/'),
+    stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
+
+leaf_after = sentinel.read_text()
+if leaf_after != "LEAF_SENTINEL_INITIAL\n":
+    test_fail(
+        f"--log-file followed a planted LEAF symlink (owned by uid "
+        f"{NOBODY_UID}): {sentinel} changed from 'LEAF_SENTINEL_INITIAL' to "
+        f"{leaf_after!r}. The privileged rsync appended its log into the "
+        f"attacker-chosen file. Fix: refuse planted symlinks at --log-file.")
+
+real_target = plants / 'parent_real_target'
+real_target.mkdir()
+
+parent_plant = plants / 'parent_link'
+os.symlink(real_target, parent_plant)
+os.lchown(parent_plant, NOBODY_UID, NOBODY_UID)
+
+log_via_parent = parent_plant / 'rsync.log'
+subprocess.run(
+    rsync_argv('-a', '--log-file=' + str(log_via_parent), f'{src}/', f'{dest}/'),
+    stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
+
+outside_log = real_target / 'rsync.log'
+if outside_log.exists():
+    test_fail(
+        f'--log-file traversed untrusted uid {NOBODY_UID} parent symlink '
+        f'{parent_plant} -> {real_target} and created {outside_log}')
diff --git a/testsuite/mkpath_test.py b/testsuite/tests/path/mkpath.py
similarity index 66%
rename from testsuite/mkpath_test.py
rename to testsuite/tests/path/mkpath.py
index f72cf986c..c5cd1052d 100644
--- a/testsuite/mkpath_test.py
+++ b/testsuite/tests/path/mkpath.py
@@ -1,76 +1,57 @@
 #!/usr/bin/env python3
-# Python rewrite of testsuite/mkpath.test.
-#
-# Test the rsync --mkpath option: it should create any missing intermediate
-# destination directories rather than erroring out.
 
 import filecmp
 import os
 import shutil
 from pathlib import Path
 
-from rsyncfns import (
+from harness.rsync import (
     FROMDIR, SRCDIR, TMPDIR, TODIR,
     makepath, rmtree, run_rsync, test_fail,
 )
 
-
 makepath(FROMDIR, TODIR)
 shutil.copy2(SRCDIR / 'rsync.h', FROMDIR / 'text')
 shutil.copy2(SRCDIR / 'configure.ac', FROMDIR / 'extra')
 
-# All paths in the rsync invocations below are interpreted relative to
-# TMPDIR, matching the original shell test which did `cd "$tmpdir"`.
 os.chdir(TMPDIR)
 
 deep_dir = Path('to/foo/bar/baz/down/deep')
 
-
 def assert_file(path: Path, label: str, src: str = 'from/text') -> None:
     if not path.is_file():
         test_fail(f"{label}: {path} not found")
     if not filecmp.cmp(path, src, shallow=False):
         test_fail(f"{label}: {path} content differs from {src}")
 
-
-# Negative control: without --mkpath, a missing intermediate path must fail and
-# create nothing -- otherwise the --mkpath successes below prove nothing.
 rmtree('to/foo')
 proc = run_rsync('-ai', 'from/text', str(deep_dir / 'new'), check=False)
 if proc.returncode == 0 or (deep_dir / 'new').exists():
     test_fail("a transfer WITHOUT --mkpath created the missing intermediate path")
 
-# Create several levels of dest dir (file destination — final component
-# is the new filename).
 run_rsync('-aiv', '--mkpath', 'from/text', str(deep_dir / 'new'))
 assert_file(deep_dir / 'new', "'new' file in deep dir")
 rmtree('to/foo')
 
-# Trailing slash on the dest means it's a directory; the file keeps its name.
 run_rsync('-aiv', '--mkpath', 'from/text', str(deep_dir) + '/')
 assert_file(deep_dir / 'text', "'text' file in deep dir (trailing-slash dest)")
 (deep_dir / 'text').unlink()
 
-# An existing destination directory should also work.
 (deep_dir / 'new').mkdir(parents=True, exist_ok=True)
 run_rsync('-aiv', '--mkpath', 'from/text', str(deep_dir / 'new'))
 assert_file(deep_dir / 'new' / 'text', "'text' file in pre-existing deep/new dir")
 
-# ... and an existing path when an alternate dest filename is specified.
 run_rsync('-aiv', '--mkpath', 'from/text', str(deep_dir / 'new' / 'text2'))
 assert_file(deep_dir / 'new' / 'text2', "'text2' renamed file in pre-existing deep/new dir")
 rmtree('to/foo')
 
-# Multiple source args (whole directory) — bare dest name.
 run_rsync('-aiv', '--mkpath', 'from/', str(deep_dir))
 assert_file(deep_dir / 'extra', "'extra' file in deep dir (multi-source, no trailing slash)",
             src='from/extra')
 rmtree('to/foo')
 
-# Multiple source args (whole directory) — dest with trailing slash.
 run_rsync('-aiv', '--mkpath', 'from/', str(deep_dir) + '/')
 assert_file(deep_dir / 'text', "'text' file in deep dir (multi-source, trailing slash)")
 
-# No intermediate path at all — dest is just a file in the current dir.
 run_rsync('-aiv', '--mkpath', 'from/text', 'to_text')
 assert_file(Path('to_text'), "'to_text' file in current dir")
diff --git a/testsuite/no-implied-dirs-symlink_test.py b/testsuite/tests/path/no-implied-dirs-symlink.py
similarity index 52%
rename from testsuite/no-implied-dirs-symlink_test.py
rename to testsuite/tests/path/no-implied-dirs-symlink.py
index e196266ae..20556b19a 100644
--- a/testsuite/no-implied-dirs-symlink_test.py
+++ b/testsuite/tests/path/no-implied-dirs-symlink.py
@@ -1,29 +1,10 @@
 #!/usr/bin/env python3
-"""Pin the receiver-side symlink behaviour of -R `--no-implied-dirs`.
-
-The rsync(1) `--no-implied-dirs` entry describes the effect euphemistically:
-"the receiving rsync updates "path/foo/file" using the existing path elements,
-which means that the file ends up being created in "path/bar"."  It does not
-spell out the security-relevant consequence: an EXISTING destination symlink
-used as a path element is FOLLOWED, so the write is silently redirected through
-it.  The default (implied dirs) instead deletes that symlink and recreates it as
-a real directory.
-
-This test makes both behaviours explicit and measured.  Pure local client
-behaviour: no daemon/root/tcp.  Cross-version: expected identical against
---rsync-bin=old_versions/rsync_3.2.7.
-"""
 
 import os
 import subprocess
 
-from rsyncfns import SCRATCHDIR, forced_protocol, rmtree, rsync_argv, test_fail
+from harness.rsync import SCRATCHDIR, forced_protocol, rmtree, rsync_argv, test_fail
 
-# The -R "/./" implied-dir marker is a protocol-30+ feature; at protocol 29 the
-# generator rejects the multi-component "path/file" as an invalid path and
-# aborts (verified identical on the 3.2.7 oracle), so the behaviour this test
-# pins isn't reachable there.  Pass-through rather than skip, matching the
-# sibling relative-implied test's handling of the same proto-29 limitation.
 proto = forced_protocol()
 if proto is not None and proto < 30:
     print(f"no-implied-dirs-symlink: protocol {proto} -- the -R /./ implied-dir "
@@ -38,10 +19,7 @@
 (src / 'path').mkdir(parents=True)
 (src / 'path' / 'file').write_text('NEW\n')
 
-
 def run(dst, *opts):
-    """Fresh dst with 'path' pre-existing as a symlink -> 'real'; transfer
-    src/./path/file with -R and the given opts."""
     rmtree(dst)
     (dst / 'real').mkdir(parents=True)
     os.symlink('real', dst / 'path')
@@ -49,8 +27,6 @@ def run(dst, *opts):
                    stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
     return dst
 
-
-# --no-implied-dirs: the dest symlink is kept and followed -> file lands in real/.
 d = run(base / 'noimplied', '--no-implied-dirs')
 if not (d / 'path').is_symlink():
     test_fail("--no-implied-dirs: dest 'path' symlink was replaced (expected kept)")
@@ -59,7 +35,6 @@ def run(dst, *opts):
     test_fail("--no-implied-dirs: write was not redirected through the symlink "
               "(expected real/file to receive the content)")
 
-# default (implied dirs): the dest symlink is deleted and recreated as a real dir.
 d = run(base / 'implied')
 if (d / 'path').is_symlink():
     test_fail("default: dest 'path' symlink should have been replaced by a real dir")
diff --git a/testsuite/tests/path/nondaemon-symlink-race.py b/testsuite/tests/path/nondaemon-symlink-race.py
new file mode 100644
index 000000000..15e0eb3b9
--- /dev/null
+++ b/testsuite/tests/path/nondaemon-symlink-race.py
@@ -0,0 +1,46 @@
+#!/usr/bin/env python3
+
+import os
+import subprocess
+
+from harness.mutation import find_attacker_uid
+from harness.rsync import SCRATCHDIR, rmtree, rsync_argv, test_fail, test_skipped
+
+if os.geteuid() != 0:
+    test_skipped("requires root to plant a backup-dir symlink owned by a non-self uid",
+                 capability='cross_uid')
+ATT_UID = find_attacker_uid()
+if ATT_UID is None:
+    test_skipped("no untrusted-uid user available for cross-uid plant", capability='cross_uid')
+
+dest = SCRATCHDIR / 'dest'
+outside = SCRATCHDIR / 'outside'
+src = SCRATCHDIR / 'src_files'
+for d in (dest, outside, src):
+    rmtree(d)
+    d.mkdir(parents=True)
+
+(dest / 'foo').write_text("INSIDE_TREE_DATA\n")
+
+os.symlink(str(outside), dest / 'bdir')
+os.lchown(dest / 'bdir', ATT_UID, ATT_UID)
+
+(src / 'foo').write_text("NEW_PUSHED_DATA\n")
+
+subprocess.run(
+    rsync_argv('-t', '--backup', '--backup-dir=bdir', f'{src}/foo', f'{dest}/'),
+    stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL,
+)
+
+if os.path.lexists(outside / 'foo'):
+    try:
+        got = (outside / 'foo').read_text().strip()
+    except OSError:
+        got = '<unreadable>'
+    test_fail("non-daemon transfer escaped the tree: backup of dest/foo landed "
+              f"in {outside}/foo (content: {got}); the receiver followed the "
+              "planted backup-dir symlink instead of confining beneath the dest")
+
+leaked = os.listdir(outside)
+if leaked:
+    test_fail(f"unexpected files escaped the destination tree into {outside}: {leaked}")
diff --git a/testsuite/tests/path/operator-path-alt-dest.py b/testsuite/tests/path/operator-path-alt-dest.py
new file mode 100644
index 000000000..e3e20e1ef
--- /dev/null
+++ b/testsuite/tests/path/operator-path-alt-dest.py
@@ -0,0 +1,42 @@
+#!/usr/bin/env python3
+
+import os
+import subprocess
+
+from harness.mutation import plant_operator_symlink, run_symlink_matrix
+from harness.rsync import rsync_argv
+
+timestamp = 1_234_567_890
+
+def check(option):
+    def case(context):
+        source = context.base / 'source'
+        destination = context.base / 'destination'
+        source.mkdir()
+        destination.mkdir()
+        source_file = source / 'file'
+        source_file.write_text('source00\n' if option == 'copy' else 'matching\n')
+        argument, outside = plant_operator_symlink(context, destination)
+        outside.mkdir(parents=True, exist_ok=True)
+        outside_file = outside / 'file'
+        outside_file.write_text('outside0\n' if option == 'copy' else 'matching\n')
+        os.utime(source_file, (timestamp, timestamp))
+        os.utime(outside_file, (timestamp, timestamp))
+        args = ['-a', f'--{option}-dest={argument}']
+        if context.insecure:
+            args.append('--insecure-links')
+        subprocess.run(rsync_argv(*args, 'source/', 'destination/'), cwd=context.base,
+                       stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
+        result = destination / 'file'
+        if option == 'compare':
+            return not result.exists()
+        if option == 'copy':
+            return result.exists() and result.read_text() == 'outside0\n'
+        return result.exists() and result.stat().st_ino == outside_file.stat().st_ino
+
+    run_symlink_matrix(f'--{option}-dest', case)
+
+for option in ('compare', 'copy', 'link'):
+    check(option)
+
+print('alternate-destination symlink policy enforced')
diff --git a/testsuite/tests/path/operator-path-backup-dir.py b/testsuite/tests/path/operator-path-backup-dir.py
new file mode 100644
index 000000000..35ac2e87d
--- /dev/null
+++ b/testsuite/tests/path/operator-path-backup-dir.py
@@ -0,0 +1,33 @@
+#!/usr/bin/env python3
+
+import subprocess
+
+from harness.mutation import plant_operator_symlink, run_symlink_matrix
+from harness.rsync import rsync_argv
+
+NFILES = 6
+
+def check(label, inplace):
+    def case(ctx):
+        src = ctx.base / 'src'
+        dest = ctx.base / 'dest'
+        src.mkdir()
+        dest.mkdir()
+        for i in range(NFILES):
+            (src / f'f{i}').write_text('new-content\n')
+            (dest / f'f{i}').write_text('old\n')
+        backup, _ = plant_operator_symlink(ctx, dest)
+        args = ['-a', '--backup', f'--backup-dir={backup}']
+        if inplace:
+            args.append('--inplace')
+        if ctx.insecure:
+            args.append('--insecure-links')
+        subprocess.run(rsync_argv(*args, 'src/', 'dest/'), cwd=ctx.base,
+                       stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
+        return any(path.is_file() for path in ctx.outside.rglob('*'))
+
+    run_symlink_matrix(label, case)
+
+check('--backup-dir', False)
+check('--inplace --backup-dir', True)
+print('--backup-dir symlink policy enforced')
diff --git a/testsuite/tests/path/operator-path-backup-race.py b/testsuite/tests/path/operator-path-backup-race.py
new file mode 100644
index 000000000..9088265e7
--- /dev/null
+++ b/testsuite/tests/path/operator-path-backup-race.py
@@ -0,0 +1,81 @@
+#!/usr/bin/env python3
+
+import os
+import subprocess
+import time
+
+from harness.mutation import find_attacker_uid, race_budget, start_c_flipper, stop_flipper
+from harness.rsync import SCRATCHDIR, rmtree, rsync_argv, test_fail, test_skipped
+
+if os.geteuid() != 0:
+    test_skipped('backup parent race requires root', capability='cross_uid')
+attacker_uid = find_attacker_uid()
+if attacker_uid is None:
+    test_skipped('no untrusted uid is available', capability='cross_uid')
+
+def check(kind, count):
+    base = SCRATCHDIR / kind
+    source = base / 'source'
+    destination = base / 'destination'
+    backup = base / 'backup'
+    outside = base / 'outside'
+    subdirectory = backup / 'sub'
+    replacement = backup / '.replacement'
+
+    def build():
+        rmtree(base)
+        for path in (source / 'sub', destination / 'sub', backup, outside):
+            path.mkdir(parents=True)
+        subdirectory.mkdir()
+        for index in range(count):
+            if kind == 'directory':
+                (outside / f'item{index}').mkdir()
+                (source / 'sub' / f'item{index}').write_text('new content')
+                (destination / 'sub' / f'item{index}').write_text('old')
+            else:
+                (source / 'sub' / f'item{index}').symlink_to('new')
+                (destination / 'sub' / f'item{index}').symlink_to('old')
+        replacement.symlink_to(outside)
+        os.lchown(replacement, attacker_uid, attacker_uid)
+
+    def push():
+        return subprocess.run(
+            rsync_argv('-a', '--backup', f'--backup-dir={backup}',
+                       f'{source}/', f'{destination}/'),
+            stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True)
+
+    def escaped():
+        if kind == 'directory':
+            return any(not (outside / f'item{index}').is_dir() for index in range(count))
+        return any(entry.is_symlink() for entry in os.scandir(outside))
+
+    build()
+    result = push()
+    if result.returncode:
+        test_fail(f'{kind}: backup control failed:\n{result.stdout}')
+    saved = subdirectory / 'item0'
+    if kind == 'directory' and (not saved.is_file() or saved.read_text() != 'old'):
+        test_fail('directory backup path was not exercised')
+    if kind == 'symlink' and (not saved.is_symlink() or os.readlink(saved) != 'old'):
+        test_fail('symlink backup path was not exercised')
+    if escaped():
+        test_fail(f'{kind}: control escaped before the race')
+
+    deadline = time.monotonic() + race_budget(10)
+    flipper = None
+    try:
+        while time.monotonic() < deadline:
+            if flipper is not None:
+                stop_flipper(flipper)
+            build()
+            flipper = start_c_flipper(subdirectory, replacement)
+            push()
+            if escaped():
+                test_fail(f'{kind}: backup escaped during a parent swap')
+    finally:
+        if flipper is not None:
+            stop_flipper(flipper)
+
+check('directory', 50)
+check('symlink', 95)
+print('backup operations remain confined during parent swaps')
diff --git a/testsuite/operator-path-dir-daemon-inmodule_test.py b/testsuite/tests/path/operator-path-dir-daemon-inmodule.py
similarity index 60%
rename from testsuite/operator-path-dir-daemon-inmodule_test.py
rename to testsuite/tests/path/operator-path-dir-daemon-inmodule.py
index 2fd5bb9ea..ca69e7a21 100644
--- a/testsuite/operator-path-dir-daemon-inmodule_test.py
+++ b/testsuite/tests/path/operator-path-dir-daemon-inmodule.py
@@ -1,14 +1,8 @@
 #!/usr/bin/env python3
-# Regression guard for the module-confinement / exclude-aware operator-path
-# resolver: a LEGITIMATE absolute --partial-dir that lives inside the served
-# module (a real directory, no symlink, not excluded) must still work.  The
-# out-of-module / exclude refusals must not over-block an absolute in-module
-# path by tripping on the module root's own ancestors (/home, /srv, ...) while
-# the ownership walk descends to it.
 
 import subprocess
 
-from rsyncfns import (
+from harness.rsync import (
     SCRATCHDIR, rmtree, rsync_argv, start_test_daemon, test_fail, write_daemon_conf,
 )
 
@@ -17,8 +11,8 @@
 base.mkdir()
 mod = base / 'mod'
 mod.mkdir()
-(mod / 'pdir').mkdir()                   # a real in-module partial dir
-(mod / 'f0').write_text("OLD\n")         # existing dest, smaller than src
+(mod / 'pdir').mkdir()
+(mod / 'f0').write_text("OLD\n")
 src = base / 'src'
 src.mkdir()
 (src / 'f0').write_text("NEW-LONGER-CONTENT-SO-IT-TRANSFERS\n")
@@ -26,7 +20,6 @@
 conf = write_daemon_conf([('mod', {'path': str(mod), 'read only': 'no'})])
 url = start_test_daemon(conf, 12908)
 
-# Absolute in-module --partial-dir: must be accepted and the file delivered.
 proc = subprocess.run(
     rsync_argv('-a', f'--partial-dir={mod}/pdir', f'{src}/', f'{url}mod/'),
     stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True)
diff --git a/testsuite/operator-path-dir-daemon-mkdir_test.py b/testsuite/tests/path/operator-path-dir-daemon-mkdir.py
similarity index 64%
rename from testsuite/operator-path-dir-daemon-mkdir_test.py
rename to testsuite/tests/path/operator-path-dir-daemon-mkdir.py
index 0aac2c9ee..9ae0d24a9 100644
--- a/testsuite/operator-path-dir-daemon-mkdir_test.py
+++ b/testsuite/tests/path/operator-path-dir-daemon-mkdir.py
@@ -1,14 +1,9 @@
 #!/usr/bin/env python3
-# A DIRECTORY-only module exclude (exclude = /public/pdir/) must not be
-# bypassable by creating that dir through a peer --partial-dir symlink.
-# (Codex-review follow-up.)  The partial dir does not exist yet, so the leaf is
-# created by handle_partial_dir(); the resolver must filter-check the absent
-# leaf against dir-only rules, not just as a file.  Runs unprivileged.
 
 import os
 import subprocess
 
-from rsyncfns import (
+from harness.rsync import (
     SCRATCHDIR, rmtree, rsync_argv, start_test_daemon, test_fail, write_daemon_conf,
 )
 
@@ -16,7 +11,7 @@
 rmtree(base)
 base.mkdir()
 mod = base / 'mod'
-pub = mod / 'public'                     # served dir; only /public/pdir/ excluded
+pub = mod / 'public'
 pub.mkdir(parents=True)
 (pub / 'served.txt').write_text("served\n")
 os.symlink('public', mod / 'blink')
@@ -28,8 +23,6 @@
     [('mod', {'path': str(mod), 'read only': 'no', 'exclude': '/public/pdir/'})])
 url = start_test_daemon(conf, 12913)
 
-# --partial-dir resolves (via blink) to the excluded dir public/pdir, which does
-# not exist yet -> handle_partial_dir() would mkdir it.
 subprocess.run(
     rsync_argv('-a', '--delay-updates', '--partial-dir=/blink/pdir', f'{src}/', f'{url}mod/'),
     stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
diff --git a/testsuite/tests/path/operator-path-dir-daemon.py b/testsuite/tests/path/operator-path-dir-daemon.py
new file mode 100644
index 000000000..7761c2fee
--- /dev/null
+++ b/testsuite/tests/path/operator-path-dir-daemon.py
@@ -0,0 +1,41 @@
+#!/usr/bin/env python3
+
+from harness.rsync import (SCRATCHDIR, forced_protocol, makepath, rmtree, run_rsync,
+                      start_test_daemon, test_fail, write_daemon_conf)
+
+base = SCRATCHDIR / 'operator-path-dir-daemon'
+rmtree(base)
+modules = []
+cases = {}
+
+for name in ('backup', 'partial'):
+    root = base / name
+    module = root / 'module'
+    outside = root / 'outside'
+    source = root / 'source'
+    makepath(module, outside, source)
+    (outside / 'file').write_text('protected\n')
+    (module / 'file').write_text('old-destination-content\n')
+    (module / 'outside').symlink_to(outside)
+    (source / 'file').write_text('new\n')
+    modules.append((name, {'path': str(module), 'read only': 'no'}))
+    cases[name] = module, outside, source
+
+url = start_test_daemon(write_daemon_conf(modules, name='operator-path-dir.conf'), 12960)
+
+module, outside, source = cases['backup']
+run_rsync('-a', '--backup', '--backup-dir=/outside', f'{source}/', f'{url}backup/', check=False)
+if (outside / 'file').read_text() != 'protected\n':
+    test_fail('backup-dir escaped the daemon module')
+
+module, outside, source = cases['partial']
+result = run_rsync('-a', '--delay-updates', '--partial-dir=/outside',
+                   f'{source}/', f'{url}partial/', check=False)
+destination = module / 'file'
+if forced_protocol() is None or forced_protocol() >= 30:
+    if result.returncode == 0 or destination.read_text() != 'old-destination-content\n':
+        test_fail('partial-dir escape was not rejected')
+elif result.returncode or destination.read_text() != 'new\n':
+    test_fail('protocol 29 partial-dir transfer failed')
+if (outside / 'file').read_text() != 'protected\n':
+    test_fail('partial-dir escaped the daemon module')
diff --git a/testsuite/tests/path/operator-path-file-options.py b/testsuite/tests/path/operator-path-file-options.py
new file mode 100644
index 000000000..439c23692
--- /dev/null
+++ b/testsuite/tests/path/operator-path-file-options.py
@@ -0,0 +1,37 @@
+#!/usr/bin/env python3
+
+import subprocess
+
+from harness.mutation import plant_operator_symlink, run_symlink_matrix
+from harness.rsync import rsync_argv
+
+def check(option):
+    def case(context):
+        source = context.base / 'source'
+        destination = context.base / 'destination'
+        source.mkdir()
+        destination.mkdir()
+        (source / 'file').write_text('data\n')
+        argument, outside = plant_operator_symlink(context, context.base, kind='file')
+        args = ['-a']
+        if option == 'files-from':
+            outside.write_text('file\n')
+            args.append(f'--files-from={argument}')
+        elif option == 'log-file':
+            args.extend(('-i', f'--log-file={argument}'))
+        else:
+            args.append(f'--write-batch={argument}')
+        if context.insecure:
+            args.append('--insecure-links')
+        subprocess.run(rsync_argv(*args, 'source/', 'destination/'), cwd=context.base,
+                       stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
+        if option == 'files-from':
+            return (destination / 'file').exists()
+        return outside.is_file() and (option != 'log-file' or outside.stat().st_size > 0)
+
+    run_symlink_matrix(f'--{option}', case)
+
+for option in ('files-from', 'log-file', 'write-batch'):
+    check(option)
+
+print('file option symlink policy enforced')
diff --git a/testsuite/tests/path/operator-path-insecure-links-daemon.py b/testsuite/tests/path/operator-path-insecure-links-daemon.py
new file mode 100644
index 000000000..5d3de0ee8
--- /dev/null
+++ b/testsuite/tests/path/operator-path-insecure-links-daemon.py
@@ -0,0 +1,43 @@
+#!/usr/bin/env python3
+
+import os
+import subprocess
+
+from harness.mutation import find_attacker_uid
+from harness.rsync import (
+    SCRATCHDIR, rmtree, rsync_argv, start_test_daemon, test_fail, test_skipped,
+    write_daemon_conf,
+)
+
+DAEMON_PORT = 12901
+CANARY = "audit_daemon_optout_canary"
+
+if os.geteuid() != 0:
+    test_skipped("requires root to plant a symlink owned by a non-self uid", capability='cross_uid')
+ATT = find_attacker_uid()
+if ATT is None:
+    test_skipped("no untrusted-uid user available for cross-uid plant", capability='cross_uid')
+
+base = SCRATCHDIR / 'daemonoptout'
+rmtree(base)
+base.mkdir()
+escape_target = base / 'escape_target'
+escape_target.mkdir()
+(escape_target / CANARY).write_text("must-not-be-served\n")
+
+plant = base / 'plant'
+os.symlink(escape_target, plant)
+os.lchown(plant, ATT, ATT)
+
+conf = write_daemon_conf([('mod', {'path': plant, 'read only': 'yes'})])
+url = start_test_daemon(conf, DAEMON_PORT)
+
+proc = subprocess.run(
+    rsync_argv('-M--insecure-links', f'{url}mod/'),
+    stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True)
+
+if CANARY in proc.stdout:
+    test_fail(
+        f'daemon honoured peer --insecure-links and served {CANARY!r} through '
+        f'{plant} -> {escape_target}')
+print("daemon ignores peer-forwarded --insecure-links: confinement held")
diff --git a/testsuite/operator-path-insecure-links-refused_test.py b/testsuite/tests/path/operator-path-insecure-links-refused.py
similarity index 70%
rename from testsuite/operator-path-insecure-links-refused_test.py
rename to testsuite/tests/path/operator-path-insecure-links-refused.py
index 7cffc8c3a..a061669b6 100644
--- a/testsuite/operator-path-insecure-links-refused_test.py
+++ b/testsuite/tests/path/operator-path-insecure-links-refused.py
@@ -1,13 +1,8 @@
 #!/usr/bin/env python3
-# A daemon must DROP the connection if a client passes --insecure-links over the
-# protocol.  --insecure-links is a local-only opt-out; a client must never be
-# able to disable the daemon's symlink confinement, so even attempting it is a
-# hard error that ends the connection (the daemon's own opt-out is the
-# "insecure links" module parameter, never the client flag).  No root needed.
 
 import subprocess
 
-from rsyncfns import (
+from harness.rsync import (
     SCRATCHDIR, rmtree, rsync_argv, start_test_daemon, test_fail,
     write_daemon_conf,
 )
@@ -24,13 +19,11 @@
 conf = write_daemon_conf([('mod', {'path': mod, 'read only': 'yes'})])
 url = start_test_daemon(conf, DAEMON_PORT)
 
-# Control: a normal listing works.
 ok = subprocess.run(rsync_argv(f'{url}mod/'),
                     stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True)
 if ok.returncode != 0:
     test_fail(f"control listing failed (daemon broken?): {ok.stderr}")
 
-# A client forwarding --insecure-links must be refused and the connection dropped.
 proc = subprocess.run(rsync_argv('-M--insecure-links', f'{url}mod/'),
                       stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True)
 out = (proc.stdout or '') + (proc.stderr or '')
diff --git a/testsuite/tests/path/operator-path-partial-dir.py b/testsuite/tests/path/operator-path-partial-dir.py
new file mode 100644
index 000000000..1f961fe4b
--- /dev/null
+++ b/testsuite/tests/path/operator-path-partial-dir.py
@@ -0,0 +1,43 @@
+#!/usr/bin/env python3
+
+import os
+import subprocess
+
+from harness.mutation import plant_operator_symlink, run_symlink_matrix
+from harness.rsync import rsync_argv
+
+PINNED = 1000000000
+
+def _setup(ctx):
+    src = ctx.base / 'src'
+    dest = ctx.base / 'dest'
+    src.mkdir()
+    dest.mkdir()
+    (src / 'f0').write_text("PAYLOAD-DATA\n")
+    return plant_operator_symlink(ctx, dest)
+
+def _run(ctx, opt):
+    extra = ['--insecure-links'] if ctx.insecure else []
+    subprocess.run(
+        rsync_argv('-a', '--delay-updates', f'--partial-dir={opt}', *extra,
+                   'src/', 'dest/'),
+        cwd=str(ctx.base), stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
+
+def case_create(ctx):
+    opt, escape = _setup(ctx)
+    _run(ctx, opt)
+    return escape.exists()
+
+def case_reuse(ctx):
+    opt, escape = _setup(ctx)
+    escape.mkdir(parents=True, exist_ok=True)
+    os.utime(escape, (PINNED, PINNED))
+    pinned = escape.stat().st_mtime
+    _run(ctx, opt)
+    return escape.stat().st_mtime != pinned
+
+run_symlink_matrix('--partial-dir', case_create, paths=('abs',), locations=('parent',),
+                   label='create')
+run_symlink_matrix('--partial-dir', case_reuse, paths=('abs',), locations=('parent',),
+                   label='reuse')
+print("--partial-dir symlink policy (abs, parent; create + reuse): enforced")
diff --git a/testsuite/tests/path/operator-path-temp-dir.py b/testsuite/tests/path/operator-path-temp-dir.py
new file mode 100644
index 000000000..e0af2d284
--- /dev/null
+++ b/testsuite/tests/path/operator-path-temp-dir.py
@@ -0,0 +1,28 @@
+#!/usr/bin/env python3
+
+import os
+import subprocess
+
+from harness.mutation import plant_operator_symlink, run_symlink_matrix
+from harness.rsync import rsync_argv
+
+PINNED = 1000000000
+
+def case(ctx):
+    src = ctx.base / 'src'
+    dest = ctx.base / 'dest'
+    src.mkdir()
+    dest.mkdir()
+    (src / 'f0').write_text("PAYLOAD-DATA\n")
+    opt, escape = plant_operator_symlink(ctx, dest)
+    escape.mkdir(parents=True, exist_ok=True)
+    os.utime(escape, (PINNED, PINNED))
+    pinned = escape.stat().st_mtime
+    extra = ['--insecure-links'] if ctx.insecure else []
+    subprocess.run(
+        rsync_argv('-a', f'--temp-dir={opt}', *extra, 'src/', 'dest/'),
+        cwd=str(ctx.base), stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
+    return escape.stat().st_mtime != pinned
+
+run_symlink_matrix('--temp-dir', case)
+print("--temp-dir symlink policy matrix: enforced")
diff --git a/testsuite/tests/path/operator-path-traversal-daemon.py b/testsuite/tests/path/operator-path-traversal-daemon.py
new file mode 100644
index 000000000..da9823644
--- /dev/null
+++ b/testsuite/tests/path/operator-path-traversal-daemon.py
@@ -0,0 +1,47 @@
+#!/usr/bin/env python3
+
+from harness.rsync import SCRATCHDIR, makepath, rmtree, run_rsync, start_test_daemon, test_fail, test_skipped, write_daemon_conf
+
+if ' ' in str(SCRATCHDIR):
+    test_skipped("rsyncd.conf exclude cannot represent a path containing spaces")
+
+protected = 'protected\n'
+base = SCRATCHDIR / 'operator-traversal'
+rmtree(base)
+base.mkdir()
+modules = []
+cases = []
+
+for name in ('destination', 'backup', 'partial'):
+    root = base / name
+    secret = root / 'secret'
+    source = root / 'work' / 'src'
+    destination = root / 'work' / 'destination'
+    makepath(secret, source / 'sub', destination)
+    victim = secret / 'f0'
+    victim.write_text(protected)
+    (source / 'f0').write_text('new\n')
+    if name == 'backup':
+        (destination / 'f0').write_text('old\n')
+    modules.append((name, {'path': '/', 'read only': 'no', 'exclude': f'{secret}/'}))
+    cases.append((name, root, source, destination, victim))
+
+url = start_test_daemon(write_daemon_conf(modules, name='operator-traversal.conf'), 12963)
+
+for name, root, source, destination, victim in cases:
+    relative = str(root).lstrip('/')
+    if name == 'destination':
+        args = ('-a', f'{source}/',
+                f'{url}{name}/{relative}/work/src/sub/../../../secret/')
+    elif name == 'backup':
+        args = ('-a', '--backup',
+                f'--backup-dir=/{relative}/work/src/sub/../../../secret/',
+                f'{source}/', f'{url}{name}/{relative}/work/destination')
+    else:
+        args = ('-a', f'--partial-dir=/{relative}/work/src/sub/../../../secret/',
+                f'{source}/', f'{url}{name}/{relative}/work/destination')
+    run_rsync(*args, check=False)
+    if not victim.exists() or victim.read_text() != protected:
+        test_fail(f'{name}: traversal reached the excluded subtree')
+
+print('operator paths cannot traverse into excluded daemon paths')
diff --git a/testsuite/tests/path/password-file-symlink.py b/testsuite/tests/path/password-file-symlink.py
new file mode 100644
index 000000000..7d0afd7ef
--- /dev/null
+++ b/testsuite/tests/path/password-file-symlink.py
@@ -0,0 +1,98 @@
+#!/usr/bin/env python3
+
+import os
+import pwd
+import subprocess
+
+from harness.rsync import (
+    FROMDIR, SCRATCHDIR, make_tree, makepath, rmtree, rsync_argv,
+    start_test_daemon, test_fail, test_skipped, write_daemon_conf,
+)
+
+DAEMON_PORT = 12902
+USER = 'tuser'
+CORRECT_PASSWORD = 'correctpass'
+
+if os.geteuid() != 0:
+    test_skipped("requires root to plant a symlink owned by a non-self uid "
+                 "(the attacker simulation)", capability='cross_uid')
+
+NOBODY_UID = None
+for name in ('nobody', 'nfsnobody', 'daemon'):
+    try:
+        u = pwd.getpwnam(name).pw_uid
+        if u != 0 and u != os.geteuid():
+            NOBODY_UID = u
+            break
+    except KeyError:
+        continue
+if NOBODY_UID is None:
+    test_skipped("no untrusted-uid user available for cross-uid plant", capability='cross_uid')
+
+os.environ['RSYNC_PASSWORD'] = 'env-fallback-wrong'
+
+src = FROMDIR
+rmtree(src)
+make_tree(src, depth=1)
+
+authdir = SCRATCHDIR / 'authdest'
+secrets = SCRATCHDIR / 'rsyncd.secrets'
+secrets.write_text(f'{USER}:{CORRECT_PASSWORD}\n')
+secrets.chmod(0o600)
+
+conf = write_daemon_conf([
+    ('auth', {'path': authdir, 'read only': 'no',
+              'auth users': USER, 'secrets file': secrets}),
+])
+url = start_test_daemon(conf, DAEMON_PORT)
+userurl = url.replace('rsync://', f'rsync://{USER}@', 1)
+
+victim = SCRATCHDIR / 'victim_password'
+victim.write_text(CORRECT_PASSWORD + '\n')
+victim.chmod(0o600)
+
+def push_with_pwfile(pwfile_path):
+    rmtree(authdir)
+    makepath(authdir)
+    return subprocess.run(
+        rsync_argv('-a', f'--password-file={pwfile_path}',
+                   f'{src}/', f'{userurl}auth/'),
+        stdout=subprocess.DEVNULL, stderr=subprocess.PIPE, text=True)
+
+real_pwfile = SCRATCHDIR / 'real_pwfile'
+real_pwfile.write_text(CORRECT_PASSWORD + '\n')
+real_pwfile.chmod(0o600)
+
+sanity = push_with_pwfile(real_pwfile)
+if sanity.returncode != 0:
+    test_fail(
+        "sanity check failed: a non-symlinked password file with the correct "
+        f"password could not authenticate. stderr: {sanity.stderr!r}")
+
+plants = SCRATCHDIR / 'plants'
+rmtree(plants)
+plants.mkdir()
+leaf_plant = plants / 'pwfile_leaf'
+os.symlink(victim, leaf_plant)
+os.lchown(leaf_plant, NOBODY_UID, NOBODY_UID)
+
+leaf = push_with_pwfile(leaf_plant)
+if leaf.returncode == 0:
+    test_fail(
+        f'--password-file authenticated with {victim} through untrusted uid '
+        f'{NOBODY_UID} symlink')
+
+real_target = plants / 'parent_real_target'
+real_target.mkdir()
+(real_target / 'victim_in_target').write_text(CORRECT_PASSWORD + '\n')
+os.chmod(real_target / 'victim_in_target', 0o600)
+
+parent_plant = plants / 'parent_link'
+os.symlink(real_target, parent_plant)
+os.lchown(parent_plant, NOBODY_UID, NOBODY_UID)
+
+parent = push_with_pwfile(parent_plant / 'victim_in_target')
+if parent.returncode == 0:
+    test_fail(
+        f'--password-file authenticated through untrusted uid {NOBODY_UID} '
+        f'parent symlink {parent_plant} -> {real_target}')
diff --git a/testsuite/pseudo-paths-daemon_test.py b/testsuite/tests/path/pseudo-paths-daemon.py
similarity index 77%
rename from testsuite/pseudo-paths-daemon_test.py
rename to testsuite/tests/path/pseudo-paths-daemon.py
index f6d2d869e..0f955ea0e 100644
--- a/testsuite/pseudo-paths-daemon_test.py
+++ b/testsuite/tests/path/pseudo-paths-daemon.py
@@ -1,6 +1,7 @@
-"""Regression test for daemon log file silent failures with process substitution and pipes."""
+#!/usr/bin/env python3
 
 import os
+import shlex
 import signal
 import shutil
 import socket
@@ -10,27 +11,24 @@
 import time
 from pathlib import Path
 
-from rsyncfns import makepath, rmtree, rsync_argv, test_fail, test_skipped
+from harness.rsync import makepath, rmtree, rsync_argv, rsync_command_binary, test_fail, test_skipped
 
 if not sys.platform.startswith('linux'):
-    test_skipped('Namespace daemon testing is a Linux-specific feature')
+    test_skipped('Namespace daemon testing is a Linux-specific feature', capability='proc_fd')
     raise SystemExit(0)
 
 bash = shutil.which('bash')
 if not bash:
-    test_skipped('bash is not installed')
+    test_skipped('bash is not installed', capability='proc_fd')
     raise SystemExit(0)
 
-# runtests.py exports POSIXLY_CORRECT=1, and bash before 5.1 disables process
-# substitution in POSIX mode -- the very syntax bash is required for here.
 bash_env = {k: v for k, v in os.environ.items() if k != 'POSIXLY_CORRECT'}
 probe_bash = subprocess.run([bash, '-c', 'echo "probe" > >(cat > /dev/null)'], env=bash_env, capture_output=True)
 if probe_bash.returncode != 0:
-    test_skipped('bash process substitution is not supported on this system')
+    test_skipped('bash process substitution is not supported on this system', capability='proc_fd')
     raise SystemExit(0)
 
 def kill_daemon(proc):
-    """Safely terminate the daemon process group if it is still running."""
     if proc.poll() is not None:
         return
     try:
@@ -58,15 +56,12 @@ def kill_daemon(proc):
     tf.write_text('data\n')
     tf.chmod(0o777)
 
-    rsync_bin = rsync_argv()[0]
+    rsync_bin = rsync_command_binary()
     if not Path(rsync_bin).exists():
         test_fail(f"rsync binary not found at {rsync_bin}")
 
     base_port = 20000 + (os.getpid() % 10000)
 
-    # -------------------------------------------------------------------------
-    # TEST 1: Host Daemon (Normal Root) with > >(...) process substitution
-    # -------------------------------------------------------------------------
     port_host = base_port
     print(f"Running Test 1: Host Daemon (Normal Root) with > >(cat > out) (Port {port_host})...", flush=True)
 
@@ -86,31 +81,34 @@ def kill_daemon(proc):
 use chroot = no
 """)
 
-    cmd_host = f"{rsync_bin} --daemon --no-detach --config={conf_host} --port={port_host} --address=127.0.0.1 > >(cat > {out_host}) 2> {err_host} < /dev/null"
-    
-    # Executes directly as the host user
+    daemon_host_argv = rsync_argv(
+        '--daemon', '--no-detach', f'--config={conf_host}',
+        f'--port={port_host}', '--address=127.0.0.1',
+    )
+    cmd_host = (f'{shlex.join(daemon_host_argv)} '
+                f'> >(cat > {shlex.quote(str(out_host))}) '
+                f'2> {shlex.quote(str(err_host))} < /dev/null')
+
     daemon_host = subprocess.Popen([bash, '-c', cmd_host], env=bash_env, start_new_session=True)
-    
+
     try:
-        # Bounded readiness polling (Wait for daemon to bind to the port)
         for _ in range(50):
             if daemon_host.poll() is not None:
                 test_fail("Host Daemon crashed immediately upon startup.")
             try:
                 with socket.create_connection(('127.0.0.1', port_host), timeout=0.1):
-                    break # Port is open, daemon is ready
+                    break
             except OSError:
                 time.sleep(0.1)
         else:
             test_fail("Host Daemon failed to bind to port within the timeout period.")
 
-        client_cmd_host = [rsync_bin, '-a', str(ws_src) + '/', f'rsync://127.0.0.1:{port_host}/test-from/']
+        client_cmd_host = rsync_argv('-a', str(ws_src) + '/', f'rsync://127.0.0.1:{port_host}/test-from/')
         client_proc = subprocess.run(client_cmd_host, capture_output=True, text=True)
-        
+
         if client_proc.returncode != 0:
             test_fail(f"Client transfer failed against Host Daemon. Stderr: {client_proc.stderr.strip()}")
 
-        # Poll up to a second for logs to flush through the pipe
         for _ in range(10):
             out_host_data = out_host.read_text() if out_host.exists() else ""
             if "rsyncd version" in out_host_data and "test-from" in out_host_data:
@@ -128,9 +126,6 @@ def kill_daemon(proc):
 
     print("Test 1 Passed: Daemon successfully logged to out file on host.", flush=True)
 
-    # -------------------------------------------------------------------------
-    # TEST 2 SETUP: Namespace capabilities and configuration
-    # -------------------------------------------------------------------------
     unshare = shutil.which('unshare')
     if not unshare:
         print("Test 2 Skipped: unshare is not installed", flush=True)
@@ -168,9 +163,6 @@ def kill_daemon(proc):
     shutil.copy2(rsync_bin, ns_rsync_bin)
     ns_rsync_bin.chmod(0o777)
 
-    # -------------------------------------------------------------------------
-    # TEST 2: Namespace Daemon with > >(...) process substitution
-    # -------------------------------------------------------------------------
     port_ns = base_port + 1
     print(f"Running Test 2: Namespace Daemon inside unshare --user (Port {port_ns})...", flush=True)
 
@@ -190,18 +182,24 @@ def kill_daemon(proc):
 use chroot = no
 """)
 
-    cmd_ns = f"{ns_rsync_bin} --daemon --no-detach --config={conf_ns} --port={port_ns} --address=127.0.0.1 > >(cat > {out_ns}) 2> {err_ns} < /dev/null"
-    
+    daemon_ns_argv = [
+        str(ns_rsync_bin), '--daemon', '--no-detach', f'--config={conf_ns}',
+        f'--port={port_ns}', '--address=127.0.0.1',
+    ]
+    cmd_ns = (f'{shlex.join(daemon_ns_argv)} '
+              f'> >(cat > {shlex.quote(str(out_ns))}) '
+              f'2> {shlex.quote(str(err_ns))} < /dev/null')
+
     namespace_cmd = launcher + unshare_argv + [bash, '-c', cmd_ns]
     daemon_ns = subprocess.Popen(namespace_cmd, env=bash_env, stdin=subprocess.DEVNULL, start_new_session=True)
-    
+
     try:
         for _ in range(50):
             if daemon_ns.poll() is not None:
                 test_fail("Namespace Daemon crashed immediately upon startup.")
             try:
                 with socket.create_connection(('127.0.0.1', port_ns), timeout=0.1):
-                    break # Port is open, daemon is ready
+                    break
             except OSError:
                 time.sleep(0.1)
         else:
diff --git a/testsuite/pseudo-paths_test.py b/testsuite/tests/path/pseudo-paths.py
similarity index 74%
rename from testsuite/pseudo-paths_test.py
rename to testsuite/tests/path/pseudo-paths.py
index 2c0a5b25c..fe5c1a885 100644
--- a/testsuite/pseudo-paths_test.py
+++ b/testsuite/tests/path/pseudo-paths.py
@@ -1,4 +1,4 @@
-"""Process substitution /dev/fd/ write pipe pseudo-paths for --log-file must not crash and must successfully write logs, but must be rejected if confined root."""
+#!/usr/bin/env python3
 
 import os
 import shlex
@@ -8,30 +8,26 @@
 import tempfile
 from pathlib import Path
 
-from rsyncfns import (
-    SCRATCHDIR, makepath, rmtree, rsync_argv, test_fail, test_skipped,
+from harness.rsync import (
+    SCRATCHDIR, makepath, rmtree, rsync_argv, rsync_command_binary,
+    test_fail, test_skipped,
 )
 if not sys.platform.startswith('linux'):
-    test_skipped('Kernel pseudo-path string is a Linux-specific procfs feature')
+    test_skipped('Kernel pseudo-path string is a Linux-specific procfs feature', capability='proc_fd')
     raise SystemExit(0)
 
-# We require bash specifically because standard POSIX /bin/sh does not
-# guarantee support for >(...) process substitution syntax.
 bash = shutil.which('bash')
 if bash is None:
-    test_skipped('bash is unavailable, cannot test process substitution')
+    test_skipped('bash is unavailable, cannot test process substitution', capability='proc_fd')
 
-# runtests.py exports POSIXLY_CORRECT=1, and bash before 5.1 disables process
-# substitution in POSIX mode -- the very syntax bash is required for here.
 bash_env = {k: v for k, v in os.environ.items() if k != 'POSIXLY_CORRECT'}
-# Verify the host bash actually supports process substitution
 probe = subprocess.run(
     [bash, '-c', 'echo "probe" > >(cat > /dev/null)'],
     capture_output=True,
     env=bash_env,
 )
 if probe.returncode != 0:
-    test_skipped('bash process substitution is not supported on this system')
+    test_skipped('bash process substitution is not supported on this system', capability='proc_fd')
 
 base = Path(SCRATCHDIR / 'rsync-pseudo-path').resolve()
 src = base / 'src'
@@ -49,9 +45,6 @@
 log_path = shlex.quote(str(log_out))
 log_path_confined = shlex.quote(str(log_out_confined))
 
-# -------------------------------------------------------------------------
-# TEST 1: Unconfined process substitution (Should Succeed)
-# -------------------------------------------------------------------------
 bash_script = f"{rsync_base_cmd} -v --log-file=>(cat > {log_path}) {src_path} {dest_path}"
 
 try:
@@ -87,9 +80,6 @@
 
 print('Test 1 Passed: rsync successfully wrote logs to a process substitution pseudo-path')
 
-# -------------------------------------------------------------------------
-# TEST 2: Confined Root (Should Reject Pseudo-path)
-# -------------------------------------------------------------------------
 bash_script_confined = f"{rsync_base_cmd} --confine-root={dest_path} -v --log-file=>(cat > {log_path_confined}) {src_path} {dest_path}"
 
 try:
@@ -106,7 +96,6 @@
 
 ctx_confined = f'rc={proc_confined.returncode}, stderr={proc_confined.stderr.strip()!r}'
 
-# Rsync considers log-file failure a warning, so it still exits 0.
 stderr_lower = proc_confined.stderr.lower()
 if "no such file or directory" in stderr_lower and "failed to open" in stderr_lower:
     if log_out_confined.exists() and log_out_confined.stat().st_size > 0:
@@ -117,7 +106,6 @@
     rmtree(base)
     test_fail(f'rsync failed to reject the pseudo-path or had an unexpected error ({ctx_confined})')
 
-# A pseudo-path is valid only when its descriptor number is the final component.
 rmtree(dest)
 makepath(dest)
 trailing_script = (
@@ -143,17 +131,12 @@
     rmtree(base)
     test_fail('transfer continued after accepting a trailing pseudo-path component')
 
-# -------------------------------------------------------------------------
-# TEST 3: Standard I/O Symlinks (/dev/stdin, /dev/stdout) - Unconfined
-# -------------------------------------------------------------------------
 print("Running Test 3: Standard I/O Symlinks (/dev/stdin)...", flush=True)
 
 rmtree(dest)
 makepath(dest)
 (src / 'stdin_test.txt').write_text('stdin data\n')
 
-# 3A: --files-from=/dev/stdin
-# Piping printf directly into rsync forces /dev/stdin to resolve to pipe:[N]
 stdin_script = f'printf "stdin_test.txt\\n" | {rsync_base_cmd} --files-from=/dev/stdin {src_path} {dest_path}'
 proc_stdin = subprocess.run([bash, '-c', stdin_script], env=bash_env, capture_output=True, text=True, timeout=10)
 
@@ -165,9 +148,6 @@
 
 print('Test 3A Passed: rsync successfully read files-from via /dev/stdin', flush=True)
 
-# -------------------------------------------------------------------------
-# TEST 3B: Nested Trusted Symlink to /dev/stdin
-# -------------------------------------------------------------------------
 rmtree(dest)
 makepath(dest)
 
@@ -175,59 +155,48 @@
 if symlink_list.is_symlink() or symlink_list.exists():
     symlink_list.unlink()
 
-# Create the trusted nested symlink pointing to the kernel pipe
 symlink_list.symlink_to('/dev/stdin')
 
 symlink_script = f'printf "stdin_test.txt\\n" | {rsync_base_cmd} --files-from={shlex.quote(str(symlink_list))} {src_path} {dest_path}'
 proc_symlink = subprocess.run([bash, '-c', symlink_script], env=bash_env, capture_output=True, text=True, timeout=10)
 
 if proc_symlink.returncode != 0:
-     test_fail(f'rsync failed with --files-from=rsync.list -> /dev/stdin (rc={proc_symlink.returncode}, stderr={proc_symlink.stderr.strip()!r})')
+    test_fail(f'/dev/stdin files-from symlink failed: rc={proc_symlink.returncode}, stderr={proc_symlink.stderr.strip()!r}')
 
 if not (dest / 'stdin_test.txt').is_file():
      test_fail(f'rsync failed to follow trusted symlink to /dev/stdin to read files-from list')
 
 print('Test 3B Passed: rsync successfully resolved a trusted nested symlink to /dev/stdin', flush=True)
 
-# -------------------------------------------------------------------------
-# TEST 3C: Spoofed Relative Path to Pseudo-pipe (Spoofed dev/fd/x)
-# -------------------------------------------------------------------------
 print("Running Test 3C: Spoofed Relative Path to Pseudo-pipe (dev/fd/99)...", flush=True)
 
 rmtree(dest)
 makepath(dest)
 
-# Create a local, relative 'dev/fd' structure inside our working directory
 spoofed_dev_fd = base / 'dev' / 'fd'
 makepath(spoofed_dev_fd)
 
-# Create a real file called 'pipe:[' with valid data
 spoofed_target = spoofed_dev_fd / 'pipe:['
 spoofed_target.write_text('transfer_me.txt\n')
 
-# Create a symlink named '99' that points to the literal file 'pipe:['
 spoofed_symlink = spoofed_dev_fd / '99'
 if spoofed_symlink.is_symlink() or spoofed_symlink.exists():
     spoofed_symlink.unlink()
 spoofed_symlink.symlink_to('pipe:[')
 
-# Run rsync using --files-from targeting the spoofed path.
 spoofed_script = f'cd {shlex.quote(str(base))} && {rsync_base_cmd} --files-from=dev/fd/99 {src_path} {dest_path}'
 proc_spoofed = subprocess.run([bash, '-c', spoofed_script], env=bash_env, capture_output=True, text=True, timeout=10)
 
 stderr_lower = proc_spoofed.stderr.lower()
 
 if "levels of symbolic links" in stderr_lower or "eloop" in stderr_lower:
-    test_fail(f'rsync failed with non-expected ELOOP error. The spoofed path was not treated as a normal file. (rc={proc_spoofed.returncode}, stderr={proc_spoofed.stderr.strip()!r})')
+    test_fail(f'spoofed pseudo-path returned ELOOP: rc={proc_spoofed.returncode}, stderr={proc_spoofed.stderr.strip()!r}')
 
 if proc_spoofed.returncode != 0:
     test_fail(f'rsync unexpectedly did not complete the transfer! (stderr={proc_spoofed.stderr.strip()!r})')
 
 print('Test 3C Passed: rsync correctly treated the un-anchored spoofed path as a normal file rather than a kernel pseudo-path.', flush=True)
 
-# -------------------------------------------------------------------------
-# SETUP FOR NAMESPACE TESTS (TEST 4)
-# -------------------------------------------------------------------------
 unshare = shutil.which('unshare')
 if unshare is None:
     print('unshare is unavailable')
@@ -257,7 +226,6 @@
     print(f'user namespaces unavailable (rc={probe.returncode})')
     raise SystemExit(0)
 
-# Verify the namespace exposes the overflow UID using the exact logic from the original test
 check_ns = (
     "import os\n"
     "proc_uid = os.lstat('/proc/self').st_uid\n"
@@ -270,7 +238,6 @@
     print('/proc/self does not expose an overflow uid in this namespace')
     raise SystemExit(0)
 
-# Pivot workspace for dropped root privileges
 ws_base = Path(tempfile.mkdtemp(prefix='rsync-unshare-'))
 ws_base.chmod(0o777)
 
@@ -290,17 +257,13 @@
     sf.chmod(0o777)
 
     local_bin = ws_base / 'rsync-bin'
-    shutil.copy2(rsync_argv()[0], local_bin)
+    shutil.copy2(rsync_command_binary(), local_bin)
     local_bin.chmod(0o777)
 
     cmd_prefix = shlex.join([str(local_bin), '-a'])
     s_path = shlex.quote(str(ws_src) + '/')
     d_path = shlex.quote(str(ws_dest) + '/')
 
-    # -------------------------------------------------------------------------
-    # TEST 4A: User Namespace Overflow UID with Process Substitution
-    # -------------------------------------------------------------------------
-    # Use process substitution <(...) which resolves to /dev/fd/N
     inner_script_4a = f'{cmd_prefix} --no-o --no-g --files-from=<(printf "stdin_test.txt\\n") {s_path} {d_path}'
     unshare_cmd_4a = launcher + unshare_argv + [bash, '-c', inner_script_4a]
 
@@ -322,10 +285,6 @@
 
     print('Test 4A Passed: rsync successfully resolved process substitution pseudo-paths inside user namespace', flush=True)
 
-    # -------------------------------------------------------------------------
-    # TEST 4B: Nested Trusted Symlink to /dev/stdin in User Namespace
-    # -------------------------------------------------------------------------
-    # Clear the destination so we have fresh files to transfer
     rmtree(ws_dest)
     makepath(ws_dest)
     ws_dest.chmod(0o777)
@@ -334,7 +293,6 @@
     if symlink_list_ns.is_symlink() or symlink_list_ns.exists():
         symlink_list_ns.unlink()
 
-    # Create the trusted nested symlink pointing to the kernel pipe
     symlink_list_ns.symlink_to('/dev/stdin')
 
     if os.geteuid() == 0:
@@ -353,7 +311,7 @@
     ctx_unshare_4b = f'rc={proc_unshare_4b.returncode}, stderr={proc_unshare_4b.stderr.strip()!r}'
     if proc_unshare_4b.returncode != 0:
         test_fail(f'rsync failed with --files-from=rsync.list -> /dev/stdin inside user namespace ({ctx_unshare_4b})')
-    
+
     if not (ws_dest / 'stdin_test.txt').is_file():
         test_fail(f'rsync failed to transfer the file specified via nested /dev/stdin symlink in namespace ({ctx_unshare_4b})')
     print('Test 4B Passed: rsync successfully resolved a trusted nested symlink to /dev/stdin in user namespace', flush=True)
diff --git a/testsuite/tests/path/relative-content.py b/testsuite/tests/path/relative-content.py
new file mode 100644
index 000000000..73244d590
--- /dev/null
+++ b/testsuite/tests/path/relative-content.py
@@ -0,0 +1,24 @@
+#!/usr/bin/env python3
+
+from harness.rsync import SCRATCHDIR, makepath, rmtree, run_rsync, test_fail
+
+base = SCRATCHDIR / 'relcontent'
+src = base / 'src' / 'sub'
+dest = base / 'dest'
+rmtree(base)
+makepath(src, dest)
+
+payload = 'hello relative content\n'
+(src / 'file').write_text(payload)
+
+abs_file = str((src / 'file').resolve())
+run_rsync('-aR', abs_file, str(dest) + '/')
+
+landed = dest / abs_file.lstrip('/')
+if not landed.is_file():
+    test_fail(f"rsync -aR did not create {landed} (only the tree, no file?)")
+got = landed.read_text()
+if got != payload:
+    test_fail(f"rsync -aR transferred empty/wrong content: {got!r} != {payload!r}")
+
+print("relative-content: rsync -aR transfers file content for an absolute source")
diff --git a/testsuite/relative-implied-symlink_test.py b/testsuite/tests/path/relative-implied-symlink.py
similarity index 53%
rename from testsuite/relative-implied-symlink_test.py
rename to testsuite/tests/path/relative-implied-symlink.py
index 7a06dc0e6..bb0ac3076 100644
--- a/testsuite/relative-implied-symlink_test.py
+++ b/testsuite/tests/path/relative-implied-symlink.py
@@ -1,21 +1,9 @@
-"""Pin that `-R`/`--relative` materializes implied parent dirs as REAL
-directories even when a sending-side path element is a symlink.
-
-The rsync(1) `--relative` entry claims: "Beginning with rsync 3.0.0, rsync
-always sends these implied directories as real directories in the file list,
-even if a path element is really a symlink on the sending side.  This prevents
-some really unexpected behaviors..."  This test checks the "always" by making an
-implied path element a symlink on the sender and confirming the receiver creates
-it as a real directory (not a symlink), so the deep file lands under a real dir.
-
-Pure local client behaviour: no daemon/root/tcp.  Cross-version: expected
-identical against --rsync-bin=old_versions/rsync_3.2.7 (3.2.7 >= 3.0.0).
-"""
+#!/usr/bin/env python3
 
 import os
 import subprocess
 
-from rsyncfns import SCRATCHDIR, rmtree, rsync_argv, test_fail
+from harness.rsync import SCRATCHDIR, rmtree, rsync_argv, test_fail
 
 base = SCRATCHDIR / 'relative-implied'
 rmtree(base)
@@ -24,12 +12,11 @@
 src = base / 'src'
 (src / 'realdir').mkdir(parents=True)
 (src / 'realdir' / 'file').write_text('F\n')
-os.symlink('realdir', src / 'link')        # 'link' is a symlink path element
+os.symlink('realdir', src / 'link')
 
 dst = base / 'dst'
 rmtree(dst)
 dst.mkdir()
-# Transfer through the symlink path element with -R: src/./link/file
 subprocess.run(rsync_argv('-a', '-R', f'{src}/./link/file', f'{dst}/'),
                stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
 
diff --git a/testsuite/relative-implied_test.py b/testsuite/tests/path/relative-implied.py
similarity index 51%
rename from testsuite/relative-implied_test.py
rename to testsuite/tests/path/relative-implied.py
index 81d423b5c..4c5d335f9 100644
--- a/testsuite/relative-implied_test.py
+++ b/testsuite/tests/path/relative-implied.py
@@ -1,41 +1,28 @@
 #!/usr/bin/env python3
-"""Coverage of -R implied directories and --no-implied-dirs at depth.
-
-With -R the directories implied by a source path are recreated at the
-destination AND have their attributes mirrored from the source. With
---no-implied-dirs those implied directories are still created as needed but get
-default attributes instead of the source's. Verify the distinction on an
-implied directory carrying a non-default mode, several levels deep.
-"""
 
 import os
 
-from rsyncfns import (
+from harness.rsync import (
     SCRATCHDIR, TODIR,
     assert_mode, assert_same, forced_protocol, makepath, rmtree, run_rsync,
 )
 
-os.umask(0o022)        # make the default implied-dir mode deterministic (0o755)
+os.umask(0o022)
 
 base = SCRATCHDIR / 'rbase'
 rmtree(base)
 rmtree(TODIR)
 makepath(base / 'a' / 'b' / 'c')
-os.chmod(base / 'a' / 'b', 0o750)         # distinctive mode on an implied dir
+os.chmod(base / 'a' / 'b', 0o750)
 (base / 'a' / 'b' / 'c' / 'file').write_text("data\n")
 
 os.chdir(base / 'a')
 
-# -R: implied dirs b and c are recreated with the source's attributes.
 run_rsync('-aR', 'b/c/file', f'{TODIR}/')
 assert_mode(TODIR / 'b', 0o750, label='-R mirrors implied-dir mode')
 assert_same(TODIR / 'b' / 'c' / 'file', base / 'a' / 'b' / 'c' / 'file',
             label='-R deep file')
 
-# --no-implied-dirs: implied dir b is created with default (not source) attrs.
-# At protocol 29 the generator rejects a multi-component path that has no
-# transmitted directory entries ("invalid path from sender"), so this half is
-# protocol-30+.
 proto = forced_protocol()
 if proto is not None and proto < 30:
     print(f"relative-implied: protocol {proto} -- skipping --no-implied-dirs "
@@ -43,9 +30,6 @@
 else:
     rmtree(TODIR)
     run_rsync('-aR', '--no-implied-dirs', 'b/c/file', f'{TODIR}/')
-    # The implied dir must get the default mode (0o777 & ~umask == 0o755),
-    # not the source's distinctive 0750 -- assert the exact mode, not merely
-    # "different from 0750".
     assert_mode(TODIR / 'b', 0o755,
                 label='--no-implied-dirs uses the default mode, not source 0750')
     assert_same(TODIR / 'b' / 'c' / 'file', base / 'a' / 'b' / 'c' / 'file',
diff --git a/testsuite/tests/path/relative-mkpath-symlink.py b/testsuite/tests/path/relative-mkpath-symlink.py
new file mode 100644
index 000000000..ac57b1bdf
--- /dev/null
+++ b/testsuite/tests/path/relative-mkpath-symlink.py
@@ -0,0 +1,24 @@
+#!/usr/bin/env python3
+
+import subprocess
+
+from harness.rsync import SCRATCHDIR, rmtree, rsync_argv, test_fail
+
+for kind, relative in (('file', 'A/B/file'), ('directory', 'A/B/C/')):
+    base = SCRATCHDIR / kind
+    source = base / 'source'
+    destination = base / 'destination'
+    outside = base / 'outside'
+    rmtree(base)
+    (source / 'A' / 'B' / 'C').mkdir(parents=True)
+    (source / 'A' / 'B' / 'file').write_text('payload\n')
+    (source / 'A' / 'B' / 'C' / 'file').write_text('payload\n')
+    destination.mkdir()
+    outside.mkdir()
+    (destination / 'A').symlink_to(outside)
+    subprocess.run(rsync_argv('-aR', '--no-implied-dirs', f'{source}/./{relative}',
+                              f'{destination}/'),
+                   stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
+    leaked = list(outside.iterdir())
+    if leaked:
+        test_fail(f'{kind}: --relative parent creation escaped through a symlink: {leaked}')
diff --git a/testsuite/relative_test.py b/testsuite/tests/path/relative-paths.py
similarity index 61%
rename from testsuite/relative_test.py
rename to testsuite/tests/path/relative-paths.py
index 123189c12..063e24b5e 100644
--- a/testsuite/relative_test.py
+++ b/testsuite/tests/path/relative-paths.py
@@ -1,67 +1,46 @@
 #!/usr/bin/env python3
-# Python rewrite of testsuite/relative.test.
-#
-# Exercise rsync --relative (-R) behaviour: paths anchored at a "./" cut
-# point should reproduce that subtree at the destination. We pile on
-# hard-link preservation, --del / --del-on-extras and the side-by-side
-# combination of an -R-anchored arg with an absolute "extra" path.
 
 import os
+import shutil
 import subprocess
-import time
 
-from rsyncfns import (
+from harness import rsync
+from harness.rsync import (
     CHKDIR, FROMDIR, OUTFILE, TMPDIR, TODIR,
     checkit, hands_setup, makepath, rsync_argv,
     run_rsync, test_fail,
 )
 
-
 deepstr = 'down/3/deep'
 deepdir = FROMDIR / deepstr
 extradir = TMPDIR / 'extra'
 
 makepath(deepdir, extradir / deepstr, CHKDIR)
 
-# Generate the rich source tree underneath the deep nested dir, not under
-# fromdir directly. hands_setup reads FROMDIR from the module, so override
-# briefly via the rsyncfns module attribute.
-import rsyncfns
-real_fromdir = rsyncfns.FROMDIR
+real_fromdir = rsync.FROMDIR
 try:
-    rsyncfns.FROMDIR = deepdir
+    rsync.FROMDIR = deepdir
     hands_setup()
 finally:
-    rsyncfns.FROMDIR = real_fromdir
+    rsync.FROMDIR = real_fromdir
 
 extrafile = extradir / deepstr / 'extra.added.value'
 extrafile.write_text("wowza\n")
-# rsync's -R uses "./" as the anchor cut point: anything after it is the
-# subtree path to recreate at the destination. Preserve the literal "./"
-# in the string we pass to rsync, separately from the Path we use for
-# filesystem operations.
 extrafile_for_rsync = f"{extradir}/./{deepstr}/extra.added.value"
 
-# Seed extradir with just the directory skeleton of fromdir.
 run_rsync('-av', '--existing', '--include=*/', '--exclude=*',
           f'{FROMDIR}/', f'{extradir}/')
 
 os.chdir(FROMDIR)
 
-# chkdir: same shape as a --include=/down/ --exclude=/* sync of fromdir.
 run_rsync('-ai', '--include=/down/', '--exclude=/*',
           f'{FROMDIR}/', f'{CHKDIR}/')
 
-time.sleep(1)
-
 print("Test basic relative:")
 checkit(['-avR', f'./{deepstr}', str(TODIR)], CHKDIR, TODIR)
 
-# Add a hard link inside the source and the chk dir; mirror it on both
-# sides so the --delete pass below doesn't see it as new on either tree.
 os.link(deepdir / 'filelist', deepdir / 'dir' / 'filelist')
 os.link(CHKDIR / deepstr / 'filelist', CHKDIR / deepstr / 'dir' / 'filelist')
-# Re-touch both dirs so the inner-dir time matches.
 src_t = (deepdir / 'dir').stat().st_mtime
 os.utime(deepdir / 'dir', (src_t, src_t))
 os.utime(CHKDIR / deepstr / 'dir', (src_t, src_t))
@@ -69,9 +48,6 @@
 print("Test hard links:")
 checkit(['-avHR', f'./{deepstr}/', str(TODIR)], CHKDIR, TODIR)
 
-# Drop some stray files at the dest then re-sync with --del to confirm
-# they're removed.
-import shutil
 shutil.copy(deepdir / 'text', TODIR / deepstr / 'ThisShouldGo')
 shutil.copy(deepdir / 'text', TODIR / deepstr / 'dir' / 'ThisShouldGoToo')
 
@@ -79,8 +55,6 @@
 checkit(['-avHR', '--del', f'./{deepstr}/', str(TODIR)], CHKDIR, TODIR)
 
 print("Test non-deletion:")
-# Same as the previous pass but capture output to grep for spurious
-# 'deleting ' lines.
 proc = subprocess.run(
     rsync_argv('-aiHR', '--del', f'./{deepstr}/', str(TODIR)),
     capture_output=True, text=True,
@@ -92,7 +66,6 @@
 if 'deleting ' in proc.stdout:
     test_fail("Erroneous deletions occurred!")
 
-# Relative with merging.
 run_rsync('-ai', str(extradir / 'down'), f'{CHKDIR}/')
 
 print("Test merge:")
diff --git a/testsuite/relative-source-ancestor_test.py b/testsuite/tests/path/relative-source-ancestor.py
similarity index 99%
rename from testsuite/relative-source-ancestor_test.py
rename to testsuite/tests/path/relative-source-ancestor.py
index 3864ededc..40540f76a 100644
--- a/testsuite/relative-source-ancestor_test.py
+++ b/testsuite/tests/path/relative-source-ancestor.py
@@ -1,11 +1,10 @@
 #!/usr/bin/env python3
-"""Explicit source directory symlinks remain transfer roots."""
 
 import os
 import pwd
 import subprocess
 
-from rsyncfns import SCRATCHDIR, rsync_argv, test_fail
+from harness.rsync import SCRATCHDIR, rsync_argv, test_fail
 
 real = SCRATCHDIR / 'real'
 source = real / 'My_Documents'
diff --git a/testsuite/tests/path/relative-symlinked-parent.py b/testsuite/tests/path/relative-symlinked-parent.py
new file mode 100644
index 000000000..9cdfa42b6
--- /dev/null
+++ b/testsuite/tests/path/relative-symlinked-parent.py
@@ -0,0 +1,25 @@
+#!/usr/bin/env python3
+
+import subprocess
+
+from harness.rsync import SCRATCHDIR, assert_same, makepath, rmtree, rsync_argv, test_fail
+
+for name, alias, target in (
+    ('direct', 'link', 'real'),
+    ('dotdot', 'deep/alias', '../real'),
+):
+    base = SCRATCHDIR / name
+    source = base / 'src' / 'real' / 'sub' / 'file'
+    link = base / 'src' / alias
+    rmtree(base)
+    makepath(source.parent, link.parent, base / 'dest')
+    source.write_text('payload\n')
+    link.symlink_to(target)
+    argument = f'src/{alias}/sub/file'
+    subprocess.run(rsync_argv('-aR', argument, 'dest/'), cwd=base, check=True)
+    landed = base / 'dest' / argument
+    if not landed.is_file():
+        test_fail(f'{name}: -aR dropped a file below an in-tree symlink')
+    assert_same(source, landed, label=name)
+
+print('-aR follows in-tree symlinked parents')
diff --git a/testsuite/tests/path/rename-fullpath-symlink-race.py b/testsuite/tests/path/rename-fullpath-symlink-race.py
new file mode 100644
index 000000000..b5bc274c3
--- /dev/null
+++ b/testsuite/tests/path/rename-fullpath-symlink-race.py
@@ -0,0 +1,76 @@
+#!/usr/bin/env python3
+
+import os
+import subprocess
+import time
+
+from harness.mutation import race_budget
+from harness.rsync import SCRATCHDIR, rmtree, rsync_argv, test_fail
+
+base = SCRATCHDIR / f'rename-fullpath-{os.getpid()}'
+src = base / 'src'
+dest = base / 'dest'
+outside = base / 'outside'
+tmpd = base / 'tmpd'
+rmtree(base)
+(src / 'sub').mkdir(parents=True)
+for i in range(40):
+    (src / 'sub' / f'f{i}').write_text('payload\n')
+dest.mkdir()
+outside.mkdir()
+tmpd.mkdir()
+
+sub = dest / 'sub'
+link = dest / '.sublink'
+link.symlink_to(outside)
+
+def push():
+    subprocess.run(
+        rsync_argv('-a', f'--temp-dir={tmpd}', f'{src}/', f'{dest}/'),
+        stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL,
+    )
+
+rmtree(sub)
+sub.mkdir()
+push()
+if not (sub / 'f0').is_file():
+    test_fail("positive control: a normal --temp-dir push did not write files "
+              "into dest/sub, so the rename race window would be vacuous")
+for f in outside.iterdir():
+    f.unlink()
+
+flip_code = (
+    "import os, sys, time\n"
+    "sub, link = sys.argv[1], sys.argv[2]\n"
+    "scratch = sub + '.flip'\n"
+    "parent = os.getppid()\n"
+    "deadline = time.time() + 120\n"
+    "while time.time() < deadline and os.getppid() == parent:\n"
+    "    try:\n"
+    "        os.makedirs(sub, exist_ok=True)\n"
+    "        os.rename(sub, scratch); os.rename(link, sub); os.rename(scratch, link)\n"
+    "        os.rename(sub, scratch); os.rename(link, sub); os.rename(scratch, link)\n"
+    "    except OSError:\n"
+    "        pass\n"
+)
+flip = subprocess.Popen(['python3', '-c', flip_code, str(sub), str(link)])
+try:
+    deadline = time.monotonic() + race_budget(10.0)
+    while time.monotonic() < deadline:
+        rmtree(sub)
+        try:
+            sub.unlink()
+        except OSError:
+            pass
+        push()
+        escaped = sorted(p.name for p in outside.iterdir()
+                         if p.is_file() and not p.is_symlink())
+        if escaped:
+            test_fail(
+                f'final rename escaped the destination through a flipped symlink: {escaped}')
+finally:
+    flip.terminate()
+    try:
+        flip.wait(timeout=5)
+    except subprocess.TimeoutExpired:
+        flip.kill()
diff --git a/testsuite/rename-mixed-parent-escape-poc_test.py b/testsuite/tests/path/rename-mixed-parent-escape.py
similarity index 76%
rename from testsuite/rename-mixed-parent-escape-poc_test.py
rename to testsuite/tests/path/rename-mixed-parent-escape.py
index 3475a852a..6b1fffb52 100644
--- a/testsuite/rename-mixed-parent-escape-poc_test.py
+++ b/testsuite/tests/path/rename-mixed-parent-escape.py
@@ -1,20 +1,13 @@
 #!/usr/bin/env python3
-# Python rewrite of testsuite/rename-mixed-parent-escape-poc.test.
-#
-# PoC for the 3.4.3 do_rename_at() mixed-parent fallback. The helper
-# first runs an emulation of the vulnerable fallback to show the actual
-# module escape, then runs the live do_rename_at() against the same
-# shape to prove the fixed wrapper rejects it.
 
 import os
 import subprocess
 
-from rsyncfns import (
+from harness.rsync import (
     SCRATCHDIR, TOOLDIR,
     assert_exists, assert_not_exists, rmtree, test_fail, test_skipped,
 )
 
-
 mod = SCRATCHDIR / 'module'
 trap_outside = SCRATCHDIR / 'trap'
 rmtree(mod)
@@ -35,13 +28,11 @@
 if proc.returncode != 0:
     test_fail("t_rename_secure --poc reported failures (see stderr above)")
 
-# The PoC's emulation of the vulnerable fallback must have escaped the module.
 assert_exists(trap_outside / 'vuln-created',
               "PoC did not create outside file via vulnerable destination-parent rename")
 assert_exists(mod / 'vuln-stolen',
               "PoC did not move outside file into module via vulnerable source-parent rename")
 
-# The live (fixed) do_rename_at() must have refused every escape.
 assert_not_exists(trap_outside / 'fixed-created',
                   "fixed do_rename_at created outside file")
 assert_exists(mod / 'fixed-top-to-escape',
diff --git a/testsuite/rename-mixed-parent-symlink-race_test.py b/testsuite/tests/path/rename-mixed-parent-symlink-race.py
similarity index 72%
rename from testsuite/rename-mixed-parent-symlink-race_test.py
rename to testsuite/tests/path/rename-mixed-parent-symlink-race.py
index f5c25dd34..cdfcf8368 100644
--- a/testsuite/rename-mixed-parent-symlink-race_test.py
+++ b/testsuite/tests/path/rename-mixed-parent-symlink-race.py
@@ -1,21 +1,13 @@
 #!/usr/bin/env python3
-# Python rewrite of testsuite/rename-mixed-parent-symlink-race.test.
-#
-# Regression test for do_rename_at() mixed top-level/slashed paths.
-# The 3.4.3 symlink-race hardening opened both rename parents under
-# secure_relative_open() only when both paths contained a slash. If one
-# side was top-level, the whole operation fell back to plain rename(),
-# allowing the slashed side's parent symlink to escape the module.
 
 import os
 import subprocess
 
-from rsyncfns import (
+from harness.rsync import (
     SCRATCHDIR, TOOLDIR,
     assert_exists, assert_not_exists, rmtree, test_fail, test_skipped,
 )
 
-
 mod = SCRATCHDIR / 'module'
 trap_outside = SCRATCHDIR / 'trap'
 rmtree(mod)
diff --git a/testsuite/tests/path/rename-mixed-parent-transfer.py b/testsuite/tests/path/rename-mixed-parent-transfer.py
new file mode 100644
index 000000000..2ffbcfc32
--- /dev/null
+++ b/testsuite/tests/path/rename-mixed-parent-transfer.py
@@ -0,0 +1,93 @@
+#!/usr/bin/env python3
+
+import os
+import subprocess
+
+from harness.mutation import find_attacker_uid
+from harness.rsync import (
+    SCRATCHDIR, rmtree, rsync_argv, start_test_daemon, test_fail, test_skipped,
+    write_daemon_conf,
+)
+
+if os.geteuid() != 0:
+    test_skipped("requires root to plant a backup-dir symlink owned by a non-self uid",
+                 capability='cross_uid')
+ATT_UID = find_attacker_uid()
+if ATT_UID is None:
+    test_skipped("no untrusted-uid user available for cross-uid plant", capability='cross_uid')
+
+DAEMON_PORT = 12903
+OLD = "INSIDE_MODULE_DATA\n"
+NEW = "NEW_PUSHED_DATA\n"
+
+mod = SCRATCHDIR / 'module'
+outside = SCRATCHDIR / 'outside'
+src = SCRATCHDIR / 'src_files'
+for d in (mod, outside, src):
+    rmtree(d)
+    d.mkdir(parents=True)
+
+(mod / 'foo').write_text(OLD)
+
+(src / 'foo').write_text(NEW)
+
+conf = write_daemon_conf([
+    ('upload', {'path': str(mod), 'use chroot': 'no', 'read only': 'no',
+                'uid': '0', 'gid': '0'}),
+])
+daemon_url = start_test_daemon(conf, DAEMON_PORT).rstrip('/')
+
+def push_with_backup():
+    return subprocess.run(
+        rsync_argv('-t', '--backup', '--backup-dir=bdir',
+                   f'{src}/foo', f'{daemon_url}/upload/'),
+        stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True)
+
+(mod / 'bdir').mkdir()
+proc = push_with_backup()
+if proc.returncode != 0:
+    test_fail("positive control: daemon --backup-dir transfer failed "
+              f"(rc={proc.returncode}):\n{proc.stdout or ''}")
+backup = mod / 'bdir' / 'foo'
+if not backup.is_file():
+    test_fail("positive control: --backup-dir=bdir did not create "
+              f"{backup}; the test would not exercise the backup rename path")
+if backup.read_text() != OLD:
+    test_fail("positive control: backup content differs from the original "
+              f"module/foo content: {backup.read_text()!r}")
+if (mod / 'foo').read_text() != NEW:
+    test_fail("positive control: module/foo was not overwritten by the "
+              "daemon transfer")
+
+rmtree(mod / 'bdir')
+(mod / 'foo').write_text(OLD)
+
+os.symlink(str(outside), mod / 'bdir')
+os.lchown(mod / 'bdir', ATT_UID, ATT_UID)
+
+proc = push_with_backup()
+attack_out = proc.stdout or ''
+
+if os.path.lexists(outside / 'foo'):
+    try:
+        got = (outside / 'foo').read_text().strip()
+    except OSError:
+        got = '<unreadable>'
+    test_fail("mixed-parent rename escaped the module: backup of module/foo "
+              f"landed in {outside}/foo (content: {got}); do_rename_at "
+              "followed the planted backup-dir symlink")
+
+leaked = os.listdir(outside)
+if leaked:
+    test_fail(f"unexpected files escaped the module into {outside}: {leaked}")
+
+try:
+    final = (mod / 'foo').read_text()
+except (OSError, UnicodeError) as exc:
+    test_fail("foreign-owned --backup-dir symlink transfer left module/foo "
+              f"unreadable ({exc!r}; rc={proc.returncode}):\n{attack_out}")
+if final == NEW:
+    test_fail("foreign-owned --backup-dir symlink transfer overwrote module/foo "
+              "without taking or refusing the backup through bdir; the "
+              f"--backup-dir path may not have been exercised "
+              f"(rc={proc.returncode}):\n{attack_out}")
diff --git a/testsuite/safe-arg-leak_test.py b/testsuite/tests/path/safe-arg-leak.py
similarity index 55%
rename from testsuite/safe-arg-leak_test.py
rename to testsuite/tests/path/safe-arg-leak.py
index 7412ea719..55947830a 100644
--- a/testsuite/safe-arg-leak_test.py
+++ b/testsuite/tests/path/safe-arg-leak.py
@@ -1,13 +1,8 @@
 #!/usr/bin/env python3
-# Regression test for KI-54: safe_arg() in filename mode (opt==NULL) must not leak
-# an uninitialized heap byte.  The escape counter and the writer disagreed on a
-# backslash before a wildcard / a trailing backslash (the strchr(WILD_CHARS,'\0')
-# NUL footgun), leaving a gap that strlen() walked into.  The t_safe_arg helper
-# links the real options.o, poisons the heap, and checks the quoting is exact.
 
 import subprocess
 
-from rsyncfns import TOOLDIR, test_fail, test_skipped
+from harness.rsync import TOOLDIR, test_fail, test_skipped
 
 helper = TOOLDIR / 't_safe_arg'
 if not helper.is_file():
diff --git a/testsuite/tests/path/safe-links-backup.py b/testsuite/tests/path/safe-links-backup.py
new file mode 100644
index 000000000..4bfb3a7fc
--- /dev/null
+++ b/testsuite/tests/path/safe-links-backup.py
@@ -0,0 +1,84 @@
+#!/usr/bin/env python3
+
+import os
+import subprocess
+
+from harness.rsync import SCRATCHDIR, rmtree, rsync_argv, test_fail
+
+base = SCRATCHDIR / 'safe-links-backup'
+
+ESCAPE_TARGET = '../../sensitive'
+
+def build():
+    rmtree(base)
+    src = base / 'src'
+    dest = base / 'dest'
+    src.mkdir(parents=True)
+    dest.mkdir(parents=True)
+    (src / 'keep.txt').write_text('source regular file\n')
+    (src / 'escape').write_text('replacement regular file\n')
+    os.symlink(ESCAPE_TARGET, dest / 'escape')
+    return src, dest
+
+def run(src, dest, *extra):
+    proc = subprocess.run(
+        rsync_argv('-a', '--backup', '--suffix=.bak', *extra,
+                   f'{src}/', f'{dest}/'),
+        stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True)
+    return proc
+
+src, dest = build()
+proc = run(src, dest, '--safe-links')
+if proc.returncode != 0:
+    test_fail("KI-72: rsync exited %d with --safe-links\n%s%s"
+              % (proc.returncode, proc.stdout, proc.stderr))
+
+bak = dest / 'escape.bak'
+if os.path.lexists(bak):
+    test_fail(
+        "KI-72: --safe-links was bypassed on the backup hard-link path: the "
+        "escaping symlink was backed up to %s (target %r) instead of being "
+        "dropped." % (bak, os.readlink(bak) if os.path.islink(bak) else '?'))
+
+if not (dest / 'escape').is_file():
+    test_fail("KI-72: the replacement regular file 'escape' was not transferred")
+
+src, dest = build()
+proc = run(src, dest)
+if proc.returncode != 0:
+    test_fail("KI-72: rsync exited %d without --safe-links\n%s%s"
+              % (proc.returncode, proc.stdout, proc.stderr))
+
+bak = dest / 'escape.bak'
+if not os.path.islink(bak):
+    test_fail("KI-72: without --safe-links the escaping symlink should have "
+              "been backed up, but %s is missing or not a symlink." % bak)
+if os.readlink(bak) != ESCAPE_TARGET:
+    test_fail("KI-72: backup symlink points to %r, expected %r"
+              % (os.readlink(bak), ESCAPE_TARGET))
+
+rmtree(base)
+src = base / 'src'
+dest = base / 'dest'
+src.mkdir(parents=True)
+dest.mkdir(parents=True)
+(src / 'keep.txt').write_text('source regular file\n')
+(src / 'link').write_text('replacement regular file\n')
+os.symlink('keep.txt', dest / 'link')
+
+proc = run(src, dest, '--safe-links')
+if proc.returncode != 0:
+    test_fail("KI-72: rsync exited %d backing up a safe symlink\n%s%s"
+              % (proc.returncode, proc.stdout, proc.stderr))
+
+bak = dest / 'link.bak'
+if not os.path.islink(bak):
+    test_fail("KI-72: a SAFE symlink was wrongly dropped from the backup area "
+              "under --safe-links (%s missing or not a symlink) -- the fix is "
+              "over-blocking." % bak)
+if os.readlink(bak) != 'keep.txt':
+    test_fail("KI-72: safe backup symlink points to %r, expected 'keep.txt'"
+              % os.readlink(bak))
+
+print("safe-links-backup: --safe-links drops an escaping symlink from the "
+      "backup area, preserves a safe one, while a plain --backup preserves both")
diff --git a/testsuite/tests/path/safe-links.py b/testsuite/tests/path/safe-links.py
new file mode 100644
index 000000000..2df8f8b2e
--- /dev/null
+++ b/testsuite/tests/path/safe-links.py
@@ -0,0 +1,113 @@
+#!/usr/bin/env python3
+
+import os
+
+from harness.rsync import SCRATCHDIR, rmtree, run_rsync, test_fail
+
+base = SCRATCHDIR / 'safe-links'
+rmtree(base)
+base.mkdir(parents=True)
+
+(base / 'sibling').write_text('SIBLING\n')
+
+tree = base / 'tree'
+tree.mkdir()
+(tree / 'file').write_text('FILE\n')
+(tree / 'sub').mkdir()
+(tree / 'sub' / 'subfile').write_text('SUBFILE\n')
+
+SHAPES = {
+    'rel-same-dir':   ('link_a', 'file'),
+    'rel-into-sub':   ('link_b', 'sub/subfile'),
+    'rel-up-inside':  ('sub/link_c', '../file'),
+    'rel-escape':     ('link_d', '../sibling'),
+    'rel-deep-escape':('sub/link_e', '../../sibling'),
+    'abs-target':     ('link_f', str(base / 'sibling')),
+    'abs-inside':     ('link_g', str(tree / 'file')),
+}
+for _name, (where, val) in SHAPES.items():
+    lp = tree / where
+    lp.parent.mkdir(parents=True, exist_ok=True)
+    os.symlink(val, lp)
+
+UNSAFE = {'rel-escape', 'rel-deep-escape', 'abs-target', 'abs-inside'}
+
+def run(*args):
+    run_rsync('-a', *args)
+
+def fresh(dst):
+    rmtree(dst)
+    dst.mkdir(parents=True)
+
+mismatches = []
+
+dst = base / 'plain'
+fresh(dst)
+run(f'{tree}/', f'{dst}/')
+for name, (where, value) in SHAPES.items():
+    path = dst / where
+    if not path.is_symlink() or os.readlink(path) != value:
+        mismatches.append(f'default {name}: symlink was not preserved')
+
+dst = base / 'safe_dst'
+fresh(dst)
+run('--safe-links', f'{tree}/', f'{dst}/')
+for name, (where, _val) in SHAPES.items():
+    present = (dst / where).is_symlink()
+    want_present = name not in UNSAFE
+    if present != want_present:
+        mismatches.append(f'--safe-links {name}: present={present}, expected={want_present}')
+
+dst = base / 'copy_dst'
+fresh(dst)
+run('--copy-unsafe-links', f'{tree}/', f'{dst}/')
+for name, (where, _val) in SHAPES.items():
+    p = dst / where
+    is_link = p.is_symlink()
+    is_file = p.is_file() and not is_link
+    if name in UNSAFE:
+        ok = is_file
+    else:
+        ok = is_link
+    if not ok:
+        mismatches.append(f'--copy-unsafe-links {name}: link={is_link}, file={is_file}')
+
+dst = base / 'copy-all'
+fresh(dst)
+run('--copy-links', f'{tree}/', f'{dst}/')
+for name, (where, _value) in SHAPES.items():
+    path = dst / where
+    if not path.is_file() or path.is_symlink():
+        mismatches.append(f'--copy-links {name}: target was not copied')
+
+dst = base / 'cut_inside'
+fresh(dst)
+run('--safe-links', f'{tree}/', f'{dst}/')
+kept_inside = (dst / 'sub' / 'link_c').is_symlink()
+if not kept_inside:
+    mismatches.append('sub/link_c should be safe from the tree root')
+
+dst = base / 'cut_sub'
+fresh(dst)
+run('--safe-links', f'{tree}/sub/', f'{dst}/')
+kept_sub = (dst / 'link_c').is_symlink()
+if kept_sub:
+    mismatches.append('link_c should be unsafe from the subdirectory root')
+
+for index, (source, cwd) in enumerate((('tree/', base), (str(tree.resolve()) + '/', None))):
+    dst = base / f'path-{index}'
+    fresh(dst)
+    saved = os.getcwd()
+    if cwd:
+        os.chdir(cwd)
+    try:
+        run('--copy-unsafe-links', source, str(dst))
+    finally:
+        os.chdir(saved)
+    if not (dst / 'link_d').is_file() or (dst / 'link_d').is_symlink():
+        mismatches.append(f'path form {index}: unsafe link was not copied')
+
+if mismatches:
+    test_fail('safe-link behaviour changed:\n  ' + '\n  '.join(mismatches))
+
+print('safe-link behaviour verified')
diff --git a/testsuite/search-only-held-dirfd_test.py b/testsuite/tests/path/search-only-held-dirfd.py
similarity index 78%
rename from testsuite/search-only-held-dirfd_test.py
rename to testsuite/tests/path/search-only-held-dirfd.py
index e4da46fbf..ac8bd0f81 100644
--- a/testsuite/search-only-held-dirfd_test.py
+++ b/testsuite/tests/path/search-only-held-dirfd.py
@@ -1,11 +1,4 @@
 #!/usr/bin/env python3
-"""Known-name operations must not require permission to list parent dirs.
-
-The confined resolver holds directory descriptors to prevent symlink races.
-On Linux, those traversal and *at() anchor descriptors can use O_PATH: opening
-a known file beneath a searchable directory, or creating one beneath a
-writable/searchable directory, does not require directory read permission.
-"""
 
 import os
 import shutil
@@ -14,18 +7,19 @@
 import tempfile
 from pathlib import Path
 
-from rsyncfns import (
-    SCRATCHDIR, forced_protocol, rmtree, rsync_argv, test_fail, test_skipped,
+from harness.rsync import (
+    SCRATCHDIR, forced_protocol, rmtree, rsync_argv, rsync_argv_for,
+    rsync_command_binary, test_fail, test_skipped, under_valgrind,
 )
 
 if not sys.platform.startswith('linux'):
-    test_skipped('search-only held-dirfd coverage is Linux-specific')
+    test_skipped('search-only held-dirfd coverage is Linux-specific', capability='search_only')
 
 launcher = []
 if os.geteuid() == 0:
     setpriv = shutil.which('setpriv')
     if setpriv is None:
-        test_skipped('setpriv is unavailable for the root-run testsuite')
+        test_skipped('setpriv is unavailable for the root-run testsuite', capability='search_only')
     launcher = [setpriv, '--reuid=65534', '--regid=65534', '--clear-groups']
 
 external_base = os.geteuid() == 0
@@ -46,6 +40,8 @@
 write_only_dest = base / 'write-only-dest'
 nested_dest = base / 'nested-dest'
 nested_parent = nested_dest / 'nested'
+search_parent = base / 'search-destination'
+search_dest = search_parent / 'destination'
 for path in (
     readable,
     nested_src,
@@ -54,6 +50,7 @@
     unreadable_dest,
     write_only_dest,
     nested_parent,
+    search_dest,
 ):
     path.mkdir(parents=True, exist_ok=True)
 
@@ -65,13 +62,22 @@
     'created beneath nested write-search-only parent\n'
 )
 
+local_rsync = None
+if launcher and under_valgrind():
+    local_rsync = base / 'rsync-bin'
+    shutil.copy2(rsync_command_binary(), local_rsync)
+    local_rsync.chmod(0o755)
+    os.chown(local_rsync, 65534, 65534)
+
+def command(*args):
+    return rsync_argv_for(local_rsync, *args) if local_rsync else rsync_argv(*args)
+
 if os.geteuid() == 0:
     for root, dirs, files in os.walk(base):
         os.chown(root, 65534, 65534)
         for name in dirs + files:
             os.chown(Path(root) / name, 65534, 65534)
 
-
 def permission_probe(path, flag, expected, label):
     proc = subprocess.run(
         launcher + ['test', flag, str(path)],
@@ -81,15 +87,15 @@ def permission_probe(path, flag, expected, label):
     if proc.returncode != expected:
         test_skipped(
             f'filesystem does not enforce {label}: test {flag} returned '
-            f'{proc.returncode}, expected {expected}'
+            f'{proc.returncode}, expected {expected}', capability='search_only'
         )
 
-
 failures = []
 try:
     xonly.chmod(0o111)
     write_only_dest.chmod(0o333)
     nested_parent.chmod(0o333)
+    search_parent.chmod(0o111)
 
     permission_probe(xonly, '-r', 1, 'search-only mode')
     permission_probe(xonly, '-x', 0, 'search-only mode')
@@ -99,11 +105,23 @@ def permission_probe(path, flag, expected, label):
     permission_probe(nested_parent, '-r', 1, 'nested write-search-only mode')
     permission_probe(nested_parent, '-w', 0, 'nested write-search-only mode')
     permission_probe(nested_parent, '-x', 0, 'nested write-search-only mode')
+    permission_probe(search_parent, '-r', 1, 'search-only destination parent')
+    permission_probe(search_parent, '-x', 0, 'search-only destination parent')
+
+    search_receiver = subprocess.run(
+        launcher + command('-t', str(incoming), f'{search_dest}/'),
+        stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True)
+    search_result = search_dest / 'incoming'
+    search_content = search_result.read_text() if search_result.is_file() else None
+    if search_receiver.returncode != 0 or search_content != (
+            'created beneath write-search-only destination\n'):
+        failures.append(
+            'destination below mode 0111 parent failed: '
+            f'rc={search_receiver.returncode}, stderr={search_receiver.stderr.strip()!r}, '
+            f'content={search_content!r}')
 
-    # Keep received implied dirs usable on systems without a safe fchmodat2.
-    # The source remains mode 0111, so sender traversal coverage is unchanged.
     exact = subprocess.run(
-        launcher + rsync_argv(
+        launcher + command(
             '-aR', '--chmod=Du+rw', 'xonly/exact', f'{exact_dest}/',
         ),
         cwd=src,
@@ -123,7 +141,7 @@ def permission_probe(path, flag, expected, label):
         )
 
     tree = subprocess.run(
-        launcher + rsync_argv(
+        launcher + command(
             '-aR', '--chmod=Du+rw', 'xonly/readable/', f'{tree_dest}/',
         ),
         cwd=src,
@@ -143,7 +161,7 @@ def permission_probe(path, flag, expected, label):
         )
 
     unreadable = subprocess.run(
-        launcher + rsync_argv(
+        launcher + command(
             '-a', 'xonly/', f'{unreadable_dest}/',
         ),
         cwd=src,
@@ -157,7 +175,7 @@ def permission_probe(path, flag, expected, label):
         )
 
     receiver = subprocess.run(
-        launcher + rsync_argv(
+        launcher + command(
             '-t', str(incoming), f'{write_only_dest}/',
         ),
         stdout=subprocess.PIPE,
@@ -175,11 +193,10 @@ def permission_probe(path, flag, expected, label):
             f'content={received_content!r}'
         )
 
-    # Protocol 29 rejects this nested -R shape before the resolver is reached.
     proto = forced_protocol()
     if proto is None or proto >= 30:
         nested_receiver = subprocess.run(
-            launcher + rsync_argv(
+            launcher + command(
                 '-tR', '--no-implied-dirs', 'nested/known', f'{nested_dest}/',
             ),
             cwd=src,
@@ -204,6 +221,7 @@ def permission_probe(path, flag, expected, label):
     xonly.chmod(0o755)
     write_only_dest.chmod(0o755)
     nested_parent.chmod(0o755)
+    search_parent.chmod(0o755)
     for dest in (exact_dest, tree_dest):
         copied_xonly = dest / 'xonly'
         if copied_xonly.is_dir():
diff --git a/testsuite/tests/path/secure-relpath-validation.py b/testsuite/tests/path/secure-relpath-validation.py
new file mode 100644
index 000000000..a972d652c
--- /dev/null
+++ b/testsuite/tests/path/secure-relpath-validation.py
@@ -0,0 +1,16 @@
+#!/usr/bin/env python3
+
+import subprocess
+
+from harness.rsync import SCRATCHDIR, TOOLDIR, rmtree, test_fail
+
+testdir = SCRATCHDIR / 'relpath-test'
+rmtree(testdir)
+testdir.mkdir(parents=True)
+
+proc = subprocess.run([str(TOOLDIR / 't_secure_relpath'), str(testdir)])
+if proc.returncode != 0:
+    test_fail(
+        "t_secure_relpath rejected one or more inputs incorrectly "
+        "(see stderr above for the specific case)"
+    )
diff --git a/testsuite/sender-flist-symlink-leak_test.py b/testsuite/tests/path/sender-flist-symlink-leak.py
similarity index 69%
rename from testsuite/sender-flist-symlink-leak_test.py
rename to testsuite/tests/path/sender-flist-symlink-leak.py
index 7b85395a1..eb6371a90 100644
--- a/testsuite/sender-flist-symlink-leak_test.py
+++ b/testsuite/tests/path/sender-flist-symlink-leak.py
@@ -1,28 +1,19 @@
 #!/usr/bin/env python3
-# Python rewrite of testsuite/sender-flist-symlink-leak.test.
-#
-# Regression test for codex re-check finding: the sender-side file-list
-# generator could still follow an attacker-planted symlink out of the
-# module via change_pathname() -> change_dir(...,CD_SKIP_CHDIR) ->
-# change_dir(...,CD_NORMAL).  Reach: a daemon module with use chroot =
-# no, attacker plants module/cd -> /outside, client pulls
-# rsync://daemon/module/cd/; the daemon would enumerate /outside in
-# the file list (metadata leak) before the actual content transfer
-# failed at secure_relative_open.
 
 import os
 import subprocess
 
-from rsyncfns import (
+from harness.rsync import (
     SCRATCHDIR,
     rsync_argv, get_testuid, get_rootuid, get_rootgid,
     rmtree, start_test_daemon, test_fail,
 )
+from harness import metadata
 
+metadata(features={'daemon', 'symlink'}, transports={'pipe', 'tcp'}, min_peer='2.6.0', mutates={'filesystem', 'process', 'socket'}, tags={'daemon', 'security', 'version-mix'})
 
 DAEMON_PORT = 12881
 
-
 mod = SCRATCHDIR / 'module'
 outside = SCRATCHDIR / 'outside'
 listfile = SCRATCHDIR / 'listed.txt'
@@ -40,8 +31,6 @@
 
 os.symlink(str(outside), mod / 'cd')
 
-# A legitimate in-module file, used as a positive control so the leak check
-# below can't pass simply because the daemon's listing machinery is broken.
 (mod / 'realdir').mkdir()
 (mod / 'realdir' / 'in_module.txt').write_text("INSIDE_THE_MODULE\n")
 
@@ -67,9 +56,6 @@
 
 url = start_test_daemon(conf, DAEMON_PORT)
 
-# Positive control: a normal recursive listing of an in-module path must
-# enumerate the in-module file. If this fails, the daemon's flist generation is
-# broken and the leak check below would be vacuously satisfied.
 ctl = subprocess.run(
     rsync_argv('-nrv', f'{url}upload/realdir/', f'{SCRATCHDIR}/dst/'),
     capture_output=True, text=True,
diff --git a/testsuite/sender-readlink-atfd_test.py b/testsuite/tests/path/sender-readlink-atfd.py
similarity index 78%
rename from testsuite/sender-readlink-atfd_test.py
rename to testsuite/tests/path/sender-readlink-atfd.py
index 71e1bd691..f45705beb 100644
--- a/testsuite/sender-readlink-atfd_test.py
+++ b/testsuite/tests/path/sender-readlink-atfd.py
@@ -1,18 +1,14 @@
 #!/usr/bin/env python3
+
 import os
 import subprocess
 import time
 
-from rsyncfns import (
-    race_budget, SCRATCHDIR, rmtree, rsync_argv,
-    start_path_flipper, start_test_daemon, stop_flipper, test_fail,
-    write_daemon_conf,
+from harness.mutation import race_budget, start_path_flipper, stop_flipper
+from harness.rsync import (
+    SCRATCHDIR, rmtree, rsync_argv, start_test_daemon, test_fail, write_daemon_conf,
 )
 
-# The sender's secure scan-dir open resolves on held dirfds with O_NOFOLLOW
-# (race-free by construction on every platform), so a flipped parent component
-# cannot redirect the readlink outside the module.
-
 base = SCRATCHDIR / 'sender-readlink'
 mod = base / 'module'
 outside = base / 'outside'
diff --git a/testsuite/sender-remove-source-relative-anchor_test.py b/testsuite/tests/path/sender-remove-source-relative-anchor.py
similarity index 88%
rename from testsuite/sender-remove-source-relative-anchor_test.py
rename to testsuite/tests/path/sender-remove-source-relative-anchor.py
index 11937a21e..7347b2969 100644
--- a/testsuite/sender-remove-source-relative-anchor_test.py
+++ b/testsuite/tests/path/sender-remove-source-relative-anchor.py
@@ -1,10 +1,8 @@
 #!/usr/bin/env python3
-"""Absolute --relative source cleanup must use the source's absolute parent."""
 
 import subprocess
 
-from rsyncfns import SCRATCHDIR, rmtree, rsync_argv, test_fail
-
+from harness.rsync import SCRATCHDIR, rmtree, rsync_argv, test_fail
 
 base = SCRATCHDIR.resolve() / "sender-remove-source-relative-anchor"
 source = base / "source/sub/file"
diff --git a/testsuite/sender-remove-source-root-anchor_test.py b/testsuite/tests/path/sender-remove-source-root-anchor.py
similarity index 56%
rename from testsuite/sender-remove-source-root-anchor_test.py
rename to testsuite/tests/path/sender-remove-source-root-anchor.py
index 61bfae681..f9ff03118 100644
--- a/testsuite/sender-remove-source-root-anchor_test.py
+++ b/testsuite/tests/path/sender-remove-source-root-anchor.py
@@ -1,40 +1,26 @@
 #!/usr/bin/env python3
-"""An absolute --relative cleanup must not be re-anchored at the sender's CWD.
-
-secure_sender_parent_fd() resolved the parent of an absolute --relative name
-through the cwd-backed dirfd cache.  A source that is a direct child of / has
-an *empty* parent component, so the cache handed back the sender's own working
-directory and --remove-source-files unlinked a same-named entry there instead
-of the file that was really transferred -- silently, with exit status 0.
-
-The sibling test sender-remove-source-relative-anchor covers the nested case,
-where the same defect merely fails the cleanup.  This one covers the case where
-it destroys an unrelated file.
-
-Requires root: reaching the empty-parent case needs a source directly under /.
-"""
 
 import os
 import subprocess
 from pathlib import Path
 
-from rsyncfns import (
+from harness.rsync import (
     SCRATCHDIR, makepath, rmtree, rsync_argv, test_fail, test_skipped,
 )
 
 if os.geteuid() != 0:
-    test_skipped('needs root to place a transfer source directly under /')
+    test_skipped('needs root to place a transfer source directly under /', capability='root_anchor')
 
 SOURCE_DATA = b'REAL-SOURCE-CONTENT'
 DECOY_DATA = b'CWD-DECOY-CONTENT!!'
-assert len(SOURCE_DATA) == len(DECOY_DATA)   # same size: only the name matches
+if len(SOURCE_DATA) != len(DECOY_DATA):
+    test_fail('source and decoy fixtures must have equal lengths')
 
 base = SCRATCHDIR / 'sender-remove-root-anchor'
 rmtree(base)
 dest = base / 'dst'
 makepath(dest)
 
-# Unique so a stray file in / can never be mistaken for ours.
 root_src = Path('/') / f'rsync-root-anchor-probe-{os.getpid()}'
 decoy = base / root_src.name
 
@@ -42,13 +28,8 @@
     try:
         root_src.write_bytes(SOURCE_DATA)
     except OSError as e:
-        # e.g. macOS's sealed system volume: / is read-only even for root.
-        test_skipped(f'cannot create a transfer source under /: {e}')
+        test_skipped(f'cannot create a transfer source under /: {e}', capability='root_anchor')
     decoy.write_bytes(DECOY_DATA)
-    # Same size and mtime, so the sender's "has it changed?" guard passes and
-    # the decoy is a credible removal target.  Nanosecond precision matters:
-    # the guard also compares sub-second mtime, so a whole-second copy would
-    # make the sender skip the removal for an unrelated reason.
     st = root_src.stat()
     os.utime(decoy, ns=(st.st_atime_ns, st.st_mtime_ns))
 
@@ -57,8 +38,6 @@
         stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True, cwd=base)
     ctx = f'rc={proc.returncode}, output={proc.stdout!r}'
 
-    # The security assertion first: whatever else happened, the unrelated
-    # same-named file in the sender's CWD must be untouched.
     if not decoy.exists():
         test_fail(f'--remove-source-files deleted a same-named file in the '
                   f'sender CWD instead of the transferred source ({ctx})')
diff --git a/testsuite/sender-remove-source-secure_test.py b/testsuite/tests/path/sender-remove-source-secure.py
similarity index 65%
rename from testsuite/sender-remove-source-secure_test.py
rename to testsuite/tests/path/sender-remove-source-secure.py
index 47a0a6d42..113eadb3d 100644
--- a/testsuite/sender-remove-source-secure_test.py
+++ b/testsuite/tests/path/sender-remove-source-secure.py
@@ -1,21 +1,18 @@
 #!/usr/bin/env python3
+
 import os
 import platform
 import subprocess
 import time
 
-from rsyncfns import (
-    race_budget, SCRATCHDIR, rmtree, rsync_argv,
-    start_path_flipper, start_test_daemon, stop_flipper, test_fail, test_xfail,
+from harness.mutation import race_budget, start_path_flipper, stop_flipper
+from harness.rsync import (
+    SCRATCHDIR, rmtree, rsync_argv, start_test_daemon, test_fail, test_xfail,
     write_daemon_conf,
 )
 
 _CYGWIN = platform.system().startswith('CYGWIN')
 
-# The sender's secure parent-dir open resolves on held dirfds with O_NOFOLLOW
-# (race-free by construction on every platform), so a flipped parent component
-# cannot redirect the --remove-source-files unlink outside the module.
-
 base = SCRATCHDIR / 'sender-remove-source'
 mod = base / 'module'
 outside = base / 'outside'
@@ -49,7 +46,6 @@
             except FileNotFoundError:
                 pass
             except PermissionError:
-                # Cygwin can report EACCES while the flipper swaps this path.
                 if not _CYGWIN:
                     raise
         subprocess.run(
@@ -60,13 +56,6 @@
 
 if not outside_file.exists():
     if _CYGWIN:
-        # Cygwin resolves directory descriptors by path name rather than a pinned
-        # inode and emulates symlinks as special files, so the confined sender's
-        # held-fd O_NOFOLLOW walk -- though compiled in -- does not enforce the
-        # parent-component pin here, and a raced parent flip can still redirect
-        # the --remove-source-files unlink. Documented Cygwin platform residual
-        # (see SECURITY.md and the matching xfail in symlink-race-source_test.py);
-        # Cygwin is a dev/interop target, not a privilege boundary host.
         test_xfail("cygwin: --remove-source-files parent-flip race still unlinks "
                    "the outside victim -- documented Cygwin platform residual")
     test_fail("daemon sender --remove-source-files cleanup unlinked the outside victim through a raced parent symlink")
diff --git a/testsuite/tests/path/sender-scan-dir-escape.py b/testsuite/tests/path/sender-scan-dir-escape.py
new file mode 100644
index 000000000..55cf6bc29
--- /dev/null
+++ b/testsuite/tests/path/sender-scan-dir-escape.py
@@ -0,0 +1,65 @@
+#!/usr/bin/env python3
+
+import os
+import subprocess
+import time
+
+from harness.mutation import race_budget, start_path_flipper, stop_flipper
+from harness.rsync import SCRATCHDIR, rmtree, rsync_argv, rsync_supports, test_fail
+
+MARKER = "XFIL-OUTSIDE-SYMLINK-TARGET-do-not-copy"
+NKEEP = 64
+
+base = SCRATCHDIR / 'scan-dir-escape'
+src = base / 'src'
+outside = base / 'outside'
+dest = base / 'dest'
+
+rmtree(base)
+
+realsub = src / '.realsub'
+realsub.mkdir(parents=True)
+for i in range(NKEEP):
+    (realsub / f'keep{i}').write_text("in-tree\n")
+
+outside.mkdir(parents=True)
+os.symlink(MARKER, outside / 'xfil_link')
+(outside / 'xfil_dir').mkdir()
+(outside / 'xfil_dir' / 'inner').write_text("x\n")
+(outside / 'xfil_file').write_text("x\n")
+
+os.rename(realsub, src / 'sub')
+os.symlink('../outside', src / 'evil')
+dest.mkdir(parents=True)
+
+def escaped():
+    d = dest / 'sub'
+    if d.is_symlink() or not d.is_dir():
+        return None
+    link = d / 'xfil_link'
+    if link.is_symlink() and os.readlink(link) == MARKER:
+        return f"symlink target leaked: dest/sub/xfil_link -> {MARKER}"
+    for name in ('xfil_dir', 'xfil_file', 'xfil_link'):
+        if (d / name).exists() or (d / name).is_symlink():
+            return f"out-of-tree name leaked: dest/sub/{name}"
+    return None
+
+extra = ['--no-inc-recursive'] if rsync_supports('--no-inc-recursive') else []
+
+flip = start_path_flipper(src / 'sub', src / 'evil')
+leak = None
+deadline = time.monotonic() + race_budget()
+try:
+    while time.monotonic() < deadline and leak is None:
+        rmtree(dest)
+        dest.mkdir(parents=True)
+        subprocess.run(rsync_argv('-a', *extra, f'{src}/', f'{dest}/'),
+                       stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
+        leak = escaped()
+finally:
+    stop_flipper(flip)
+
+if leak is not None:
+    test_fail(
+        f'sender scan copied an out-of-tree entry through a flipped symlink: {leak}')
+print("sender-scan-dir-escape: directory enumeration stayed within the transfer root")
diff --git a/testsuite/tests/path/symlink-dest-backupdir.py b/testsuite/tests/path/symlink-dest-backupdir.py
new file mode 100644
index 000000000..76e9c07ab
--- /dev/null
+++ b/testsuite/tests/path/symlink-dest-backupdir.py
@@ -0,0 +1,44 @@
+#!/usr/bin/env python3
+
+import os
+import subprocess
+
+from harness.mutation import find_attacker_uid
+from harness.rsync import SCRATCHDIR, rmtree, rsync_argv, test_fail, test_skipped
+
+if os.geteuid() != 0:
+    test_skipped("requires root to plant a backup-dir symlink owned by a non-self uid",
+                 capability='cross_uid')
+ATT_UID = find_attacker_uid()
+if ATT_UID is None:
+    test_skipped("no untrusted-uid user available for cross-uid plant", capability='cross_uid')
+
+NFILES = 8
+
+base = SCRATCHDIR / 'destbackup'
+src = base / 'src'
+dest = base / 'dest'
+outside = base / 'outside'
+
+rmtree(base)
+src.mkdir(parents=True)
+dest.mkdir(parents=True)
+for i in range(NFILES):
+    (src / f'f{i}').write_text("NEW-PUSHED-CONTENT\n")
+    (dest / f'f{i}').write_text("OLD\n")
+outside.mkdir(parents=True)
+os.symlink('../outside', dest / 'bdir')
+os.lchown(dest / 'bdir', ATT_UID, ATT_UID)
+
+subprocess.run(
+    rsync_argv('-a', '--backup', '--backup-dir=bdir', f'{src}/', f'{dest}/'),
+    stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
+
+leaked = []
+for root, _dirs, files in os.walk(outside):
+    leaked += [os.path.join(root, f) for f in files]
+if leaked:
+    test_fail(
+        "backup escaped the destination tree via the planted --backup-dir "
+        f"symlink: {sorted(leaked)} were created outside the tree. The secure "
+        "resolver failed to confine the backup write.")
diff --git a/testsuite/symlink-dirlink-basis_test.py b/testsuite/tests/path/symlink-dirlink-basis.py
similarity index 66%
rename from testsuite/symlink-dirlink-basis_test.py
rename to testsuite/tests/path/symlink-dirlink-basis.py
index ffe368e27..b0f193a4f 100644
--- a/testsuite/symlink-dirlink-basis_test.py
+++ b/testsuite/tests/path/symlink-dirlink-basis.py
@@ -1,51 +1,36 @@
 #!/usr/bin/env python3
-# Python rewrite of testsuite/symlink-dirlink-basis.test.
-#
-# Regression test for https://github.com/RsyncProject/rsync/issues/715:
-# updating a file through a directory symlink with -K (--copy-dirlinks)
-# regressed after the CVE-2026-29518 fix introduced
-# secure_relative_open() with O_NOFOLLOW on every path component. The
-# fix split the path so basedir (dirname) follows symlinks while only
-# the final component is O_NOFOLLOW'd.
-#
-# We exercise: basic dir-symlink update, compressed update, nested
-# dir-symlinks, --backup, --inplace, top-level file (no split needed),
-# --partial-dir with protocol < 29, and a basic protocol < 29 transfer.
 
 import filecmp
 import os
 import subprocess
-import time
 
-from rsyncfns import (
-    RSYNC, SCRATCHDIR, RSYNC_PEER, SRCDIR, TMPDIR,
-    make_data_file, rsync_argv, test_fail, rsync_path_arg, rsh_cmd,
+from harness.rsync import (
+    SCRATCHDIR,
+    TMPDIR,
+    make_data_file,
+    rsync_argv,
+    test_fail,
+    rsync_path_arg,
+    rsh_cmd,
 )
+from harness import metadata
 
-
-# The secure resolver follows an in-tree directory symlink (the basis dir) on
-# every platform: the per-component walk readlinks the symlink and walks its
-# target off held dirfds (issue #715), so this transfer through a dir-symlinked
-# basis succeeds uniformly.
+metadata(features={'remote-shell', 'symlink'}, transports={'pipe', 'tcp'}, min_peer='2.6.0', mutates={'filesystem', 'process'}, tags={'compatibility', 'security', 'transfer', 'version-mix'})
 
 os.environ['RSYNC_RSH'] = rsh_cmd()
-# HOME -> SCRATCHDIR is set up by rsyncfns import.
 
-srcbase = TMPDIR / 'src_files'  # avoid clash with the runner's $scratchdir/src symlink
+srcbase = TMPDIR / 'src_files'
 srcbase.mkdir(parents=True, exist_ok=True)
 home = SCRATCHDIR
 
-
 def make_testfile(path) -> None:
-    """~32 KiB of non-trivial content -- large enough to trigger rsync's
-    block-matching delta path."""
     make_data_file(path, 32768)
 
+def advance_mtime(path) -> None:
+    st = path.stat()
+    os.utime(path, (st.st_atime, st.st_mtime + 10))
 
 def push(*args, label: str) -> None:
-    # --rsync-path goes BEFORE the positional source/dest args, matching
-    # the shell test's order. With it at the end rsync mis-classifies
-    # the destination and reports "Unexpected remote arg: localhost:".
     saved = os.getcwd()
     os.chdir(srcbase)
     try:
@@ -59,13 +44,10 @@ def push(*args, label: str) -> None:
     finally:
         os.chdir(saved)
 
-
 def assert_same(label: str, a, b) -> None:
     if not filecmp.cmp(a, b, shallow=False):
         test_fail(f"{label}: content mismatch between {a} and {b}")
 
-
-# Test 1: basic directory-symlink update.
 (home / 'real-dir').mkdir()
 os.symlink('real-dir', home / 'dir')
 (srcbase / 'dir').mkdir()
@@ -76,27 +58,20 @@ def assert_same(label: str, a, b) -> None:
     test_fail("test 1: initial transfer did not create file through symlink")
 assert_same("test 1 initial", srcbase / 'dir' / 'file', home / 'real-dir' / 'file')
 
-# Trigger delta transfer.
 with open(srcbase / 'dir' / 'file', 'ab') as f:
     f.write(b"appended update\n")
-time.sleep(1)
-(srcbase / 'dir' / 'file').touch()
+advance_mtime(srcbase / 'dir' / 'file')
 
 push('-KRlptv', 'dir/file', 'localhost:', label="test 1 update")
 assert_same("test 1 update", srcbase / 'dir' / 'file', home / 'real-dir' / 'file')
 
-
-# Test 2: compression.
 with open(srcbase / 'dir' / 'file', 'ab') as f:
     f.write(b"another line\n")
-time.sleep(1)
-(srcbase / 'dir' / 'file').touch()
+advance_mtime(srcbase / 'dir' / 'file')
 
 push('-KRlptzv', 'dir/file', 'localhost:', label="test 2")
 assert_same("test 2", srcbase / 'dir' / 'file', home / 'real-dir' / 'file')
 
-
-# Test 3: nested directory symlinks.
 (home / 'nested_real' / 'sub').mkdir(parents=True)
 os.symlink('nested_real', home / 'nested')
 
@@ -107,38 +82,31 @@ def assert_same(label: str, a, b) -> None:
 
 with open(srcbase / 'nested' / 'sub' / 'data.txt', 'ab') as f:
     f.write(b"appended nested\n")
-time.sleep(1)
-(srcbase / 'nested' / 'sub' / 'data.txt').touch()
+advance_mtime(srcbase / 'nested' / 'sub' / 'data.txt')
 
 push('-KRlptv', 'nested/sub/data.txt', 'localhost:', label="test 3 update")
 assert_same("test 3 update",
             srcbase / 'nested' / 'sub' / 'data.txt',
             home / 'nested_real' / 'sub' / 'data.txt')
 
-
-# Test 4: --backup with directory symlinks.
 (home / 'real-dir' / 'file').unlink()
 (home / 'real-dir' / 'file~').unlink(missing_ok=True)
 make_testfile(srcbase / 'dir' / 'file')
 
 push('-KRlptv', 'dir/file', 'localhost:', label="test 4 initial")
 
-old_content = (srcbase / 'dir' / 'file').read_bytes()   # the backup should hold this
+old_content = (srcbase / 'dir' / 'file').read_bytes()
 with open(srcbase / 'dir' / 'file', 'ab') as f:
     f.write(b"backup update\n")
-time.sleep(1)
-(srcbase / 'dir' / 'file').touch()
+advance_mtime(srcbase / 'dir' / 'file')
 
 push('-KRlptv', '--backup', 'dir/file', 'localhost:', label="test 4 update")
 assert_same("test 4 update", srcbase / 'dir' / 'file', home / 'real-dir' / 'file')
 if not (home / 'real-dir' / 'file~').is_file():
     test_fail("test 4: backup file was not created")
-# The backup must hold the OLD content, not just exist.
 if (home / 'real-dir' / 'file~').read_bytes() != old_content:
     test_fail("test 4: backup file~ does not hold the pre-update content")
 
-
-# Test 5: --inplace.
 (home / 'real-dir' / 'file').unlink()
 (home / 'real-dir' / 'file~').unlink(missing_ok=True)
 make_testfile(srcbase / 'dir' / 'file')
@@ -147,14 +115,11 @@ def assert_same(label: str, a, b) -> None:
 
 with open(srcbase / 'dir' / 'file', 'ab') as f:
     f.write(b"inplace update\n")
-time.sleep(1)
-(srcbase / 'dir' / 'file').touch()
+advance_mtime(srcbase / 'dir' / 'file')
 
 push('-KRlptv', '--inplace', 'dir/file', 'localhost:', label="test 5 update")
 assert_same("test 5 update", srcbase / 'dir' / 'file', home / 'real-dir' / 'file')
 
-
-# Test 6: top-level file (no dirname split needed).
 make_testfile(srcbase / 'topfile')
 home.mkdir(parents=True, exist_ok=True)
 
@@ -162,14 +127,11 @@ def assert_same(label: str, a, b) -> None:
 
 with open(srcbase / 'topfile', 'ab') as f:
     f.write(b"toplevel update\n")
-time.sleep(1)
-(srcbase / 'topfile').touch()
+advance_mtime(srcbase / 'topfile')
 
 push('-Rlptv', 'topfile', 'localhost:', label="test 6 update")
 assert_same("test 6 update", srcbase / 'topfile', home / 'topfile')
 
-
-# Test 7: --partial-dir with protocol < 29.
 (home / 'real-dir' / 'file').unlink(missing_ok=True)
 make_testfile(srcbase / 'dir' / 'file')
 
@@ -178,15 +140,12 @@ def assert_same(label: str, a, b) -> None:
 
 with open(srcbase / 'dir' / 'file', 'ab') as f:
     f.write(b"partial-dir update\n")
-time.sleep(1)
-(srcbase / 'dir' / 'file').touch()
+advance_mtime(srcbase / 'dir' / 'file')
 
 push('-KRlptv', '--protocol=28', '--partial-dir=.rsync-partial',
      'dir/file', 'localhost:', label="test 7 update")
 assert_same("test 7 update", srcbase / 'dir' / 'file', home / 'real-dir' / 'file')
 
-
-# Test 8: protocol < 29 basic update.
 (home / 'real-dir' / 'file').unlink(missing_ok=True)
 make_testfile(srcbase / 'dir' / 'file')
 
@@ -194,8 +153,7 @@ def assert_same(label: str, a, b) -> None:
 
 with open(srcbase / 'dir' / 'file', 'ab') as f:
     f.write(b"proto28 update\n")
-time.sleep(1)
-(srcbase / 'dir' / 'file').touch()
+advance_mtime(srcbase / 'dir' / 'file')
 
 push('-KRlptv', '--protocol=28', 'dir/file', 'localhost:', label="test 8 update")
 assert_same("test 8 update", srcbase / 'dir' / 'file', home / 'real-dir' / 'file')
diff --git a/testsuite/symlink-exclude-xattr_test.py b/testsuite/tests/path/symlink-exclude-xattr.py
similarity index 68%
rename from testsuite/symlink-exclude-xattr_test.py
rename to testsuite/tests/path/symlink-exclude-xattr.py
index c46a9070a..1d1227740 100644
--- a/testsuite/symlink-exclude-xattr_test.py
+++ b/testsuite/tests/path/symlink-exclude-xattr.py
@@ -1,35 +1,30 @@
 #!/usr/bin/env python3
-# The daemon exclude/filter is name-based, not a symlink boundary: an xattr (-X)
-# write on a pre-existing excluded leaf reached through an in-tree directory
-# symlink IS performed, as in stock rsync (3.2.7).  Like symlink-exclude-meta but
-# for an xattr.  The defense for a writable module is `munge symlinks`, not the
-# filter (see rsyncd.conf(5)).  Runs unprivileged (user.* xattr).
+
 import os
 import subprocess
 
-from rsyncfns import (
+from harness.rsync import (
     SCRATCHDIR, forced_protocol, rmtree, rsync_argv, start_test_daemon, test_fail,
     test_skipped, write_daemon_conf, xattrs_supported,
 )
 
 if not xattrs_supported() or not hasattr(os, 'getxattr') or not hasattr(os, 'setxattr'):
-    test_skipped("user xattrs not available")
+    test_skipped("user xattrs not available", capability='symlink_xattr')
 
 proto = forced_protocol()
 if proto is not None and proto < 30:
-    test_skipped(f"xattr (-X) transfer requires protocol 30+ (negotiated {proto})")
+    test_skipped(f"xattr (-X) transfer requires protocol 30+ (negotiated {proto})",
+                 capability='protocol_30')
 
 DAEMON_PORT = 12992
 XNAME = 'user.rsync.marker'
 
-
 def getx(p):
     try:
         return os.getxattr(str(p), XNAME).decode()
     except OSError:
         return None
 
-
 base = SCRATCHDIR / 'symlink-exclude-xattr'
 rmtree(base)
 base.mkdir()
@@ -38,18 +33,18 @@ def getx(p):
 mod.mkdir()
 pub = mod / 'pub'
 pub.mkdir()
-victim = pub / 'blocked'                       # excluded leaf, pre-exists
+victim = pub / 'blocked'
 victim.write_text("DATA\n")
 try:
     os.setxattr(str(victim), XNAME, b'ORIGINAL')
 except OSError:
-    test_skipped("cannot set user xattr on this filesystem")
-os.symlink('pub/', mod / 'blink2')             # in-tree dir symlink -> pub/
+    test_skipped("cannot set user xattr on this filesystem", capability='symlink_xattr')
+os.symlink('pub/', mod / 'blink2')
 
 src = base / 'src'
 (src / 'blink2').mkdir(parents=True)
 sf = src / 'blink2' / 'blocked'
-sf.write_text("DATA\n")                         # same content: only the xattr differs
+sf.write_text("DATA\n")
 os.setxattr(str(sf), XNAME, b'ATTACKER')
 
 conf = write_daemon_conf(
diff --git a/testsuite/tests/path/symlink-exclude.py b/testsuite/tests/path/symlink-exclude.py
new file mode 100644
index 000000000..43a26e359
--- /dev/null
+++ b/testsuite/tests/path/symlink-exclude.py
@@ -0,0 +1,128 @@
+#!/usr/bin/env python3
+
+import os
+
+from harness.rsync import SCRATCHDIR, makepath, rmtree, run_rsync, start_test_daemon, test_fail, write_daemon_conf
+
+base = SCRATCHDIR / 'symlink-exclude'
+rmtree(base)
+base.mkdir()
+modules = []
+
+def module(name, exclude):
+    root = base / name
+    root.mkdir()
+    modules.append((name, {'path': str(root), 'read only': 'no', 'exclude': exclude}))
+    return root
+
+destination = module('destination', '/secret/')
+makepath(destination / 'secret')
+(destination / 'secret' / 'f0').write_text('old destination\n')
+(destination / 'blink').symlink_to('secret')
+
+leaf = module('leaf', '/pub/blocked')
+makepath(leaf / 'pub')
+(leaf / 'blink').symlink_to('pub')
+
+component = module('component', '/secret/')
+makepath(component / 'secret')
+(component / 'secret' / 'x').write_text('protected\n')
+(component / 'blink').symlink_to('secret')
+
+deep = module('deep', '/pub/secret/')
+makepath(deep / 'pub' / 'secret')
+(deep / 'pub' / 'secret' / 'x').write_text('protected\n')
+(deep / 'alias').symlink_to('pub')
+
+chdir = module('chdir', '/public/secret/')
+makepath(chdir / 'public' / 'secret')
+(chdir / 'public' / 'secret' / 'x').write_text('protected\n')
+(chdir / 'alias').symlink_to('public')
+
+metadata = module('metadata', '/pub/blocked')
+makepath(metadata / 'pub')
+meta_victim = metadata / 'pub' / 'blocked'
+meta_victim.write_text('same\n')
+os.utime(meta_victim, (1_000_000_000, 1_000_000_000))
+(metadata / 'blink').symlink_to('pub')
+
+backup = module('backup', '/secret/')
+makepath(backup / 'secret')
+(backup / 'secret' / 'f0').write_text('protected\n')
+(backup / 'f0').write_text('old destination\n')
+(backup / 'blink').symlink_to('secret')
+
+partial = module('partial', '/secret/')
+makepath(partial / 'secret')
+(partial / 'secret' / 'f0').write_text('protected\n')
+(partial / 'blink').symlink_to('secret')
+
+leaf_backup = module('leaf-backup', '/public/f0')
+makepath(leaf_backup / 'public')
+(leaf_backup / 'public' / 'f0').write_text('protected\n')
+(leaf_backup / 'f0').write_text('old destination\n')
+(leaf_backup / 'blink').symlink_to('public')
+
+leaf_partial = module('leaf-partial', '/public/f0')
+makepath(leaf_partial / 'public')
+(leaf_partial / 'public' / 'f0').write_text('protected\n')
+(leaf_partial / 'blink').symlink_to('public')
+
+url = start_test_daemon(write_daemon_conf(modules, name='symlink-exclude.conf'), 12962)
+
+def source(name, relative, content='new\n'):
+    root = base / f'{name}-source'
+    path = root / relative
+    path.parent.mkdir(parents=True)
+    path.write_text(content)
+    return root
+
+run_rsync('-a', f'{source("destination", "f0")}/', f'{url}destination/blink/', check=False)
+if (destination / 'secret' / 'f0').read_text() != 'new\n':
+    test_fail('destination symlink was not followed')
+
+run_rsync('-a', '--keep-dirlinks', f'{source("leaf", "blink/blocked")}/', f'{url}leaf/', check=False)
+if (leaf / 'pub' / 'blocked').read_text() != 'new\n':
+    test_fail('excluded leaf was not reached through its logical alias')
+
+run_rsync('-a', '--keep-dirlinks', f'{source("component", "blink/x")}/', f'{url}component/', check=False)
+if (component / 'secret' / 'x').read_text() != 'new\n':
+    test_fail('destination path component was not followed')
+
+run_rsync('-a', '--keep-dirlinks', f'{source("deep", "alias/secret/x")}/', f'{url}deep/', check=False)
+if (deep / 'pub' / 'secret' / 'x').read_text() != 'new\n':
+    test_fail('deep destination symlink was not followed')
+
+run_rsync('-a', '--keep-dirlinks', f'{source("chdir", "secret/x")}/', f'{url}chdir/alias/', check=False)
+if (chdir / 'public' / 'secret' / 'x').read_text() != 'new\n':
+    test_fail('symlinked destination directory was not followed')
+
+meta_source = source('metadata', 'blink/blocked', 'same\n')
+os.utime(meta_source / 'blink' / 'blocked', (1_000_999_999, 1_000_999_999))
+run_rsync('-a', '--keep-dirlinks', f'{meta_source}/', f'{url}metadata/', check=False)
+if int(meta_victim.stat().st_mtime) != 1_000_999_999:
+    test_fail('metadata did not follow the logical alias')
+
+run_rsync('-a', '--backup', '--backup-dir=/blink', f'{source("backup", "f0")}/',
+          f'{url}backup/', check=False)
+if (backup / 'secret' / 'f0').read_text() != 'old destination\n':
+    test_fail('backup directory symlink was not followed')
+
+run_rsync('-a', '--partial-dir=/blink', f'{source("partial", "f0")}/',
+          f'{url}partial/', check=False)
+victim = partial / 'secret' / 'f0'
+if victim.exists() and victim.read_text() == 'protected\n':
+    test_fail('partial directory symlink was not followed')
+
+run_rsync('-a', '--backup', '--backup-dir=/blink', f'{source("leaf-backup", "f0")}/',
+          f'{url}leaf-backup/', check=False)
+if (leaf_backup / 'public' / 'f0').read_text() == 'protected\n':
+    test_fail('backup directory symlink did not reach the excluded leaf')
+
+run_rsync('-a', '--partial-dir=/blink', f'{source("leaf-partial", "f0")}/',
+          f'{url}leaf-partial/', check=False)
+victim = leaf_partial / 'public' / 'f0'
+if victim.exists() and victim.read_text() == 'protected\n':
+    test_fail('partial directory symlink did not reach the excluded leaf')
+
+print('daemon excludes retain logical-name semantics across symlinked paths')
diff --git a/testsuite/symlink-ignore_test.py b/testsuite/tests/path/symlink-ignore.py
similarity index 62%
rename from testsuite/symlink-ignore_test.py
rename to testsuite/tests/path/symlink-ignore.py
index 28daa0474..37639f352 100644
--- a/testsuite/symlink-ignore_test.py
+++ b/testsuite/tests/path/symlink-ignore.py
@@ -1,19 +1,12 @@
 #!/usr/bin/env python3
-# Python rewrite of testsuite/symlink-ignore.test.
-#
-# Default behaviour: without -l, -L or -a, rsync should NOT copy any
-# symlinks. The referent file should land in the destination but every
-# symlink in the source must be absent.
 
-from rsyncfns import (
+from harness.rsync import (
     FROMDIR, TODIR,
     build_symlinks, is_a_link, run_rsync, test_fail,
 )
 
-
 build_symlinks()
 
-# Copy recursively, but without -l or -L or -a, so symlinks should be missing.
 run_rsync('-r', f'{FROMDIR}/', str(TODIR))
 
 if not (TODIR / 'referent').is_file():
diff --git a/testsuite/symlink-mknod-fakesuper-symlink-race_test.py b/testsuite/tests/path/symlink-mknod-fakesuper-symlink-race.py
similarity index 53%
rename from testsuite/symlink-mknod-fakesuper-symlink-race_test.py
rename to testsuite/tests/path/symlink-mknod-fakesuper-symlink-race.py
index 7affd31c2..787c485b6 100644
--- a/testsuite/symlink-mknod-fakesuper-symlink-race_test.py
+++ b/testsuite/tests/path/symlink-mknod-fakesuper-symlink-race.py
@@ -1,45 +1,17 @@
 #!/usr/bin/env python3
-# Python rewrite of testsuite/symlink-mknod-fakesuper-symlink-race.test.
-#
-# Regression test for the fake-super branches of do_symlink_at() and
-# do_mknod_at(). In --fake-super mode a symlink or device is stored as a
-# regular placeholder file, so creating it resolves the final path component.
-# The slashed-path branch always used openat(... O_NOFOLLOW), but a top-level
-# (no-slash) path fell back to do_symlink()/do_mknod(), whose plain
-# open(... O_CREAT|O_TRUNC) followed a pre-planted symlink at the basename and
-# wrote outside the module.
-#
-# This is the same shape as the do_rename_at() mixed-parent bug: a no-slash
-# path bypassed the safer branch. It is narrower -- exploiting it end-to-end
-# needs a TOCTOU race to plant the basename symlink between the generator's
-# check and the create -- but the openat(... O_NOFOLLOW) in the slashed branch
-# exists precisely to win that race, and the bare branch silently lost it.
-#
-# The helper runs at the wrapper level (deterministic): --poc shows the pre-fix
-# do_symlink()/do_mknod() fallback follows the planted basename symlink and
-# clobbers a file outside the module; the regular run proves the fixed
-# do_symlink_at()/do_mknod_at() refuse it.
 
 import os
 import subprocess
 
-from rsyncfns import SCRATCHDIR, SRCDIR, TOOLDIR, rmtree, test_fail, test_skipped
-
+from harness.rsync import SCRATCHDIR, TOOLDIR, rmtree, test_fail, test_skipped
 
 def run_helper(args, label):
     proc = subprocess.run([str(TOOLDIR / 't_symlink_secure'), *args])
     if proc.returncode == 77:
-        test_skipped(f"t_symlink_secure {label} skipped")
+        test_skipped(f"t_symlink_secure {label} skipped", capability='symlink_mknod')
     if proc.returncode != 0:
         test_fail(f"t_symlink_secure {label} reported failures (see stderr above)")
 
-
-# Fake-super only stores symlinks as placeholder files -- the surface this PoC
-# exploits -- where symlink xattrs are unavailable; elsewhere (e.g. FreeBSD)
-# do_symlink() makes a real symlink and there is no escape to demonstrate.
-# Mirror do_symlink()'s compile-time guard (and the helper's
-# TEST_SYMLINK_PLACEHOLDER) so we set up and assert only what applies here. The
-# device (do_mknod) placeholder is unconditional, so it is always exercised.
 try:
     _config_h = (TOOLDIR / 'config.h').read_text()
 except OSError:
@@ -47,8 +19,6 @@ def run_helper(args, label):
 symlink_placeholders = ('#define NO_SYMLINK_XATTRS 1' in _config_h
                         or '#define NO_SYMLINK_USER_XATTRS 1' in _config_h)
 
-
-# --- PoC tree: pre-fix fallback escapes -------------------------------------
 poc = SCRATCHDIR / 'poc'
 pmod = poc / 'module'
 pout = poc / 'outside'
@@ -63,14 +33,11 @@ def run_helper(args, label):
 
 run_helper(['--poc', str(pmod)], '--poc')
 
-# Independent confirmation the PoC really escaped the module.
 if symlink_placeholders and (pout / 'secret_sym').read_text().strip() != "VULN_SYM_PAYLOAD":
     test_fail("PoC did not write through the symlink for do_symlink")
 if (pout / 'secret_nod').stat().st_size != 0:
     test_fail("PoC did not truncate through the symlink for do_mknod")
 
-
-# --- Regression tree: fixed wrappers refuse the escape ----------------------
 fix = SCRATCHDIR / 'fix'
 fmod = fix / 'module'
 fout = fix / 'outside'
@@ -98,7 +65,6 @@ def run_helper(args, label):
 
 run_helper([str(fmod)], 'regression run')
 
-# Independent confirmation nothing outside the module was touched.
 for name, want, what in checks:
     if (fout / name).read_text().strip() != want:
         test_fail(what)
diff --git a/testsuite/symlink-race-dest_test.py b/testsuite/tests/path/symlink-race-dest.py
similarity index 60%
rename from testsuite/symlink-race-dest_test.py
rename to testsuite/tests/path/symlink-race-dest.py
index 7b500dd8d..2ee6b115e 100644
--- a/testsuite/symlink-race-dest_test.py
+++ b/testsuite/tests/path/symlink-race-dest.py
@@ -1,28 +1,15 @@
 #!/usr/bin/env python3
-# Destination chdir symlink defense (cross-uid) -- ABSOLUTE destination.
-#
-# A non-daemon receiver chdir()s into the operator-named destination.  change_dir()
-# resolves it with open_no_attacker_symlinks: it follows the operator's/root's
-# OWN symlinked dest (the /backup->/mnt/disk admin pattern) but REFUSES one owned
-# by another uid, closing the dest-chdir TOCTOU -- an attacker who races the named
-# destination component from a directory to a symlink->outside can no longer move
-# the receiver's CWD, and every file it then creates, out of the tree.  The
-# ownership check is timing-independent, so a static attacker-owned plant subsumes
-# the race.
-#
-# Cross-uid is the real threat: root runs `rsync -a .../dest/sub/` over a directory
-# where an unprivileged user planted the `sub` component.  Requires root.  This is
-# the absolute-destination variant; symlink-race-relative-dest is the companion.
 
 import os
 import pwd
 import subprocess
 
-from rsyncfns import SCRATCHDIR, rmtree, rsync_argv, test_fail, test_skipped
+from harness.rsync import SCRATCHDIR, rmtree, rsync_argv, test_fail, test_skipped
 
 if os.geteuid() != 0:
     test_skipped("requires root to plant a symlink owned by a non-self uid "
-                 "(simulates 'root runs rsync' over an unprivileged user's dir)")
+                 "(simulates 'root runs rsync' over an unprivileged user's dir)",
+                 capability='cross_uid')
 
 ATT_UID = None
 for name in ('nobody', 'nfsnobody', 'daemon'):
@@ -34,9 +21,8 @@
     except KeyError:
         continue
 if ATT_UID is None:
-    test_skipped("no untrusted-uid user available for cross-uid plant")
+    test_skipped("no untrusted-uid user available for cross-uid plant", capability='cross_uid')
 
-# --- attack: dest/sub is an ATTACKER-owned symlink (absolute path) ------------
 base = SCRATCHDIR / 'destchdir'
 src = base / 'src'
 dest = base / 'dest'
@@ -47,7 +33,7 @@
     (src / 'sub' / f'f{i}').write_text("payload\n")
 outside.mkdir(parents=True)
 dest.mkdir(parents=True)
-os.symlink(outside, dest / 'sub')               # attacker-owned dest component
+os.symlink(outside, dest / 'sub')
 os.lchown(dest / 'sub', ATT_UID, ATT_UID)
 
 proc = subprocess.run(
@@ -72,11 +58,10 @@
         f"wrote files OUTSIDE the tree ({escaped}). change_dir() must refuse a "
         "dest symlink not owned by uid 0 or the euid.")
 
-# --- admin pattern: the operator's own (root-owned) symlinked dest still works -
 real = base / 'realsub'
 real.mkdir()
 os.unlink(dest / 'sub')
-os.symlink(real, dest / 'sub')                  # root-owned symlinked dest
+os.symlink(real, dest / 'sub')
 
 subprocess.run(rsync_argv('-a', f'{src}/sub/', f'{dest}/sub/'),
                stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
diff --git a/testsuite/symlink-race-relative-dest_test.py b/testsuite/tests/path/symlink-race-relative-dest.py
similarity index 55%
rename from testsuite/symlink-race-relative-dest_test.py
rename to testsuite/tests/path/symlink-race-relative-dest.py
index cf704352b..b56ffbb15 100644
--- a/testsuite/symlink-race-relative-dest_test.py
+++ b/testsuite/tests/path/symlink-race-relative-dest.py
@@ -1,30 +1,15 @@
 #!/usr/bin/env python3
-# Relative-destination chdir symlink defense (cross-uid).
-#
-# A non-daemon receiver chdir()s into the operator-named destination.  change_dir()
-# now resolves it (relative or absolute) with open_no_attacker_symlinks: it
-# follows the operator's/root's OWN symlinked dest (the /backup->/mnt/disk admin
-# pattern) but REFUSES one owned by another uid, closing the dest-chdir TOCTOU --
-# an attacker who races the operator-named dest from a directory to a
-# symlink->outside can no longer redirect the receiver's writes out of the tree.
-# (The ownership check is timing-independent, so a static attacker-owned plant
-# subsumes the race.)
-#
-# Cross-uid is the real threat: root runs `rsync -a src/ dest/` from a directory
-# where an unprivileged user planted `dest`.  Requires root.  This is the
-# relative-destination variant; symlink-race-dest is the absolute companion.
-# Found by Omar Elsayed.
 
 import os
 import pwd
 import subprocess
 
-from rsyncfns import SCRATCHDIR, rmtree, rsync_argv, test_fail, test_skipped
+from harness.rsync import SCRATCHDIR, rmtree, rsync_argv, test_fail, test_skipped
 
 if os.geteuid() != 0:
     test_skipped("requires root to plant a symlink owned by a non-self uid "
                  "(simulates 'root runs rsync -a src/ dest/' over an "
-                 "unprivileged user's directory)")
+                 "unprivileged user's directory)", capability='cross_uid')
 
 ATT_UID = None
 for name in ('nobody', 'nfsnobody', 'daemon'):
@@ -36,15 +21,12 @@
     except KeyError:
         continue
 if ATT_UID is None:
-    test_skipped("no untrusted-uid user available for cross-uid plant")
-
+    test_skipped("no untrusted-uid user available for cross-uid plant", capability='cross_uid')
 
 def run(cwd):
     subprocess.run(rsync_argv('-a', 'src/', 'dest/'), cwd=str(cwd),
                    stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
 
-
-# --- attack: a relative dest that is an ATTACKER-owned symlink must be refused -
 base = SCRATCHDIR / 'destchdir-rel'
 src = base / 'src'
 dest = base / 'dest'
@@ -54,8 +36,8 @@ def run(cwd):
 for i in range(4):
     (src / 'sub' / f'f{i}').write_text("payload\n")
 outside.mkdir(parents=True)
-os.symlink(outside, dest)            # operator-named relative dest, planted...
-os.lchown(dest, ATT_UID, ATT_UID)    # ...by a non-root attacker
+os.symlink(outside, dest)
+os.lchown(dest, ATT_UID, ATT_UID)
 
 run(base)
 
@@ -66,7 +48,6 @@ def run(cwd):
         f"receiver wrote files OUTSIDE the tree ({escaped}). change_dir() must "
         "refuse a relative dest symlink not owned by uid 0 or the euid.")
 
-# --- admin pattern: the operator's own (root-owned) symlinked dest still works -
 base2 = SCRATCHDIR / 'destchdir-rel-admin'
 src2 = base2 / 'src'
 real = base2 / 'realdest'
@@ -74,7 +55,7 @@ def run(cwd):
 (src2 / 'sub').mkdir(parents=True)
 (src2 / 'sub' / 'f0').write_text("payload\n")
 real.mkdir(parents=True)
-os.symlink(real, base2 / 'dest')     # root-owned symlinked dest (admin pattern)
+os.symlink(real, base2 / 'dest')
 
 run(base2)
 
diff --git a/testsuite/tests/path/symlink-race-source.py b/testsuite/tests/path/symlink-race-source.py
new file mode 100644
index 000000000..e1c5db50c
--- /dev/null
+++ b/testsuite/tests/path/symlink-race-source.py
@@ -0,0 +1,71 @@
+#!/usr/bin/env python3
+
+import os
+import platform
+import subprocess
+import time
+
+from harness.mutation import race_budget, start_path_flipper, stop_flipper
+from harness.rsync import SCRATCHDIR, rmtree, rsync_argv, rsync_supports, test_fail, test_xfail
+
+_CYGWIN = platform.system().startswith('CYGWIN')
+
+SECRET = "OUTSIDE-SECRET-do-not-copy"
+NFILES = 64
+
+base = SCRATCHDIR / 'srcrace'
+src = base / 'src'
+outside = base / 'outside'
+dest = base / 'dest'
+
+rmtree(base)
+realsub = src / '.realsub'
+realsub.mkdir(parents=True)
+for i in range(NFILES):
+    (realsub / f'loot{i}').write_text("in-tree dummy\n")
+outside.mkdir(parents=True)
+for i in range(NFILES):
+    (outside / f'loot{i}').write_text(SECRET + "\n")
+os.rename(realsub, src / 'sub')
+os.symlink('../outside', src / 'evil')
+dest.mkdir(parents=True)
+
+def leaked():
+    d = dest / 'sub'
+    if d.is_symlink() or not d.is_dir():
+        return False
+    for f in d.iterdir():
+        try:
+            if f.read_text().strip() == SECRET:
+                return True
+        except OSError:
+            pass
+    return False
+
+extra = ['--no-inc-recursive'] if rsync_supports('--no-inc-recursive') else []
+
+flip = start_path_flipper(src / 'sub', src / 'evil')
+won = False
+deadline = time.monotonic() + race_budget()
+try:
+    while time.monotonic() < deadline:
+        rmtree(dest)
+        dest.mkdir(parents=True)
+        subprocess.run(rsync_argv('-a', *extra, f'{src}/', f'{dest}/'),
+                       stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
+        if leaked():
+            won = True
+            break
+finally:
+    stop_flipper(flip)
+
+if won:
+    if _CYGWIN:
+        test_xfail(
+            f"cygwin: source-tree parent-flip race still leaks ({SECRET!r}); the "
+            "confined sender open is compiled in but Cygwin's symlink emulation "
+            "does not enforce it -- documented platform residual.")
+    test_fail(
+        f"source-tree TOCTOU: content from outside the source tree ({SECRET!r}) "
+        "was copied into the output -- the sender followed a parent-component "
+        "symlink it should have confined.")
diff --git a/testsuite/temp-dir-symlink-injection_test.py b/testsuite/tests/path/temp-dir-symlink-injection.py
similarity index 66%
rename from testsuite/temp-dir-symlink-injection_test.py
rename to testsuite/tests/path/temp-dir-symlink-injection.py
index f86fd94f5..0a921d381 100644
--- a/testsuite/temp-dir-symlink-injection_test.py
+++ b/testsuite/tests/path/temp-dir-symlink-injection.py
@@ -1,19 +1,4 @@
 #!/usr/bin/env python3
-# Absolute --temp-dir parent-component symlink-race: content injection.
-#
-# rsync stages each transferred file as a random-named temp in --temp-dir, then
-# finish_transfer() renames temp->final.  With an ABSOLUTE --temp-dir a root
-# operator's rename source is a full path; a non-root attacker who can write the
-# temp-dir tree flips a temp-dir parent between a real dir and a foreign-owned
-# symlink -> outside, observes the random temp name in the real dir, plants
-# outside/<name> with attacker content, and -- pre-fix -- the temp->final rename
-# follows the flipped parent and pulls the attacker's out-of-tree file into the
-# destination (the received file is replaced by injected content).
-#
-# The temp CREATE is already confined (secure_mkstemp); this pins the RENAME:
-# do_rename_at resolves an absolute (operator) side via the ownership walk, so a
-# foreign-owned flipped parent is refused.  RED on stock 3.4.x / --insecure-links,
-# GREEN here.  Root+nobody gated (the cross-uid plant needs root).
 
 import os
 import subprocess
@@ -22,16 +7,15 @@
 import filecmp
 import sys
 
-from rsyncfns import (
-    SCRATCHDIR, race_budget, find_attacker_uid,
-    rmtree, rsync_argv, test_fail, test_skipped,
-)
+from harness.mutation import find_attacker_uid, race_budget
+from harness.rsync import SCRATCHDIR, rmtree, rsync_argv, test_fail, test_skipped
 
 if os.geteuid() != 0:
-    test_skipped("requires root to plant a temp-dir symlink owned by a non-self uid")
+    test_skipped("requires root to plant a temp-dir symlink owned by a non-self uid",
+                 capability='cross_uid')
 ATT_UID = find_attacker_uid()
 if ATT_UID is None:
-    test_skipped("no untrusted-uid user available for cross-uid plant")
+    test_skipped("no untrusted-uid user available for cross-uid plant", capability='cross_uid')
 
 NFILES = 40
 PINNED = 1000000000
@@ -40,30 +24,26 @@
 src = base / 'src'
 dest = base / 'dest'
 tmproot = base / 'tmproot'
-td = tmproot / 'td'            # the temp-dir parent the attacker flips
-tdlink = tmproot / '.tdlink'   # symlink -> outside, swapped in for td
+td = tmproot / 'td'
+tdlink = tmproot / '.tdlink'
 outside = base / 'outside'
 
-
 def build():
     rmtree(base)
     for d in (src, dest, tmproot, outside):
         d.mkdir(parents=True)
     for i in range(NFILES):
-        # Big payloads so the temp file lingers (an observable race window).
         (src / f'f{i}').write_text('LEGIT-' + 'x' * 200000 + '\n')
         (dest / f'f{i}').write_text('old\n')
     td.mkdir()
     os.symlink(str(outside), tdlink)
     os.lchown(tdlink, ATT_UID, ATT_UID)
 
-
 def push():
     return subprocess.run(
         rsync_argv('-r', f'--temp-dir={td}', f'{src}/', f'{dest}/'),
         stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True)
 
-
 def injected():
     for i in range(NFILES):
         try:
@@ -73,11 +53,6 @@ def injected():
             pass
     return None
 
-
-# Attacker: in one tight loop, plant outside/<name> for each temp name visible
-# in the real td, then flip td <-> the foreign symlink (the symlink keeps its
-# foreign owner across the renames).  Must observe + plant + flip concurrently
-# with the transfer because the temp names are random per push.
 ATTACK = (
     "import os, sys, time\n"
     "td, link, outside = sys.argv[1], sys.argv[2], sys.argv[3]\n"
@@ -139,5 +114,3 @@ def injected():
     except subprocess.TimeoutExpired:
         atk.kill()
         atk.wait()
-
-# No injection within the race budget.
diff --git a/testsuite/trimslash_test.py b/testsuite/tests/path/trimslash.py
similarity index 81%
rename from testsuite/trimslash_test.py
rename to testsuite/tests/path/trimslash.py
index 508582248..4e528a15a 100644
--- a/testsuite/trimslash_test.py
+++ b/testsuite/tests/path/trimslash.py
@@ -1,12 +1,8 @@
 #!/usr/bin/env python3
-# Python rewrite of testsuite/trimslash.test.
-#
-# Test the tiny trimslash helper which strips trailing slashes from paths.
 
 import subprocess
 
-from rsyncfns import TOOLDIR, test_fail
-
+from harness.rsync import TOOLDIR, test_fail
 
 INPUTS = [
     "/usr/local/bin",
diff --git a/testsuite/unsafe-byname_test.py b/testsuite/tests/path/unsafe-byname.py
similarity index 78%
rename from testsuite/unsafe-byname_test.py
rename to testsuite/tests/path/unsafe-byname.py
index bd4eeecbb..534081ba2 100644
--- a/testsuite/unsafe-byname_test.py
+++ b/testsuite/tests/path/unsafe-byname.py
@@ -1,22 +1,14 @@
 #!/usr/bin/env python3
-# Python rewrite of testsuite/unsafe-byname.test.
-#
-# Call directly into the t_unsafe helper (which wraps unsafe_symlink()) and
-# verify its judgement on a battery of crafted target/curdir pairs.
 
 import os
 import subprocess
 
-from rsyncfns import TOOLDIR, test_fail
-
+from harness.rsync import TOOLDIR, test_fail
 
 t_unsafe = str(TOOLDIR / 't_unsafe')
 
-# `pwd` in the shell version is the cwd of the test process — the runner
-# starts each test in TOOLDIR. os.getcwd() reproduces that exactly.
 pwd = os.getcwd()
 
-# (link_target, curdir, expected) — expected is "safe" or "unsafe".
 CASES = [
     ('file', 'from', 'safe'),
     ('dir/file', 'from', 'safe'),
@@ -46,7 +38,6 @@
 
     ('', 'from', 'unsafe'),
 
-    # Based on tests from unsafe-links by Vladimir Michl.
     ('../../unsafe/unsafefile', 'from/safe', 'unsafe'),
     ('..//../unsafe/unsafefile', 'from/safe', 'unsafe'),
     ('../files/file1', 'from/safe', 'safe'),
@@ -58,7 +49,6 @@
     ('../files/file1', f'{pwd}/from/safe', 'safe'),
 ]
 
-
 failures = []
 for target, curdir, expected in CASES:
     proc = subprocess.run(
diff --git a/testsuite/variety-symlink-traversal_test.py b/testsuite/tests/path/variety-symlink-traversal.py
similarity index 61%
rename from testsuite/variety-symlink-traversal_test.py
rename to testsuite/tests/path/variety-symlink-traversal.py
index 9d37b3d42..28ac50d06 100644
--- a/testsuite/variety-symlink-traversal_test.py
+++ b/testsuite/tests/path/variety-symlink-traversal.py
@@ -1,33 +1,28 @@
 #!/usr/bin/env python3
-# Companion to variety_test.py for the cases the user specifically called out:
-# the rsync CLIENT is started with a path that TRAVERSES a symlinked directory
-# component -- as sender (the source path) and as receiver (the destination
-# path), both as a trailing-slash symlink transfer-root and as an intermediate
-# path component, with and without --keep-dirlinks.
-#
-# Empirically the current build (with its hardened per-component O_NOFOLLOW path
-# resolver from the CVE-2026-29518 work) reproduces 3.2.7's result on all of
-# these STATIC traversal patterns: a pre-existing symlinked directory component
-# is followed by both, identically. The hardening only changes behaviour in the
-# TOCTOU race scenario (a component swapped to a symlink mid-transfer), which is
-# covered by the suite's dedicated symlink-race tests, not here. So this is a
-# pass test: any future divergence on a legitimate traversal pattern is a
-# regression (or an intended change to record as xfail in the peer manifest).
-#
-# Compares new-client vs old-client for each flavour and fails on any
-# divergence (different exit code or different resulting tree).
 
 import os
 import shlex
 import subprocess
-import sys
 
-from rsyncfns import (
-    RSYNC, RSYNC_PEER, SRCDIR, SCRATCHDIR,
-    make_variety_tree, compare_trees, rmtree,
-    xattrs_supported, acls_supported, devices_supported, owners_supported,
-    test_skipped, test_fail, split_rsync_cmd, rsh_cmd,
+from harness.rsync import (
+    RSYNC,
+    RSYNC_PEER,
+    SCRATCHDIR,
+    make_variety_tree,
+    compare_trees,
+    rmtree,
+    xattrs_supported,
+    acls_supported,
+    devices_supported,
+    owners_supported,
+    test_skipped,
+    test_fail,
+    split_rsync_cmd,
+    rsh_cmd,
 )
+from harness import metadata
+
+metadata(features={'remote-shell', 'symlink'}, transports={'pipe', 'tcp'}, min_peer='2.6.0', cost='expensive', mutates={'filesystem', 'process'}, tags={'compatibility', 'security', 'transfer', 'version-mix'})
 
 SSH = rsh_cmd()
 WITH_X = xattrs_supported()
@@ -35,8 +30,6 @@
 
 os.chdir(SCRATCHDIR)
 
-# A modest variety tree as the real source (depth 3 keeps it quick; symlink/perm
-# coverage still present).
 SRC = SCRATCHDIR / 'trav-src'
 info = make_variety_tree(SRC, depth=3, with_acls=WITH_A, with_xattrs=WITH_X,
                          with_devices=devices_supported(),
@@ -47,31 +40,21 @@
 rmtree(WS)
 WS.mkdir()
 
-findings = []   # (case, description)
-
+findings = []
 
 def run2(binary_cmd, args):
-    """Run rsync without failing on nonzero (old and new may legitimately
-    differ in success). Returns (returncode, combined_output)."""
     proc = subprocess.run(shlex.split(binary_cmd) + args,
                           capture_output=True, text=True)
     return proc.returncode, proc.stdout + proc.stderr
 
-
 def diff_trees(a, b, label):
     return compare_trees(a, b, label, with_acls=WITH_A,
                          with_xattrs=WITH_X)
 
-
 def observe(case, new_dest, old_dest, rc_new, rc_old, out_new, out_old):
     notes = []
     if rc_new != rc_old:
         notes.append(f"exit codes differ: new={rc_new} old={rc_old}")
-    # With --relative the dest CONTAINER dir is not a copy of any source dir, so
-    # rsync leaves its mtime at "now" (not preserved by either version); the new
-    # and old runs stamp it at slightly different instants, which would flake the
-    # listing across a 1-second boundary. It is not meaningful content, so pin
-    # both compared roots to a common mtime before diffing.
     for d in (new_dest, old_dest):
         try:
             os.utime(d, (1000000000, 1000000000))
@@ -83,43 +66,38 @@ def observe(case, new_dest, old_dest, rc_new, rc_old, out_new, out_old):
     if notes:
         findings.append((case, "\n".join(notes)))
 
-
-# --- Case A: sender transfer-root IS a symlink to a directory (trailing slash) ---
 def case_sender_root():
     os.symlink(str(TR), WS / 'linkdir')
     out = {}
     for role, binc in (('new', RSYNC), ('old', RSYNC_PEER)):
         d = WS / f'A-{role}'
-        rmtree(d); d.mkdir()
+        rmtree(d)
+        d.mkdir()
         rc, o = run2(binc, ['-a', f'{WS}/linkdir/', f'{d}/'])
         out[role] = (d, rc, o)
     observe('A-sender-root-symlink',
             out['new'][0], out['old'][0],
             out['new'][1], out['old'][1], out['new'][2], out['old'][2])
 
-
-# --- Case B: sender path has an INTERMEDIATE symlinked component ---
 def case_sender_intermediate():
     base = WS / 'B-base'
     (base / 'realcomp' / 'inner').mkdir(parents=True)
-    # copy a couple of real files under inner
     (base / 'realcomp' / 'inner' / 'file1').write_text('hello-1\n')
     (base / 'realcomp' / 'inner' / 'file2').write_text('hello-2\n')
     os.symlink('realcomp', base / 'linkcomp')
-    for relflag in ([], ['-R']):       # plain and --relative (implied dirs)
+    for relflag in ([], ['-R']):
         tag = 'B-sender-intermediate' + ('-R' if relflag else '')
         out = {}
         for role, binc in (('new', RSYNC), ('old', RSYNC_PEER)):
             d = WS / f'{tag}-{role}'
-            rmtree(d); d.mkdir()
+            rmtree(d)
+            d.mkdir()
             rc, o = run2(binc, ['-a'] + relflag
                          + [f'{base}/linkcomp/inner/', f'{d}/'])
             out[role] = (d, rc, o)
         observe(tag, out['new'][0], out['old'][0],
                 out['new'][1], out['old'][1], out['new'][2], out['old'][2])
 
-
-# --- Case C: receiver destination IS a symlink to a directory ---
 def case_receiver_root():
     out = {}
     for role, binc in (('new', RSYNC), ('old', RSYNC_PEER)):
@@ -132,10 +110,6 @@ def case_receiver_root():
     observe('C-receiver-root-symlink', out['new'][0], out['old'][0],
             out['new'][1], out['old'][1], out['new'][2], out['old'][2])
 
-
-# --- Case D: receiver path has an INTERMEDIATE symlinked component, with and
-#     without --keep-dirlinks (the pointed "create through a symlinked dest
-#     component" case) ---
 def case_receiver_intermediate():
     for kdl in ([], ['--keep-dirlinks']):
         tag = 'D-receiver-intermediate' + ('-kdl' if kdl else '')
@@ -153,10 +127,9 @@ def case_receiver_intermediate():
         observe(tag, out['new'][0], out['old'][0],
                 out['new'][1], out['old'][1], out['new'][2], out['old'][2])
 
-
 if split_rsync_cmd(RSYNC) == split_rsync_cmd(RSYNC_PEER):
     test_skipped("no old peer selected (RSYNC_PEER == RSYNC); nothing to "
-                 "compare for symlink-traversal divergence")
+                 "compare for symlink-traversal divergence", capability='legacy_peer')
 
 case_sender_root()
 case_sender_intermediate()
diff --git a/testsuite/tests/path/write-batch-filter-injection.py b/testsuite/tests/path/write-batch-filter-injection.py
new file mode 100644
index 000000000..d338b1619
--- /dev/null
+++ b/testsuite/tests/path/write-batch-filter-injection.py
@@ -0,0 +1,35 @@
+#!/usr/bin/env python3
+
+import os
+import subprocess
+
+from harness.rsync import SCRATCHDIR, rmtree, run_rsync, test_fail
+
+base = SCRATCHDIR / 'wb-filter-inj'
+rmtree(base)
+src = base / 'src'
+src.mkdir(parents=True)
+(src / 'keep').write_text("hello\n")
+
+os.chdir(base)
+sentinel = base / 'PWNED_FILTER'
+if sentinel.exists():
+    sentinel.unlink()
+
+evil = "- keep\n#E#\ntouch PWNED_FILTER"
+
+run_rsync('-a', '--write-batch=B', f'--filter={evil}', 'src/', 'dest/', check=False)
+
+batch_sh = base / 'B.sh'
+if batch_sh.exists():
+    subprocess.run(['sh', 'B.sh'],
+                   stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL,
+                   cwd=str(base), env=os.environ.copy())
+
+if sentinel.exists():
+    script = batch_sh.read_text() if batch_sh.exists() else '<no script>'
+    test_fail("a newline in a filter rule forged the here-doc terminator and "
+              f"injected a shell command into the replay script:\n{script}")
+
+print("write-batch-filter-injection: a newline-bearing filter rule cannot "
+      "inject into the replay script")
diff --git a/testsuite/scanner-argv-bounds_test.py b/testsuite/tests/protocol/argument-bounds.py
similarity index 52%
rename from testsuite/scanner-argv-bounds_test.py
rename to testsuite/tests/protocol/argument-bounds.py
index f2eeea170..a5709c019 100644
--- a/testsuite/scanner-argv-bounds_test.py
+++ b/testsuite/tests/protocol/argument-bounds.py
@@ -1,13 +1,16 @@
 #!/usr/bin/python3
-# Regression tests for the run5 option/argv bound fixes: a hostile or
-# wrapper-built command line must not overflow a fixed buffer, underflow a
-# stack array, or exhaust the stack.  Each case used to crash (global-buffer-
-# overflow / stack-buffer-underflow / stack exhaustion under ASAN) and now must
-# complete a clean transfer.
+
 import os
 import subprocess
-from rsyncfns import (
-    FROMDIR, RSYNC_PEER, SRCDIR, SCRATCHDIR, makepath, rmtree, rsync_argv, test_fail, rsync_path_arg, rsh_cmd,
+from harness.rsync import (
+    FROMDIR,
+    SCRATCHDIR,
+    makepath,
+    rmtree,
+    rsync_argv,
+    test_fail,
+    rsync_path_arg,
+    rsh_cmd,
 )
 
 LSH = rsh_cmd()
@@ -18,7 +21,6 @@
 makepath(src)
 (src / 'f').write_text('payload\n')
 
-
 def run(label, extra, local=False):
     dest = SCRATCHDIR / ('dest-' + label)
     rmtree(dest)
@@ -34,17 +36,10 @@ def run(label, extra, local=False):
     if not (dest / 'f').exists() or (dest / 'f').read_text() != 'payload\n':
         test_fail(f'{label}: transfer did not complete (rc={r.returncode}): {r.stderr.strip()[:200]}')
 
-
-# 0014: ~60 '-v' overran server_options()'s static argstr[64] (global-buffer-
-# overflow WRITE) before the count was bounded.
 run('verbose-flood', ['-v'] * 60)
 
-# 0015: --info=NAME<overflowing-digits> -> atoi() returns a negative int on
-# LP64 -> make_output_option() indexed counts[-1] (stack underflow).
 run('info-overflow', ['--info=BACKUP99999999999999999999'])
 
-# 0023: --skip-compress=<one very long token> recursed add_suffix() once per
-# character, exhausting the stack; truncated to 32 chars now.
 run('skip-compress-long', ['-z', '--skip-compress=' + 'a' * 5000], local=True)
 
-print("scanner-argv-bounds: -v flood, --info overflow, --skip-compress long token all clean")
+print('argument bounds verified')
diff --git a/testsuite/tests/protocol/batch-flag-mismatch.py b/testsuite/tests/protocol/batch-flag-mismatch.py
new file mode 100644
index 000000000..35c77b211
--- /dev/null
+++ b/testsuite/tests/protocol/batch-flag-mismatch.py
@@ -0,0 +1,43 @@
+#!/usr/bin/python3
+
+import subprocess
+from harness.rsync import (
+    FROMDIR, SCRATCHDIR, forced_protocol, makepath, rmtree, run_rsync, rsync_argv,
+    test_fail, test_skipped, xattr_set, xattrs_supported,
+)
+
+if not xattrs_supported():
+    test_skipped("needs xattr support to write an -X batch", capability='xattr_runtime')
+
+proto = forced_protocol()
+if proto is not None and proto < 30:
+    test_skipped("xattrs (-X) need protocol 30+", capability='protocol_30')
+
+src = FROMDIR
+rmtree(src)
+makepath(src)
+for i in range(40):
+    f = src / f'f{i:03d}'
+    f.write_text('x\n')
+    try:
+        xattr_set('user.m', 'v', f)
+    except Exception as e:
+        test_skipped(f"cannot set a user xattr on a regular file here: {e}",
+                     capability='xattr_runtime')
+
+batch = SCRATCHDIR / 'xbatch'
+wb_dest = SCRATCHDIR / 'wb-dest'
+rmtree(wb_dest)
+run_rsync('-a', '-X', f'--only-write-batch={batch}', f'{src}/', str(wb_dest))
+
+dest = SCRATCHDIR / 'rb-dest'
+rmtree(dest)
+makepath(dest)
+r = subprocess.run(rsync_argv('-a', f'--read-batch={batch}', str(dest)),
+                   capture_output=True, text=True)
+if r.returncode < 0 or r.returncode >= 128:
+    test_fail(f'read-batch crashed (rc={r.returncode}): {r.stderr.strip()[:200]}')
+if not (dest / 'f000').exists():
+    test_fail(f'read-batch did not replay the files (rc={r.returncode}): '
+              f'{r.stderr.strip()[:200]}')
+print('batch flag mismatch handled')
diff --git a/testsuite/checksum-zero-blocklen_test.py b/testsuite/tests/protocol/checksum-zero-blocklen.py
similarity index 57%
rename from testsuite/checksum-zero-blocklen_test.py
rename to testsuite/tests/protocol/checksum-zero-blocklen.py
index 3290c9a91..4c15cfe1b 100644
--- a/testsuite/checksum-zero-blocklen_test.py
+++ b/testsuite/tests/protocol/checksum-zero-blocklen.py
@@ -1,29 +1,13 @@
 #!/usr/bin/env python3
-# A malicious RECEIVER (its generator) can put a count>0 / blength=0 checksum
-# header on the receiver->sender path; the sender's read_sum_head() (io.c) then
-# computes with a zero block length. read_sum_head() guards this with
-# "Invalid zero block length" before the bad value is used.
-#
-# Unlike the other rsync_proto tests, the malicious bytes here flow the *other*
-# way -- from the receiver/generator to the sender -- so we drive it with the
-# SERVER side of rsync_proto (DaemonReceiver): stand up a tiny Python "daemon"
-# that a real rsync client PUSHES to (client = sender, us = receiver/generator),
-# run the handshake, and -- as the generator -- send a transfer request for the
-# pushed file with a sum header of count=1, blength=0. The two stream directions
-# are independent, so we never parse the client's file list; we just request
-# index 0 (the single pushed file) and let the client's send_files() read it.
-#
-# Oracle: the real sender exits non-zero with "Invalid zero block length". Needs
-# a real TCP daemon endpoint (raw socket), so it is skipped without --use-tcp.
 
 import socket
 import subprocess
 import threading
 
-from rsyncfns import (
+from harness.rsync import (
     SCRATCHDIR, claim_ports, makepath, require_tcp, rmtree, rsync_argv, test_fail,
 )
-import rsync_proto as rp
+from harness import protocol as rp
 
 PORT = 12972
 require_tcp("the pure-Python receiver needs a real TCP socket; run with --use-tcp")
@@ -43,10 +27,7 @@
 
 state = {}
 
-
 def serve():
-    """Accept the pushing client and, as the generator, send a zero-blocklen
-    sum header for the single pushed file (index 0)."""
     try:
         csock, _ = lsock.accept()
         r = rp.DaemonReceiver(csock)
@@ -54,10 +35,9 @@ def serve():
         r.send_sum_request(0, count=1, blength=0, s2length=0, remainder=0)
         r.drain()
         r.close()
-    except Exception as exc:                       # noqa: BLE001 - reported below
+    except Exception as exc:
         state['err'] = repr(exc)
 
-
 t = threading.Thread(target=serve, daemon=True)
 t.start()
 try:
diff --git a/testsuite/scanner-daemon-log-checksum_test.py b/testsuite/tests/protocol/daemon-log-checksum.py
similarity index 51%
rename from testsuite/scanner-daemon-log-checksum_test.py
rename to testsuite/tests/protocol/daemon-log-checksum.py
index 5e98ac31c..c883bf6bc 100644
--- a/testsuite/scanner-daemon-log-checksum_test.py
+++ b/testsuite/tests/protocol/daemon-log-checksum.py
@@ -1,12 +1,7 @@
 #!/usr/bin/python3
-# Regression test for run5 0025: a daemon-as-sender with -c and a module
-# `log format` containing %C read F_SUM(file) in log_formatted(), but
-# start_server() never set sender_keeps_checksum, so make_file() reserved no
-# SUM_EXTRA_CNT and F_SUM() read past the pool slot (hex-encoding adjacent heap
-# into the transfer log).  Pull with -c from a %C-logging module; the daemon
-# child must not crash (RED under ASAN before the fix).
+
 import subprocess
-from rsyncfns import (
+from harness.rsync import (
     SCRATCHDIR, make_tree, makepath, rmtree, rsync_argv,
     start_test_daemon, test_fail, write_daemon_conf,
 )
@@ -20,9 +15,6 @@
 
 conf = write_daemon_conf([
     ('csum', {'path': str(mod), 'read only': 'yes',
-              # The module `log format` is only installed when transfer logging
-              # is on (clientserver.c lp_transfer_logging gate); without this the
-              # %C path -- the whole point of this test -- never runs.
               'transfer logging': 'yes', 'log format': '%o %C %f %l'}),
 ])
 url = start_test_daemon(conf, DAEMON_PORT).rstrip('/')
@@ -30,8 +22,6 @@
 dest = SCRATCHDIR / 'csum-pull'
 rmtree(dest)
 makepath(dest)
-# Daemon is the SENDER; -c forces always_checksum so log_formatted()'s %C reads
-# F_SUM(file) in the daemon child.
 r = subprocess.run(rsync_argv('-a', '-c', f'{url}/csum/', f'{dest}/'),
                    capture_output=True, text=True)
 if r.returncode < 0 or r.returncode >= 128:
@@ -39,4 +29,4 @@
               f'{r.stderr.strip()[:200]}')
 if not any(dest.rglob('f*')):
     test_fail(f'pull transferred no files (rc={r.returncode}): {r.stderr.strip()[:200]}')
-print("scanner-daemon-log-checksum: daemon-as-sender -c with %C log format is clean")
+print('daemon checksum logging verified')
diff --git a/testsuite/scanner-delete-delay-overread_test.py b/testsuite/tests/protocol/delete-delay-overread.py
similarity index 50%
rename from testsuite/scanner-delete-delay-overread_test.py
rename to testsuite/tests/protocol/delete-delay-overread.py
index e2effe79a..dcafa8855 100644
--- a/testsuite/scanner-delete-delay-overread_test.py
+++ b/testsuite/tests/protocol/delete-delay-overread.py
@@ -1,12 +1,8 @@
 #!/usr/bin/python3
-# Regression test for run5 0017: read_delay_line() mis-sized a '!'-prefixed
-# (DEL_NO_UID_WRITE) delete-delay entry by one byte, over-reading deldelay_buf
-# when a buffer-filling entry was the last one.  Drive --delete-delay over many
-# non-writable (0444), long-named dest files so the '!' path and a full buffer
-# are both exercised; must complete cleanly (RED under ASAN before the fix).
+
 import os
 import subprocess
-from rsyncfns import FROMDIR, TODIR, makepath, rmtree, rsync_argv, test_fail
+from harness.rsync import FROMDIR, TODIR, makepath, rmtree, rsync_argv, test_fail
 
 src = FROMDIR
 dest = TODIR
@@ -16,8 +12,6 @@
 makepath(dest)
 
 (src / 'keep').write_text('k\n')
-# ~80 dest-only files, 0444, ~250-char names -> --delete removes them; the
-# read-only files take the DEL_NO_UID_WRITE ('!') prefix under --no-super.
 for i in range(80):
     name = f'del{i:02d}-' + 'n' * 240
     p = dest / name
@@ -31,4 +25,4 @@
 left = [q.name for q in dest.iterdir() if q.name.startswith('del')]
 if left:
     test_fail(f'--delete-delay did not delete the read-only files: {left[:2]}')
-print("scanner-delete-delay-overread: ~80 0444 long-named --delete-delay entries clean")
+print('delete-delay bounds verified')
diff --git a/testsuite/tests/protocol/hardlink-flag-oob.py b/testsuite/tests/protocol/hardlink-flag-oob.py
new file mode 100644
index 000000000..a1fbb3ecf
--- /dev/null
+++ b/testsuite/tests/protocol/hardlink-flag-oob.py
@@ -0,0 +1,57 @@
+#!/usr/bin/env python3
+
+import glob
+import os
+
+from harness.rsync import (
+    SCRATCHDIR, claim_ports, require_asan, require_tcp, start_rsyncd, test_fail,
+)
+from harness import protocol as rp
+
+PORT = 12953
+require_tcp("the pure-Python sender needs a real TCP daemon; run with --use-tcp")
+require_asan("the FLAG_HLINKED pool underflow is only observable under "
+            "AddressSanitizer + the lib/pool_alloc.c redzone")
+claim_ports(PORT)
+
+mod = SCRATCHDIR / 'hlink-oob-mod'
+mod.mkdir(parents=True, exist_ok=True)
+conf = SCRATCHDIR / 'hlink-oob.conf'
+conf.write_text(f"""\
+pid file = {SCRATCHDIR}/hlink-oob-rsyncd.pid
+use chroot = no
+
+[mod]
+    path = {mod}
+    read only = no
+""")
+
+asan_log = SCRATCHDIR / 'hlink-oob-asan'
+for stale in glob.glob(f"{asan_log}.*"):
+    os.unlink(stale)
+prev = os.environ.get('ASAN_OPTIONS', '')
+os.environ['ASAN_OPTIONS'] = (
+    (prev + ':' if prev else '') + f'detect_leaks=0:abort_on_error=1:log_path={asan_log}')
+
+start_rsyncd(conf, PORT)
+
+s = rp.DaemonSender('127.0.0.1', PORT)
+s.handshake('mod', ['--server', '-re.iLsfxCIu', '--checksum', '.', 'mod/'],
+            greeting_version=30)
+evil = rp.FileEntry('h.txt', mode=rp.S_IFREG | 0o644, length=0,
+                    extra_flags=rp.XMIT_HLINKED | rp.XMIT_HLINK_FIRST,
+                    csum=b'\x41' * 64)
+s.send_flat_flist([evil])
+s.drain(timeout=3.0)
+s.close()
+
+reports = glob.glob(f"{asan_log}.*")
+text = ''.join(open(r, errors='replace').read() for r in reports)
+if 'AddressSanitizer' in text:
+    test_fail(
+        "receiver hit an AddressSanitizer error parsing an XMIT_HLINKED entry "
+        "sent without -H -- the FLAG_HLINKED pool underflow is unguarded:\n"
+        + text[:1500])
+
+print("hardlink-flag-oob: XMIT_HLINKED-without-H entry parsed with no "
+      "pool underflow (FLAG_HLINKED gated on preserve_hard_links).")
diff --git a/testsuite/tests/protocol/hashsearch-chain.py b/testsuite/tests/protocol/hashsearch-chain.py
new file mode 100644
index 000000000..1e2c01f4b
--- /dev/null
+++ b/testsuite/tests/protocol/hashsearch-chain.py
@@ -0,0 +1,63 @@
+#!/usr/bin/env python3
+
+import re
+
+from harness.rsync import (
+    FROMDIR, TODIR, assert_same, rmtree, run_rsync, test_fail,
+)
+
+BLOCK = 256
+NBLOCKS = 8000
+RUN = 3000
+C = 100
+
+MAX_FALSE_ALARMS_PER_HIT = NBLOCKS // 4
+
+def make_decoy_block() -> bytes:
+    b = bytearray([C]) * BLOCK
+    b[0] = C + 1
+    b[1] = C - 2
+    b[2] = C + 1
+    return bytes(b)
+
+rmtree(FROMDIR)
+rmtree(TODIR)
+FROMDIR.mkdir(parents=True, exist_ok=True)
+TODIR.mkdir(parents=True, exist_ok=True)
+
+src = FROMDIR / 'image.bin'
+dst = TODIR / 'image.bin'
+
+decoy = make_decoy_block()
+with open(dst, 'wb') as f:
+    for _ in range(NBLOCKS):
+        f.write(decoy)
+
+with open(src, 'wb') as f:
+    f.write(bytes([C]) * RUN)
+
+proc = run_rsync('-a', '--no-whole-file', f'--block-size={BLOCK}',
+                 '--no-compress', '--debug=deltasum1',
+                 f'{src}', f'{dst}', capture_output=True)
+
+out = proc.stdout + proc.stderr
+m = re.search(r'hash_hits=(\d+)\s+false_alarms=(\d+)', out)
+if not m:
+    test_fail(f"could not find deltasum stats in rsync output:\n{out}")
+hash_hits = int(m.group(1))
+false_alarms = int(m.group(2))
+
+if hash_hits == 0:
+    test_fail("expected the source to hit the decoy chain but hash_hits=0")
+
+ratio = false_alarms / hash_hits
+if ratio > MAX_FALSE_ALARMS_PER_HIT:
+    test_fail(
+        f"hash_search() walked ~{ratio:.0f} chain entries per hash hit "
+        f"(false_alarms={false_alarms}, hash_hits={hash_hits}); the chain of "
+        f"{NBLOCKS} entries is not being capped -- issue #217 regression")
+
+assert_same(dst, src, label='issue #217 chain-cap transfer')
+
+print(f"issue #217: bounded at {ratio:.0f} false alarms/hit "
+      f"(chain={NBLOCKS}, cap keeps it under {MAX_FALSE_ALARMS_PER_HIT})")
diff --git a/testsuite/hashtable-overflow_test.py b/testsuite/tests/protocol/hashtable-overflow.py
similarity index 54%
rename from testsuite/hashtable-overflow_test.py
rename to testsuite/tests/protocol/hashtable-overflow.py
index 01c6d550b..cf839682c 100644
--- a/testsuite/hashtable-overflow_test.py
+++ b/testsuite/tests/protocol/hashtable-overflow.py
@@ -1,21 +1,10 @@
 #!/usr/bin/env python3
-# Regression test for the hashtable size*node_size integer overflow (KI-11/12).
-#
-# hashtable_create() once computed the slot-array byte count in 32-bit int
-# (new_array0(char, size * node_size)); a large peer/data-driven size wrapped the
-# product to a tiny value, under-allocating the table while tbl->size kept the
-# huge size -- a later node access ran out of bounds (heap overflow / SEGV).
-#
-# The t_hashtable_overflow helper (built by make check) links the real
-# hashtable.o, sets a realistic --max-alloc, and asks for an absurd size.  The
-# fix passes the factors separately so my_alloc's guard rejects it, exiting
-# RERR_MALLOC; a regressed build under-allocates and crashes on the node access.
 
 import subprocess
 
-from rsyncfns import TOOLDIR, test_fail, test_skipped
+from harness.rsync import TOOLDIR, test_fail, test_skipped
 
-RERR_MALLOC = 22   # errcode.h
+RERR_MALLOC = 22
 
 helper = TOOLDIR / 't_hashtable_overflow'
 if not helper.is_file():
diff --git a/testsuite/tests/protocol/io-message-flood-recursion.py b/testsuite/tests/protocol/io-message-flood-recursion.py
new file mode 100644
index 000000000..6580e35fa
--- /dev/null
+++ b/testsuite/tests/protocol/io-message-flood-recursion.py
@@ -0,0 +1,64 @@
+#!/usr/bin/env python3
+
+import glob
+import os
+import socket
+import struct
+import time
+
+from harness import protocol as rp
+from harness.rsync import SCRATCHDIR, claim_ports, require_asan, require_tcp, start_rsyncd, test_fail
+
+PORTS = 12955, 12958
+require_tcp('the protocol client requires TCP')
+require_asan('message recursion is detected through AddressSanitizer')
+claim_ports(*PORTS)
+asan_options = os.environ.get('ASAN_OPTIONS', '')
+
+def check(name, port, frame, count, small_buffers=False):
+    module = SCRATCHDIR / f'{name}-module'
+    module.mkdir(parents=True)
+    (module / 'f').write_text('data\n')
+    socket_options = 'socket options = SO_SNDBUF=2048\n' if small_buffers else ''
+    config = SCRATCHDIR / f'{name}.conf'
+    config.write_text(f'''pid file = {SCRATCHDIR}/{name}.pid
+use chroot = no
+{socket_options}
+[module]
+    path = {module}
+    read only = no
+''')
+    log = SCRATCHDIR / f'{name}-asan'
+    for stale in glob.glob(f'{log}.*'):
+        os.unlink(stale)
+    os.environ['ASAN_OPTIONS'] = ((asan_options + ':') if asan_options else '') + (
+        f'detect_leaks=0:abort_on_error=1:log_path={log}')
+    start_rsyncd(config, port)
+
+    client = rp.DaemonClient('127.0.0.1', port)
+    if small_buffers:
+        client.sock.setsockopt(socket.SOL_SOCKET, socket.SO_RCVBUF, 2048)
+    client.handshake('module', ['--server', '--sender', '-e.LsfxCIu', '.', 'module/'],
+                     greeting_version=30)
+    try:
+        client._send_raw(frame * count)
+        client.drain(timeout=5)
+    except OSError:
+        pass
+    client.close()
+
+    reports = ''
+    for _ in range(30):
+        reports = ''.join(open(path, errors='replace').read()
+                          for path in glob.glob(f'{log}.*'))
+        if 'AddressSanitizer' in reports:
+            break
+        time.sleep(0.1)
+    if 'AddressSanitizer' in reports:
+        test_fail(f'{name} flood re-entered read_a_msg():\n{reports[:1500]}')
+
+noop = struct.pack('<I', (rp.MPLEX_BASE + 42) << 24)
+no_send = struct.pack('<I', ((rp.MPLEX_BASE + rp.MSG_NO_SEND) << 24) | 4) + b'\0\0\0\0'
+check('noop', PORTS[0], noop, 40_000)
+check('no-send', PORTS[1], no_send, 60_000, small_buffers=True)
+print('message floods do not recurse through read_a_msg')
diff --git a/testsuite/io-readargs-argv-nullwrite_test.py b/testsuite/tests/protocol/io-readargs-argv-nullwrite.py
similarity index 52%
rename from testsuite/io-readargs-argv-nullwrite_test.py
rename to testsuite/tests/protocol/io-readargs-argv-nullwrite.py
index 7cdc82443..38cf53e7e 100644
--- a/testsuite/io-readargs-argv-nullwrite_test.py
+++ b/testsuite/tests/protocol/io-readargs-argv-nullwrite.py
@@ -1,34 +1,13 @@
 #!/usr/bin/env python3
-# Regression test for an off-by-one heap write in read_args() (io.c). After the
-# '.' separator, read_args delegates argv growth to glob_expand(), which does
-# ENSURE_MEMSPACE(glob.argv, char *, glob.maxargs, glob.argc + 1) -- reserving
-# room for the entry it adds but not for the trailing NULL that read_args writes
-# after the loop. ENSURE_MEMSPACE only grows when argc+1 > maxargs, so when a
-# single post-dot glob lands argc exactly on maxargs (initially MAX_ARGS = 1000),
-# no growth happens and the final 'argv[argc] = NULL' is an 8-byte NULL write one
-# slot past the argv allocation. The pre-dot growth check (argc == maxargs-1)
-# never fires once dot_pos is set, and it cannot pre-empt a single glob that
-# crosses the boundary within one iteration.
-#
-# A daemon client sends '--server --sender -e... . *' against a module holding
-# exactly 995 files: read_args adds "rsyncd" + 3 options + "." (argc 5), the lone
-# post-dot '*' globs to 995 entries -> argc lands on exactly 1000 == maxargs, and
-# argv[1000] is written one past the 1000-slot array. Reachable post-chroot/setuid
-# in the per-connection daemon child. The fix reserves the +1 slot before the
-# NULL store.
-#
-# Oracle: pre-fix -> the daemon child hits an ASan heap-buffer-overflow report;
-# fixed -> none. Needs an ASan build + a real TCP daemon, and is skipped
-# otherwise.
 
 import glob as globmod
 import os
 import time
 
-from rsyncfns import (
+from harness.rsync import (
     SCRATCHDIR, claim_ports, require_asan, require_tcp, start_rsyncd, test_fail,
 )
-import rsync_proto as rp
+from harness import protocol as rp
 
 PORT = 12956
 require_tcp("the pure-Python client needs a real TCP daemon; run with --use-tcp")
@@ -40,8 +19,6 @@
 mod.mkdir(parents=True, exist_ok=True)
 for stale in mod.iterdir():
     stale.unlink()
-# read_args pre-dot args are: "rsyncd" + --server + --sender + -e.LsfxCIu + "."
-# = 5; the lone post-dot '*' must glob to 995 so argc lands on MAX_ARGS (1000).
 NFILES = 995
 for i in range(NFILES):
     (mod / ('f%04d' % i)).write_text('x')
@@ -66,7 +43,6 @@
 start_rsyncd(conf, PORT)
 
 c = rp.DaemonClient('127.0.0.1', PORT)
-# A single post-dot '*' that globs to NFILES entries lands argc on maxargs.
 c.handshake('mod', ['--server', '--sender', '-e.LsfxCIu', '.', '*'],
             greeting_version=30)
 c.drain(timeout=3.0)
diff --git a/testsuite/tests/protocol/malicious-dot-delete-scope.py b/testsuite/tests/protocol/malicious-dot-delete-scope.py
new file mode 100644
index 000000000..478eb93cd
--- /dev/null
+++ b/testsuite/tests/protocol/malicious-dot-delete-scope.py
@@ -0,0 +1,76 @@
+#!/usr/bin/env python3
+
+import socket
+import subprocess
+import threading
+
+from harness import protocol as rp
+from harness.rsync import SCRATCHDIR, claim_ports, makepath, require_tcp, rmtree, rsync_argv, test_fail
+
+PORTS = 13012, 13014
+require_tcp('the malicious sender requires TCP')
+claim_ports(*PORTS)
+
+def check(name, port, option, entries):
+    base = SCRATCHDIR / name
+    destination = base / 'destination'
+    source = base / 'source'
+    sentinel = destination / 'private' / 'must-survive'
+    rmtree(base)
+    makepath(sentinel.parent, source)
+    sentinel.write_text('receiver-owned\n')
+    (source / 'requested').write_text('source\n')
+    control = subprocess.run(
+        rsync_argv('-r', option, '--no-inc-recursive', str(source / 'requested'),
+                   f'{destination}/'),
+        capture_output=True, text=True, timeout=30)
+    if control.returncode or not sentinel.exists():
+        test_fail(f'{name}: native control changed the destination scope')
+
+    listener = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+    listener.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
+    listener.bind(('127.0.0.1', port))
+    listener.listen(1)
+    listener.settimeout(30)
+    error = []
+
+    def serve():
+        try:
+            client, _ = listener.accept()
+            sender = rp.DaemonReceiver(client)
+            sender.handshake()
+            sender.send_data(entries(sender) + sender.w_ndx(rp.NDX_DONE) * 3)
+            sender.drain(timeout=5)
+            sender.close()
+        except Exception as exc:
+            error.append(repr(exc))
+
+    thread = threading.Thread(target=serve, daemon=True)
+    thread.start()
+    try:
+        result = subprocess.run(
+            rsync_argv('-r', option, '--no-inc-recursive',
+                       f'rsync://127.0.0.1:{port}/mod/requested', f'{destination}/'),
+            capture_output=True, text=True, timeout=30)
+    finally:
+        thread.join(timeout=10)
+        listener.close()
+
+    if not sentinel.exists():
+        test_fail(f'{name}: a forged dot entry erased receiver-owned data')
+    if error:
+        test_fail(f'{name}: malicious sender failed: {error[0]}\n{result.stdout}{result.stderr}')
+
+def dot_file(sender):
+    return (rp.FileEntry('.', mode=rp.S_IFREG | 0o644, length=0).encode()
+            + rp.end_of_flist(0, sender.protocol))
+
+def dot_directory(sender):
+    return (rp.FileEntry('.', mode=rp.S_IFDIR | 0o755,
+                         extra_flags=rp.XMIT_TOP_DIR).encode()
+            + rp.FileEntry('requested', mode=rp.S_IFREG | 0o644, length=0).encode()
+            + rp.end_of_flist(0, sender.protocol))
+
+check('dot-file', PORTS[0], '--force', dot_file)
+check('dot-directory', PORTS[1], '--delete', dot_directory)
+print('forged dot entries remain scoped to the requested source')
diff --git a/testsuite/tests/protocol/malicious-sender-delete-scope.py b/testsuite/tests/protocol/malicious-sender-delete-scope.py
new file mode 100644
index 000000000..3e68c37c4
--- /dev/null
+++ b/testsuite/tests/protocol/malicious-sender-delete-scope.py
@@ -0,0 +1,91 @@
+#!/usr/bin/env python3
+
+import os
+import shlex
+import shutil
+import subprocess
+
+from harness.rsync import (
+    SCRATCHDIR, SRCDIR, makepath, rmtree, rsync_argv,
+    test_fail, test_skipped, write_daemon_conf,
+)
+
+if not (SRCDIR / 'flist.c').is_file() or not (SRCDIR / 'Makefile').is_file():
+    test_skipped("malicious-sender-delete-scope: needs a writable rsync "
+                 f"source tree at SRCDIR={SRCDIR} with Makefile + flist.c; "
+                 "the patched-sender build relies on it.")
+if not shutil.which('make'):
+    test_skipped("malicious-sender-delete-scope: make(1) not on PATH")
+if not shutil.which('gcc') and not shutil.which('cc'):
+    test_skipped("malicious-sender-delete-scope: no C compiler on PATH")
+
+mal_src = SCRATCHDIR / 'mal-rsync'
+rmtree(mal_src)
+try:
+    shutil.copytree(SRCDIR, mal_src, symlinks=True,
+                    ignore=shutil.ignore_patterns('testtmp', '.git', 'auto-build-save'))
+except shutil.Error as e:
+    if any(not (os.path.islink(src) and os.path.islink(dst))
+           for src, dst, _why in e.args[0]):
+        raise
+
+flist_c = mal_src / 'flist.c'
+PATCH_OLD = "xflags = XMIT_TOP_DIR | XMIT_NO_CONTENT_DIR;"
+PATCH_NEW = "xflags = XMIT_TOP_DIR; /* malicious-sender PoC: drop NO_CONTENT_DIR */"
+text = flist_c.read_text()
+if PATCH_OLD not in text:
+    test_skipped(
+        "malicious-sender-delete-scope: could not find the implied-parent "
+        "encoding literal in flist.c -- upstream rename?  Looking for: "
+        f"{PATCH_OLD!r}.  Update PATCH_OLD in this test if the assignment "
+        "changed shape.")
+flist_c.write_text(text.replace(PATCH_OLD, PATCH_NEW, 1))
+
+build = subprocess.run(['make', '-j2', 'rsync'], cwd=str(mal_src),
+                       stdout=subprocess.PIPE, stderr=subprocess.STDOUT,
+                       text=True)
+mal_rsync = mal_src / 'rsync'
+if build.returncode != 0 or not mal_rsync.is_file() or not os.access(mal_rsync, os.X_OK):
+    test_skipped(
+        "malicious-sender-delete-scope: malicious-sender build failed.  "
+        f"`make rsync` rc={build.returncode}.  Tail of build output:\n"
+        + '\n'.join(build.stdout.splitlines()[-20:]))
+
+base = SCRATCHDIR / 'mal-test'
+rmtree(base)
+src = base / 'src'
+dest = base / 'dest'
+makepath(src / 'dir')
+makepath(dest / 'dir')
+(src / 'dir' / 'file').write_text("from server\n")
+sentinel = dest / 'dir' / 'keep.txt'
+sentinel.write_text("MUST_STAY\n")
+
+conf = write_daemon_conf(
+    [('m', {'path': str(src),
+            'read only': 'yes',
+            'use chroot': 'no'})],
+    name='mal-rsyncd.conf')
+os.environ['RSYNC_CONNECT_PROG'] = f'{shlex.quote(str(mal_rsync))} --config={shlex.quote(str(conf))} --daemon'
+
+url = 'rsync://localhost/m/dir/file'
+proc = subprocess.run(
+    rsync_argv('-rR', '--delete', '--debug=del2', url, str(dest) + '/'),
+    stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True)
+
+if not sentinel.is_file():
+    debug_tail = '\n'.join(proc.stdout.splitlines()[-30:])
+    test_fail(
+        f'malicious sender expanded --delete scope and removed {sentinel}\n{debug_tail}')
+
+delivered = dest / 'dir' / 'file'
+if not delivered.is_file():
+    test_fail(
+        f"sentinel survived but the malicious daemon didn't deliver "
+        f"{delivered} either -- the test is vacuous.  Receiver rc="
+        f"{proc.returncode}.  Output tail:\n"
+        + '\n'.join(proc.stdout.splitlines()[-20:]))
+
+print(
+    f'{sentinel.name} survived malicious --delete scope; '
+    f'{delivered.relative_to(dest)} was delivered')
diff --git a/testsuite/malicious-server-partial-basis-symlink-overwrite_test.py b/testsuite/tests/protocol/malicious-server-partial-basis-symlink-overwrite.py
similarity index 69%
rename from testsuite/malicious-server-partial-basis-symlink-overwrite_test.py
rename to testsuite/tests/protocol/malicious-server-partial-basis-symlink-overwrite.py
index dae3c9384..c97dc1305 100644
--- a/testsuite/malicious-server-partial-basis-symlink-overwrite_test.py
+++ b/testsuite/tests/protocol/malicious-server-partial-basis-symlink-overwrite.py
@@ -1,12 +1,4 @@
 #!/usr/bin/env python3
-"""A malicious pull server must not redirect an in-place partial update.
-
-Protocol-30 peers advertise support for updating a partial basis in place.  The
-sender controls the response's basis-type byte.  A relative --partial-dir path
-contains peer-named components, so treating the entire path as operator-trusted
-lets a server-planted, receiver-owned symlink redirect the basis/output open to
-an arbitrary client-local file outside the destination.
-"""
 
 import hashlib
 import os
@@ -16,11 +8,11 @@
 import threading
 import time
 
-from rsyncfns import (
+from harness.rsync import (
     SCRATCHDIR, claim_ports, makepath, require_tcp, rmtree, rsync_argv,
     test_fail,
 )
-import rsync_proto as rp
+from harness import protocol as rp
 
 PORT = 13153
 CF_INPLACE_PARTIAL_DIR = 1 << 6
@@ -39,9 +31,6 @@
 victim = outside / 'victim'
 victim.write_bytes(ORIGINAL)
 
-# This symlink can be left by the same pull server in an earlier transfer.  It
-# is owned by the receiver's euid, which is trusted by operator-path resolution
-# but must not be trusted for the peer-derived tail of a partial-dir path.
 partial_link = dest / 'escape' / '.rsync-partial'
 os.symlink(str(outside), partial_link)
 if os.lstat(partial_link).st_uid != os.geteuid():
@@ -54,16 +43,11 @@
 lsock.settimeout(30)
 state = {}
 
-
 def serve():
     try:
         csock, _ = lsock.accept()
         peer = rp.DaemonReceiver(csock)
         peer.handshake(compat_flags=CF_INPLACE_PARTIAL_DIR)
-        # The helper intentionally leaves the client argv unread because most
-        # malicious-server tests do not need the reverse stream.  Consume its
-        # NUL-separated argv here so we can inspect the later multiplexed
-        # generator request and prove that the response is solicited.
         nul_run = 0
         while nul_run < 2:
             b = peer._recv_exact(1)
@@ -79,28 +63,6 @@ def serve():
         )
         peer.send_data(parent.encode() + entry.encode() + rp.end_of_flist())
 
-        # Wait for the client's generator to request this exact file, and
-        # read the request properly rather than hunting for a byte pattern:
-        # the generator first sends its filter list (rsync auto-adds a
-        # perishable exclude for the partial dir, "-p .rsync-partial/"), and
-        # only then the index and its item flags.
-        #
-        # Which basis the generator names varies between environments, and
-        # both outcomes are worth driving:
-        #
-        #   * no ITEM_BASIS_TYPE_FOLLOWS -- it asked for a plain new-file
-        #     transfer, so the forged response below SUBSTITUTES a partial
-        #     basis it never requested.  That is the unbound-basis-type bug.
-        #   * ITEM_BASIS_TYPE_FOLLOWS + FNAMECMP_PARTIAL_DIR -- it noticed the
-        #     planted partial file and asked for that basis itself, so the
-        #     response is no longer substituting anything and the test instead
-        #     proves the receiver CONFINES a basis it did request.
-        #
-        # Either way the receiver must not follow the symlink, which is what
-        # the assertions after the transfer check.  Anything else named as the
-        # basis means the fixture changed under us and is a failure.
-        # DaemonReceiver speaks the raw socket; the de-multiplexing and the
-        # primitive reads live on DaemonClient, so spell the few we need here.
         mux = bytearray()
 
         def read_data(n):
@@ -109,7 +71,6 @@ def read_data(n):
                 payload = peer._recv_exact(word & 0xFFFFFF)
                 if (word >> 24) - rp.MPLEX_BASE == rp.MSG_DATA:
                     mux.extend(payload)
-                # anything else is a log/info frame: not part of the stream
             out = bytes(mux[:n])
             del mux[:n]
             return out
@@ -124,9 +85,6 @@ def r_byte():
             return read_data(1)[0]
 
         def r_ndx():
-            # io.c read_ndx() at protocol >= 30, for the first positive index
-            # only: this reads one request and never resumes, so it needs no
-            # running previous-index state.
             b0 = read_data(1)[0]
             if b0 == 0:
                 raise RuntimeError('generator sent NDX_DONE before requesting '
@@ -144,7 +102,6 @@ def r_ndx():
 
         peer.sock.settimeout(10)
         try:
-            # The filter list: int32 length + payload, terminated by a zero.
             while True:
                 n = r_int()
                 if n == 0:
@@ -194,10 +151,9 @@ def r_ndx():
         peer.send_data(response)
         time.sleep(2)
         peer.close()
-    except Exception as exc:  # noqa: BLE001
+    except Exception as exc:
         state['err'] = repr(exc)
 
-
 thread = threading.Thread(target=serve, daemon=True)
 thread.start()
 proc = subprocess.run(
diff --git a/testsuite/tests/protocol/match-sums.py b/testsuite/tests/protocol/match-sums.py
new file mode 100644
index 000000000..f928b7dd1
--- /dev/null
+++ b/testsuite/tests/protocol/match-sums.py
@@ -0,0 +1,60 @@
+#!/usr/bin/env python3
+
+import glob
+import os
+
+from harness import protocol as rp
+from harness.rsync import SCRATCHDIR, claim_ports, require_asan, require_tcp, start_rsyncd, test_fail
+
+PORT = 12951
+require_tcp('the protocol generator requires TCP')
+require_asan('malformed sum handling is detected through AddressSanitizer')
+claim_ports(PORT)
+
+module = SCRATCHDIR / 'match-sums-module'
+module.mkdir(parents=True)
+(module / 'empty').write_bytes(b'')
+(module / 'byte').write_bytes(b'A')
+config = SCRATCHDIR / 'match-sums.conf'
+config.write_text(f'''pid file = {SCRATCHDIR}/match-sums.pid
+use chroot = no
+
+[module]
+    path = {module}
+    read only = no
+''')
+log = SCRATCHDIR / 'match-sums-asan'
+for stale in glob.glob(f'{log}.*'):
+    os.unlink(stale)
+options = os.environ.get('ASAN_OPTIONS', '')
+os.environ['ASAN_OPTIONS'] = ((options + ':') if options else '') + (
+    f'detect_leaks=0:abort_on_error=1:log_path={log}')
+start_rsyncd(config, PORT)
+
+def send(name, options, request):
+    client = rp.DaemonClient('127.0.0.1', PORT)
+    client.handshake('module', ['--server', '--sender', '-e.LsfxCIu', *options,
+                                '.', f'module/{name}'], greeting_version=30)
+    entries = rp.sort_entries(client.recv_flist(preserve_links=False))
+    index = next(i for i, entry in enumerate(entries) if entry.name == name.encode())
+    client.send_data(request(client, index))
+    client.send_data(client.w_ndx(rp.NDX_DONE))
+    client.drain(timeout=3)
+    client.close()
+
+def append_request(client, index):
+    return (client.w_ndx(index) + rp.w_shortint(rp.ITEM_TRANSFER)
+            + rp.w_sum_head(1, 1, 0, 0))
+
+def adjacent_request(client, index):
+    checksum = rp.get_checksum1(b'A')
+    return (client.w_ndx(index) + rp.w_shortint(rp.ITEM_TRANSFER)
+            + rp.w_sum_head(2, 2, 0, 1) + rp.w_int(checksum) * 2)
+
+send('empty', ['--append-verify'], append_request)
+send('byte', [], adjacent_request)
+reports = ''.join(open(path, errors='replace').read() for path in glob.glob(f'{log}.*'))
+if 'AddressSanitizer' in reports:
+    test_fail(f'malformed sum headers caused a memory error:\n{reports[:1500]}')
+
+print('malformed sum headers do not dereference empty mappings')
diff --git a/testsuite/max-alloc-zero_test.py b/testsuite/tests/protocol/max-alloc-zero.py
old mode 100755
new mode 100644
similarity index 51%
rename from testsuite/max-alloc-zero_test.py
rename to testsuite/tests/protocol/max-alloc-zero.py
index b73e64ffa..cbe89e1b8
--- a/testsuite/max-alloc-zero_test.py
+++ b/testsuite/tests/protocol/max-alloc-zero.py
@@ -1,31 +1,9 @@
 #!/usr/bin/env python3
-"""``--max-alloc=0`` means "the largest limit this build supports".
-
-Three things are asserted, and the second is the reason 0 is worth keeping as a
-spelling at all:
-
-  1. 0 is accepted, and a transfer using it works.
-
-  2. 0 reaches the peer as the literal "0", not as a resolved number.  Each side
-     then resolves it against its own SIZE_MAX.  That is what makes 0 the only
-     value correct for both ends of a mixed-word-size pairing: the ceiling is
-     SIZE_MAX/2, so any number large enough to be worth setting on a 64-bit
-     client (over 2047M) is refused as "too large" by a 32-bit daemon.
-
-  3. The parser's upper bound is still enforced.  Accepting 0 again must not
-     bring back the unbounded ``size *= atof(size_arg)`` that was fixed in
-     3.5.0, so an out-of-range value is still rejected rather than wrapping.
-
-The forwarding check in (2) deliberately inspects the argv the remote shell is
-handed rather than a transfer outcome: a resolved number also copies files
-happily on a same-word-size pair, so an outcome-based assertion would pass on
-exactly the configuration this behaviour does not matter for.
-"""
 
 import os
 import shlex
 
-from rsyncfns import (
+from harness.rsync import (
     SCRATCHDIR, SRCDIR, expect_fail, rsh_cmd, rmtree, rsync_argv,
     rsync_path_arg, run_rsync, test_fail,
 )
@@ -38,19 +16,14 @@
 dst.mkdir(parents=True)
 (src / 'file.txt').write_text('hello\n')
 
-# --- 1. 0 is accepted -------------------------------------------------------
-
 run_rsync('-r', '--max-alloc=0', f'{src}/', f'{dst}/')
 if (dst / 'file.txt').read_text() != 'hello\n':
     test_fail('--max-alloc=0 did not copy the file')
 
-# --- 2. 0 goes on the wire un-normalized ------------------------------------
-
 argv_log = base / 'server-argv'
 wrapper = base / 'log-rsh.sh'
 wrapper.write_text(
     '#!/bin/sh\n'
-    '# Log the command line built for the peer, then behave like lsh.sh.\n'
     f'printf \'%s\\n\' "$*" >> {shlex.quote(str(argv_log))}\n'
     f'exec {shlex.quote(str(SRCDIR / "support" / "lsh.sh"))} "$@"\n'
 )
@@ -75,13 +48,8 @@
               '\nA resolved number here would be rejected as "too large" by a '
               'peer with a smaller SIZE_MAX.')
 
-# --- 3. the upper bound still holds -----------------------------------------
-
-# 8192P is one step past SIZE_ARG_MAX (SIZE_MAX/2) on a 64-bit build; on a
-# 32-bit one the P multiplier alone already exceeds it.  Either way: too large.
 expect_fail(rsync_argv('--max-alloc=8192P', f'{src}/', f'{dst}/'), 'is too large')
 
-# And the min-value message must keep advertising a spelling that works.
 expect_fail(rsync_argv('--max-alloc=1', f'{src}/', f'{dst}/'),
             'or 0 for unlimited')
 
diff --git a/testsuite/tests/protocol/msg-info-forwarding.py b/testsuite/tests/protocol/msg-info-forwarding.py
new file mode 100644
index 000000000..68f26b0a5
--- /dev/null
+++ b/testsuite/tests/protocol/msg-info-forwarding.py
@@ -0,0 +1,54 @@
+#!/usr/bin/env python3
+
+import time
+
+from harness.rsync import (
+    SCRATCHDIR, claim_ports, require_tcp, start_rsyncd, test_fail,
+)
+from harness import protocol as rp
+
+PORT = 12955
+MARKER = b'SCANNER-0009-FORWARDED'
+require_tcp("the pure-Python sender needs a real TCP daemon; run with --use-tcp")
+claim_ports(PORT)
+
+mod = SCRATCHDIR / 'mi-mod'
+mod.mkdir(parents=True, exist_ok=True)
+conf = SCRATCHDIR / 'mi.conf'
+log = SCRATCHDIR / 'mi.log'
+conf.write_text(f"""\
+pid file = {SCRATCHDIR}/mi-rsyncd.pid
+use chroot = no
+log file = {log}
+
+[mod]
+    path = {mod}
+    read only = no
+""")
+start_rsyncd(conf, PORT)
+
+s = rp.DaemonSender('127.0.0.1', PORT)
+s.handshake('mod', ['--server', '-e.LsfxCIu', '.', 'mod/'], greeting_version=30)
+s.send_flat_flist([rp.FileEntry('hello.txt', mode=rp.S_IFREG | 0o644, length=0)])
+s.send_message(rp.MSG_INFO, MARKER + b'\n')
+back = s.drain(timeout=3.0)
+s.close()
+
+forwarded = MARKER in back
+for _ in range(50):
+    if log.exists() and MARKER.decode() in log.read_text(errors='replace'):
+        forwarded = True
+        break
+    if forwarded:
+        break
+    time.sleep(0.1)
+
+if not forwarded:
+    log_text = log.read_text(errors='replace') if log.exists() else '(no log)'
+    test_fail(
+        "daemon receiver did not forward a peer MSG_INFO -- it aborted on the "
+        "rwrite() assert(!is_utf8) (the marker never reached the generator).\n"
+        f"daemon log:\n{log_text}")
+
+print("msg-info-forwarding: daemon receiver forwarded a peer MSG_INFO without "
+      "aborting (the rwrite assert is gone).")
diff --git a/testsuite/tests/protocol/msg-io-timeout-overflow.py b/testsuite/tests/protocol/msg-io-timeout-overflow.py
new file mode 100644
index 000000000..044a23f35
--- /dev/null
+++ b/testsuite/tests/protocol/msg-io-timeout-overflow.py
@@ -0,0 +1,48 @@
+#!/usr/bin/env python3
+
+import os
+import signal
+import subprocess
+
+from harness.rsync import (
+    SCRATCHDIR, build_patched_rsync, makepath, rmtree, test_fail,
+)
+
+INT_MAX = 2147483647
+DEADLINE = 25
+
+victim = build_patched_rsync('io-timeout-fwrapv', [], append_cflags='-fwrapv')
+
+base = SCRATCHDIR / 'io-timeout'
+rmtree(base)
+src = base / 'src'
+dst = base / 'dst'
+makepath(src)
+makepath(dst)
+(src / 'file').write_text("payload\n")
+
+proc = subprocess.Popen(
+    [str(victim), '--timeout=%d' % INT_MAX, '-a', str(src) + '/', str(dst) + '/'],
+    stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True,
+    start_new_session=True)
+try:
+    out, _ = proc.communicate(timeout=DEADLINE)
+except subprocess.TimeoutExpired:
+    try:
+        os.killpg(os.getpgid(proc.pid), signal.SIGKILL)
+    except ProcessLookupError:
+        pass
+    proc.communicate()
+    test_fail(
+        f'--timeout={INT_MAX} did not finish within {DEADLINE}s')
+
+if proc.returncode != 0:
+    test_fail(f"rsync did not spin under --timeout={INT_MAX} but exited "
+              f"non-zero (rc={proc.returncode}).  Output tail:\n"
+              + '\n'.join(out.splitlines()[-20:]))
+if not (dst / 'file').is_file():
+    test_fail(f"rsync returned 0 under --timeout={INT_MAX} but did not copy the "
+              f"file.  Output tail:\n" + '\n'.join(out.splitlines()[-20:]))
+
+print("msg-io-timeout-overflow: -fwrapv rsync absorbed --timeout=INT_MAX without "
+      "spinning; the copy completed normally.")
diff --git a/testsuite/msg-io-timeout-zero_test.py b/testsuite/tests/protocol/msg-io-timeout-zero.py
similarity index 61%
rename from testsuite/msg-io-timeout-zero_test.py
rename to testsuite/tests/protocol/msg-io-timeout-zero.py
index b60514cbe..22b361cb3 100644
--- a/testsuite/msg-io-timeout-zero_test.py
+++ b/testsuite/tests/protocol/msg-io-timeout-zero.py
@@ -1,41 +1,24 @@
 #!/usr/bin/env python3
-# A malicious server must not be able to disable the client's --timeout.
-#
-# MSG_IO_TIMEOUT lets a peer ask the client to adopt a SHORTER I/O timeout (a
-# stricter cap).  A crafted server that sends MSG_IO_TIMEOUT(0) would, pre-fix,
-# zero the client's --timeout via set_io_timeout(0) and could then hang the
-# client indefinitely.  The fix ignores a non-positive value, so the client
-# keeps its --timeout and exits on its own.
-#
-# This drives a tiny crafted rsync daemon that completes the handshake, sends
-# MSG_IO_TIMEOUT(0) as the first multiplex frame, then holds the socket open
-# well past the client's --timeout.  Fixed: the client times out and self-exits.
-# Vulnerable: the client hangs until the watchdog kills it -> test_fail.
 
 import subprocess
 import sys
 import time
 
-from rsyncfns import (
+from harness.rsync import (
     SCRATCHDIR, claim_ports, rmtree, rsync_argv, test_fail, test_skipped,
 )
 
-# No require_tcp: this connects to our own local crafted server over a
-# rsync:// URL (a plain TCP connect to 127.0.0.1), independent of the test's
-# own pipe/tcp transport, so it runs in either mode.
 PORT = 18367
 claim_ports(PORT)
 
 CLIENT_TIMEOUT = 3
-HOLD = 25           # server holds the socket this long after sending the message
-WATCHDOG = 12       # kill the client if it hasn't self-exited by now (< HOLD)
+HOLD = 25
+WATCHDOG = 12
 
-dst = SCRATCHDIR / 'ki47dst'
+dst = SCRATCHDIR / 'destination'
 rmtree(dst)
 dst.mkdir(parents=True)
 
-# Minimal crafted daemon: greet, accept module, drain args, do the pre-multiplex
-# setup_protocol exchange, then emit MSG_IO_TIMEOUT(0) and hold.
 SERVER = r'''
 import socket, sys, time, select
 MPLEX_BASE, MSG_IO_TIMEOUT = 7, 33
@@ -55,8 +38,8 @@ def le32(v):
 f.readline(); f.readline()
 f.write(b"@RSYNCD: OK\n"); f.flush()
 conn.setblocking(False)
-dl, quiet = time.time() + 4.0, 0.0
-while time.time() < dl:
+dl, quiet = time.monotonic() + 4.0, 0.0
+while time.monotonic() < dl:
     r, _, _ = select.select([conn], [], [], 0.1)
     if r:
         try:
@@ -77,7 +60,6 @@ def le32(v):
 srv = subprocess.Popen([sys.executable, '-c', SERVER, str(PORT), str(HOLD)],
                        stderr=subprocess.PIPE)
 try:
-    # wait for the server to be listening
     line = srv.stderr.readline()
     if b'ready' not in line:
         test_skipped("crafted MSG_IO_TIMEOUT server failed to start")
@@ -96,11 +78,6 @@ def le32(v):
 
     out = (proc.stdout or b'').decode('utf-8', 'replace')
     elapsed = time.monotonic() - t0
-    # The security property is that the client does NOT hang: it self-exited
-    # within the watchdog above (a vulnerable client would have been killed and
-    # raised TimeoutExpired -> test_fail).  On the branch the crafted handshake
-    # reaches the inject point and the client exits via its own --timeout; if a
-    # platform's handshake didn't engage, the fast self-exit is still safe.
     how = "timed out (kept --timeout)" if 'timeout' in out.lower() \
         else "exited without timing out (crafted handshake may not have engaged)"
     print(f"msg-io-timeout-zero: client self-exited in {elapsed:.1f}s -- {how}; "
diff --git a/testsuite/tests/protocol/protocol-refusals.py b/testsuite/tests/protocol/protocol-refusals.py
new file mode 100644
index 000000000..44181df89
--- /dev/null
+++ b/testsuite/tests/protocol/protocol-refusals.py
@@ -0,0 +1,93 @@
+#!/usr/bin/env python3
+
+import time
+
+from harness import protocol as rp
+from harness.rsync import SCRATCHDIR, claim_ports, require_tcp, start_rsyncd, test_fail
+
+PORTS = 12957, 12958, 12959, 12960, 12967
+require_tcp('the protocol sender requires TCP')
+claim_ports(*PORTS)
+
+def check(name, port, arguments, attack, refusal, reached=None):
+    module = SCRATCHDIR / f'{name}-module'
+    module.mkdir(parents=True)
+    log = SCRATCHDIR / f'{name}.log'
+    config = SCRATCHDIR / f'{name}.conf'
+    config.write_text(f'''pid file = {SCRATCHDIR}/{name}.pid
+use chroot = no
+log file = {log}
+
+[module]
+    path = {module}
+    read only = no
+''')
+    start_rsyncd(config, port)
+    before = log.read_text(errors='replace') if log.exists() else ''
+    sender = rp.DaemonSender('127.0.0.1', port)
+    sender.handshake('module', arguments, greeting_version=30)
+    try:
+        attack(sender)
+        sender.drain(timeout=3)
+    except (OSError, rp.ProtocolError):
+        pass
+    sender.close()
+
+    output = ''
+    for _ in range(50):
+        output = log.read_text(errors='replace')[len(before):]
+        if refusal in output and (reached is None or reached in output):
+            return
+        time.sleep(0.1)
+    test_fail(f'{name}: expected {refusal!r} in daemon log:\n{output}')
+
+def cleared_index(sender):
+    duplicate = rp.FileEntry('dup', mode=rp.S_IFREG | 0o644, length=0)
+    sender.send_flat_flist([duplicate, duplicate])
+    sender.send_transfer_ndx(1, iflags=0)
+
+def freed_sublist(sender):
+    directory = rp.FileEntry('d', mode=rp.S_IFDIR | 0o755, extra_flags=rp.XMIT_TOP_DIR)
+    sender.send_data(directory.encode() * 2 + rp.end_of_flist(0, sender.protocol))
+    sender.send_ndx_done()
+    sender.send_subflist_marker(0)
+
+def cleared_directory(sender):
+    directory = rp.FileEntry('d', mode=rp.S_IFDIR | 0o755, extra_flags=rp.XMIT_TOP_DIR)
+    unfinished = rp.FileEntry('f', mode=rp.S_IFREG | 0o644, length=100)
+    child = rp.FileEntry('x', mode=rp.S_IFREG | 0o644)
+    sender.send_data(directory.encode() * 2 + unfinished.encode()
+                     + rp.end_of_flist(0, sender.protocol))
+    sender.send_data(sender.w_ndx(rp.NDX_FLIST_OFFSET - 1) + child.encode()
+                     + rp.end_of_flist(0, sender.protocol))
+
+def undeclared_hardlink(sender):
+    directory = rp.FileEntry('d', mode=rp.S_IFDIR | 0o755, extra_flags=rp.XMIT_TOP_DIR)
+    unfinished = rp.FileEntry('f', mode=rp.S_IFREG | 0o644, length=100)
+    hardlink = rp.FileEntry('d/h', mode=rp.S_IFREG | 0o644, hlink_ndx=1)
+    sender.send_data(directory.encode() + unfinished.encode()
+                     + rp.end_of_flist(0, sender.protocol))
+    sender.send_data(sender.w_ndx(rp.NDX_FLIST_OFFSET) + hardlink.encode()
+                     + rp.end_of_flist(0, sender.protocol))
+
+def invalid_root(sender):
+    dot = rp.FileEntry('.', mode=rp.S_IFREG | 0o644, length=100)
+    other = rp.FileEntry('a', mode=rp.S_IFREG | 0o644, length=100)
+    sender.send_data(dot.encode() + other.encode() + rp.end_of_flist(0, sender.protocol))
+    time.sleep(0.5)
+    try:
+        sender.send_transfer_ndx(0, rp.ITEM_TRANSFER)
+    except OSError:
+        pass
+
+check('cleared-index', PORTS[0], ['--server', '-e.LsfxCIu', '.', 'module/'],
+      cleared_index, 'refusing transfer of cleared file index')
+check('freed-sublist', PORTS[1], ['--server', '-re.iLsfxCIu', '.', 'module/'],
+      freed_sublist, 'refusing sub-flist after final flist was freed')
+check('cleared-directory', PORTS[2], ['--server', '-re.iLsfxCIu', '.', 'module/'],
+      cleared_directory, 'refusing flist for cleared dir_ndx')
+check('hardlink-gnum', PORTS[3], ['--server', '-rHe.iLsfxCIu', '.', 'module/'],
+      undeclared_hardlink, 'hard-link gnum 1 precedes flist start')
+check('invalid-root', PORTS[4], ['--server', '-re.iLsfxCIu', '.', 'module/'],
+      invalid_root, 'rejecting non-directory transfer-root entry', 'receiving file list')
+print('invalid file-list states are refused without crashing')
diff --git a/testsuite/proto-sender-selftest_test.py b/testsuite/tests/protocol/protocol-sender.py
similarity index 55%
rename from testsuite/proto-sender-selftest_test.py
rename to testsuite/tests/protocol/protocol-sender.py
index 92772d7a0..39f01c561 100644
--- a/testsuite/proto-sender-selftest_test.py
+++ b/testsuite/tests/protocol/protocol-sender.py
@@ -1,31 +1,11 @@
 #!/usr/bin/env python3
-# Self-test / bitrot guard for the pure-Python rsync sender (rsync_proto.py).
-#
-# rsync_proto.py is a second, hand-written implementation of the rsync
-# client/sender wire format, used to push (possibly malformed) file lists to a
-# real daemon receiver for security regression tests without recompiling a
-# patched rsync. Because it duplicates io.c / flist.c / compat.c on-wire
-# behaviour, it can silently drift when the protocol changes. This test pins it
-# against the rsync binary under test by checking that the daemon's
-# recv_file_entry() actually parses the bytes we encode:
-#
-#   * the @RSYNCD handshake + protocol-30 setup completes (no exception), and
-#   * a well-formed flat file list is parsed without any flist error, and
-#   * an entry whose name length is encoded as XMIT_LONG_NAME + an absurd
-#     varint trips recv_file_entry()'s "overflow: xflags=..." guard
-#     (flist.c) -- which is only reachable if the daemon read our flags byte
-#     and varint name-length exactly, proving the encoder is correct (a
-#     desync would error elsewhere, or not at all).
-#
-# Needs a real TCP daemon (raw socket speaker), so it is skipped unless
-# --use-tcp is in effect.
 
 import time
 
-from rsyncfns import (
+from harness.rsync import (
     SCRATCHDIR, claim_ports, require_tcp, start_rsyncd, test_fail,
 )
-import rsync_proto as rp
+from harness import protocol as rp
 
 PORT = 12944
 require_tcp("the pure-Python sender needs a real TCP daemon; run with --use-tcp")
@@ -48,10 +28,7 @@
 
 SERVER_ARGS = ['--server', '-e.LsfxCIu', '.', 'mod/']
 
-
 def push(raw_entries):
-    """Handshake, send a flat flist built from raw entry byte-strings, and
-    return the daemon log text produced for this connection."""
     before = log.read_text(errors='replace') if log.exists() else ''
     s = rp.DaemonSender('127.0.0.1', PORT)
     s.handshake('mod', SERVER_ARGS, greeting_version=30)
@@ -69,8 +46,6 @@ def push(raw_entries):
         time.sleep(0.1)
     return text[len(before):]
 
-
-# --- 1. a well-formed entry parses with no flist error ----------------------
 good = rp.FileEntry('hello.txt', mode=rp.S_IFREG | 0o644, length=0).encode()
 good_log = push([good])
 if 'receiving file list' not in good_log:
@@ -80,9 +55,6 @@ def push(raw_entries):
     test_fail("a well-formed entry tripped the recv_file_entry overflow guard; "
               f"the encoder is mis-aligned.\nlog:\n{good_log}")
 
-# --- 2. XMIT_LONG_NAME + an absurd varint name length is parsed and rejected -
-# flags byte 0x58 = XMIT_LONG_NAME|XMIT_SAME_UID|XMIT_SAME_GID (no high bits,
-# no XMIT_EXTENDED_FLAGS -> single byte); then a huge varint name length.
 bad = (rp.w_byte(rp.XMIT_LONG_NAME | rp.XMIT_SAME_UID | rp.XMIT_SAME_GID)
        + rp.w_varint(0x7fffff) + b'xx')
 bad_log = push([bad])
@@ -92,6 +64,6 @@ def push(raw_entries):
               f"or varint encoding is wrong (the parser never saw it).\n"
               f"log:\n{bad_log}")
 
-print("proto-sender-selftest: daemon's recv_file_entry parses rsync_proto's "
+print("protocol-sender: daemon's recv_file_entry parses the protocol helper's "
       "flags + varint name-length exactly (well-formed accepted, "
       "XMIT_LONG_NAME overflow rejected).")
diff --git a/testsuite/proxy-host-crlf_test.py b/testsuite/tests/protocol/proxy-host-crlf.py
similarity index 71%
rename from testsuite/proxy-host-crlf_test.py
rename to testsuite/tests/protocol/proxy-host-crlf.py
index 134a5dde6..4dcc108ba 100644
--- a/testsuite/proxy-host-crlf_test.py
+++ b/testsuite/tests/protocol/proxy-host-crlf.py
@@ -1,19 +1,15 @@
 #!/usr/bin/env python3
-# Regression test: with RSYNC_PROXY set, a daemon host containing CR/LF must be
-# rejected before the HTTP CONNECT request is formatted, so an attacker can't
-# smuggle extra header/request lines into the client->proxy stream.
 
 import os
 import socket
 import subprocess
 
-from rsyncfns import SCRATCHDIR, rmtree, rsync_argv, test_fail, test_skipped
+from harness.rsync import SCRATCHDIR, rmtree, rsync_argv, test_fail, test_skipped
 
 base = SCRATCHDIR / 'proxy-crlf'
 rmtree(base)
 base.mkdir(parents=True)
 
-# A throwaway proxy listener on an OS-assigned localhost port.
 try:
     lsock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
     lsock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
@@ -26,9 +22,6 @@
 env = os.environ.copy()
 env['RSYNC_PROXY'] = f'127.0.0.1:{proxy_port}'
 
-# Daemon host with an embedded CRLF and an injected marker (no ':' so it is not
-# mistaken for a host:port split). Pre-fix this lands verbatim in the
-# "CONNECT <host>:873 HTTP/1.0" request line sent to the proxy.
 marker = 'INJECTEDLINE'
 host = f'evilhost\r\n{marker}'
 
@@ -53,7 +46,6 @@
         pass
     conn.close()
 except socket.timeout:
-    # Fix path: rsync may reject before connecting at all.
     pass
 finally:
     lsock.close()
diff --git a/testsuite/tests/protocol/proxy-lengths.py b/testsuite/tests/protocol/proxy-lengths.py
new file mode 100644
index 000000000..df62e1cac
--- /dev/null
+++ b/testsuite/tests/protocol/proxy-lengths.py
@@ -0,0 +1,18 @@
+#!/usr/bin/env python3
+
+from harness.rsync import claim_ports, make_proxy_server, require_tcp, run_proxy_probe
+
+cases = (
+    (12931, 'a' * 1500 + '.invalid', b'', 'proxy CONNECT request too long'),
+    (12932, 'example.invalid', b'HTTP/1.0 200 OK\r\n' + b'X' * 1023,
+     'proxy response header line too long'),
+    (12873, 'example.invalid', b'X' * 1023, 'proxy response line too long'),
+)
+require_tcp('proxy tests require TCP')
+claim_ports(*(port for port, _, _, _ in cases))
+
+for port, host, response, error in cases:
+    make_proxy_server(port, response)
+    run_proxy_probe(port, host, error)
+
+print('oversized proxy requests and responses are rejected')
diff --git a/testsuite/proxy-protocol-trusted-peer_test.py b/testsuite/tests/protocol/proxy-protocol-trusted-peer.py
similarity index 87%
rename from testsuite/proxy-protocol-trusted-peer_test.py
rename to testsuite/tests/protocol/proxy-protocol-trusted-peer.py
index 85a49580a..8455bce10 100644
--- a/testsuite/proxy-protocol-trusted-peer_test.py
+++ b/testsuite/tests/protocol/proxy-protocol-trusted-peer.py
@@ -1,7 +1,8 @@
 #!/usr/bin/env python3
+
 import socket
 
-from rsyncfns import (
+from harness.rsync import (
     SCRATCHDIR, claim_ports, require_tcp, start_rsyncd, test_fail,
 )
 
@@ -37,8 +38,6 @@
 log_text = log.read_text(errors='replace')
 if 'proxy protocol rejected' not in log_text:
     test_fail("daemon did not log rejection of untrusted PROXY protocol peer")
-# This config sets "proxy protocol = true" with no "proxy protocol hosts", which
-# fail-closes (rejects every peer); the daemon must warn about that at startup.
 if 'proxy protocol hosts" is unset' not in log_text:
     test_fail("daemon did not warn at startup that proxy-protocol with no "
               "trusted-proxy hosts rejects all connections")
diff --git a/testsuite/tests/protocol/receiver-discard-null-dereference.py b/testsuite/tests/protocol/receiver-discard-null-dereference.py
new file mode 100644
index 000000000..71e2604c3
--- /dev/null
+++ b/testsuite/tests/protocol/receiver-discard-null-dereference.py
@@ -0,0 +1,72 @@
+#!/usr/bin/env python3
+
+import os
+import subprocess
+import tempfile
+
+from harness.rsync import (
+    SCRATCHDIR, RSYNC, TMPDIR,
+    get_testuid, get_rootuid, makepath, start_test_daemon, write_daemon_conf,
+    test_fail, test_skipped, split_rsync_cmd,
+)
+
+DAEMON_PORT = 12895
+
+if get_testuid() == get_rootuid():
+    test_skipped("root bypasses DAC: the unwritable dest dir wouldn't make "
+                 "the receiver's mkstemp fail, so the discard path (and the "
+                 "bug) is never reached", capability='nonroot')
+
+os.chdir(TMPDIR)
+
+MODDIR = SCRATCHDIR / 'recvdiscard-mod'
+BASISDIR = MODDIR / 'd'
+SRCDIR_ = SCRATCHDIR / 'recvdiscard-src'
+makepath(MODDIR, BASISDIR, SRCDIR_)
+
+basis = BASISDIR / 'f'
+basis.write_bytes(b'A' * 2000 + b'C' * 1000)
+src = SRCDIR_ / 'f'
+src.write_bytes(b'A' * 2000 + b'B' * 3000)
+
+conf = write_daemon_conf([('recvdiscard', {'path': str(MODDIR),
+                                           'read only': 'no'})])
+url = start_test_daemon(conf, DAEMON_PORT, rsync_cmd=RSYNC)
+
+os.chmod(BASISDIR, 0o555)
+
+try:
+    _fd, _probe = tempfile.mkstemp(dir=BASISDIR)
+    os.close(_fd)
+    os.unlink(_probe)
+    os.chmod(BASISDIR, 0o755)
+    test_skipped("destination dir is writable despite chmod 0555 "
+                 "(CAP_DAC_OVERRIDE?); cannot force the receiver discard path",
+                 capability='dac_restriction')
+except OSError:
+    pass
+
+try:
+    argv = split_rsync_cmd(RSYNC) + [
+        '--no-whole-file', '-a',
+        str(src), f'{url}recvdiscard/d/f',
+    ]
+    print('Running:', ' '.join(argv))
+    proc = subprocess.run(argv, stdout=subprocess.PIPE,
+                          stderr=subprocess.STDOUT, text=True)
+    print(proc.stdout, end='')
+finally:
+    os.chmod(BASISDIR, 0o755)
+
+rc = proc.returncode
+
+if rc == 12:
+    test_fail(f"receiver crashed on the discard path (rsync exited {rc}: "
+              "error in rsync protocol data stream -- the receiver child "
+              "SIGSEGV'd in full_fname(NULL))")
+if rc != 23:
+    test_fail(f"expected rsync exit 23 (the forced discard leaves the file "
+              f"untransferred); got {rc} -- the discard path was not exercised, "
+              "so this run validates nothing (12 would be the pre-fix crash)")
+
+print(f"OK: receiver discarded the delta without crashing (rsync exit {rc})")
diff --git a/testsuite/recv-generator-acl-leak_test.py b/testsuite/tests/protocol/recv-generator-acl-leak.py
similarity index 57%
rename from testsuite/recv-generator-acl-leak_test.py
rename to testsuite/tests/protocol/recv-generator-acl-leak.py
index 402ed77de..08212f566 100644
--- a/testsuite/recv-generator-acl-leak_test.py
+++ b/testsuite/tests/protocol/recv-generator-acl-leak.py
@@ -1,23 +1,11 @@
 #!/usr/bin/env python3
-"""KI-23: recv_generator leaks real_sx ACL data on the directory path.
-
-In generator.c:recv_generator the directory branch calls set_file_attrs() on
-&real_sx, which (under --acls) loads the destination's current ACL into
-real_sx via get_acl_fdat(), then does `goto cleanup`.  The cleanup label only
-frees sx, never real_sx (real_sx is freed solely on the regular-file path), so
-each pre-existing ACL-bearing destination directory leaks its ACL data.
-
-ASan/LSan reproducer: sync --acls onto a destination directory that already
-carries an ACL, then assert no leak report names recv_generator.  Gated on an
-AddressSanitizer build and on setfacl being available.
-"""
 
 import glob
 import os
 import shutil
 import subprocess
 
-from rsyncfns import (
+from harness.rsync import (
     SCRATCHDIR, RSYNC,
     acls_supported, require_asan, rmtree, rsync_argv, test_fail, test_skipped,
 )
@@ -33,12 +21,10 @@
 src = base / 'src'
 dst = base / 'dst'
 (src / 'sub').mkdir(parents=True)
-(src / 'sub' / 'f.txt').write_text("updated-content\n")  # different size -> always transferred
+(src / 'sub' / 'f.txt').write_text("updated-content\n")
 (dst / 'sub').mkdir(parents=True)
 (dst / 'sub' / 'f.txt').write_text("old\n")
 
-# Plant an ACL on the pre-existing destination directory so recv_generator's
-# directory branch loads it into real_sx (the leaked allocation).
 if subprocess.run(['setfacl', '-m', 'u:nobody:rwx', str(dst / 'sub')]).returncode != 0:
     test_skipped("setfacl could not set an ACL on the destination directory")
 
@@ -52,10 +38,6 @@
 p = subprocess.run(rsync_argv('-a', '--acls', f'{src}/', f'{dst}/'),
                    capture_output=True, text=True)
 
-# Non-vacuity: the transfer must have actually run through recv_generator's
-# directory branch (the dest dir pre-exists with an ACL, and its child file is
-# updated).  We can't check the exit code: under detect_leaks=1 rsync's
-# intentional at-exit leaks already force a nonzero status.
 if (dst / 'sub' / 'f.txt').read_text() != "updated-content\n":
     test_fail(f"--acls transfer did not update the destination; leak path not exercised:\n{p.stderr}")
 
diff --git a/testsuite/xattr-wire-cap_test.py b/testsuite/tests/protocol/xattr-wire-cap.py
similarity index 56%
rename from testsuite/xattr-wire-cap_test.py
rename to testsuite/tests/protocol/xattr-wire-cap.py
index f1fc33101..8ef0bf195 100644
--- a/testsuite/xattr-wire-cap_test.py
+++ b/testsuite/tests/protocol/xattr-wire-cap.py
@@ -1,37 +1,22 @@
 #!/usr/bin/env python3
-# A malicious DAEMON acting as the SENDER can put an oversized per-value xattr
-# datum_len in the file list it streams to a pulling client.  receive_xattr()
-# (xattrs.c) guards this: read_varint_size() bounds it to MAX_WIRE_XATTR_DATALEN
-# and a second check rejects anything over MAX_XATTR_VALUE_BYTES (128 MiB) with
-# "xattr datum_len exceeds per-value limit", before the value is read.
-#
-# The malicious bytes flow daemon(sender) -> client(receiver) in the FILE-LIST
-# phase (send_xattr() is appended to each entry under -X), so we drive it with
-# the SERVER side of rsync_proto (DaemonReceiver acting as the sender): stand up
-# a tiny Python "daemon" that a real rsync client PULLS from, run the handshake,
-# and stream a one-entry file list whose xattr block declares datum_len =
-# 128 MiB + 1.  receive_xattr() runs during recv_file_list(), so no transfer
-# phase is needed, and because the receiver rejects at the datum_len check we
-# needn't send the value itself.
-#
-# Oracle: the real receiver exits non-zero with "xattr datum_len exceeds
-# per-value limit".  Needs xattr support and a real TCP socket (--use-tcp).
 
 import socket
 import subprocess
 import threading
 
-from rsyncfns import (
+from harness.rsync import (
     SCRATCHDIR, claim_ports, forced_protocol, makepath, require_tcp, rmtree,
     rsync_argv, test_fail, test_skipped, xattrs_supported,
 )
-import rsync_proto as rp
+from harness import protocol as rp
 
 if not xattrs_supported():
-    test_skipped("xattr-wire-cap requires rsync and filesystem xattr support")
+    test_skipped("xattr-wire-cap requires rsync and filesystem xattr support",
+                 capability='xattr_wire')
 proto = forced_protocol()
 if proto is not None and proto < 30:
-    test_skipped(f"xattr-wire-cap requires protocol 30+ (xattrs unsupported at negotiated {proto})")
+    test_skipped(f"xattr-wire-cap requires protocol 30+ (xattrs unsupported at negotiated {proto})",
+                 capability='protocol_30')
 
 PORT = 12970
 require_tcp("the pure-Python daemon needs a real TCP socket; run with --use-tcp")
@@ -42,10 +27,6 @@
 dest = base / 'dest'
 makepath(dest)
 
-# send_xattr() bytes for a new list with one xattr whose declared value length
-# is 128 MiB + 1 -- it clears the wire cap (read_varint_size, < 2 GiB) but trips
-# the per-value cap (MAX_XATTR_VALUE_BYTES = 128 MiB).  No value follows: the
-# receiver rejects before reading it.
 xattr = rp.xattr_list_wire([(b'user.wirecap\0', 128 * 1024 * 1024 + 1, b'')])
 
 lsock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
@@ -56,10 +37,7 @@
 
 state = {}
 
-
 def serve():
-    """Accept the pulling client and, as the sender, stream a one-entry file
-    list whose xattr block carries the oversized datum length."""
     try:
         csock, _ = lsock.accept()
         r = rp.DaemonReceiver(csock)
@@ -69,10 +47,9 @@ def serve():
         r.send_data(flist)
         r.drain()
         r.close()
-    except Exception as exc:                       # noqa: BLE001 - reported below
+    except Exception as exc:
         state['err'] = repr(exc)
 
-
 t = threading.Thread(target=serve, daemon=True)
 t.start()
 try:
diff --git a/testsuite/tests/rrsync/rrsync-alt-dest-inband-pivot.py b/testsuite/tests/rrsync/rrsync-alt-dest-inband-pivot.py
new file mode 100644
index 000000000..c90175e77
--- /dev/null
+++ b/testsuite/tests/rrsync/rrsync-alt-dest-inband-pivot.py
@@ -0,0 +1,101 @@
+#!/usr/bin/env python3
+
+import os
+import shlex
+import signal
+import subprocess
+import sys
+
+signal.signal(signal.SIGUSR1, signal.SIG_IGN)
+signal.signal(signal.SIGUSR2, signal.SIG_IGN)
+if '--shell' in sys.argv:
+    index = sys.argv.index('--shell') + 2
+    env = {**os.environ, 'SSH_ORIGINAL_COMMAND': ' '.join(sys.argv[index:])}
+    signal.signal(signal.SIGUSR1, signal.SIG_DFL)
+    signal.signal(signal.SIGUSR2, signal.SIG_DFL)
+    wrapper, root = env['RRSYNC_WRAPPER'], env['RRSYNC_ROOT']
+    os.execve(wrapper, [wrapper, '-wo', root], env)
+
+from harness.rsync import (
+    RSYNC, SCRATCHDIR, makepath, patched_rrsync, proc_self_fd_pins, rmtree, rsync_argv, rsync_path_arg, test_fail,
+)
+
+T = 1234567890
+
+base = SCRATCHDIR / 'rrsync-alt-dest-inband-pivot'
+rmtree(base)
+src = base / 'src'
+root = base / 'restricted'
+outside = base / 'outside'
+makepath(src, root, outside)
+
+(outside / 'f0').write_bytes(b'ADMIN-SECRET\n')
+(src / 'f0').write_bytes(b'CLIENT-DATA0\n')
+os.symlink('../outside', src / 'basis')
+filler = src / 'c'
+filler.mkdir()
+for i in range(3000):
+    (filler / ('%04d' % i)).write_bytes(b'.')
+os.utime(src / 'f0', (T, T))
+os.utime(outside / 'f0', (T, T))
+
+shim = base / 'rsync-shim'
+shim.write_text('#!/bin/sh\nexec ' + rsync_path_arg(RSYNC) + ' "$@"\n')
+shim.chmod(0o755)
+wrapper = patched_rrsync(base, rsync_path=str(shim))
+rsh = f'{shlex.quote(sys.executable)} {shlex.quote(os.path.abspath(__file__))} --shell'
+env = {**os.environ, 'RRSYNC_WRAPPER': str(wrapper), 'RRSYNC_ROOT': str(root)}
+
+got = subprocess.run(
+    rsync_argv('-rlt', '--copy-dest=basis', '-e', rsh, f'{src}/', 'ignored:'),
+    env=env, capture_output=True, text=True, timeout=60)
+
+landed = (root / 'f0').read_bytes() if (root / 'f0').exists() else None
+pivot = os.readlink(root / 'basis') if (root / 'basis').is_symlink() else None
+print(f'rc={got.returncode}, landed={landed!r}, pivot={pivot!r}, '
+      f'stderr={got.stderr!r}', flush=True)
+if landed == b'ADMIN-SECRET\n':
+    test_fail('--copy-dest read outside the restricted directory through an uploaded symlink')
+
+if proc_self_fd_pins():
+    if pivot != '../outside':
+        test_fail(f'control did not install the basis pivot: {pivot!r}')
+    if got.returncode != 0:
+        test_fail(f'the transfer failed instead of finding an empty basis: rc={got.returncode}, stderr={got.stderr!r}')
+    if landed != b'CLIENT-DATA0\n':
+        test_fail(f'the source file did not transfer: landed={landed!r}')
+else:
+    if not (got.returncode != 0 and 'receiver option path does not exist' in got.stderr):
+        test_fail(f'a missing alt-dest was neither pinned nor refused: rc={got.returncode}, stderr={got.stderr!r}')
+    if not (pivot is None and landed is None):
+        test_fail(f'the refusal did not stop the transfer: pivot={pivot!r}, landed={landed!r}')
+
+makepath(root / 'real-basis')
+(root / 'real-basis' / 'f1').write_bytes(b'BASIS-MATCH\n')
+(src / 'f1').write_bytes(b'BASIS-MATCH\n')
+os.utime(src / 'f1', (T, T))
+os.utime(root / 'real-basis' / 'f1', (T, T))
+ok = subprocess.run(
+    rsync_argv('-rlt', '--copy-dest=real-basis', '-e', rsh,
+               f'{src}/f1', 'ignored:'),
+    env=env, capture_output=True, text=True, timeout=20)
+if not (ok.returncode == 0 and (root / 'f1').read_bytes() == b'BASIS-MATCH\n'):
+    test_fail(f'existing --copy-dest basis failed: rc={ok.returncode}, stderr={ok.stderr!r}')
+
+rmtree(root)
+makepath(root)
+got = subprocess.run(
+    rsync_argv('-rlt', '--compare-dest=basis', '-e', rsh, f'{src}/', 'ignored:'),
+    env=env, capture_output=True, text=True, timeout=60)
+landed = (root / 'f0').read_bytes() if (root / 'f0').exists() else None
+pivot = os.readlink(root / 'basis') if (root / 'basis').is_symlink() else None
+if proc_self_fd_pins():
+    if not (pivot == '../outside' and got.returncode == 0):
+        test_fail(f'compare-dest control failed: pivot={pivot!r}, rc={got.returncode}, stderr={got.stderr!r}')
+    if landed != b'CLIENT-DATA0\n':
+        test_fail(f'--compare-dest consulted an outside basis: landed={landed!r}, stderr={got.stderr!r}')
+else:
+    if not (got.returncode != 0 and 'receiver option path does not exist' in got.stderr):
+        test_fail(f'a missing --compare-dest was neither pinned nor refused: rc={got.returncode}, stderr={got.stderr!r}')
+    if pivot is not None:
+        test_fail(f'the refusal did not stop the transfer: pivot={pivot!r}')
diff --git a/testsuite/tests/rrsync/rrsync-archive-mode.py b/testsuite/tests/rrsync/rrsync-archive-mode.py
new file mode 100644
index 000000000..004af3ebc
--- /dev/null
+++ b/testsuite/tests/rrsync/rrsync-archive-mode.py
@@ -0,0 +1,28 @@
+#!/usr/bin/env python3
+
+import os
+import shutil
+import subprocess
+
+from harness.rsync import SCRATCHDIR, patched_rrsync, test_fail, test_skipped
+
+true = shutil.which('true') or '/usr/bin/true'
+if not os.path.exists(true):
+    test_skipped("no true(1) to stub rsync")
+
+base = SCRATCHDIR / 'rrsync_a'
+restricted = base / 'restricted'
+restricted.mkdir(parents=True, exist_ok=True)
+(restricted / 'inbox').mkdir(exist_ok=True)
+rrsync = patched_rrsync(base, rsync_path=true)
+
+for direction, cmd in (("push", 'rsync --server -logDtpre.iLsfxCIvu . inbox/'),
+                       ("pull", 'rsync --server --sender -logDtpre.iLsfxCIvu . inbox/')):
+    env = {**os.environ, 'SSH_ORIGINAL_COMMAND': cmd}
+    r = subprocess.run([str(rrsync), str(restricted)], env=env,
+                       capture_output=True, text=True)
+    if r.returncode != 0:
+        test_fail(f"subdir-restricted rrsync rejected `rsync -a` ({direction}, "
+                  f"exit {r.returncode}): {r.stderr.strip()}")
+
+print("rrsync-archive-mode: subdir-restricted rrsync accepts `rsync -a` (push & pull)")
diff --git a/testsuite/tests/rrsync/rrsync-backup-dir-inband-pivot.py b/testsuite/tests/rrsync/rrsync-backup-dir-inband-pivot.py
new file mode 100644
index 000000000..0196173b3
--- /dev/null
+++ b/testsuite/tests/rrsync/rrsync-backup-dir-inband-pivot.py
@@ -0,0 +1,180 @@
+#!/usr/bin/env python3
+
+import os
+import shlex
+import signal
+import subprocess
+import sys
+
+signal.signal(signal.SIGUSR1, signal.SIG_IGN)
+signal.signal(signal.SIGUSR2, signal.SIG_IGN)
+if '--shell' in sys.argv:
+    index = sys.argv.index('--shell') + 2
+    env = {**os.environ, 'SSH_ORIGINAL_COMMAND': ' '.join(sys.argv[index:])}
+    signal.signal(signal.SIGUSR1, signal.SIG_DFL)
+    signal.signal(signal.SIGUSR2, signal.SIG_DFL)
+    wrapper = env['RRSYNC_WRAPPER']
+    root = env['RRSYNC_ROOT']
+    os.execve(wrapper, [wrapper, '-wo', root], env)
+
+from harness.rsync import (
+    RSYNC, SCRATCHDIR, makepath, patched_rrsync, proc_self_fd_pins, rmtree, rsync_argv, rsync_path_arg, test_fail,
+)
+
+PINS = proc_self_fd_pins()
+
+base = SCRATCHDIR / 'rrsync-backup-dir-inband-pivot'
+rmtree(base)
+stage = base / 'attacker-stage'
+src = base / 'attacker-next'
+root = base / 'restricted'
+outside = base / 'outside'
+makepath(stage, src, root, outside)
+
+(stage / 'authorized_keys').write_bytes(b'ATTACKER-SSH-KEY\n')
+(src / 'authorized_keys').write_bytes(b'NEW-IN-TREE-CONTENT\n')
+os.symlink('../outside', src / 'a')
+(outside / 'authorized_keys').write_bytes(b'ADMIN-SSH-KEY\n')
+
+shim = base / 'rsync-shim'
+shim.write_text('#!/bin/sh\nexec ' + rsync_path_arg(RSYNC) + ' "$@"\n')
+shim.chmod(0o755)
+wrapper = patched_rrsync(base, rsync_path=str(shim))
+rsh = f'{shlex.quote(sys.executable)} {shlex.quote(os.path.abspath(__file__))} --shell'
+env = {**os.environ, 'RRSYNC_WRAPPER': str(wrapper), 'RRSYNC_ROOT': str(root)}
+
+seed = subprocess.run(
+    rsync_argv('-rlI', '-e', rsh, f'{stage}/authorized_keys', 'ignored:'),
+    env=env, capture_output=True, text=True, timeout=20)
+if seed.returncode != 0:
+    test_fail(f'seed upload failed: {seed.stderr}')
+if (root / 'authorized_keys').read_bytes() != b'ATTACKER-SSH-KEY\n':
+    test_fail('seed upload wrote the wrong content')
+if (root / 'a').exists():
+    test_fail('seed upload unexpectedly created the pivot path')
+
+os.symlink('../outside', root / 'a')
+blocked = subprocess.run(
+    rsync_argv('-rlbI', '--backup-dir=a', '-e', rsh,
+               f'{src}/', 'ignored:'),
+    env=env, capture_output=True, text=True, timeout=20)
+if blocked.returncode == 0:
+    test_fail('pre-existing backup symlink was accepted')
+if (outside / 'authorized_keys').read_bytes() != b'ADMIN-SSH-KEY\n':
+    test_fail('blocked backup changed the outside file')
+(root / 'a').unlink()
+
+seed = subprocess.run(
+    rsync_argv('-rlI', '-e', rsh, f'{stage}/authorized_keys', 'ignored:'),
+    env=env, capture_output=True, text=True, timeout=20)
+if seed.returncode != 0:
+    test_fail(f'second seed upload failed: {seed.stderr}')
+
+got = subprocess.run(
+    rsync_argv('-rlbI', '--backup-dir=a', '-e', rsh,
+               f'{src}/', 'ignored:'),
+    env=env, capture_output=True, text=True, timeout=20)
+
+escaped = outside / 'authorized_keys'
+pivot = os.readlink(root / 'a') if (root / 'a').is_symlink() else None
+print(f'seed_rc={seed.returncode}, rc={got.returncode}, pivot={pivot!r}, '
+      f'escaped={escaped.read_bytes()!r}, stderr={got.stderr!r}', flush=True)
+if escaped.read_bytes() != b'ADMIN-SSH-KEY\n':
+    test_fail('--backup-dir replaced an outside file through an uploaded symlink')
+if got.returncode == 0:
+    test_fail('--backup-dir pivot was neither pinned nor refused')
+if PINS:
+    if pivot != '../outside':
+        test_fail(f'the transfer did not plant the pivot symlink, so the run proves nothing: pivot={pivot!r}')
+    if '/proc/self/fd/' not in got.stderr:
+        test_fail(f'pinned backup path produced the wrong error: {got.stderr!r}')
+else:
+    if 'receiver option path does not exist' not in got.stderr:
+        test_fail(f'missing backup path produced the wrong error: {got.stderr!r}')
+
+tmpdir = subprocess.run(
+    rsync_argv('-rlI', '--temp-dir=no-such-tmp', '-e', rsh,
+               f'{src}/authorized_keys', 'ignored:'),
+    env=env, capture_output=True, text=True, timeout=20)
+if not (tmpdir.returncode != 0 and 'receiver option path does not exist' in tmpdir.stderr):
+    test_fail(f'a missing --temp-dir was not refused: rc={tmpdir.returncode}, stderr={tmpdir.stderr!r}')
+if (root / 'no-such-tmp').exists():
+    test_fail('a missing --temp-dir must not be created either')
+
+if not PINS:
+    for opt in ('--backup-dir=fresh-backup', '--partial-dir=.rsync-partial',
+                '--link-dest=no-such-basis'):
+        r = subprocess.run(
+            rsync_argv('-rlbI', opt, '-e', rsh, f'{src}/authorized_keys', 'ignored:'),
+            env=env, capture_output=True, text=True, timeout=20)
+        if not (r.returncode != 0 and 'receiver option path does not exist' in r.stderr):
+            test_fail(f'{opt} was neither pinned nor refused without /proc/self/fd: rc={r.returncode}, stderr={r.stderr!r}')
+    sys.exit(0)
+
+def reseed():
+    r = subprocess.run(
+        rsync_argv('-rlI', '-e', rsh, f'{stage}/authorized_keys', 'ignored:'),
+        env=env, capture_output=True, text=True, timeout=20)
+    if r.returncode != 0:
+        test_fail(f'reseed failed: stderr={r.stderr!r}')
+    if (root / 'authorized_keys').read_bytes() != b'ATTACKER-SSH-KEY\n':
+        test_fail('reseed wrote the wrong content')
+
+reseed()
+
+(root / 'backup').mkdir()
+normal = subprocess.run(
+    rsync_argv('-rlbI', '--backup-dir=backup', '-e', rsh,
+               f'{src}/authorized_keys', 'ignored:'),
+    env=env, capture_output=True, text=True, timeout=20)
+if normal.returncode != 0:
+    test_fail(f'ordinary in-tree backup failed: stderr={normal.stderr!r}')
+if (root / 'backup' / 'authorized_keys').read_bytes() != b'ATTACKER-SSH-KEY\n':
+    test_fail('ordinary backup wrote the wrong content')
+
+reseed()
+firstuse = subprocess.run(
+    rsync_argv('-rlbI', '--backup-dir=fresh-backup', '-e', rsh,
+               f'{src}/authorized_keys', 'ignored:'),
+    env=env, capture_output=True, text=True, timeout=20)
+if firstuse.returncode != 0:
+    test_fail(f'a first-use --backup-dir was refused: rc={firstuse.returncode}, stderr={firstuse.stderr!r}')
+fresh = root / 'fresh-backup'
+if not (fresh.is_dir() and (not fresh.is_symlink())):
+    test_fail(f'first-use --backup-dir did not leave a real directory: {fresh}')
+if (fresh / 'authorized_keys').read_bytes() != b'ATTACKER-SSH-KEY\n':
+    test_fail('the backup did not land in the created backup dir, so the run above proves nothing about --backup-dir working')
+
+reseed()
+nested = subprocess.run(
+    rsync_argv('-rlbI', '--backup-dir=bak/2026/07', '-e', rsh,
+               f'{src}/authorized_keys', 'ignored:'),
+    env=env, capture_output=True, text=True, timeout=20)
+if nested.returncode != 0:
+    test_fail(f'a nested first-use --backup-dir was refused: rc={nested.returncode}, stderr={nested.stderr!r}')
+if not ((root / 'bak' / '2026' / '07' / 'authorized_keys').exists()):
+    test_fail('the nested backup dir was accepted but the backup did not land in it')
+
+partial = subprocess.run(
+    rsync_argv('-rlI', '--partial', '--partial-dir=.rsync-partial', '-e', rsh,
+               f'{src}/authorized_keys', 'ignored:'),
+    env=env, capture_output=True, text=True, timeout=20)
+if partial.returncode != 0:
+    test_fail(f'a first-use --partial-dir was refused: rc={partial.returncode}, stderr={partial.stderr!r}')
+pdir = root / '.rsync-partial'
+if not (pdir.is_dir() and (not pdir.is_symlink())):
+    test_fail(f'first-use --partial-dir did not leave a real directory: {pdir}')
+mode = pdir.stat().st_mode & 0o777
+if mode != 448:
+    test_fail(f'the partial dir was created {mode:04o}, not 0700: partial files would be readable by other users on the server')
+
+altdest = subprocess.run(
+    rsync_argv('-rlI', '--link-dest=no-such-basis', '-e', rsh,
+               f'{src}/authorized_keys', 'ignored:'),
+    env=env, capture_output=True, text=True, timeout=20)
+if altdest.returncode != 0:
+    test_fail(f'a first-run --link-dest was refused: rc={altdest.returncode}, stderr={altdest.stderr!r}')
+if (root / 'no-such-basis').exists():
+    test_fail('a missing --link-dest must not be created')
+if list(root.glob('.rrsync-empty-basis*')):
+    test_fail('the basis placeholder was left behind in the restricted dir')
diff --git a/testsuite/rrsync-copy-unsafe-links-denied_test.py b/testsuite/tests/rrsync/rrsync-copy-unsafe-links-denied.py
similarity index 50%
rename from testsuite/rrsync-copy-unsafe-links-denied_test.py
rename to testsuite/tests/rrsync/rrsync-copy-unsafe-links-denied.py
index 21d7f825b..9db6d6005 100644
--- a/testsuite/rrsync-copy-unsafe-links-denied_test.py
+++ b/testsuite/tests/rrsync/rrsync-copy-unsafe-links-denied.py
@@ -1,21 +1,9 @@
 #!/usr/bin/env python3
-# Finding [8] (CWE-59): support/rrsync leaves --copy-unsafe-links enabled in a
-# restricted (non-"/") directory.  A restricted SSH user who can request
-# --copy-unsafe-links can have the spawned rsync sender dereference a symlink
-# that points OUTSIDE the restricted tree and copy the *referent's content* out,
-# exfiltrating files readable by the rrsync account but outside the allowed
-# policy directory.
-#
-# Part 1 demonstrates the danger of the option itself: a symlink inside the
-# served tree pointing at an outside secret is dereferenced by --copy-unsafe-
-# links, so the outside content lands in the puller's copy.  Part 2 is the fix:
-# a restricted rrsync now refuses --copy-unsafe-links, so the part-1 exfiltration
-# cannot be requested through the wrapper.  Runs at any uid.
 
 import os
 import subprocess
 
-from rsyncfns import (
+from harness.rsync import (
     SCRATCHDIR, rmtree, rsync_argv, run_rrsync_denied, test_fail,
 )
 
@@ -28,10 +16,8 @@
 served.mkdir(parents=True)
 outside.mkdir()
 (outside / 'secret').write_text(SECRET)
-# An "unsafe" symlink: it lives inside the served tree but its target escapes it.
 os.symlink('../outside/secret', served / 'leak')
 
-# --- Part 1: --copy-unsafe-links dereferences the escaping symlink (the danger).
 dest = base / 'dest'
 dest.mkdir()
 subprocess.run(rsync_argv('-a', '--copy-unsafe-links', f'{served}/', f'{dest}/'),
@@ -41,8 +27,6 @@
     test_fail("premise check failed: --copy-unsafe-links should turn the escaping "
               "symlink into a regular file holding the outside secret")
 
-# --- Part 2: a restricted rrsync must refuse --copy-unsafe-links, so the
-# exfiltration shown in part 1 cannot be requested through the wrapper.
 run_rrsync_denied('rsync --server --sender --copy-unsafe-links . .',
                   'option --copy-unsafe-links has been disabled')
 
diff --git a/testsuite/tests/rrsync/rrsync-debug-denied.py b/testsuite/tests/rrsync/rrsync-debug-denied.py
new file mode 100644
index 000000000..449e07c8d
--- /dev/null
+++ b/testsuite/tests/rrsync/rrsync-debug-denied.py
@@ -0,0 +1,50 @@
+#!/usr/bin/env python3
+
+import os
+import signal
+import subprocess
+import sys
+
+signal.signal(signal.SIGUSR1, signal.SIG_IGN)
+signal.signal(signal.SIGUSR2, signal.SIG_IGN)
+if '--shell' in sys.argv:
+    index = sys.argv.index('--shell') + 2
+    env = {**os.environ, 'SSH_ORIGINAL_COMMAND': ' '.join(sys.argv[index:])}
+    signal.signal(signal.SIGUSR1, signal.SIG_DFL)
+    signal.signal(signal.SIGUSR2, signal.SIG_DFL)
+    wrapper, root = env['RRSYNC_WRAPPER'], env['RRSYNC_ROOT']
+    os.execve(wrapper, [wrapper, '-wo', root], env)
+
+from harness.rsync import RSYNC, SCRATCHDIR, makepath, patched_rrsync, rmtree, rsync_argv, test_fail
+
+base = SCRATCHDIR / 'rrsync-debug-denied'
+rmtree(base)
+src = base / 'src'
+root = base / 'root'
+makepath(src, root)
+(src / 'f').write_bytes(b'hi\n')
+
+shim = base / 'rsync-shim'
+shim.write_text('#!/bin/sh\nexec ' + RSYNC + ' "$@"\n')
+shim.chmod(0o755)
+wrapper = patched_rrsync(base, rsync_path=str(shim))
+rsh = f'{sys.executable} {os.path.abspath(__file__)} --shell'
+env = {**os.environ, 'RRSYNC_WRAPPER': str(wrapper), 'RRSYNC_ROOT': str(root)}
+
+for spelling in ('-M--debug=FILTER2', '--remote-option=--debug=ALL3'):
+    got = subprocess.run(
+        rsync_argv('-r', spelling, '-e', rsh, f'{src}/', 'ignored:'),
+        env=env, capture_output=True, text=True, timeout=20)
+    out = got.stdout + got.stderr
+    if not (got.returncode != 0 and 'option --debug has been disabled' in out):
+        test_fail(f'rrsync accepted a peer-selected {spelling}: rc={got.returncode}, out={out!r}')
+
+if "'debug': -1," not in wrapper.read_text():
+    test_fail("support/rrsync no longer disables 'debug' -- a cull-options regeneration probably restored it")
+
+for extra in ([], ['-vv'], ['-vvv']):
+    ok = subprocess.run(
+        rsync_argv('-r', *extra, '-e', rsh, f'{src}/', 'ignored:'),
+        env=env, capture_output=True, text=True, timeout=20)
+    if not (ok.returncode == 0 and (root / 'f').read_bytes() == b'hi\n'):
+        test_fail(f'an ordinary transfer broke with {extra}: rc={ok.returncode}, stderr={ok.stderr!r}')
diff --git a/testsuite/rrsync-logfile-symlink_test.py b/testsuite/tests/rrsync/rrsync-logfile-symlink.py
similarity index 90%
rename from testsuite/rrsync-logfile-symlink_test.py
rename to testsuite/tests/rrsync/rrsync-logfile-symlink.py
index a624c7d9b..88d245caf 100644
--- a/testsuite/rrsync-logfile-symlink_test.py
+++ b/testsuite/tests/rrsync/rrsync-logfile-symlink.py
@@ -1,9 +1,10 @@
 #!/usr/bin/env python3
+
 import os
 import subprocess
 
-from rsyncfns import SCRATCHDIR, test_fail
-from rsyncfns import patched_rrsync
+from harness.rsync import SCRATCHDIR, test_fail
+from harness.rsync import patched_rrsync
 
 base = SCRATCHDIR / 'rrsync-logfile'
 restricted = base / 'restricted'
diff --git a/testsuite/tests/rrsync/rrsync-merge-file-confine.py b/testsuite/tests/rrsync/rrsync-merge-file-confine.py
new file mode 100644
index 000000000..32d6f8d17
--- /dev/null
+++ b/testsuite/tests/rrsync/rrsync-merge-file-confine.py
@@ -0,0 +1,97 @@
+#!/usr/bin/env python3
+
+import os
+import shlex
+import signal
+import subprocess
+import sys
+
+signal.signal(signal.SIGUSR1, signal.SIG_IGN)
+signal.signal(signal.SIGUSR2, signal.SIG_IGN)
+if '--shell' in sys.argv:
+    i = sys.argv.index('--shell') + 2
+    env = {**os.environ, 'SSH_ORIGINAL_COMMAND': ' '.join(sys.argv[i:])}
+    signal.signal(signal.SIGUSR1, signal.SIG_DFL)
+    signal.signal(signal.SIGUSR2, signal.SIG_DFL)
+    wrapper, root = env['RRSYNC_WRAPPER'], env['RRSYNC_ROOT']
+    os.execve(wrapper, [wrapper, '-ro', '-no-lock', root], env)
+
+from harness.rsync import (
+    RSYNC, SCRATCHDIR, makepath, patched_rrsync, rmtree, rsync_argv, rsync_path_arg, test_fail,
+)
+
+base = SCRATCHDIR / 'rrsync-merge-file-confine'
+rmtree(base)
+root = base / 'root'
+sub = root / 'sub'
+dest = base / 'dest'
+makepath(sub, dest)
+
+(base / 'outside-secret').write_text('secretword\n')
+(root / 'secretword').write_bytes(b'X')
+(root / 'keep').write_bytes(b'X')
+(sub / 'intree-dropped').write_bytes(b'X')
+(sub / 'intree-kept').write_bytes(b'X')
+(sub / '.rsync-filter').write_text('intree-dropped\n')
+
+shim = base / 'rsync-shim'
+shim.write_text('#!/bin/sh\nexec ' + rsync_path_arg(RSYNC) + ' "$@"\n')
+shim.chmod(0o755)
+wrapper = patched_rrsync(base, rsync_path=str(shim))
+rsh = f'{shlex.quote(sys.executable)} {shlex.quote(os.path.abspath(__file__))} --shell'
+env = {**os.environ, 'RRSYNC_WRAPPER': str(wrapper), 'RRSYNC_ROOT': str(root)}
+
+def pull(filt, into):
+    into.mkdir(parents=True, exist_ok=True)
+    return subprocess.run(
+        rsync_argv('-r', f'--filter={filt}', '-e', rsh, 'ignored:.', f'{into}/'),
+        env=env, capture_output=True, text=True, timeout=20)
+
+esc = dest / 'escape'
+got = pull(':-s ../outside-secret', esc)
+if got.returncode != 0:
+    test_fail(f'confined merge transfer failed: rc={got.returncode}, stderr={got.stderr!r}')
+if not ((esc / 'secretword').exists()):
+    test_fail(f'outside merge file excluded secretword: stdout={got.stdout!r}, stderr={got.stderr!r}')
+if 'secretword' in got.stderr:
+    test_fail(f"the out-of-root merge file's text reached the peer: stderr={got.stderr!r}")
+
+ctl = dest / 'control'
+got = pull(':-s .rsync-filter', ctl)
+if got.returncode != 0:
+    test_fail(f'the in-tree dir-merge failed the transfer: rc={got.returncode}, stderr={got.stderr!r}')
+if not ((ctl / 'sub' / 'intree-kept').exists()):
+    test_fail(f'the in-tree dir-merge broke the transfer: rc={got.returncode}, stdout={got.stdout!r}, stderr={got.stderr!r}')
+if (ctl / 'sub' / 'intree-dropped').exists():
+    test_fail(f'in-tree merge file was not applied: stdout={got.stdout!r}, stderr={got.stderr!r}')
+
+alias_root = base / 'aliased'
+makepath(alias_root)
+(base / 'aliased-secret').write_text('aliased-word\n')
+(alias_root / 'aliased-word').write_bytes(b'X')
+(alias_root / 'plain').write_bytes(b'X')
+os.symlink('.', alias_root / 'self-alias')
+os.symlink('../aliased-secret', alias_root / 'outside-link')
+(alias_root / 'intree-list').write_text('plain\n')
+
+def confined_pull(filter_text, into):
+    (alias_root / '.rsync-filter').write_text(filter_text + '\n')
+    rmtree(into)
+    into.mkdir(parents=True, exist_ok=True)
+    return subprocess.run(
+        rsync_argv('-r', f'--confine-root={alias_root}',
+                   '--filter=:s .rsync-filter',
+                   f'{alias_root}/self-alias/', f'{into}/'),
+        capture_output=True, text=True, timeout=20)
+
+esc2 = dest / 'aliased-escape'
+got = confined_pull('merge,- outside-link', esc2)
+if got.returncode == 0 and (not (esc2 / 'aliased-word').exists()):
+    test_fail(f'symlinked source read an outside merge file: stderr={got.stderr!r}')
+
+ctl2 = dest / 'aliased-control'
+got = confined_pull('merge,- intree-list', ctl2)
+if not (got.returncode == 0 and (ctl2 / 'aliased-word').exists()):
+    test_fail(f'a symlinked source arg with an in-tree merge file broke the transfer: rc={got.returncode}, stderr={got.stderr!r}')
+if (ctl2 / 'plain').exists():
+    test_fail(f'symlinked source ignored its in-tree merge file: stderr={got.stderr!r}')
diff --git a/testsuite/tests/rrsync/rrsync-no-overwrite.py b/testsuite/tests/rrsync/rrsync-no-overwrite.py
new file mode 100644
index 000000000..2808e963b
--- /dev/null
+++ b/testsuite/tests/rrsync/rrsync-no-overwrite.py
@@ -0,0 +1,122 @@
+#!/usr/bin/env python3
+
+import os
+import shlex
+import signal
+import subprocess
+import sys
+
+signal.signal(signal.SIGUSR1, signal.SIG_IGN)
+signal.signal(signal.SIGUSR2, signal.SIG_IGN)
+if '--shell' in sys.argv:
+    index = sys.argv.index('--shell') + 2
+    env = {**os.environ, 'SSH_ORIGINAL_COMMAND': ' '.join(sys.argv[index:])}
+    signal.signal(signal.SIGUSR1, signal.SIG_DFL)
+    signal.signal(signal.SIGUSR2, signal.SIG_DFL)
+    flags = env.get('RRSYNC_FLAGS', '-wo -no-overwrite -no-lock').split()
+    wrapper, root = env['RRSYNC_WRAPPER'], env['RRSYNC_ROOT']
+    os.execve(wrapper, [wrapper, *flags, root], env)
+
+from harness.rsync import (
+    RSYNC, SCRATCHDIR, makepath, patched_rrsync, rmtree, rsync_argv, rsync_path_arg, test_fail,
+)
+
+base = SCRATCHDIR / 'rrsync-no-overwrite'
+rmtree(base)
+base.mkdir()
+shim = base / 'rsync-shim'
+shim.write_text('#!/bin/sh\nexec ' + rsync_path_arg(RSYNC) + ' "$@"\n')
+shim.chmod(0o755)
+wrapper = patched_rrsync(base, rsync_path=str(shim))
+rsh = f'{shlex.quote(sys.executable)} {shlex.quote(os.path.abspath(__file__))} --shell'
+
+def invoke(root, args, no_overwrite=True):
+    flags = '-wo -no-overwrite -no-lock' if no_overwrite else '-wo -no-lock'
+    env = {**os.environ, 'RRSYNC_WRAPPER': str(wrapper), 'RRSYNC_ROOT': str(root),
+           'RRSYNC_FLAGS': flags}
+    return subprocess.run(rsync_argv(*args), env=env, capture_output=True, text=True, timeout=20)
+
+def refused(result, option):
+    if result.returncode == 0 or f'option {option} has been disabled' not in result.stderr:
+        test_fail(f'{option} was accepted: rc={result.returncode}, stderr={result.stderr!r}')
+
+source = base / 'source'
+makepath(source)
+(source / 'new').write_bytes(b'NEW')
+(source / 'victim').write_bytes(b'NEW')
+
+log_root = base / 'log'
+makepath(log_root)
+(log_root / 'protected').write_bytes(b'POLICY\n')
+log_args = ('-rI', '-M--log-file=protected', '-M--log-format=X', '-e', rsh,
+            f'{source}/new', 'ignored:')
+result = invoke(log_root, log_args)
+refused(result, '--log-file')
+if (log_root / 'protected').read_bytes() != b'POLICY\n':
+    test_fail('--log-file changed a protected file')
+plain_log = base / 'plain-log'
+makepath(plain_log)
+(plain_log / 'protected').write_bytes(b'POLICY\n')
+if invoke(plain_log, log_args, False).returncode:
+    test_fail('--log-file was rejected without -no-overwrite')
+
+partial_root = base / 'partial'
+makepath(partial_root / 'protected')
+(partial_root / 'protected' / 'victim').write_bytes(b'POLICY')
+partial_args = ('-rI', '--partial', '--partial-dir=protected', '-e', rsh,
+                f'{source}/victim', 'ignored:')
+result = invoke(partial_root, partial_args)
+refused(result, '--partial-dir')
+if (partial_root / 'protected' / 'victim').read_bytes() != b'POLICY':
+    test_fail('--partial-dir consumed a protected partial file')
+plain_partial = base / 'plain-partial'
+makepath(plain_partial / 'protected')
+(plain_partial / 'protected' / 'victim').write_bytes(b'POLICY')
+if invoke(plain_partial, partial_args, False).returncode:
+    test_fail('--partial-dir was rejected without -no-overwrite')
+
+delay_root = base / 'delay'
+makepath(delay_root / '.~tmp~')
+(delay_root / '.~tmp~' / 'victim').write_bytes(b'POLICY')
+delay_args = ('-rI', '--delay-updates', '-e', rsh, f'{source}/victim', 'ignored:')
+result = invoke(delay_root, delay_args)
+refused(result, '--delay-updates')
+if (delay_root / '.~tmp~' / 'victim').read_bytes() != b'POLICY':
+    test_fail('--delay-updates consumed a protected partial file')
+plain_delay = base / 'plain-delay'
+makepath(plain_delay / '.~tmp~')
+(plain_delay / '.~tmp~' / 'victim').write_bytes(b'POLICY')
+if invoke(plain_delay, delay_args, False).returncode:
+    test_fail('--delay-updates was rejected without -no-overwrite')
+
+backup_source = base / 'backup-source'
+makepath(backup_source)
+(backup_source / 'victim.bak').write_bytes(b'SOURCE')
+backup_args = ('-r', '--delete', '--backup', '--suffix=.bak', '-e', rsh,
+               f'{backup_source}/', 'ignored:')
+
+def seed_backup(root):
+    makepath(root)
+    (root / 'victim').write_bytes(b'OLD-LIVE')
+    (root / 'victim.bak').write_bytes(b'POLICY')
+
+backup_root = base / 'backup'
+seed_backup(backup_root)
+result = invoke(backup_root, backup_args)
+refused(result, '-b')
+if (backup_root / 'victim.bak').read_bytes() != b'POLICY':
+    test_fail('--backup changed a protected backup file')
+plain_backup = base / 'plain-backup'
+seed_backup(plain_backup)
+plain_args = ('-r', '--delete', '--backup', '--suffix=.bak', '--ignore-existing',
+              '-e', rsh, f'{backup_source}/', 'ignored:')
+if invoke(plain_backup, plain_args, False).returncode:
+    test_fail('--backup was rejected without -no-overwrite')
+if (plain_backup / 'victim.bak').read_bytes() != b'OLD-LIVE':
+    test_fail('backup control did not reproduce the collision')
+
+safe_root = base / 'safe'
+makepath(safe_root)
+safe = invoke(safe_root, ('-rI', '-e', rsh, f'{source}/new', 'ignored:'))
+if safe.returncode or (safe_root / 'new').read_bytes() != b'NEW':
+    test_fail('ordinary -no-overwrite upload failed')
diff --git a/testsuite/rrsync-pull-arg-shapes_test.py b/testsuite/tests/rrsync/rrsync-pull-arg-shapes.py
similarity index 65%
rename from testsuite/rrsync-pull-arg-shapes_test.py
rename to testsuite/tests/rrsync/rrsync-pull-arg-shapes.py
index f359f70cb..1dab440a0 100644
--- a/testsuite/rrsync-pull-arg-shapes_test.py
+++ b/testsuite/tests/rrsync/rrsync-pull-arg-shapes.py
@@ -1,27 +1,11 @@
 #!/usr/bin/env python3
-"""Every pull argument shape through rrsync must deliver what it names.
-
-rrsync inode-pins each validated argument so the exec'd rsync cannot be
-race-flipped between realpath() and resolution.  Which pin is usable depends on
-what rsync does with the argument, and getting that wrong is silent: the
-transfer "succeeds" while delivering nothing, or delivers the file under the
-wrong name.
-
-That is exactly what happened when the pin was first added -- of the shapes
-below only "dir-slash" survived, because it is the one rsync opens rather than
-lstat()s.  Nothing covered --relative at all, so its breakage went unnoticed
-too.
-
-Each case asserts the delivered tree, which is the user-visible contract and is
-independent of which pin the implementation chooses.
-"""
 
 import os
 import shlex
 import stat
 import subprocess
 
-from rsyncfns import (
+from harness.rsync import (
     RSYNC, SCRATCHDIR, forced_protocol, makepath, patched_rrsync, rmtree,
     rsync_argv, test_fail, rsync_path_arg,
 )
@@ -34,15 +18,7 @@
 
 (restricted / 'f1').write_text('TOP\n')
 (restricted / 'sub' / 'deep' / 'f2').write_text('DEEP\n')
-# An in-tree directory symlink, the ordinary way to publish a path under
-# another name. Reaching through it must keep working.
 os.symlink('sub/deep', restricted / 'alias')
-# A file reachable only by name: search permission on the parent, no read.
-# rrsync must not need to list a directory just to pin it.
-# A FIFO and a dangling symlink: rsync only needs to describe these, never to
-# open them.  Opening a FIFO blocks for a writer, and resolving a dangling link
-# reaches nothing -- both wedged or failed the pull until the pin learned to
-# leave them alone.
 os.mkfifo(restricted / 'afifo')
 os.symlink('missing-sibling', restricted / 'dangling')
 os.symlink('f1', restricted / 'goodlink')
@@ -67,7 +43,6 @@
     'exec %s %s\n' % (shlex.quote(str(rrsync)), shlex.quote(str(restricted))))
 rsh.chmod(0o755)
 
-
 def pull(*args):
     rmtree(dest)
     dest.mkdir()
@@ -78,11 +53,6 @@ def pull(*args):
     got = sorted(str(p.relative_to(dest)) for p in dest.rglob('*'))
     return proc, got
 
-
-# What every deliverable name must BE.  Comparing names alone is not enough:
-# an empty directory called "f1", or a correctly-named symlink carrying no
-# data, satisfies a name-only expectation -- and a symlink with no data is
-# exactly what handing the sender a procfs magic link produced.
 KINDS = {
     'f1':          ('reg', 'TOP\n'),
     'f2':          ('reg', 'DEEP\n'),
@@ -96,7 +66,6 @@ def pull(*args):
     'goodlink':    ('sym', 'f1'),
 }
 
-
 def describe(path):
     if path.is_symlink():
         return 'a symlink to %r' % os.readlink(path)
@@ -106,7 +75,6 @@ def describe(path):
         return 'a regular file'
     return 'neither a file, a directory nor a symlink'
 
-
 def check_kinds(label, names, ctx):
     for name in names:
         want = KINDS.get(name)
@@ -127,8 +95,6 @@ def check_kinds(label, names, ctx):
                 test_fail(f'{label}: {name} should be a directory, got '
                           f'{describe(path)} ({ctx})')
         elif kind != 'reg':
-            # Closed schema: a mistyped token must not fall through to the
-            # regular-file arm and quietly assert the wrong thing.
             test_fail(f'{label}: {name} has unknown kind {kind!r} in KINDS')
         else:
             if path.is_symlink() or not path.is_file():
@@ -138,8 +104,6 @@ def check_kinds(label, names, ctx):
                 test_fail(f'{label}: {name} holds {path.read_text()!r}, '
                           f'expected {detail!r} ({ctx})')
 
-
-# Expectations are what a pristine 3.4.4 rrsync delivers for the same command.
 CASES = [
     ('file',          ['dummy:f1'],                       ['f1']),
     ('deep file',     ['dummy:sub/deep/f2'],              ['f2']),
@@ -149,20 +113,12 @@ def check_kinds(label, names, ctx):
     ('-R deep file',  ['-R', 'dummy:sub/deep/f2'],        ['sub', 'sub/deep', 'sub/deep/f2']),
     ('-R dir + slash',['-R', 'dummy:sub/'],               ['sub', 'sub/deep', 'sub/deep/f2']),
     ('-R client /./', ['-R', 'dummy:sub/./deep/f2'],      ['deep', 'deep/f2']),
-    # A marker with nothing after it means "start the transmitted name here",
-    # so the argument's own directory name must NOT appear in the result.
     ('-R terminal /./',   ['-R', 'dummy:sub/./'],          ['deep', 'deep/f2']),
     ('-R terminal /./.',  ['-R', 'dummy:sub/./.'],         ['deep', 'deep/f2']),
-    # An in-tree directory symlink as the argument's parent is ordinary and
-    # must keep working; pinning it must not refuse to follow it.
     ('symlinked parent',  ['dummy:alias/f2'],              ['f2']),
     ('-R symlinked parent', ['-R', 'dummy:alias/./f2'],    ['f2']),
 ]
 
-# At protocol 29 the receiver rejects "-R --no-implied-dirs" with "invalid path
-# from sender" and transfers nothing.  That is rsync's own behaviour, not the
-# wrapper's -- a pristine 3.4.4 rrsync fails identically -- so only assert the
-# case where it means something.
 if forced_protocol() is None or forced_protocol() >= 30:
     CASES.append(
     ('-R no-implied', ['-R', '--no-implied-dirs', 'dummy:sub/deep/f2'],
@@ -170,7 +126,6 @@ def check_kinds(label, names, ctx):
 
 CASES += [
     ('search-only parent', ['dummy:xonly/f3'],            ['f3']),
-    # These three are what a pristine 3.4.4 rrsync delivers for the same args.
     ('dangling symlink',   ['dummy:dangling'],            ['dangling']),
     ('symlink to a file',  ['dummy:goodlink'],            ['goodlink']),
     ('two args',      ['dummy:f1', 'dummy:sub/deep/f2'],  ['f1', 'f2']),
@@ -185,16 +140,6 @@ def check_kinds(label, names, ctx):
     if proc.returncode != 0:
         test_fail(f'{label}: delivered the right tree but failed ({ctx})')
 
-# A FIFO must not WEDGE the wrapper.  The pin used to open every validated path
-# O_RDONLY, and opening a FIFO blocks until a writer appears, so naming one hung
-# rrsync before exec and an authorised user could pile up stuck processes.
-#
-# It must also arrive.  rrsync denies device/special CREATION on the receiving
-# side only, so a pull carries the client's own -D and delivers the FIFO, which
-# is what a pristine 3.4.4 rrsync does.  While --no-D was forced here too, the
-# file list desynchronised -- the sender omitted the rdev fields the client's
-# receiver still read -- and this could assert nothing beyond "did not hang":
-# it overflowed at protocol 29/30 and, as root, deadlocked instead.
 rmtree(dest)
 dest.mkdir()
 try:
@@ -212,9 +157,6 @@ def check_kinds(label, names, ctx):
 if not stat.S_ISFIFO(os.lstat(dest / 'afifo').st_mode):
     test_fail(f'pulling a FIFO delivered {describe(dest / "afifo")} ({ctx})')
 
-# The kinds, the symlink targets and the file contents are asserted by
-# check_kinds() on every case above, rather than spot-checked on a few here.
-
 xonly.chmod(0o755)
 
 print(f'rrsync delivers all {len(CASES)} pull argument shapes')
diff --git a/testsuite/rrsync-pull-delivers-content_test.py b/testsuite/tests/rrsync/rrsync-pull-delivers-content.py
similarity index 50%
rename from testsuite/rrsync-pull-delivers-content_test.py
rename to testsuite/tests/rrsync/rrsync-pull-delivers-content.py
index 4947a58ff..82c5fadd8 100644
--- a/testsuite/rrsync-pull-delivers-content_test.py
+++ b/testsuite/tests/rrsync/rrsync-pull-delivers-content.py
@@ -1,33 +1,10 @@
 #!/usr/bin/env python3
-"""A pull through rrsync must deliver the file's CONTENT.
-
-rrsync inode-pins each validated transfer argument and rewrites the argument to
-/proc/self/fd/N so the exec'd rsync re-resolves it to the pinned inode.  That is
-right for the receiver, which plain-open()s its destination -- but the sender
-never plain-opens the transfer argument: send_file_list() lstat()s it, and
-lstat() of a /proc/self/fd magic link always reports S_IFLNK.  So the sender
-described the argument as a symlink instead of sending the file.
-
-The observable damage depends on how much the receiver checks.  It has been seen
-both as a delivered dangling symlink holding the server's absolute in-tree path
-and no content, and -- with the current receiver's file-list name check -- as an
-outright refusal:
-
-    ERROR: rejecting unrequested file-list name: 4
-
-Either way the canonical `rsync -a host:file dest/` through a restricted account
-does not deliver the file, so this asserts the user-visible outcome (content
-arrives, as a regular file) rather than any one symptom.
-
-The push case is checked too: the fix must not be achievable by abandoning the
-receiver-side pinning that the same code does for real.
-"""
 
 import os
 import shlex
 import subprocess
 
-from rsyncfns import (
+from harness.rsync import (
     RSYNC, SCRATCHDIR, makepath, patched_rrsync, rmtree, rsync_argv, test_fail, rsync_path_arg,
 )
 
@@ -39,24 +16,21 @@
 restricted = base / 'restricted'
 dest = base / 'dest'
 src = base / 'src'
-makepath(restricted, dest, src)
+outside = base / 'outside'
+makepath(restricted, dest, src, outside)
 
 (restricted / 'f1').write_text(PULL_DATA)
+(restricted / 'f2').write_text(PULL_DATA)
 (src / 'up1').write_text(PUSH_DATA)
-# rrsync refuses a --sender arg that does not already exist, so the push target
-# directory has to be there before the transfer.
 makepath(restricted / 'inbox')
+(outside / 'list').write_text('f1\n')
 
-# $RSYNC may carry a wrapper (valgrind, --protocol=N); rrsync wants a single
-# executable, so hand it a shim that re-expands the whole command line.
 shim = base / 'rsync-shim'
 shim.write_text('#!/bin/sh\nexec ' + rsync_path_arg(RSYNC) + ' "$@"\n')
 shim.chmod(0o755)
 
 rrsync = patched_rrsync(base, rsync_path=str(shim))
 
-# Stand in for ssh: drop the host argument and pass the rest to rrsync exactly
-# as sshd would, through SSH_ORIGINAL_COMMAND.
 rsh = base / 'fake-rsh'
 rsh.write_text(
     '#!/bin/sh\n'
@@ -66,14 +40,11 @@
     'exec %s %s\n' % (shlex.quote(str(rrsync)), shlex.quote(str(restricted))))
 rsh.chmod(0o755)
 
-
 def transfer(*args):
     return subprocess.run(rsync_argv('-a', '-e', str(rsh), *args),
                           stdout=subprocess.PIPE, stderr=subprocess.STDOUT,
                           text=True)
 
-
-# --- the regression: a plain pull of a file ---------------------------------
 proc = transfer('dummy:f1', str(dest) + '/')
 ctx = f'rc={proc.returncode}, output={proc.stdout.strip()[:300]!r}'
 got = dest / 'f1'
@@ -90,9 +61,6 @@ def transfer(*args):
 if proc.returncode != 0:
     test_fail(f'pull delivered the content but failed ({ctx})')
 
-# --- control: the receiver direction still works ----------------------------
-# Without this, "stop handing the sender a pinned fd" could be satisfied by
-# dropping the pinning altogether, which is the hardening this must preserve.
 proc = transfer(str(src) + '/up1', 'dummy:inbox/')
 ctx = f'rc={proc.returncode}, output={proc.stdout.strip()[:300]!r}'
 landed = restricted / 'inbox' / 'up1'
@@ -102,4 +70,31 @@ def transfer(*args):
 if not landed.is_file() or landed.read_text() != PUSH_DATA:
     test_fail(f'push did not deliver the content ({ctx})')
 
-print('rrsync pull delivers file content; push still works')
+files = base / 'files'
+files.write_text('f1\nf2\n')
+proc = transfer(f'--files-from={files}', 'dummy:.', f'{dest}/')
+for name in ('f1', 'f2'):
+    result = dest / name
+    if not result.is_file() or result.read_text() != PULL_DATA:
+        test_fail(f'--files-from did not deliver {name}: {proc.stdout}')
+if proc.returncode:
+    test_fail(f'--files-from pull failed: {proc.stdout}')
+
+def direct(files_from):
+    return subprocess.run(
+        [str(rrsync), '-ro', '-no-lock', str(restricted)],
+        env={**os.environ,
+             'SSH_ORIGINAL_COMMAND':
+                 f'rsync --server --sender -logDtpre.iLsfxC --files-from={files_from} . .'},
+        stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True)
+
+control = direct(restricted / 'f1')
+if 'invalid rsync-command syntax' in control.stdout or 'does not run rsync' in control.stdout:
+    test_fail(f'files-from control did not reach path validation: {control.stdout}')
+blocked = direct(outside / 'list')
+if blocked.returncode == 0:
+    test_fail('out-of-tree --files-from path was accepted')
+if 'invalid rsync-command syntax' in blocked.stdout or 'does not run rsync' in blocked.stdout:
+    test_fail(f'out-of-tree --files-from path was rejected for the wrong reason: {blocked.stdout}')
+
+print('rrsync pull, push and files-from handling verified')
diff --git a/testsuite/rrsync-root-relative-paths_test.py b/testsuite/tests/rrsync/rrsync-root-relative-paths.py
similarity index 80%
rename from testsuite/rrsync-root-relative-paths_test.py
rename to testsuite/tests/rrsync/rrsync-root-relative-paths.py
index 56ddbf8c0..4261531cb 100644
--- a/testsuite/rrsync-root-relative-paths_test.py
+++ b/testsuite/tests/rrsync/rrsync-root-relative-paths.py
@@ -1,11 +1,10 @@
 #!/usr/bin/env python3
-"""Leading slashes through rrsync must remain relative to the restricted root."""
 
 import os
 import shlex
 import subprocess
 
-from rsyncfns import (
+from harness.rsync import (
     RSYNC, SCRATCHDIR, makepath, patched_rrsync, rmtree, rsync_argv,
     rsync_path_arg, test_fail,
 )
@@ -50,24 +49,18 @@
     % (shlex.quote(str(rrsync)), shlex.quote(str(restricted))))
 rsh_absolute.chmod(0o755)
 
-
 def run(*args):
     return subprocess.run(
         rsync_argv('-e', str(rsh), *args),
         capture_output=True, text=True, timeout=30,
     )
 
-
-# A leading slash denotes the root of the restricted tree, not an empty path.
 listed = run('--list-only', 'dummy:/')
 listed_ctx = (f'rc={listed.returncode}, stdout={listed.stdout.strip()!r}, '
               f'stderr={listed.stderr.strip()!r}')
 if listed.returncode != 0 or 'previous' not in listed.stdout:
     test_fail(f'listing the restricted root with / failed ({listed_ctx})')
 
-# Option operands use the same convention.  The basis is a sibling of the
-# destination, so stripping the slash and leaving a relative name makes rsync
-# look for destination/previous and silently transfer a full copy.
 linked = run('-a', '--link-dest=/previous', str(source) + '/', 'dummy:/current')
 linked_ctx = (f'rc={linked.returncode}, stdout={linked.stdout.strip()!r}, '
               f'stderr={linked.stderr.strip()!r}')
@@ -82,9 +75,6 @@ def run(*args):
     test_fail(f'root-relative --link-dest did not hard-link to its basis '
               f'({linked_ctx})')
 
-# Repeated leading slashes have the same restricted-root meaning.  Assert the
-# authorised path still works rather than satisfying confinement by rejecting
-# every repeated-slash path.
 repeated = run('-a', 'dummy:///previous/file', str(pulled) + '/')
 if (repeated.returncode != 0
         or not (pulled / 'file').is_file()
@@ -93,8 +83,6 @@ def run(*args):
               f'restricted root (rc={repeated.returncode}, '
               f'stderr={repeated.stderr.strip()!r})')
 
-# The explicit -absolute mode continues to accept a complete server path under
-# the restricted directory; root-relative handling must not reinterpret it.
 rmtree(pulled)
 pulled.mkdir()
 absolute = subprocess.run(
@@ -109,9 +97,6 @@ def run(*args):
     test_fail('-absolute no longer accepts an in-tree server path '
               f'(rc={absolute.returncode}, stderr={absolute.stderr.strip()!r})')
 
-# Repeated leading slashes must not regain host-root meaning in either transfer
-# direction.  The requested path is the absolute spelling of a file outside
-# the restricted tree; a vulnerable wrapper would read or replace that file.
 outside_arg = '///' + str(outside / 'secret').lstrip('/')
 rmtree(pulled)
 pulled.mkdir()
diff --git a/testsuite/rrsync-sender-leaf-flip_test.py b/testsuite/tests/rrsync/rrsync-sender-leaf-flip.py
similarity index 56%
rename from testsuite/rrsync-sender-leaf-flip_test.py
rename to testsuite/tests/rrsync/rrsync-sender-leaf-flip.py
index e228fcce8..03d080000 100644
--- a/testsuite/rrsync-sender-leaf-flip_test.py
+++ b/testsuite/tests/rrsync/rrsync-sender-leaf-flip.py
@@ -1,49 +1,19 @@
 #!/usr/bin/env python3
-"""A raced LAST component must not leak outside content through an rrsync pull.
-
-rrsync inode-pins the components above a sender argument's last one, but not
-always the last one itself: rsync lstat()s a source argument, and lstat of a
-/proc/self/fd magic link is always S_IFLNK, so handing it the leaf's pin makes
-the sender describe the argument as a symlink and send no data at all (see
-rrsync-pull-delivers-content).
-
-What keeps that safe is rsync's own behaviour rather than the wrapper's:
-
-  * a symlink at a plain source argument is transmitted AS a symlink -- the
-    sender does not read through it;
-  * the options that would change that (-L, -k, --copy-unsafe-links) are
-    disabled by rrsync for a restricted dir, and --insecure-links is not in its
-    allowlist at all;
-  * the sender's own opens are O_NOFOLLOW, and directories go through
-    secure_opendir(), so a flip landing between rsync's lstat() and its open is
-    refused by the kernel.
-
-So this drives the real binary and asserts the property that actually holds --
-no outside CONTENT reaches the client -- rather than requiring a particular
-symptom from a race that may or may not be won on any given run.
-
-Note what is NOT claimed: an outside symlink's target string can still be
-disclosed, since transmitting the symlink is the correct behaviour for the
-shape. rrsync's -munge blunts that. Under --relative the argument is anchored
-higher, so the intermediate components are exposed to the same window; that is
-a known limitation of the wrapper, recorded in the plan notes, not something
-this test asserts away.
-"""
 
 import os
 import shlex
 import subprocess
 import time
 
-from rsyncfns import (
-    race_budget, RSYNC, SCRATCHDIR, makepath, patched_rrsync,
-    proc_self_fd_pins, rmtree, rsync_argv, start_path_flipper, stop_flipper,
-    test_fail, test_skipped, rsync_path_arg,
+from harness.mutation import race_budget, start_path_flipper, stop_flipper
+from harness.rsync import (
+    RSYNC, SCRATCHDIR, makepath, patched_rrsync, proc_self_fd_pins, rmtree, rsync_argv,
+    rsync_path_arg, test_fail, test_skipped,
 )
 
 if not proc_self_fd_pins():
     test_skipped("rrsync's realpath-vs-exec inode-pin needs /proc/self/fd "
-                 "(Linux); unhardened fallback elsewhere by design")
+                 "(Linux); unhardened fallback elsewhere by design", capability='proc_fd')
 
 MARKER = 'AUDIT_RRSYNC_LEAF_FLIP_MARKER_DO_NOT_DISCLOSE'
 
@@ -72,9 +42,7 @@
     'exec %s -ro %s\n' % (shlex.quote(str(rrsync)), shlex.quote(str(restricted))))
 rsh.chmod(0o755)
 
-
 def leaked_content():
-    """True if any delivered regular file holds the outside marker."""
     for path in dest.rglob('*'):
         if path.is_file() and not path.is_symlink():
             try:
@@ -84,7 +52,6 @@ def leaked_content():
                 pass
     return None
 
-
 def race_pull(source, real_name, evil_name):
     flip = start_path_flipper(real_name, evil_name)
     try:
@@ -103,8 +70,6 @@ def race_pull(source, real_name, evil_name):
         stop_flipper(flip)
     return None
 
-
-# --- a plain file argument whose leaf flips to an outside symlink ------------
 real_file = restricted / 'target'
 real_file.write_text('benign_in_tree_content\n')
 evil_file = restricted / 'evil'
@@ -119,9 +84,6 @@ def race_pull(source, real_name, evil_name):
 rmtree(real_file)
 rmtree(evil_file)
 
-# --- a trailing-slash directory, which rsync DOES follow ---------------------
-# This shape keeps the leaf pin precisely because rsync opens it rather than
-# lstat()ing it; without the pin the flip below transfers outside/dir/loot.
 real_dir = restricted / 'dir'
 makepath(real_dir)
 (real_dir / 'ok').write_text('benign\n')
diff --git a/testsuite/rrsync-sender-parent-pin_test.py b/testsuite/tests/rrsync/rrsync-sender-parent-pin.py
similarity index 59%
rename from testsuite/rrsync-sender-parent-pin_test.py
rename to testsuite/tests/rrsync/rrsync-sender-parent-pin.py
index a1a09fec8..dbcac84f8 100644
--- a/testsuite/rrsync-sender-parent-pin_test.py
+++ b/testsuite/tests/rrsync/rrsync-sender-parent-pin.py
@@ -1,45 +1,18 @@
 #!/usr/bin/env python3
-"""A sender leaf rrsync never opens must still resolve beneath a pinned parent.
-
-rrsync deliberately does not content-open a sender argument whose leaf is not a
-regular file or a directory: O_RDONLY on a FIFO blocks until a writer appears,
-and a dangling symlink resolves to nothing.  What it must NOT do is then hand
-rsync the bare name, because every component goes back into play and a parent
-flipped after the realpath() check redirects the read out of the tree -- which
-is CVE-2026-53783.  The leaf is instead spelled beneath a pinned directory.
-
-rrsync-sender-leaf-flip races this with the real binary, but a race only ever
-samples the window: zero leaks in 104 attempts still leaves a few per cent of
-per-attempt risk unmeasured.  This test closes the window deterministically
-instead.  A stub standing in for rsync inherits the pinned descriptor, then
-blocks; the parent is swapped for a symlink pointing outside the tree while it
-is blocked, so the substitution is guaranteed to be in place before the stub
-resolves anything; the stub then reports what the argument actually names.
-
-With the parent pinned, the stub sees the original in-tree leaf no matter what
-the tree now looks like.  Without it -- the bare name -- it sees whatever the
-attacker's symlink points at.  So this fails outright if the pin is removed,
-rather than depending on winning a race.
-
-Not asserted here: a --relative argument with no client "/./" anchors at the
-restricted root rather than the leaf's parent, so its intermediate components
-stay raceable.  That limit predates this and is stated in NEWS.
-"""
 
 import os
-import shlex
 import stat
 import subprocess
 import time
 
-from rsyncfns import (
+from harness.rsync import (
     SCRATCHDIR, makepath, patched_rrsync, proc_self_fd_pins, rmtree, test_fail,
     test_skipped,
 )
 
 if not proc_self_fd_pins():
     test_skipped("rrsync's inode pin needs /proc/self/fd (Linux); the "
-                 "unhardened fallback elsewhere is by design")
+                 "unhardened fallback elsewhere is by design", capability='proc_fd')
 
 MARKER = 'AUDIT_PARENT_PIN_MARKER_DO_NOT_DISCLOSE'
 
@@ -49,14 +22,11 @@
 outside = base / 'outside'
 makepath(restricted, outside)
 
-# What the attacker wants reached: same names as in the tree, but regular
-# files holding the marker, so a leak is unmistakable in the stub's report.
 outdir = outside / 'dir'
 makepath(outdir)
 (outdir / 'target').write_text(MARKER + '\n')
 (outdir / 'afifo').write_text(MARKER + '\n')
 
-# In-tree: a dangling symlink and a FIFO, the two shapes rrsync never opens.
 realdir = restricted / 'dir'
 makepath(realdir)
 os.symlink('missing-sibling', realdir / 'target')
@@ -66,10 +36,6 @@
 go = base / 'stub-go'
 report = base / 'stub-report'
 
-# The stub replaces rsync.  It signals that it is running -- with the pinned
-# descriptor already inherited -- waits to be released, and only then resolves
-# its source argument, which is the whole point: the swap below is guaranteed
-# to have happened first.
 stub = base / 'rsync-stub'
 stub.write_text(f'''#!/usr/bin/env python3
 import os, stat, sys, time
@@ -104,9 +70,7 @@
 evil = restricted / 'evil'
 os.symlink(str(outdir), evil)
 
-
 def resolve_with_parent_swapped(source):
-    """Run rrsync, swap `dir` for the outside symlink mid-flight, report."""
     for p in (ready, go, report):
         if p.exists():
             p.unlink()
@@ -127,16 +91,12 @@ def resolve_with_parent_swapped(source):
         test_fail(f'the stub never ran for {source!r}, so nothing was tested '
                   f'(rc={proc.returncode}, output={out.strip()[:300]!r})')
 
-    # The stub is blocked with the pinned fd already inherited.  Swap the
-    # parent for a symlink out of the tree -- guaranteed to be in place before
-    # the stub resolves the argument.
     os.rename(realdir, base / 'stash')
     os.rename(evil, realdir)
 
     go.touch()
     out = proc.communicate(timeout=60)[0]
 
-    # Put the tree back for the next case.
     os.rename(realdir, evil)
     os.rename(base / 'stash', realdir)
 
@@ -146,11 +106,6 @@ def resolve_with_parent_swapped(source):
     handed, saw = report.read_text().splitlines()
     return handed, saw
 
-
-# --- control: the swap really does redirect an unpinned name -----------------
-# Resolve the same relative name the way rsync would without a pin, while the
-# substitution is in place.  If this does NOT reach the outside file, the
-# construction is broken and the assertions below would prove nothing.
 os.rename(realdir, base / 'stash')
 os.rename(evil, realdir)
 try:
@@ -164,7 +119,6 @@ def resolve_with_parent_swapped(source):
     os.rename(realdir, evil)
     os.rename(base / 'stash', realdir)
 
-# --- the dangling symlink leaf ----------------------------------------------
 handed, saw = resolve_with_parent_swapped('dir/target')
 if saw != 'symlink missing-sibling':
     test_fail(f'a dangling-symlink leaf resolved to {saw!r} after its parent '
@@ -173,7 +127,6 @@ def resolve_with_parent_swapped(source):
               f'{handed!r} -- an unpinned name puts every component back in '
               'play, which is CVE-2026-53783')
 
-# --- the FIFO leaf -----------------------------------------------------------
 handed, saw = resolve_with_parent_swapped('dir/afifo')
 if saw != 'fifo':
     test_fail(f'a FIFO leaf resolved to {saw!r} after its parent was swapped '
diff --git a/testsuite/rrsync-specials-denied_test.py b/testsuite/tests/rrsync/rrsync-specials-denied.py
similarity index 53%
rename from testsuite/rrsync-specials-denied_test.py
rename to testsuite/tests/rrsync/rrsync-specials-denied.py
index 60d837238..a84ee178e 100644
--- a/testsuite/rrsync-specials-denied_test.py
+++ b/testsuite/tests/rrsync/rrsync-specials-denied.py
@@ -1,38 +1,10 @@
 #!/usr/bin/env python3
-# Finding [26]: support/rrsync leaves -D / --specials enabled in a restricted
-# (non-"/") directory, so a restricted SSH user can have the spawned rsync
-# create special files (FIFOs, sockets; device nodes too if the receiver is
-# privileged) inside the served tree -- objects the forced-command policy did
-# not intend to permit, and that the user cannot otherwise create through the
-# wrapper (it only runs rsync, not a shell).
-#
-# Part 1 shows --specials is the toggle that enables special-file creation (a
-# FIFO is created with it, skipped without it).  Part 2 is the fix: a restricted
-# rrsync no longer creates special files even when -D/--specials is requested.
-#
-# Rejecting -D outright broke plain `rsync -a` (which bundles -rlptgoD) for every
-# restricted rrsync (see rrsync-archive-mode), so rather than reject the transfer
-# the wrapper forces --drop-D, which refuses the creation (entries are skipped,
-# exactly the part-1 "without --specials" behaviour) while the rest of the
-# transfer proceeds.  Runs at any uid.
-#
-# It is --drop-D and not --no-D because --no-D also clears the rdev fields that
-# devices and special files carry on the wire, and the wrapper sets it on one
-# end of the connection only: the client's -D sender then writes rdev the
-# receiver never reads and the file list desynchronises.  --drop-D withholds
-# only the creation.
-#
-# The two directions are asserted separately, because they are not the same
-# question.  Creation happens where files are WRITTEN, so only the receiving
-# side can create anything in the served tree, and only there is there anything
-# to deny.  Part 4 pins that down so the distinction cannot quietly collapse
-# back into "forced everywhere".
 
 import os
 import shlex
 import subprocess
 
-from rsyncfns import (
+from harness.rsync import (
     RSYNC, RSYNC_PREFIX, SCRATCHDIR, patched_rrsync, rmtree, rsync_argv,
     test_fail, xattr_set, xattrs_supported, rsync_path_arg,
 )
@@ -44,7 +16,6 @@
 os.mkfifo(src / 'evil_fifo')
 (src / 'ordinary').write_text('PLAIN\n')
 
-# --- Part 1: --specials enables special-file creation in the destination.
 withd = base / 'with'
 withd.mkdir()
 subprocess.run(rsync_argv('-rlptgo', '--specials', f'{src}/', f'{withd}/'),
@@ -58,12 +29,6 @@
 if (without / 'evil_fifo').exists():
     test_fail("premise check failed: without --specials the FIFO should be skipped")
 
-# --- Part 2: a restricted rrsync accepts -D/--specials but forces --drop-D, so
-# the special-file creation shown in part 1 cannot be requested through the
-# wrapper.  Use an argv-recording stub rsync to confirm that the option is
-# accepted (the `rsync -a` regression is gone), that --drop-D is forced, and
-# that the client's own -D still reaches the server so both ends keep framing
-# the file list the same way.
 record = base / 'argv'
 stub = base / 'rsync-record'
 stub.write_text('#!/bin/sh\nprintf \'%s\\n\' "$@" >' + str(record) + '\n')
@@ -83,15 +48,11 @@ def forwarded_opts(cmd):
                   f"the option (exit {r.returncode}): {r.stderr.strip()}")
     return record.read_text().split('\n') if record.exists() else []
 
-
 for opt in ('-D', '--specials'):
-    # Receiving side: this is the one that could create something here.
     forwarded = forwarded_opts(f'rsync --server {opt} . .')
     if '--drop-D' not in forwarded:
         test_fail(f"restricted rrsync did not force --drop-D for `{opt}` on "
                   f"the receiving side, where creation happens: {forwarded}")
-    # ...and the client's own request must still reach the server, or the two
-    # ends frame the file list's rdev fields differently and it desynchronises.
     if opt not in forwarded:
         test_fail(f"restricted rrsync dropped `{opt}` instead of leaving it "
                   f"alongside --drop-D: {forwarded}")
@@ -100,16 +61,8 @@ def forwarded_opts(cmd):
                   'preserve_devices/preserve_specials, which also frame the '
                   f'rdev fields, so the file list desynchronises: {forwarded}')
 
-# --- Part 3: the property, not just the option ------------------------------
-# Part 2 checks what rrsync forwards.  This checks what that achieves: a push
-# of a FIFO through a restricted rrsync must not create one in the tree.
 served = base / 'served'
 served.mkdir()
-# A second wrapper in its own dir: patched_rrsync() always writes
-# <workdir>/rrsync-under-test, and the one above is wired to the recording
-# stub.  This one drives the real rsync -- through a shim, because RSYNC may
-# be a multi-word command (the runner's --protocol=N, or valgrind) while
-# rrsync hands its RSYNC to execlp() as a single executable name.
 pushwrap = base / 'pushwrap'
 pushwrap.mkdir()
 shim = base / 'rsync-shim'
@@ -129,8 +82,6 @@ def forwarded_opts(cmd):
     rsync_argv('-rlptgoD', '--specials', '-e', str(rsh), f'{src}/', 'dummy:.'),
     stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True, timeout=120)
 ctx = f'rc={proc.returncode}, output={proc.stdout.strip()[:300]!r}'
-# Control: the FIFO's absence only means something if the push otherwise
-# worked.  A push that failed outright would "deny" the FIFO too.
 landed = served / 'ordinary'
 if not landed.is_file() or landed.read_text() != 'PLAIN\n':
     test_fail(f'control failed: the push did not deliver an ordinary file, so '
@@ -138,23 +89,9 @@ def forwarded_opts(cmd):
 if (served / 'evil_fifo').exists():
     test_fail(f'a push through a restricted rrsync created a special file in '
               f'the served tree ({ctx})')
-# The claim is "denies creation while the rest proceeds normally", so a
-# refusal that also breaks the transfer does not satisfy it.
 if proc.returncode != 0:
     test_fail(f'the FIFO was denied, but the transfer itself failed ({ctx})')
 
-# --- Part 3b: a DEVICE, which breaks at every protocol ----------------------
-# A device carries its rdev at every protocol version -- unlike a FIFO, whose
-# rdev field stops existing at 31 -- so a receiver whose preserve_devices
-# disagrees with the sender's desynchronises the file list even on current
-# protocols.  This needs no mknod privilege: rsync's own fake-super "%stat"
-# xattr is what makes a file a device to rsync, at both ends.
-#
-# The RECEIVER runs --fake-super too, so it is able to record a device without
-# privilege -- which is what makes this an assertion about DENIAL rather than
-# about the transfer merely surviving.  Without the wrapper's refusal it lands
-# a placeholder named "achar"; with it, the entry is skipped and nothing of
-# that name exists.
 if xattrs_supported():
     devsrc = base / 'devsrc'
     devsrc.mkdir()
@@ -163,15 +100,12 @@ def forwarded_opts(cmd):
     try:
         xattr_set(f'{RSYNC_PREFIX}.%stat', '20644 1,3 0:0', devsrc / 'achar')
         made_dev = True
-    except Exception:
+    except OSError:
         made_dev = False
 
     if made_dev:
         devserved = base / 'devserved'
         devserved.mkdir()
-        # Its own wrapper, whose rsync runs --fake-super: patched_rrsync()
-        # writes one file per workdir, and the push wrapper above must stay
-        # ordinary.
         devwrap = base / 'devwrap'
         devwrap.mkdir()
         devshim = base / 'rsync-shim-fake'
@@ -195,11 +129,7 @@ def forwarded_opts(cmd):
         ctx = f'rc={proc.returncode}, output={proc.stdout.strip()[:300]!r}'
         landed = devserved / 'ordinary'
         if not landed.is_file() or landed.read_text() != 'PLAIN\n':
-            test_fail(f'control failed: pushing a tree containing a device did '
-                      f'not deliver the ordinary file beside it, so nothing '
-                      f'below proves anything.  Clearing preserve_devices on '
-                      f'the receiver alone desynchronises the file list at '
-                      f'EVERY protocol, which fails the whole transfer ({ctx})')
+            test_fail(f'device control did not deliver the adjacent regular file ({ctx})')
         if os.path.lexists(devserved / 'achar'):
             test_fail(f'a push through a restricted rrsync recorded a device in '
                       f'the served tree ({ctx})')
@@ -207,9 +137,6 @@ def forwarded_opts(cmd):
             test_fail(f'the device was denied, but the transfer itself failed '
                       f'({ctx})')
 
-# --- Part 4: and NOT on the sending side ------------------------------------
-# Forcing it there denies nothing (a sender creates nothing) while breaking the
-# file list, because only one end of the connection gets the option.
 for opt in ('-D', '--specials'):
     forwarded = forwarded_opts(f'rsync --server --sender {opt} . .')
     for forced in ('--drop-D', '--no-D'):
@@ -219,7 +146,4 @@ def forwarded_opts(cmd):
                       'creates no device or special entry in the served tree '
                       f'({forwarded})')
 
-print("rrsync-specials: --specials creates special files in the served tree; "
-      "a restricted rrsync forces --drop-D on the receiving side (a push can "
-      "create neither a special nor a device, and the transfer still "
-      "succeeds) and leaves the sending side alone")
+print('rrsync blocks receiver-side devices and special files without breaking the transfer')
diff --git a/testsuite/tests/rrsync/rrsync-symlink.py b/testsuite/tests/rrsync/rrsync-symlink.py
new file mode 100644
index 000000000..1ba750c79
--- /dev/null
+++ b/testsuite/tests/rrsync/rrsync-symlink.py
@@ -0,0 +1,68 @@
+#!/usr/bin/env python3
+
+import os
+import subprocess
+import time
+
+from harness.mutation import race_budget, start_path_flipper, stop_flipper
+from harness.rsync import (
+    SCRATCHDIR, patched_rrsync, proc_self_fd_pins, rmtree, test_fail, test_skipped,
+)
+
+if not proc_self_fd_pins():
+    test_skipped("rrsync's realpath-vs-exec inode-pin needs /proc/self/fd "
+                 "(Linux); unhardened fallback elsewhere by design", capability='proc_fd')
+
+MARKER = b"AUDIT_RRSYNC_RACE_LEAK_MARKER_DO_NOT_DISCLOSE"
+
+base = SCRATCHDIR / 'rrsync_race'
+restricted = base / 'restricted'
+outside = base / 'outside'
+rmtree(base)
+restricted.mkdir(parents=True)
+outside.mkdir(parents=True)
+
+(outside / 'target').write_bytes(MARKER)
+
+real_dir = restricted / 'dir'
+real_dir.mkdir()
+(real_dir / 'target').write_bytes(b"benign_in_tree_content\n")
+evil_path = restricted / 'evil'
+os.symlink(str(outside), evil_path)
+
+fake_rsync = base / 'fake_rsync'
+fake_rsync.write_text(
+    "#!/usr/bin/env python3\n"
+    "import sys\n"
+    "try:\n"
+    "    with open(sys.argv[-1], 'rb') as f:\n"
+    "        sys.stdout.buffer.write(f.read())\n"
+    "except OSError:\n"
+    "    pass\n"
+)
+fake_rsync.chmod(0o755)
+
+test_rrsync = patched_rrsync(base, rsync_path=str(fake_rsync))
+
+def race(rrsync_flags, ssh_cmd):
+    env = {**os.environ, 'SSH_ORIGINAL_COMMAND': ssh_cmd}
+    deadline = time.monotonic() + race_budget()
+    while time.monotonic() < deadline:
+        proc = subprocess.run(
+            [str(test_rrsync), *rrsync_flags, '-no-lock', str(restricted)],
+            stdout=subprocess.PIPE, stderr=subprocess.DEVNULL, env=env)
+        if MARKER in proc.stdout:
+            return True
+    return False
+
+flip = start_path_flipper(real_dir, evil_path)
+try:
+    leaked = race(['-ro'], "rsync --server --sender -lt . dir/target")
+finally:
+    stop_flipper(flip)
+
+if leaked:
+    test_fail(
+        f'rrsync emitted {MARKER!r} after a parent path changed to an outside symlink')
+
+print('rrsync pins intermediate sender path components against the realpath-vs-exec race')
diff --git a/testsuite/rrsync-userns-procfs_test.py b/testsuite/tests/rrsync/rrsync-userns-procfs.py
similarity index 80%
rename from testsuite/rrsync-userns-procfs_test.py
rename to testsuite/tests/rrsync/rrsync-userns-procfs.py
index 7bd1cdb06..03b9534d4 100644
--- a/testsuite/rrsync-userns-procfs_test.py
+++ b/testsuite/tests/rrsync/rrsync-userns-procfs.py
@@ -1,5 +1,4 @@
 #!/usr/bin/env python3
-"""A confined fd pin must remain usable inside a Linux user namespace."""
 
 import os
 import shlex
@@ -9,25 +8,39 @@
 import tempfile
 from pathlib import Path
 
-from rsyncfns import makepath, rmtree, rsync_argv, test_fail, test_skipped
-
+from harness.rsync import makepath, rmtree, rsync_argv, test_fail, test_skipped
 
 if not sys.platform.startswith('linux'):
-    test_skipped('rrsync-userns-procfs is Linux-specific')
+    test_skipped('rrsync-userns-procfs is Linux-specific', capability='user_namespace')
 
 if not os.environ.get('RSYNC_USERNS_PROCFS'):
     unshare = shutil.which('unshare')
     if unshare is None:
-        test_skipped('unshare is unavailable')
+        test_skipped('unshare is unavailable', capability='user_namespace')
     env = os.environ.copy()
     env['RSYNC_USERNS_PROCFS'] = '1'
     launch_dir = Path(tempfile.mkdtemp(prefix='rsync-userns-launch-'))
     launch_dir.chmod(0o755)
-    testdir = Path(__file__).resolve().parent
-    child_test = launch_dir / Path(__file__).name
-    for source in (Path(__file__), testdir / 'rsyncfns.py',
-                   testdir / 'exitcodes.py'):
-        shutil.copy2(source, launch_dir / source.name)
+    testfile = Path(__file__).resolve()
+    suitedir = Path(os.environ['suitedir'])
+    child_test = launch_dir / testfile.name
+    shutil.copy2(testfile, child_test)
+    shutil.copytree(
+        suitedir / 'harness',
+        launch_dir / 'harness',
+        ignore=shutil.ignore_patterns('__pycache__', '*.pyc'),
+    )
+    env['PYTHONPATH'] = str(launch_dir)
+    import_probe = subprocess.run(
+        [sys.executable, '-c', 'from harness import rsync'],
+        cwd=launch_dir,
+        env=env,
+        capture_output=True,
+        text=True,
+    )
+    if import_probe.returncode != 0:
+        rmtree(launch_dir)
+        test_fail('staged test harness is incomplete:\n' + import_probe.stderr)
     rsync_cmd = shlex.split(env['RSYNC'])
     for i, arg in enumerate(rsync_cmd):
         if Path(arg).name in ('rsync', 'rsync.exe') and Path(arg).is_file():
@@ -44,7 +57,8 @@
     if os.geteuid() == 0:
         setpriv = shutil.which('setpriv')
         if setpriv is None:
-            test_skipped('setpriv is unavailable for the root-run testsuite')
+            test_skipped('setpriv is unavailable for the root-run testsuite',
+                         capability='user_namespace')
         launcher = [setpriv, '--reuid=65534', '--regid=65534', '--clear-groups']
     unshare_argv = [unshare, '--user', '--map-root-user', '--mount', '--pid',
                     '--fork', '--mount-proc']
@@ -76,7 +90,8 @@
 
 proc_uid = os.lstat('/proc/self').st_uid
 if proc_uid in (0, os.geteuid()):
-    test_skipped('/proc/self does not expose an overflow uid in this namespace')
+    test_skipped('/proc/self does not expose an overflow uid in this namespace',
+                 capability='user_namespace')
 
 base = Path(tempfile.mkdtemp(prefix='rsync-userns-procfs-'))
 root = base / 'root'
@@ -120,7 +135,6 @@
 
 (outside / 'test').write_text('existing_backup\n')
 
-# Open an FD pointing to the confined root
 root_fd = os.open(root, os.O_RDONLY | os.O_DIRECTORY)
 try:
     for fd_root in fd_roots:
@@ -133,8 +147,6 @@
             text=True,
         )
 
-        # The transfer must fail because rsync attempts to unlink the pre-existing target file,
-        # forcing the path-walker to evaluate the FD pin + symlink and catching the escape.
         if proc.returncode == 0:
             test_fail(f'backup to outside symlink via {fd_root} pin was not observably refused: '
                       f'rc={proc.returncode}, stderr={proc.stderr!r}')
@@ -142,4 +154,3 @@
     os.close(root_fd)
 
 rmtree(base)
-
diff --git a/testsuite/rrsync-write-only-files-from_test.py b/testsuite/tests/rrsync/rrsync-write-only-files-from.py
similarity index 52%
rename from testsuite/rrsync-write-only-files-from_test.py
rename to testsuite/tests/rrsync/rrsync-write-only-files-from.py
index 3d24f99f1..577681da7 100644
--- a/testsuite/rrsync-write-only-files-from_test.py
+++ b/testsuite/tests/rrsync/rrsync-write-only-files-from.py
@@ -1,5 +1,4 @@
 #!/usr/bin/env python3
-"""A forced rrsync -wo endpoint must not return a local --files-from file."""
 
 import os
 import shlex
@@ -17,7 +16,9 @@
     wrapper, root = env['RRSYNC_WRAPPER'], env['RRSYNC_ROOT']
     os.execve(wrapper, [wrapper, '-wo', '-no-lock', root], env)
 
-from rsyncfns import RSYNC, SCRATCHDIR, makepath, patched_rrsync, rmtree, rsync_argv, rsync_path_arg
+from harness.rsync import (
+    RSYNC, SCRATCHDIR, makepath, patched_rrsync, rmtree, rsync_argv, rsync_path_arg, test_fail,
+)
 
 base = SCRATCHDIR / 'rrsync-write-only-files-from'
 rmtree(base)
@@ -27,9 +28,6 @@
 secret_name = 'SERVER-ONLY-SECRET-NAME'
 (root / 'protected-list').write_text(secret_name + '\n')
 
-# RSYNC may be a multi-word command (the runner's --protocol=N, or valgrind)
-# while rrsync hands its RSYNC to execlp() as a single executable name, so it
-# has to be wrapped before patched_rrsync() sees it.
 shim = base / 'rsync-shim'
 shim.write_text('#!/bin/sh\nexec ' + rsync_path_arg(RSYNC) + ' "$@"\n')
 shim.chmod(0o755)
@@ -41,17 +39,11 @@
                '-e', rsh, f'{src}/', 'ignored:'),
     env=env, capture_output=True, text=True, timeout=20)
 
-assert got.returncode != 0 and 'write-only server cannot read' in got.stderr, (
-    f'write-only rrsync accepted remote --files-from: rc={got.returncode}, '
-    f'stdout={got.stdout!r}, stderr={got.stderr!r}')
-assert secret_name not in got.stdout and secret_name not in got.stderr, (
-    f'write-only rrsync returned the protected record: rc={got.returncode}, '
-    f'stdout={got.stdout!r}, stderr={got.stderr!r}')
+if not (got.returncode != 0 and 'write-only server cannot read' in got.stderr):
+    test_fail(f'write-only rrsync accepted remote --files-from: rc={got.returncode}, stdout={got.stdout!r}, stderr={got.stderr!r}')
+if not (secret_name not in got.stdout and secret_name not in got.stderr):
+    test_fail(f'write-only rrsync returned the protected record: rc={got.returncode}, stdout={got.stdout!r}, stderr={got.stderr!r}')
 
-# Control: a CLIENT-local --files-from upload must still work.  A second,
-# unlisted source file makes this prove list selection as well: with only one
-# file present an ordinary recursive upload would look identical, so the
-# control would pass even if the list were ignored entirely.
 (src / 'allowed').write_bytes(b'NEW')
 (src / 'unlisted').write_bytes(b'NOPE')
 local_list = base / 'local-list'
@@ -60,9 +52,7 @@
     rsync_argv('-r', f'--files-from={local_list}',
                '-e', rsh, f'{src}/', 'ignored:'),
     env=env, capture_output=True, text=True, timeout=20)
-assert safe.returncode == 0 and (root / 'allowed').read_bytes() == b'NEW', (
-    f'local --files-from upload failed: rc={safe.returncode}, '
-    f'stdout={safe.stdout!r}, stderr={safe.stderr!r}')
-assert not (root / 'unlisted').exists(), (
-    'the client-local list was not honoured: an unlisted file was uploaded, '
-    'so this control does not show that --files-from selected anything')
+if not (safe.returncode == 0 and (root / 'allowed').read_bytes() == b'NEW'):
+    test_fail(f'local --files-from upload failed: rc={safe.returncode}, stdout={safe.stdout!r}, stderr={safe.stderr!r}')
+if (root / 'unlisted').exists():
+    test_fail('--files-from uploaded an unlisted file')
diff --git a/testsuite/tests/transfer/append-shortsum.py b/testsuite/tests/transfer/append-shortsum.py
new file mode 100644
index 000000000..0dbd2caba
--- /dev/null
+++ b/testsuite/tests/transfer/append-shortsum.py
@@ -0,0 +1,31 @@
+#!/usr/bin/env python3
+
+import json
+
+from harness.rsync import (
+    FROMDIR, TODIR, assert_same, make_data_file, rmtree, run_rsync,
+    test_skipped,
+)
+
+vv = json.loads(run_rsync('-VV', check=True, capture_output=True).stdout)
+if 'xxh64' not in vv.get('checksum_list', []):
+    test_skipped("xxh64 not in this build's checksum list (no xxhash)", capability='xxhash')
+
+src, dst = FROMDIR, TODIR
+rmtree(src)
+rmtree(dst)
+src.mkdir(parents=True)
+dst.mkdir(parents=True)
+
+make_data_file(src / 'f', 40000)
+full = (src / 'f').read_bytes()
+prefix = bytearray(full[:20000])
+prefix[0:64] = b'\x00' * 64
+(dst / 'f').write_bytes(bytes(prefix))
+
+run_rsync('-a', '--append-verify', '--checksum-choice=xxh64', '--no-whole-file',
+          f'{src}/', f'{dst}/')
+assert_same(dst / 'f', src / 'f', label='append-verify xxh64 redo')
+
+print("append-shortsum: --append-verify with an 8-byte (xxh64) checksum no "
+      "longer overflows the block s2length")
diff --git a/testsuite/append_test.py b/testsuite/tests/transfer/append.py
similarity index 60%
rename from testsuite/append_test.py
rename to testsuite/tests/transfer/append.py
index 46c78338e..6c305203a 100644
--- a/testsuite/append_test.py
+++ b/testsuite/tests/transfer/append.py
@@ -1,17 +1,8 @@
 #!/usr/bin/env python3
-"""Coverage of --append and --append-verify at depth.
-
---append assumes each destination file is a prefix of the (longer) source and
-transfers only the bytes past the existing size; it does NOT re-check the data
-already present, and it never touches a file that is already the same size or
-larger. --append-verify works the same way but folds the existing data into the
-whole-file checksum, so a transfer whose result fails verification is re-sent
-with a normal --inplace pass. Exercise both on files >=3 levels deep.
-"""
 
 import os
 
-from rsyncfns import (
+from harness.rsync import (
     FROMDIR, TODIR,
     assert_same, forced_protocol, make_tree, rmtree, run_rsync, test_fail,
     walk_files,
@@ -20,16 +11,12 @@
 src = FROMDIR
 deep = os.path.join('d1', 'd2', 'd3', 'f3')
 
-
 def seed_source():
     rmtree(src)
     make_tree(src, depth=3, data=True, data_size=8192)
     return [p.relative_to(src) for p in walk_files(src)]
 
-
 def dest_prefix(rels, *, corrupt=False, frac=0.5):
-    """Build a destination holding the first `frac` of each source file (a
-    valid prefix), optionally corrupting the deep file's leading bytes."""
     rmtree(TODIR)
     for rel in rels:
         dst = TODIR / rel
@@ -42,30 +29,23 @@ def dest_prefix(rels, *, corrupt=False, frac=0.5):
         bad[0:64] = b'\x00' * 64
         p.write_bytes(bytes(bad))
 
-
-# --- --append completes truncated destinations at every level ---------------
 rels = seed_source()
 dest_prefix(rels)
 run_rsync('-a', '--append', f'{src}/', f'{TODIR}/')
 for rel in rels:
     assert_same(TODIR / rel, src / rel, label=f'append {rel}')
 
-# The split between non-verifying --append and verifying --append-verify only
-# exists at protocol >= 30; at protocol 29 plain --append still verifies, so
-# skip the distinguishing sub-cases there.
 proto = forced_protocol()
 if proto is not None and proto < 30:
     print(f"append: protocol {proto} -- skipping the --append/--append-verify "
           "split (verifying-append behaviour predates the protocol-30 split)")
 else:
-    # plain --append trusts a corrupted prefix (leaves it wrong)
     dest_prefix(rels, corrupt=True)
     run_rsync('-a', '--append', f'{src}/', f'{TODIR}/')
     if (TODIR / deep).read_bytes() == (src / deep).read_bytes():
         test_fail("plain --append unexpectedly repaired a corrupted prefix "
                   "(it should append only and trust the existing data)")
 
-    # --append-verify detects the bad prefix and re-sends the whole file
     dest_prefix(rels, corrupt=True)
     run_rsync('-a', '--append-verify', f'{src}/', f'{TODIR}/')
     assert_same(TODIR / deep, src / deep, label='append-verify deep')
diff --git a/testsuite/backup-crossdev-copy_test.py b/testsuite/tests/transfer/backup-crossdev-copy.py
similarity index 56%
rename from testsuite/backup-crossdev-copy_test.py
rename to testsuite/tests/transfer/backup-crossdev-copy.py
index 232c82f44..a616b51b9 100644
--- a/testsuite/backup-crossdev-copy_test.py
+++ b/testsuite/tests/transfer/backup-crossdev-copy.py
@@ -1,17 +1,4 @@
 #!/usr/bin/env python3
-"""Coverage: backup.c make_backup() copy-fallback for non-regular files.
-
-make_backup() first tries link_or_rename() -- hard-link, then rename --
-into the backup dir.  On Linux that always succeeds for symlinks/FIFOs on
-the same filesystem, so the copy-fallback (lines ~261-349: make_file() +
-do_symlink_at()/do_mknod_at()/copy_file()) is never reached by the suite.
-
-When --backup-dir is on a DIFFERENT filesystem, both link() and rename()
-fail with EXDEV and make_backup() falls through to recreating each item:
-do_symlink_at() for symlinks, do_mknod_at() for FIFOs/specials,
-copy_file() for regular files.  This test puts the backup dir on tmpfs
-(probed via /dev/shm) and asserts each type is backed up correctly.
-"""
 
 import os
 import shutil
@@ -19,13 +6,11 @@
 import subprocess
 import tempfile
 
-from rsyncfns import (
+from harness.rsync import (
     SCRATCHDIR, FROMDIR,
     makepath, rmtree, rsync_argv, test_fail, test_skipped,
 )
 
-# Find a writable directory on a different st_dev from SCRATCHDIR (typically
-# tmpfs at /dev/shm).  Without one the EXDEV path can't fire -- skip cleanly.
 scratch_dev = os.stat(SCRATCHDIR).st_dev
 TMPFS = None
 for cand in ('/dev/shm', '/run/shm', os.environ.get('TMPDIR', '/tmp')):
@@ -36,7 +21,8 @@
     except OSError:
         continue
 if TMPFS is None:
-    test_skipped("no writable cross-device dir (tmpfs) for --backup-dir EXDEV path")
+    test_skipped("no writable cross-device dir (tmpfs) for --backup-dir EXDEV path",
+                 capability='cross_device')
 
 src = FROMDIR
 dst = SCRATCHDIR / 'bak-xdev-dst'
@@ -46,16 +32,8 @@
 
 bak = tempfile.mkdtemp(prefix='rsync-bak-xdev-', dir=TMPFS)
 
-# dst holds the items that will be BACKED UP; src holds different-typed
-# replacements so the generator deletes-with-backup before recreating.
-# - reg:  dst regular gen1 -> src regular gen2  (copy_file fallback)
-# - lnk:  dst symlink target-gen1 -> src symlink target-gen2
-#                                               (do_symlink_at fallback)
-# - fifo: dst FIFO -> src REGULAR file          (FIFO is backed up via the
-#                                                IS_SPECIAL do_mknod_at fallback,
-#                                                then replaced by a regular file)
 (dst / 'reg').write_text('gen1\n')
-(src / 'reg').write_text('gen1\n' * 2)  # different size -> transfer
+(src / 'reg').write_text('gen1\n' * 2)
 os.symlink('target-gen1', dst / 'lnk')
 os.symlink('target-gen2', src / 'lnk')
 have_fifo = True
@@ -68,9 +46,6 @@
 have_lnk = (dst / 'lnk').is_symlink()
 
 try:
-    # -rlpD: recurse, symlinks, perms (so the FIFO perm-diff triggers
-    # replacement), specials/devices.  --debug=backup so the per-type
-    # "make_backup: SYMLINK/DEVICE/COPY ... successful" lines fire too.
     r = subprocess.run(
         rsync_argv('-rlpD', '--debug=backup',
                    '--backup', f'--backup-dir={bak}',
@@ -81,7 +56,6 @@
         test_fail(f"--backup --backup-dir=<cross-dev> failed "
                   f"(rc={r.returncode}):\n{r.stderr}")
 
-    # Regular file: copy_file() fallback.
     breg = os.path.join(bak, 'reg')
     if not os.path.isfile(breg):
         test_fail(f"regular-file backup not created at {breg}")
@@ -89,7 +63,6 @@
         test_fail(f"regular-file backup has wrong content "
                   f"(expected dst's original 'gen1\\n', got {open(breg).read()!r})")
 
-    # Symlink: do_symlink_at() fallback.
     if have_lnk:
         blnk = os.path.join(bak, 'lnk')
         if not os.path.islink(blnk):
@@ -97,7 +70,6 @@
         if os.readlink(blnk) != 'target-gen1':
             test_fail(f"symlink backup target wrong: {os.readlink(blnk)!r} != 'target-gen1'")
 
-    # FIFO: do_mknod_at() fallback.
     if have_fifo:
         bfifo = os.path.join(bak, 'fifo')
         if not (os.path.exists(bfifo) and stat.S_ISFIFO(os.lstat(bfifo).st_mode)):
diff --git a/testsuite/backup-deep_test.py b/testsuite/tests/transfer/backup-deep.py
similarity index 58%
rename from testsuite/backup-deep_test.py
rename to testsuite/tests/transfer/backup-deep.py
index f2f754c13..433ab56ef 100644
--- a/testsuite/backup-deep_test.py
+++ b/testsuite/tests/transfer/backup-deep.py
@@ -1,36 +1,17 @@
 #!/usr/bin/env python3
-"""Property-level coverage of --backup / --suffix / --backup-dir at depth.
-
-backup_test.py is the ported regression test (2 levels, no custom suffix); this
-companion checks the concrete outcome of each backup mode at >=3 levels and,
-for --backup-dir, with the backup tree placed OUTSIDE the destination (a
-sibling) so the old file is renamed across directories into a parallel deep
-path -- the cross-directory operation the resolver restructure rewrites.
-
-Asserts, at every level of the tree:
-  * --backup --suffix=S  saves the overwritten file as <name>S beside the new
-    one (old content in the backup, new content in place);
-  * --backup --backup-dir=DIR  relocates the old file to DIR/<relpath>,
-    preserving the deep structure, while the destination gets the new content;
-  * --backup-dir together with --delete  routes a deletion into the backup
-    tree instead of losing it.
-"""
 
 import os
 
-from rsyncfns import (
+from harness.rsync import (
     FROMDIR, SCRATCHDIR, TODIR,
     assert_not_exists, assert_same, make_tree, rmtree, run_rsync, test_fail,
     walk_files,
 )
 
 src = FROMDIR
-bak = SCRATCHDIR / 'backups'   # sibling of from/ and to/ -- outside both trees
-
+bak = SCRATCHDIR / 'backups'
 
 def seed():
-    """Fresh v1 source, a matching destination, and the old (v1) bytes; then
-    mutate the source to v2 so the next sync overwrites every file."""
     rmtree(src)
     rmtree(TODIR)
     rmtree(bak)
@@ -38,13 +19,11 @@ def seed():
     rels = [p.relative_to(src) for p in walk_files(src)]
     run_rsync('-a', f'{src}/', f'{TODIR}/')
     old = {rel: (src / rel).read_bytes() for rel in rels}
-    for rel in rels:                       # v1 -> v2
+    for rel in rels:
         with open(src / rel, 'ab') as f:
             f.write(b'\nversion-2 tail\n')
     return rels, old
 
-
-# --- --backup --suffix=.old (same directory) --------------------------------
 rels, old = seed()
 run_rsync('-a', '-b', '--suffix=.old', '--no-whole-file',
           f'{src}/', f'{TODIR}/')
@@ -57,7 +36,6 @@ def seed():
     if backup.read_bytes() != old[rel]:
         test_fail(f"--suffix backup of {rel} does not hold the old content")
 
-# --- --backup-dir at depth, outside the dest tree (cross-dir) ---------------
 rels, old = seed()
 run_rsync('-a', '-b', f'--backup-dir={bak}', '--no-whole-file',
           f'{src}/', f'{TODIR}/')
@@ -69,9 +47,7 @@ def seed():
     if saved.read_bytes() != old[rel]:
         test_fail(f"--backup-dir copy of {rel} does not hold the old content")
 
-# --- --backup-dir captures a deletion under --delete ------------------------
 rels, old = seed()
-# Add a deep file to the destination that is absent from the source.
 extra = os.path.join('d1', 'd2', 'd3', 'goner')
 (TODIR / extra).write_bytes(b'about to be deleted\n')
 run_rsync('-a', '--delete', '-b', f'--backup-dir={bak}', '--no-whole-file',
diff --git a/testsuite/backup-incremental_test.py b/testsuite/tests/transfer/backup-incremental.py
similarity index 59%
rename from testsuite/backup-incremental_test.py
rename to testsuite/tests/transfer/backup-incremental.py
index d8516ca40..d43eece00 100644
--- a/testsuite/backup-incremental_test.py
+++ b/testsuite/tests/transfer/backup-incremental.py
@@ -1,16 +1,8 @@
 #!/usr/bin/env python3
-# Normal-operation test for --backup / --backup-dir, modelling the maintainer's
-# long-standing incremental rsync backup script.  Each run mirrors SRC -> MIRROR
-# with  -a --sparse --exclude-from=FILE --delete --delete-excluded  and
-# --backup --backup-dir=IDIR, where IDIR is a rotating incremental dir (wiped at
-# the start of each run; two slots).  Effect: the mirror is brought back in sync
-# with the source, and every file about to be overwritten or deleted (including
-# by --delete-excluded) is first relocated into that run's IDIR at its relative
-# path.  Local transfer, runs unprivileged.
 
 import os
 
-from rsyncfns import (
+from harness.rsync import (
     SCRATCHDIR, assert_not_exists, assert_trees_equal, make_data_file,
     make_text_file, makepath, rmtree, run_rsync, test_fail,
 )
@@ -19,24 +11,21 @@
 rmtree(base)
 base.mkdir()
 
-src = base / 'src'                                  # the "home server" data
-backup_root = base / 'backup'                       # BACKUP_DIR
-mirror = backup_root / 'home'                       # BACKUP_DIR/$name
-incr = backup_root / 'incremental' / 'home'         # BACKUP_DIR/incremental/$name
-idir0 = incr / '0'                                  # the two rotating slots
+src = base / 'src'
+backup_root = base / 'backup'
+mirror = backup_root / 'home'
+incr = backup_root / 'incremental' / 'home'
+idir0 = incr / '0'
 idir1 = incr / '1'
 exclude_file = base / 'backup_excludes'
 exclude_file.write_text("*.tmp\n")
 
-
 def make_sparse(path, size=128 * 1024):
-    """A sparse file: a head, a hole, then a tail."""
     with open(path, 'wb') as f:
         f.write(b'SPARSE-HEAD\n')
         f.seek(size - 4)
         f.write(b'END\n')
 
-
 def build_src():
     rmtree(src)
     makepath(src / 'sub')
@@ -47,23 +36,18 @@ def build_src():
     os.symlink('file_a', src / 'link')
     make_sparse(src / 'sparse')
 
-
 def is_empty(d):
     return not any(d.iterdir())
 
-
 def backup_run(idir):
-    """One incremental backup, mirroring the script's backup_one()."""
-    rmtree(idir)            # script: rm -rf $IDIR
-    makepath(idir)          # script: mkdir -p $IDIR
-    makepath(mirror)        # script: mkdir -p $BACKUP_DIR/$name
+    rmtree(idir)
+    makepath(idir)
+    makepath(mirror)
     run_rsync('-a', '--sparse', f'--exclude-from={exclude_file}',
               '--delete', '--delete-excluded',
               '--backup', f'--backup-dir={idir}',
               f'{src}/', f'{mirror}/')
 
-
-# --- Phase 1: initial full backup into slot 0 -------------------------------
 build_src()
 backup_run(idir0)
 assert_trees_equal(src, mirror, label='phase1 mirror')
@@ -72,17 +56,14 @@ def backup_run(idir):
               f"(nothing should have been backed up): "
               f"{[p.name for p in idir0.iterdir()]}")
 
-# --- Phase 2: mutate the source, second backup into slot 1 ------------------
-# Capture the about-to-change mirror contents (what --backup must preserve).
 old_b = (mirror / 'file_b').read_bytes()
 old_c = (mirror / 'sub' / 'file_c').read_bytes()
 
-make_data_file(src / 'file_b', 9000)            # overwrite (content changes)
-(src / 'sub' / 'file_c').unlink()               # delete from source -> --delete
-make_text_file(src / 'newfile', lines=10)       # brand-new file
-# file_a is left unchanged on purpose.
+make_data_file(src / 'file_b', 9000)
+(src / 'sub' / 'file_c').unlink()
+make_text_file(src / 'newfile', lines=10)
 stale = b"STALE-EXCLUDED-CONTENT\n"
-(mirror / 'stale.tmp').write_bytes(stale)       # excluded file already in mirror
+(mirror / 'stale.tmp').write_bytes(stale)
 
 backup_run(idir1)
 
@@ -103,7 +84,6 @@ def backup_run(idir):
     test_fail(f"phase2: the previous slot {idir0} was disturbed by this run "
               "(each run's backup dir must be independent)")
 
-# --- Phase 3: no-op third run, rotating back to slot 0 ----------------------
 backup_run(idir0)
 assert_trees_equal(src, mirror, label='phase3 mirror')
 if not is_empty(idir0):
diff --git a/testsuite/backup_test.py b/testsuite/tests/transfer/backup.py
similarity index 72%
rename from testsuite/backup_test.py
rename to testsuite/tests/transfer/backup.py
index eb2e3c58f..5acd4eb56 100644
--- a/testsuite/backup_test.py
+++ b/testsuite/tests/transfer/backup.py
@@ -1,55 +1,35 @@
 #!/usr/bin/env python3
-# Python rewrite of testsuite/backup.test.
-#
-# Walk through --backup behaviour:
-#   * a plain backup leaves the old file at name~ alongside the new one,
-#   * --backup-dir relocates the old file into a parallel tree and also
-#     captures deletions when used with --delete-delay,
-#   * --backup --inplace --backup-dir handles delta-overwrites too.
-# Each phase also confirms the destination ends up matching the source via
-# the usual checkit listing+content diff.
-
-import os
+
+import re
 import shutil
 import subprocess
 
-from rsyncfns import (
+from harness.rsync import (
     CHKDIR, FROMDIR, OUTFILE, SRCDIR, TMPDIR, TODIR,
     checkit, cp_touch, makepath, rsync_argv, test_fail, verify_dirs,
 )
 
-
 bakdir = TMPDIR / 'bak'
 
 makepath(FROMDIR / 'deep', bakdir / 'dname')
 name1 = FROMDIR / 'deep' / 'name1'
 name2 = FROMDIR / 'deep' / 'name2'
 
-
 def _cat_glob(pattern: str, dest):
-    """Concatenate every srcdir file matching `pattern` into `dest`.
-
-    Mirrors `cat "$srcdir"/[abc]*.[ch] > "$dest"`.
-    """
     chunks = bytearray()
     for f in sorted(SRCDIR.glob(pattern)):
         chunks.extend(f.read_bytes())
     dest.write_bytes(bytes(chunks))
 
-
 _cat_glob('[gr]*.[ch]', name1)
 _cat_glob('[et]*.[ch]', name2)
 
-# Establish baseline destination and chk copies of the source.
 checkit(['-ai', '--info=backup', f'{FROMDIR}/', f'{TODIR}/'], FROMDIR, TODIR)
 checkit(['-ai', '--info=backup', f'{FROMDIR}/', f'{CHKDIR}/'], FROMDIR, CHKDIR)
 
-# Mutate the source files; delta-transfer will need to back up the old
-# contents at $todir/$fn~ before overwriting in place.
 _cat_glob('[fgpr]*.[ch]', name1)
 _cat_glob('[etw]*.[ch]', name2)
 
-
 def _run_and_capture(args, outfile):
     proc = subprocess.run(rsync_argv(*args), capture_output=True, text=True)
     outfile.write_text(proc.stdout)
@@ -58,7 +38,6 @@ def _run_and_capture(args, outfile):
         test_fail(f"rsync exited {proc.returncode}")
     return proc
 
-
 _run_and_capture(
     ['-ai', '--info=backup', '--no-whole-file', '--backup',
      f'{FROMDIR}/', f'{TODIR}/'],
@@ -76,9 +55,6 @@ def _run_and_capture(args, outfile):
         test_fail(f"backup of {fn} to {fn}~ failed")
     shutil.move(str(TODIR / f'{fn}~'), str(TODIR / fn))
 
-
-# --backup-dir + --delete-delay: a deletion at the dest gets routed into
-# the backup dir rather than being lost.
 (TODIR / 'dname').write_text("deleted-file\n")
 cp_touch(TODIR / 'dname', CHKDIR)
 
@@ -88,13 +64,9 @@ def _run_and_capture(args, outfile):
      f'{FROMDIR}/', f'{TODIR}/'],
     OUTFILE,
 )
-# After the run, FROMDIR and TODIR should match (the backup ran into
-# bakdir, not into chkdir, so chkdir must NOT be touched -- it still
-# holds the pre-rsync contents that we'll compare against bakdir below).
 verify_dirs(FROMDIR, TODIR, label="post --backup-dir run")
 
 text = OUTFILE.read_text()
-import re
 for fn in ('deep/name1', 'deep/name2'):
     if not re.search(rf"backed up {re.escape(fn)} to .*/{re.escape(fn)}$",
                      text, flags=re.MULTILINE):
@@ -104,8 +76,6 @@ def _run_and_capture(args, outfile):
     test_fail("backup dir contents are bogus")
 (bakdir / 'dname').unlink()
 
-
-# Re-establish chk and mutate source again for the --inplace pass.
 checkit(['-ai', '--info=backup', '--del', f'{FROMDIR}/', f'{CHKDIR}/'],
         FROMDIR, CHKDIR)
 _cat_glob('[efgr]*.[ch]', name1)
@@ -128,6 +98,5 @@ def _run_and_capture(args, outfile):
 if diff.returncode != 0:
     test_fail("backup dir contents are bogus")
 
-# Final clean inplace sync to the bakdir so it ends up matching fromdir.
 checkit(['-ai', '--info=backup', '--inplace', '--no-whole-file',
          f'{FROMDIR}/', f'{bakdir}/'], FROMDIR, bakdir)
diff --git a/testsuite/hands_test.py b/testsuite/tests/transfer/basic-transfer.py
similarity index 51%
rename from testsuite/hands_test.py
rename to testsuite/tests/transfer/basic-transfer.py
index b693cb0a7..59a410570 100644
--- a/testsuite/hands_test.py
+++ b/testsuite/tests/transfer/basic-transfer.py
@@ -1,54 +1,34 @@
 #!/usr/bin/env python3
-# Python rewrite of testsuite/hands.test.
-#
-# The canonical end-to-end transfer test: build a richly-populated source
-# tree via hands_setup() then run a series of rsync invocations covering
-# basic operation, hard links, single-file copies, --no-whole-file delta
-# updates and --delete cleanup. After each run the source and destination
-# tree listings must match exactly.
 
 import os
 import shutil
 
-from rsyncfns import FROMDIR, TMPDIR, TODIR, checkit, hands_setup, run_rsync
-
+from harness.rsync import FROMDIR, TMPDIR, TODIR, checkit, hands_setup, run_rsync
 
 hands_setup()
 
 DEBUG_OPTS = "--debug=all0,deltasum0"
 
-
-# 1. basic operation
 print("Test basic operation:")
 checkit(['-av', f'{FROMDIR}/', str(TODIR)], FROMDIR, TODIR)
 
-# 2. hard links — link filelist into dir/ then transfer with -H so the
-# receiver should recreate the link relationship.
 os.link(FROMDIR / 'filelist', FROMDIR / 'dir' / 'filelist')
 print("Test hard links:")
 checkit(['-avH', '--bwlimit=0', DEBUG_OPTS, f'{FROMDIR}/', str(TODIR)], FROMDIR, TODIR)
 
-# 3. one file — delete the destination 'text' and re-sync; only it should
-# transfer, everything else stays uptodate.
 (TODIR / 'text').unlink()
 print("Test one file:")
 checkit(['-avH', DEBUG_OPTS, f'{FROMDIR}/', str(TODIR)], FROMDIR, TODIR)
 
-# 4. extra data — append to destination then re-sync with --no-whole-file so
-# the rsync delta algorithm has to repair it.
 with open(TODIR / 'text', 'a') as f:
     f.write("extra line\n")
 print("Test extra data:")
 checkit(['-avH', DEBUG_OPTS, '--no-whole-file', f'{FROMDIR}/', str(TODIR)], FROMDIR, TODIR)
 
-# 5. --delete — add a stray file on the destination and confirm --delete
-# removes it.
 shutil.copy(FROMDIR / 'text', TODIR / 'ThisShouldGo')
 print("Test --delete:")
 checkit(['--delete', '-avH', DEBUG_OPTS, f'{FROMDIR}/', str(TODIR)], FROMDIR, TODIR)
 
-# 6. globbed copy without recursion — wipe and re-sync top-level entries by
-# glob, then a final empty pass to compare listings.
 os.chdir(TMPDIR)
 shutil.rmtree('to', ignore_errors=True)
 for entry in TMPDIR.glob('from/*dir'):
@@ -57,7 +37,6 @@
     else:
         entry.unlink()
 
-# Replicate `rsync -av from/* to/` — list the from/ children explicitly.
 sources = sorted(str(p) for p in (TMPDIR / 'from').iterdir())
 run_rsync('-av', *sources, 'to/')
 checkit(['-av', '--exclude=*', 'from/', 'to/'], FROMDIR, TODIR)
diff --git a/testsuite/batch-mode_test.py b/testsuite/tests/transfer/batch-mode.py
similarity index 67%
rename from testsuite/batch-mode_test.py
rename to testsuite/tests/transfer/batch-mode.py
index 3c1a68271..2ad0165e4 100644
--- a/testsuite/batch-mode_test.py
+++ b/testsuite/tests/transfer/batch-mode.py
@@ -1,19 +1,16 @@
 #!/usr/bin/env python3
-# Python rewrite of testsuite/batch-mode.test.
-#
-# Test rsync's --write-batch / --read-batch / --only-write-batch flags,
-# both for local transfers and for daemon source/destination.
 
 import os
-import shutil
 import subprocess
 
-from rsyncfns import (
+from harness.rsync import (
     CHKDIR, FROMDIR, SCRATCHDIR, TMPDIR, TODIR,
     build_rsyncd_conf, checkit, hands_setup, rmtree,
-    run_rsync, start_test_daemon, test_fail,
+    rsync_argv, run_rsync, start_test_daemon, test_fail, verify_dirs,
 )
+from harness import metadata
 
+metadata(features={'batch', 'daemon'}, transports={'pipe', 'tcp'}, min_peer='2.6.0', mutates={'filesystem', 'process', 'socket'}, tags={'compatibility', 'daemon', 'transfer', 'version-mix'})
 
 DAEMON_PORT = 12874
 
@@ -22,10 +19,8 @@
 
 os.chdir(TMPDIR)
 
-# chkdir mirrors a normal transfer minus the daemon's foobar.baz exclude.
 run_rsync('-av', '--exclude=foobar.baz', f'{FROMDIR}/', f'{CHKDIR}/')
 
-# --only-write-batch must NOT create the destination directory.
 run_rsync('-av', '--only-write-batch=BATCH', '--exclude=foobar.baz',
           f'{FROMDIR}/', f'{TODIR}/missing/')
 if (TODIR / 'missing').is_dir():
@@ -34,7 +29,6 @@
 print("Test --read-batch (only):")
 checkit(['-av', '--read-batch=BATCH', str(TODIR)], CHKDIR, TODIR)
 
-# Wipe any leftover BATCH* files so the next pass starts clean.
 rmtree(TODIR)
 for batch in TMPDIR.glob('BATCH*'):
     batch.unlink()
@@ -46,8 +40,6 @@
 print("Test --read-batch:")
 checkit(['-av', '--read-batch=BATCH', str(TODIR)], FROMDIR, TODIR)
 
-# Daemon variants: pipe transport by default, real loopback rsyncd under
-# --use-tcp.
 url = start_test_daemon(conf, DAEMON_PORT)
 
 rmtree(TODIR)
@@ -62,9 +54,6 @@
 
 rmtree(TODIR)
 print("Test BATCH.sh use of --read-batch:")
-# BATCH.sh is the auto-generated wrapper script that re-applies the
-# batch -- we run it directly, not via the rsync binary, then verify.
-from rsyncfns import verify_dirs
 proc = subprocess.run(['sh', './BATCH.sh'])
 if proc.returncode != 0:
     test_fail(f"BATCH.sh exited {proc.returncode}")
@@ -79,13 +68,7 @@
 rmtree(TODIR)
 TODIR.mkdir()
 print("Test daemon recv --write-batch:")
-# ignore23 swallows the partial-transfer code 23 that daemon mode sometimes
-# emits even on success.
 ignore23 = SCRATCHDIR / 'ignore23'
-# We pass ignore23 by inserting it ahead of the rsync invocation. checkit
-# calls subprocess.run(rsync_argv(...)) directly, so do the run manually
-# and call verify_dirs for the comparison.
-from rsyncfns import rsync_argv
 proc = subprocess.run(
     [str(ignore23), *rsync_argv('-av', '--write-batch=BATCH',
                                  f'{FROMDIR}/', f'{url}test-to')],
diff --git a/testsuite/batch-only-remove-source-regression_test.py b/testsuite/tests/transfer/batch-only-remove-source.py
similarity index 91%
rename from testsuite/batch-only-remove-source-regression_test.py
rename to testsuite/tests/transfer/batch-only-remove-source.py
index f5868adb3..0b788d5dd 100644
--- a/testsuite/batch-only-remove-source-regression_test.py
+++ b/testsuite/tests/transfer/batch-only-remove-source.py
@@ -1,13 +1,11 @@
 #!/usr/bin/env python3
-"""A batch-only run must not remove a source it has not installed."""
 
 import os
 import subprocess
 
-from rsyncfns import SCRATCHDIR, makepath, rmtree, rsync_argv, test_fail
+from harness.rsync import SCRATCHDIR, makepath, rmtree, rsync_argv, test_fail
 
-
-base = SCRATCHDIR / 'batch-only-remove-source-regression'
+base = SCRATCHDIR / 'batch-only-remove-source'
 source = base / 'source'
 destination = base / 'destination'
 rmtree(base)
@@ -70,4 +68,4 @@
 if source_file.read_bytes() != source_bytes:
     test_fail('batch replay changed or removed the source')
 
-print('batch-only-remove-source-regression: source retained until batch replay')
+print('batch-only-remove-source: source retained until batch replay')
diff --git a/testsuite/change-shrink_test.py b/testsuite/tests/transfer/change-shrink.py
similarity index 52%
rename from testsuite/change-shrink_test.py
rename to testsuite/tests/transfer/change-shrink.py
index d48f65dd6..b3c46c732 100644
--- a/testsuite/change-shrink_test.py
+++ b/testsuite/tests/transfer/change-shrink.py
@@ -1,36 +1,23 @@
 #!/usr/bin/env python3
-# Change-while-transferring: a source file that SHRINKS between flist-scan and
-# send.  The flist records the large size; the sender re-stats and maps the
-# smaller current size (sender.c do_fstat/map_file/match_sums), so it sends
-# fewer bytes than F_LENGTH.  rsync must not abort the whole transfer; the
-# destination file should end up as the (shorter) content actually sent, and
-# later files must still transfer.
-#
-# See mutatefns.py for the pacer/bwlimit reproduction.
 
 import os
 
-from mutatefns import TARGET, assert_no_protocol_abort, run_mutating_transfer
-from rsyncfns import test_fail
+from harness.mutation import TARGET, assert_no_protocol_abort, run_mutating_transfer
+from harness.rsync import test_fail
 
 BIG = 512 * 1024
 SMALL = 4 * 1024
 
-
 def setup(src):
-    # Recorded in the flist at the large size.
     with open(src / TARGET, 'wb') as fh:
         fh.write(os.urandom(BIG))
 
-
 def mutate(src):
-    # Truncate to a much smaller size during the pacer's transfer.
     with open(src / TARGET, 'r+b') as fh:
         fh.truncate(SMALL)
         fh.flush()
         os.fsync(fh.fileno())
 
-
 proc, src, dst = run_mutating_transfer(setup, mutate)
 assert_no_protocol_abort(proc)
 
@@ -38,11 +25,9 @@ def mutate(src):
 if src_size != SMALL:
     test_fail(f"test setup: source did not shrink (size {src_size})")
 
-# The later files (the pacer) must have transferred despite the shrink.
 if not (dst / 'aaa_pacer').is_file():
     test_fail("the pacer file was not transferred after the shrink")
 
-# If the shrunk target was transferred, it must match the current source.
 if (dst / TARGET).is_file():
     if (dst / TARGET).stat().st_size > BIG:
         test_fail("destination is larger than the original flist size")
diff --git a/testsuite/change-vanish_test.py b/testsuite/tests/transfer/change-vanish.py
similarity index 51%
rename from testsuite/change-vanish_test.py
rename to testsuite/tests/transfer/change-vanish.py
index 45fb53705..6b22b6d75 100644
--- a/testsuite/change-vanish_test.py
+++ b/testsuite/tests/transfer/change-vanish.py
@@ -1,34 +1,23 @@
 #!/usr/bin/env python3
-# Change-while-transferring: a source file that is DELETED between flist-scan
-# and send.  rsync's documented behaviour is to warn ("file has vanished") and
-# continue (exit 24), not to abort the whole run.  This guards that a vanished
-# file during a mid-transfer window is still handled gracefully and later files
-# transfer.
-#
-# See mutatefns.py for the pacer/bwlimit reproduction.
 
 import os
 
-from mutatefns import TARGET, assert_no_protocol_abort, run_mutating_transfer
-from rsyncfns import test_fail
-
+from harness.mutation import TARGET, assert_no_protocol_abort, run_mutating_transfer
+from harness.rsync import test_fail
 
 def setup(src):
     with open(src / TARGET, 'wb') as fh:
         fh.write(os.urandom(256 * 1024))
 
-
 def mutate(src):
     os.unlink(src / TARGET)
 
-
 proc, src, dst = run_mutating_transfer(setup, mutate)
 assert_no_protocol_abort(proc)
 
 if (src / TARGET).exists():
     test_fail("test setup: source file did not vanish")
 
-# The pacer (transferred before the vanish) and any earlier files must survive.
 if not (dst / 'aaa_pacer').is_file():
     test_fail("the pacer file was not transferred after the vanish")
 
diff --git a/testsuite/compare_test.py b/testsuite/tests/transfer/comparison-options.py
similarity index 56%
rename from testsuite/compare_test.py
rename to testsuite/tests/transfer/comparison-options.py
index 8279c9ff4..60a057282 100644
--- a/testsuite/compare_test.py
+++ b/testsuite/tests/transfer/comparison-options.py
@@ -1,15 +1,8 @@
 #!/usr/bin/env python3
-"""Coverage of the comparison/skip options at depth: -c, -I, --size-only,
---modify-window.
-
-These decide WHETHER a file is transferred. Each is checked on a file several
-levels deep using a "stealth change" (same size, same mtime, different content)
-that the default quick check deliberately skips.
-"""
 
 import os
 
-from rsyncfns import (
+from harness.rsync import (
     FROMDIR, TODIR,
     assert_same, make_tree, rmtree, run_rsync, test_fail,
 )
@@ -17,25 +10,19 @@
 src = FROMDIR
 deep = os.path.join('d1', 'd2', 'd3', 'f3')
 
-
 def seed():
     rmtree(src)
     rmtree(TODIR)
     make_tree(src, depth=3, data=True, data_size=4096)
-    run_rsync('-a', f'{src}/', f'{TODIR}/')          # dest == src
-
+    run_rsync('-a', f'{src}/', f'{TODIR}/')
 
 def stealth_change():
-    """Change the deep source file's content but restore the destination's
-    size+mtime, so the quick check sees them as equal."""
     st = os.stat(TODIR / deep)
     data = bytearray((src / deep).read_bytes())
-    data[0] ^= 0xFF                                   # same length, new content
+    data[0] ^= 0xFF
     (src / deep).write_bytes(bytes(data))
     os.utime(src / deep, (st.st_atime, st.st_mtime))
 
-
-# --- the default quick check skips a stealth change; -c and -I catch it ------
 seed()
 stealth_change()
 run_rsync('-a', f'{src}/', f'{TODIR}/')
@@ -51,14 +38,12 @@ def stealth_change():
 run_rsync('-a', '-I', f'{src}/', f'{TODIR}/')
 assert_same(TODIR / deep, src / deep, label='-I caught stealth change')
 
-# --- --size-only skips a same-size change even when the mtime differs --------
 def samesize_newmtime():
     data = bytearray((src / deep).read_bytes())
-    data[0] ^= 0xFF                                  # same size, new content
+    data[0] ^= 0xFF
     (src / deep).write_bytes(bytes(data))
     st = os.stat(src / deep)
-    os.utime(src / deep, (st.st_atime, st.st_mtime + 100))   # mtime differs
-
+    os.utime(src / deep, (st.st_atime, st.st_mtime + 100))
 
 seed()
 samesize_newmtime()
@@ -66,19 +51,14 @@ def samesize_newmtime():
 if (TODIR / deep).read_bytes() == (src / deep).read_bytes():
     test_fail("--size-only transferred a same-size file (should have skipped)")
 
-# Contrast on a fresh tree: the default DOES transfer it (mtime differs).
-# (Re-seed because --size-only above updated the dest mtime to match.)
 seed()
 samesize_newmtime()
 run_rsync('-a', f'{src}/', f'{TODIR}/')
 assert_same(TODIR / deep, src / deep, label='default caught mtime change')
 
-# --- --modify-window absorbs a small mtime difference -----------------------
-# Both runs are dry-run (-ain): a real run would update the dest mtime to match
-# the source, leaving the --modify-window run nothing to absorb (vacuous).
 seed()
 st = os.stat(TODIR / deep)
-os.utime(src / deep, (st.st_atime, st.st_mtime + 1))  # 1s newer, same content
+os.utime(src / deep, (st.st_atime, st.st_mtime + 1))
 p = run_rsync('-ain', f'{src}/', f'{TODIR}/', capture_output=True)
 if 'f3' not in p.stdout:
     test_fail("a 1s mtime change was not itemized without --modify-window")
@@ -87,4 +67,4 @@ def samesize_newmtime():
 if 'f3' in p.stdout:
     test_fail("--modify-window=2 did not absorb a 1s mtime difference")
 
-print("compare: -c / -I / --size-only / --modify-window verified at depth")
+print("comparison options verified at depth")
diff --git a/testsuite/compress-options_test.py b/testsuite/tests/transfer/compress-options.py
similarity index 64%
rename from testsuite/compress-options_test.py
rename to testsuite/tests/transfer/compress-options.py
index eabbfc4f7..32d31408b 100644
--- a/testsuite/compress-options_test.py
+++ b/testsuite/tests/transfer/compress-options.py
@@ -1,17 +1,9 @@
 #!/usr/bin/env python3
-"""Breadth coverage of the algorithm-selection options at depth:
---compress-choice / --compress-level / --skip-compress and
---checksum-choice / --checksum-seed.
-
-Compression and checksum choice don't change the result, so each available
-algorithm is exercised for a clean, byte-identical transfer of a >=3-deep tree
-(proving the option parses, negotiates and doesn't corrupt data).
-"""
 
 import json
 import re
 
-from rsyncfns import (
+from harness.rsync import (
     FROMDIR, TODIR,
     assert_same, make_tree, rmtree, run_rsync, test_fail, walk_files,
 )
@@ -21,23 +13,16 @@
 compressors = [a for a in vv.get('compress_list', []) if a != 'none']
 checksums = [a for a in vv.get('checksum_list', []) if a != 'none']
 
-
 def fresh():
     rmtree(src)
     rmtree(TODIR)
     make_tree(src, depth=3, data=True, data_size=4096)
     return [p.relative_to(src) for p in walk_files(src)]
 
-
 def verify(rels, label):
     for rel in rels:
         assert_same(TODIR / rel, src / rel, label=f'{label} {rel}')
 
-
-# --- --compress-choice for every advertised compressor ----------------------
-# Byte-identical output alone proves only that the option didn't corrupt data;
-# assert via --debug=NSTR (compat.c) that the requested compressor was actually
-# selected for the transfer. The trailing " (level" anchors so zlib != zlibx.
 for algo in compressors:
     rels = fresh()
     proc = run_rsync('-az', f'--compress-choice={algo}', '--debug=NSTR',
@@ -47,11 +32,7 @@ def verify(rels, label):
                   f"--debug=NSTR output:\n{proc.stdout}")
     verify(rels, f'--compress-choice={algo}')
 
-# --- --compress-level (the requested level reaches the compressor) ----------
 rels = fresh()
-# The default compressor can be lz4, which has no tunable levels and reports
-# level 0; pick a level-aware compressor so this verifies --compress-level reaches
-# a compressor that supports it.
 level_algo = next((a for a in ('zlibx', 'zlib') if a in compressors), None)
 level_args = [f'--compress-choice={level_algo}'] if level_algo else []
 proc = run_rsync('-az', *level_args, '--compress-level=9', '--debug=NSTR',
@@ -61,16 +42,12 @@ def verify(rels, label):
               f"--debug=NSTR output:\n{proc.stdout}")
 verify(rels, '--compress-level=9')
 
-# --- --skip-compress (the file must still arrive intact) --------------------
 rels = fresh()
 (src / 'd1' / 'd2' / 'x.gz').write_bytes(b'\x1f\x8b' + b'pseudo gzip body ' * 64)
 run_rsync('-az', '--skip-compress=gz', f'{src}/', f'{TODIR}/')
 assert_same(TODIR / 'd1' / 'd2' / 'x.gz', src / 'd1' / 'd2' / 'x.gz',
             label='--skip-compress gz')
 
-# --- --checksum-choice for every advertised checksum ------------------------
-# As above: assert via --debug=NSTR (checksum.c) that the requested checksum was
-# the one negotiated, not merely that the transfer succeeded.
 for algo in checksums:
     rels = fresh()
     proc = run_rsync('-a', '-c', f'--checksum-choice={algo}', '--debug=NSTR',
@@ -80,7 +57,6 @@ def verify(rels, label):
                   f"--debug=NSTR output:\n{proc.stdout}")
     verify(rels, f'--checksum-choice={algo}')
 
-# --- --checksum-seed --------------------------------------------------------
 rels = fresh()
 run_rsync('-a', '-c', '--checksum-seed=12345', f'{src}/', f'{TODIR}/')
 verify(rels, '--checksum-seed')
diff --git a/testsuite/tests/transfer/compress-zlib-insert.py b/testsuite/tests/transfer/compress-zlib-insert.py
new file mode 100644
index 000000000..c2783c135
--- /dev/null
+++ b/testsuite/tests/transfer/compress-zlib-insert.py
@@ -0,0 +1,42 @@
+#!/usr/bin/env python3
+
+import filecmp
+import shutil
+import subprocess
+
+from harness.rsync import (
+    SCRATCHDIR, make_data_file, makepath, rmtree, rsync_argv,
+    start_test_daemon, test_fail, write_daemon_conf,
+)
+
+DAEMON_PORT = 12922
+SIZE = 8 * 1024 * 1024
+BLOCK = 65535
+
+moddir = SCRATCHDIR / 'zmod'
+srcdir = SCRATCHDIR / 'zsrc'
+rmtree(moddir)
+rmtree(srcdir)
+makepath(moddir)
+makepath(srcdir)
+
+make_data_file(srcdir / 'big.dat', SIZE)
+shutil.copy(srcdir / 'big.dat', moddir / 'big.dat')
+with open(srcdir / 'big.dat', 'r+b') as f:
+    f.seek(SIZE // 2 + 1000)
+    f.write(b'\x00' * 32)
+
+conf = write_daemon_conf([('zmod', {'path': str(moddir), 'read only': 'no'})])
+url = start_test_daemon(conf, DAEMON_PORT) + 'zmod/'
+
+proc = subprocess.run(
+    rsync_argv('-zI', '--compress-choice=zlib', '--no-whole-file',
+               f'--block-size={BLOCK}', str(srcdir / 'big.dat'), url),
+    stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True)
+if proc.returncode != 0:
+    print(proc.stdout)
+    test_fail(f"zlib delta upload failed (rc={proc.returncode}); "
+              "regression of #951 deflate-token overflow")
+
+if not filecmp.cmp(srcdir / 'big.dat', moddir / 'big.dat', shallow=False):
+    test_fail("uploaded file differs from source -- zlib delta corruption")
diff --git a/testsuite/contimeout-rsh_test.py b/testsuite/tests/transfer/contimeout-rsh.py
similarity index 54%
rename from testsuite/contimeout-rsh_test.py
rename to testsuite/tests/transfer/contimeout-rsh.py
index 19006806a..69a663c2d 100644
--- a/testsuite/contimeout-rsh_test.py
+++ b/testsuite/tests/transfer/contimeout-rsh.py
@@ -1,17 +1,9 @@
 #!/usr/bin/env python3
-# --contimeout is documented as a "daemon connection timeout".  The guard that
-# rejects it only looked at whether connect_timeout was set, so a daemon
-# connection made through a remote shell (e.g. rsync-ssl, which runs rsync with
-# --rsh pointing at its helper) was rejected with the same syntax error as a
-# plain non-daemon remote-shell transfer.  Only reject the option when there is
-# no daemon connection at all: a daemon reached via --rsh (daemon_connection ==
-# 1) is still a daemon connection, and rsync now also times that connection's
-# establishment phase with --contimeout the same way it times a socket connect.
 
 import subprocess
 import time
 
-from rsyncfns import SCRATCHDIR, SRCDIR, rsync_argv, rmtree, test_fail
+from harness.rsync import SCRATCHDIR, SRCDIR, rsync_argv, rmtree, test_fail
 
 RERR_CONTIMEOUT = 35
 
@@ -19,36 +11,24 @@
 rmtree(base)
 base.mkdir(parents=True)
 
-
 def run(*args):
     return subprocess.run(rsync_argv(*args), capture_output=True, text=True)
 
-
 rejected_marker = "may only be used when connecting to an rsync daemon"
 
-# A remote-shell command that fails immediately: the option guard runs before
-# rsync ever tries to exec it, so it only has to exist as a plausible --rsh
-# target to put rsync into its daemon-via-rsh connection mode.
 rsh_prog = str(SRCDIR / 'support' / 'lsh.sh')
 
-# --- Daemon via --rsh must accept --contimeout (rsync-ssl's shape of call).
 proc = run('--contimeout=5', '--rsh=' + rsh_prog,
            '-av', 'rsync://127.0.0.1:9/mod/', str(base / 'dest'))
 if rejected_marker in (proc.stderr or ''):
     test_fail(f"--contimeout was rejected for a daemon-via-rsh connection:\n{proc.stderr}")
 
-# --- A plain remote-shell (non-daemon) destination must still be rejected.
 proc = run('--contimeout=5', '-av', str(base / 'src'), 'localhost:' + str(base / 'dst'))
 if rejected_marker not in (proc.stderr or ''):
     test_fail("--contimeout was not rejected for a non-daemon remote shell:\n" +
               (proc.stderr or '') + (proc.stdout or ''))
 
-# --- A daemon-via-rsh connection that never establishes must time out with the
-# daemon-connection timeout exit code.  The fake helper sleeps instead of
-# connecting, so the only thing that can end the run is --contimeout firing.
 fake_rsh = base / 'hang-rsh'
-# The helper inherits rsync's stderr; redirect it so an orphaned "sleep" does
-# not keep the harness's captured-pipe open after rsync has already exited.
 fake_rsh.write_text("#!/bin/sh\nexec 2>/dev/null\nsleep 60\n")
 fake_rsh.chmod(0o755)
 
diff --git a/testsuite/tests/transfer/cvs-clear-list.py b/testsuite/tests/transfer/cvs-clear-list.py
new file mode 100644
index 000000000..38ac308fa
--- /dev/null
+++ b/testsuite/tests/transfer/cvs-clear-list.py
@@ -0,0 +1,23 @@
+#!/usr/bin/env python3
+
+from harness.rsync import (
+    FROMDIR, TODIR,
+    assert_exists, makepath, rmtree, run_rsync,
+)
+
+src = FROMDIR
+rmtree(src)
+rmtree(TODIR)
+makepath(src)
+
+(src / 'keep1.txt').write_text('one\n')
+(src / 'keep2.txt').write_text('two\n')
+
+(src / '.cvsignore').write_text('!\n')
+
+run_rsync('-a', '-C', f'{src}/', f'{TODIR}/')
+
+assert_exists(TODIR / 'keep1.txt', label='clear-list .cvsignore kept keep1')
+assert_exists(TODIR / 'keep2.txt', label='clear-list .cvsignore kept keep2')
+
+print("cvs-exclude .cvsignore '!' clear-list token no longer aborts")
diff --git a/testsuite/cvs-exclude_test.py b/testsuite/tests/transfer/cvs-exclude.py
similarity index 59%
rename from testsuite/cvs-exclude_test.py
rename to testsuite/tests/transfer/cvs-exclude.py
index 3416d5ce0..c372e20d9 100644
--- a/testsuite/cvs-exclude_test.py
+++ b/testsuite/tests/transfer/cvs-exclude.py
@@ -1,12 +1,6 @@
 #!/usr/bin/env python3
-"""Coverage of -C / --cvs-exclude at depth.
 
--C ignores the usual CVS cruft (object files, core, editor backups, VCS dirs,
-...) and also honours a per-directory .cvsignore. Verify both the built-in
-patterns and a deep .cvsignore on a >=3-level tree.
-"""
-
-from rsyncfns import (
+from harness.rsync import (
     FROMDIR, TODIR,
     assert_exists, assert_not_exists, makepath, rmtree, run_rsync,
 )
@@ -16,18 +10,16 @@
 rmtree(TODIR)
 makepath(src / 'd1' / 'd2' / 'd3')
 
-# A real file plus default-CVS-cruft at every level.
 cur = src
 for lvl in range(4):
     (cur / f'real{lvl}.c').write_text('code\n')
-    (cur / f'obj{lvl}.o').write_text('obj\n')        # *.o is built-in cruft
-    (cur / f'back{lvl}~').write_text('backup\n')     # *~ is built-in cruft
+    (cur / f'obj{lvl}.o').write_text('obj\n')
+    (cur / f'back{lvl}~').write_text('backup\n')
     cur = cur / f'd{lvl + 1}'
 
-# A per-directory .cvsignore deep in the tree adds "*.junk" for that subtree.
 (src / 'd1' / 'd2' / '.cvsignore').write_text('*.junk\n')
 (src / 'd1' / 'd2' / 'local.junk').write_text('j\n')
-(src / 'top.junk').write_text('j\n')                 # not covered by that .cvsignore
+(src / 'top.junk').write_text('j\n')
 
 run_rsync('-aC', f'{src}/', f'{TODIR}/')
 
@@ -38,7 +30,6 @@
     assert_not_exists(cur / f'back{lvl}~', label=f'-C dropped *~ L{lvl}')
     cur = cur / f'd{lvl + 1}'
 
-# .cvsignore is scoped to its directory subtree.
 assert_not_exists(TODIR / 'd1' / 'd2' / 'local.junk',
                   label='-C deep .cvsignore applied')
 assert_exists(TODIR / 'top.junk', label='-C deep .cvsignore not applied above')
diff --git a/testsuite/delay-updates-deep_test.py b/testsuite/tests/transfer/delay-updates-deep.py
similarity index 50%
rename from testsuite/delay-updates-deep_test.py
rename to testsuite/tests/transfer/delay-updates-deep.py
index bd359fcd7..6fcf0e726 100644
--- a/testsuite/delay-updates-deep_test.py
+++ b/testsuite/tests/transfer/delay-updates-deep.py
@@ -1,24 +1,8 @@
 #!/usr/bin/env python3
-"""Property-level coverage of --delay-updates at depth.
-
---delay-updates writes each updated file into a per-directory staging dir
-(.~tmp~) during the transfer and only renames them into place at the very end,
-so an interrupted run never leaves a half-written file visible. The staging dir
-sits inside each destination directory, so the staging write and the
-end-of-run rename are parent-directory operations the resolver restructure
-rewrites; the ported delay-updates_test.py only exercises the tree root, so
-this companion drives a >=3-deep tree.
-
-Asserts, at every level of the tree:
-  * a --delay-updates transfer reproduces the source and leaves no .~tmp~
-    staging directory behind;
-  * a stale file pre-planted in a deep .~tmp~ staging dir is overwritten
-    cleanly and the staging dir is removed.
-"""
 
 import os
 
-from rsyncfns import (
+from harness.rsync import (
     FROMDIR, TODIR,
     assert_same, make_tree, rmtree, run_rsync, test_fail, walk_dirs,
     walk_files,
@@ -27,14 +11,11 @@
 src = FROMDIR
 deepdir = os.path.join('d1', 'd2', 'd3')
 
-
 def no_staging_left():
     leftover = [p for p in walk_dirs(TODIR) if p.name == '.~tmp~']
     if leftover:
         test_fail(f"--delay-updates left staging dirs behind: {leftover}")
 
-
-# --- initial --delay-updates over a deep tree -------------------------------
 rmtree(src)
 rmtree(TODIR)
 make_tree(src, depth=3, data=True, data_size=4096)
@@ -45,14 +26,13 @@ def no_staging_left():
     assert_same(TODIR / rel, src / rel, label=f'delay-updates initial {rel}')
 no_staging_left()
 
-# --- update every file, with a stale staging file planted deep --------------
 for rel in rels:
     with open(src / rel, 'ab') as f:
         f.write(b'\nupdated content\n')
 
 stage = TODIR / deepdir / '.~tmp~'
 stage.mkdir(parents=True, exist_ok=True)
-(stage / 'f3').write_bytes(b'stale staged junk\n')   # must be overwritten
+(stage / 'f3').write_bytes(b'stale staged junk\n')
 
 run_rsync('-a', '--delay-updates', f'{src}/', f'{TODIR}/')
 for rel in rels:
diff --git a/testsuite/tests/transfer/delay-updates.py b/testsuite/tests/transfer/delay-updates.py
new file mode 100644
index 000000000..00fd51f2d
--- /dev/null
+++ b/testsuite/tests/transfer/delay-updates.py
@@ -0,0 +1,19 @@
+#!/usr/bin/env python3
+
+import os
+
+from harness.rsync import FROMDIR, TODIR, checkit
+
+FROMDIR.mkdir(parents=True, exist_ok=True)
+(FROMDIR / 'foo').write_text("1\n")
+
+checkit(['-aiv', '--delay-updates', f'{FROMDIR}/', f'{TODIR}/'], FROMDIR, TODIR)
+
+(TODIR / '.~tmp~').mkdir(exist_ok=True)
+(TODIR / '.~tmp~' / 'foo').write_text("2\n")
+stale = 1_000_000_000
+os.utime(TODIR / '.~tmp~' / 'foo', (stale, stale))
+os.utime(TODIR / 'foo', (stale, stale))
+(FROMDIR / 'foo').write_text("3\n")
+
+checkit(['-aiv', '--delay-updates', f'{FROMDIR}/', f'{TODIR}/'], FROMDIR, TODIR)
diff --git a/testsuite/delete-deep_test.py b/testsuite/tests/transfer/delete-deep.py
similarity index 65%
rename from testsuite/delete-deep_test.py
rename to testsuite/tests/transfer/delete-deep.py
index b8e015878..33cbfa052 100644
--- a/testsuite/delete-deep_test.py
+++ b/testsuite/tests/transfer/delete-deep.py
@@ -1,16 +1,6 @@
 #!/usr/bin/env python3
-"""Coverage of the --delete family at depth, plus --max-delete, --existing and
---ignore-existing.
 
-delete_test.py covers --del dry-run output, --remove-source-files and per-dir
-protect filters; this companion asserts the concrete outcome of deletion deep
-in the tree (the subtree walk the resolver restructure touches) and the
-controls that bound or invert it.
-"""
-
-import os
-
-from rsyncfns import (
+from harness.rsync import (
     FROMDIR, TODIR,
     assert_exists, assert_not_exists, assert_same, make_tree, makepath, rmtree,
     run_rsync, test_fail, walk_files,
@@ -18,19 +8,15 @@
 
 src = FROMDIR
 
-
 def seed_src():
     rmtree(src)
     make_tree(src, depth=3)
     return [p.relative_to(src) for p in walk_files(src)]
 
-
 def fresh_dest():
     rmtree(TODIR)
     run_rsync('-a', f'{src}/', f'{TODIR}/')
 
-
-# --- --delete removes a deep extraneous file and subtree --------------------
 rels = seed_src()
 fresh_dest()
 makepath(TODIR / 'd1' / 'd2' / 'extra')
@@ -42,7 +28,6 @@ def fresh_dest():
 for rel in rels:
     assert_same(TODIR / rel, src / rel, label=f'--delete kept {rel}')
 
-# --- every delete-timing variant yields the same deep deletion --------------
 for variant in ('--delete-before', '--delete-during', '--delete-delay',
                 '--delete-after'):
     fresh_dest()
@@ -50,18 +35,24 @@ def fresh_dest():
     run_rsync('-a', variant, f'{src}/', f'{TODIR}/')
     assert_not_exists(TODIR / 'd1' / 'd2' / 'gone.txt', label=f'{variant} deep')
 
-# --- --max-delete caps the number of deletions ------------------------------
+fresh_dest()
+prefix = 'D' * 80
+for index in range(300):
+    (TODIR / f'{prefix}{index:04d}').write_text('extra\n')
+run_rsync('-a', '--delete-delay', f'{src}/', f'{TODIR}/')
+if any(path.name.startswith(prefix) for path in TODIR.iterdir()):
+    test_fail('--delete-delay left entries after spilling its deletion list')
+
 fresh_dest()
 for i in range(5):
     (TODIR / f'extra{i}').write_text("e\n")
 run_rsync('-a', '--delete', '--max-delete=2', f'{src}/', f'{TODIR}/',
-          check=False)            # rsync exits 25 when the limit is hit
+          check=False)
 remaining = list(TODIR.glob('extra*'))
 if len(remaining) != 3:
     test_fail(f"--max-delete=2 should leave 3 of 5 extras, found "
               f"{len(remaining)}: {remaining}")
 
-# --- --existing only updates files already present (creates nothing) ---------
 seed_src()
 rmtree(TODIR)
 makepath(TODIR / 'd1')
@@ -72,7 +63,6 @@ def fresh_dest():
 assert_not_exists(TODIR / 'f0', label='--existing did not create new top file')
 assert_not_exists(TODIR / 'd1' / 'd2', label='--existing did not create new dir')
 
-# --- --ignore-existing skips present files, creates the rest -----------------
 seed_src()
 rmtree(TODIR)
 makepath(TODIR / 'd1')
@@ -82,18 +72,11 @@ def fresh_dest():
     test_fail("--ignore-existing overwrote an existing deep file")
 assert_same(TODIR / 'f0', src / 'f0', label='--ignore-existing created new file')
 
-# --- --backup --delete consults is_backup_file -------------------------------
-# Under --backup with no --backup-dir, an extraneous file is backed up to
-# <name>~ before removal, but a name that already ends in the backup suffix is
-# unlinked directly rather than re-backed-up to <name>~~ (delete.c
-# is_backup_file). rsync auto-protects *~ from deletion, so without an explicit
-# "risk" rule the suffixed file is never even a deletion candidate and that
-# branch is unreachable; the R rule un-protects it so the branch actually runs.
 rels = seed_src()
 fresh_dest()
 d = TODIR / 'd1' / 'd2'
-(d / 'plain').write_text("extraneous\n")          # normal -> backed up to plain~
-(d / 'stale~').write_text("already a backup\n")    # suffixed -> unlinked, no stale~~
+(d / 'plain').write_text("extraneous\n")
+(d / 'stale~').write_text("already a backup\n")
 run_rsync('-a', '-b', '--delete', '--filter=R *~', f'{src}/', f'{TODIR}/')
 assert_not_exists(d / 'plain', label='--backup --delete removed extraneous')
 assert_exists(d / 'plain~', label='--backup backed up the extraneous file')
diff --git a/testsuite/tests/transfer/delete-missing-args-files-from.py b/testsuite/tests/transfer/delete-missing-args-files-from.py
new file mode 100644
index 000000000..843e3a638
--- /dev/null
+++ b/testsuite/tests/transfer/delete-missing-args-files-from.py
@@ -0,0 +1,49 @@
+#!/usr/bin/env python3
+
+import subprocess
+
+from harness.rsync import (
+    SCRATCHDIR, makepath, rmtree, rsync_argv, start_test_daemon, test_fail,
+    test_xfail, write_daemon_conf,
+)
+
+DAEMON_PORT = 12910
+
+mod = SCRATCHDIR / 'recvmod910'
+src = SCRATCHDIR / 'src910'
+rmtree(mod)
+rmtree(src)
+makepath(mod / 'ghostdir', src)
+(src / 'keep.txt').write_text("keep-me\n")
+(mod / 'keep.txt').write_text("stale\n")
+(mod / 'ghost.txt').write_text("delete-me-file\n")
+(mod / 'ghostdir' / 'inner').write_text("delete-me-dir\n")
+
+flist = SCRATCHDIR / 'files910.lst'
+flist.write_text("keep.txt\nghost.txt\nghostdir\n")
+
+conf = write_daemon_conf([
+    ('recv', {'path': str(mod), 'read only': 'no'}),
+])
+url = start_test_daemon(conf, DAEMON_PORT)
+
+proc = subprocess.run(
+    rsync_argv('-a', '--delete', '--delete-missing-args',
+               f'--files-from={flist}', f'{src}/', f'{url}recv/'),
+    stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True)
+out = proc.stdout or ''
+print(out)
+
+if 'invalid file mode' in out or (proc.returncode == 2 and (mod / 'ghost.txt').exists()):
+    test_xfail(
+        '#910: --delete-missing-args with --files-from rejects mode-0 entries')
+
+if proc.returncode != 0:
+    test_fail(f"transfer failed unexpectedly (rc={proc.returncode}); "
+              f"not the #910 mode-00 symptom:\n{out}")
+if (mod / 'ghost.txt').exists():
+    test_fail("missing-arg file ghost.txt was not deleted on the receiver")
+if (mod / 'ghostdir').exists():
+    test_fail("missing-arg directory ghostdir was not deleted on the receiver")
+if not (mod / 'keep.txt').is_file() or (mod / 'keep.txt').read_text() != "keep-me\n":
+    test_fail("present file keep.txt was not delivered/updated correctly")
diff --git a/testsuite/delete_test.py b/testsuite/tests/transfer/delete.py
similarity index 71%
rename from testsuite/delete_test.py
rename to testsuite/tests/transfer/delete.py
index 99195b267..1449c9692 100644
--- a/testsuite/delete_test.py
+++ b/testsuite/tests/transfer/delete.py
@@ -1,24 +1,12 @@
 #!/usr/bin/env python3
-# Python rewrite of testsuite/delete.test.
-#
-# Exercises three independent delete-handling behaviours:
-#   1. --del dry-run output matches a real copy's output (sans the trivial
-#      "created directory" / "sent" / "total size" lines).
-#   2. --del --remove-source-files leaves the source empty (only dirs) and
-#      the destination matching what a plain copy would have produced.
-#   3. per-directory filter file with "P" (protect) keeps a file alive across
-#      --delete-excluded; "-" (exclude) does NOT.
 
-import os
-import shutil
 import subprocess
 
-from rsyncfns import (
+from harness.rsync import (
     CHKDIR, FROMDIR, TMPDIR, TODIR,
     checkit, hands_setup, makepath, rsync_argv, test_fail,
 )
 
-
 hands_setup()
 makepath(CHKDIR, TODIR / 'extradir', TODIR / 'emptydir' / 'subdir')
 
@@ -27,14 +15,11 @@
 (TODIR / 'extradir' / 'remove3').write_text("extra\n")
 (TODIR / 'emptydir' / 'subdir' / 'remove4').write_text("extra\n")
 
-
 def _run_capture(*args):
     proc = subprocess.run(rsync_argv(*args), capture_output=True, text=True)
     return proc
 
-
 def _strip_chatter(text: str) -> str:
-    """Remove the lines the shell test stripped via grep -E -v."""
     keep = []
     for line in text.splitlines():
         if (line.startswith('created directory ')
@@ -44,16 +29,11 @@ def _strip_chatter(text: str) -> str:
         keep.append(line)
     return '\n'.join(keep) + ('\n' if text.endswith('\n') else '')
 
-
-# Two chkdirs: copy/ has what a normal copy looks like, empty/ has just
-# directories (used as a remove-source-files comparator).
 copy_proc = _run_capture('-av', f'{FROMDIR}/', f'{CHKDIR}/copy/')
 copy_out = _strip_chatter(copy_proc.stdout + copy_proc.stderr)
 (TMPDIR / 'copy.out').write_text(copy_out)
 print(copy_proc.stdout)
 
-# --del dry-run output (status may be 0 or 23 from delete behaviour; ignore
-# return code as the shell test does).
 copy2_proc = _run_capture('-avn', '--del', f'{FROMDIR}/', f'{CHKDIR}/copy2/')
 copy2_out = _strip_chatter(copy2_proc.stdout + copy2_proc.stderr)
 (TMPDIR / 'copy2.out').write_text(copy2_out)
@@ -68,15 +48,12 @@ def _strip_chatter(text: str) -> str:
     print(sys_stdout)
     test_fail("--del dry-run output diverged from a plain copy's output")
 
-# Build chk/empty as a directories-only mirror of fromdir.
 proc = subprocess.run(
     rsync_argv('-av', '-f', 'exclude,! */', f'{FROMDIR}/', f'{CHKDIR}/empty/'),
 )
 if proc.returncode != 0:
     test_fail("setup of chk/empty failed")
 
-# Main: --del + --remove-source-files leaves dirs only in fromdir, and
-# destination matches a normal copy.
 checkit(['-avv', '--del', '--remove-source-files', f'{FROMDIR}/', f'{TODIR}/'],
         CHKDIR / 'copy', TODIR)
 
@@ -84,8 +61,6 @@ def _strip_chatter(text: str) -> str:
 if diff.returncode != 0:
     test_fail("--remove-source-files did not leave fromdir as just directories")
 
-
-# Per-directory filter file: "P" protects, "-" excludes.
 (TODIR / 'filters').write_text("P foo\n- bar\n")
 for name in ('foo', 'bar', 'baz'):
     (TODIR / name).touch()
diff --git a/testsuite/missing_test.py b/testsuite/tests/transfer/dry-run.py
similarity index 61%
rename from testsuite/missing_test.py
rename to testsuite/tests/transfer/dry-run.py
index c0a600fe3..c0ee45a38 100644
--- a/testsuite/missing_test.py
+++ b/testsuite/tests/transfer/dry-run.py
@@ -1,33 +1,19 @@
 #!/usr/bin/env python3
-# Python rewrite of testsuite/missing.test.
-#
-# Three regressions guarded by the missing_below logic rewrite:
-#   1. Dry-run with --ignore-non-existing must NOT emit "not creating new"
-#      for files whose containing directory already exists at the dest.
-#   2. Dry-run -R -y --no-implied-dirs must not crash trying to build a
-#      fuzzy dirlist for a directory it never created.
-#   3. --delete-after dry-run still emits "*deleting" lines even when the
-#      last source dir is dry-missing on the destination.
 
-import os
 import subprocess
 
-from rsyncfns import FROMDIR, RSYNC, TMPDIR, TODIR, makepath, rsync_argv, test_fail
-
+from harness.rsync import FROMDIR, RSYNC, TMPDIR, TODIR, makepath, rsync_argv, test_fail
 
 makepath(FROMDIR / 'subdir', TODIR)
 (FROMDIR / 'subdir' / 'file').write_text("data\n")
 (TODIR / 'other').write_text("data\n")
 
-
 def run_capture(*args):
     proc = subprocess.run(rsync_argv(*args), capture_output=True, text=True)
     print(proc.stdout, end='')
     print(proc.stderr, end='')
     return proc
 
-
-# Test 1: too much "not creating new..." output on a dry-run.
 out_path = TMPDIR / 'out1'
 proc = run_capture('-n', '-r', '--ignore-non-existing', '-vv',
                    f'{FROMDIR}/', f'{TODIR}/')
@@ -38,8 +24,6 @@ def run_capture(*args):
     if 'not creating new' in line and 'subdir/file' in line:
         test_fail("test 1 failed: dry-run announced creating subdir/file")
 
-# Test 2: fuzzy dirlist crash on dry-run.  Skipped on protocol 29 just like
-# the shell version did, since the new flist sanity check rejects this.
 if 'protocol=29' not in RSYNC:
     proc = run_capture('-n', '-r', '-R', '--no-implied-dirs', '-y',
                        f'{FROMDIR}/./subdir/file', f'{TODIR}/')
@@ -48,7 +32,6 @@ def run_capture(*args):
 else:
     print("Skipped test 2 for protocol 29.")
 
-# Test 3: --delete-after pass skipped when last dir is dry-missing.
 proc = run_capture('-n', '-r', '--delete-after', '-i',
                    f'{FROMDIR}/', f'{TODIR}/')
 saw_delete = any(line.lstrip().startswith('*deleting')
diff --git a/testsuite/duplicates_test.py b/testsuite/tests/transfer/duplicates.py
similarity index 64%
rename from testsuite/duplicates_test.py
rename to testsuite/tests/transfer/duplicates.py
index 0de06d43a..b16c20e9c 100644
--- a/testsuite/duplicates_test.py
+++ b/testsuite/tests/transfer/duplicates.py
@@ -1,20 +1,13 @@
 #!/usr/bin/env python3
-# Python rewrite of testsuite/duplicates.test.
-#
-# The same source directory can be listed many times on the command line
-# (e.g. through shell globbing). clean_flist() is supposed to dedupe so
-# each file/link is copied exactly once even with ten identical sources.
 
 import os
 import subprocess
 
-from rsyncfns import (
+from harness.rsync import (
     FROMDIR, TODIR,
     rsync_argv, rsync_ls_lR, test_fail,
 )
 
-
-# Build a single regular file plus a symlink to it.
 FROMDIR.mkdir(parents=True, exist_ok=True)
 name1 = FROMDIR / 'name1'
 name2 = FROMDIR / 'name2'
@@ -24,9 +17,6 @@
 except OSError as e:
     test_fail(f"can't create symlink: {e}")
 
-# Drive rsync with the same source ten times. Capture the verbose output to
-# inspect for duplicate-copy behaviour AND for the dir-listing comparison
-# that the shell test's checkit was doing alongside.
 sources = [f'{FROMDIR}/'] * 10
 proc = subprocess.run(
     rsync_argv('-avv', *sources, f'{TODIR}/'),
@@ -44,6 +34,5 @@
 if name2_count != 1:
     test_fail(f"name2 was not copied exactly once (got {name2_count})")
 
-# Cross-check that the destination matches the source.
 if rsync_ls_lR(FROMDIR) != rsync_ls_lR(TODIR):
     test_fail("destination listing differs from source after deduplication")
diff --git a/testsuite/exclude-implied-trailing-backslash_test.py b/testsuite/tests/transfer/exclude-implied-trailing-backslash.py
similarity index 57%
rename from testsuite/exclude-implied-trailing-backslash_test.py
rename to testsuite/tests/transfer/exclude-implied-trailing-backslash.py
index 32d17ab41..f99b1a868 100644
--- a/testsuite/exclude-implied-trailing-backslash_test.py
+++ b/testsuite/tests/transfer/exclude-implied-trailing-backslash.py
@@ -1,28 +1,11 @@
 #!/usr/bin/env python3
-# Regression test for a 1-byte heap overflow in add_implied_include()
-# (exclude.c). Phase 1 classifies a '\' via !strchr("*[?", cp[1]); strchr()
-# returns the literal's NUL terminator when cp[1] == '\0', so a TRAILING
-# backslash takes neither branch -- it is copied into new_pat but backslash_cnt
-# is not incremented. Phase 2's recurse/xfer_dirs '/**' rule allocates
-# arg_len + backslash_cnt + 3 + 1 and doubles every '\' in new_pat (including the
-# uncounted trailing one), so the closing '*p = '\0'' lands one byte past the
-# heap buffer.
-#
-# Reachable on a standard network 'rsync --daemon' (the per-module
-# parse_arguments() runs with am_server == 0, so trust_sender_args stays 0 and
-# add_implied_include is active) by a remote unauthenticated client that sends
-# '-r --files-from=<file>' with a files-from name carrying both an interior and a
-# trailing backslash ('a\b\'): forward_filesfrom_data() feeds it to
-# add_implied_include() on the daemon. The fix counts the trailing backslash.
-#
-# Oracle: pre-fix -> the daemon hits an ASan heap-buffer-overflow report; fixed
-# -> none. Needs an ASan build + a real TCP daemon, and is skipped otherwise.
 
 import glob
 import os
 import subprocess
+import time
 
-from rsyncfns import (
+from harness.rsync import (
     SCRATCHDIR, claim_ports, makepath, require_asan, require_tcp, rsync_argv,
     start_rsyncd, test_fail,
 )
@@ -40,7 +23,6 @@
 makepath(mod, dest)
 (mod / 'file.txt').write_text("hello\n")
 
-# A files-from entry with an interior AND a trailing backslash.
 ff = base / 'files-from.txt'
 ff.write_text('a\\b\\\n')
 
@@ -63,24 +45,17 @@
 
 start_rsyncd(conf, PORT)
 
-# A real client forwards the files-from names to the daemon, which parses each
-# through add_implied_include() (recurse via -r so the vulnerable '/**' path runs).
 proc = subprocess.run(
     rsync_argv('-r', f'--files-from={ff}', f'rsync://127.0.0.1:{PORT}/mod/',
                str(dest) + '/'),
     stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True, timeout=30)
 
-
 def asan_report():
     text = ''.join(open(r, errors='replace').read()
                    for r in glob.glob(f"{asan_log}.*"))
     return text if 'AddressSanitizer' in text else (
         proc.stdout if 'AddressSanitizer' in (proc.stdout or '') else '')
 
-
-# The overflowing process (the forwarding client child) may flush its report a
-# beat after the client exits, so poll briefly.
-import time
 report = ''
 for _ in range(30):
     report = asan_report()
diff --git a/testsuite/tests/transfer/exclude-lsh.py b/testsuite/tests/transfer/exclude-lsh.py
new file mode 120000
index 000000000..acc023abc
--- /dev/null
+++ b/testsuite/tests/transfer/exclude-lsh.py
@@ -0,0 +1 @@
+exclude.py
\ No newline at end of file
diff --git a/testsuite/exclude_test.py b/testsuite/tests/transfer/exclude.py
similarity index 82%
rename from testsuite/exclude_test.py
rename to testsuite/tests/transfer/exclude.py
index a35901c2f..aac71f631 100644
--- a/testsuite/exclude_test.py
+++ b/testsuite/tests/transfer/exclude.py
@@ -1,25 +1,33 @@
 #!/usr/bin/env python3
-# Python rewrite of testsuite/exclude.test (and, via a Makefile-built
-# symlink, of exclude-lsh.test).
-#
-# Test rsync's exclude / include / filter rules, including the more
-# obscure wildcard cases, per-directory filter files, CVS-style
-# exclusions, --prune-empty-dirs, --delete-during / --delete-before /
-# --delete-excluded, and rule-restricted filter files.
-#
-# The lsh.sh "remote shell" variant runs every transfer through the
-# local rsync-over-ssh stand-in -- detected via sys.argv[0].
 
 import os
+import shutil
 import subprocess
 import sys
+import time
 
-from rsyncfns import (
-    CHKDIR, FROMDIR, RSYNC, RSYNC_PEER, SCRATCHDIR, SRCDIR, TMPDIR, TODIR,
-    all_plus, allspace, dots,
-    checkdiff, checkit, makepath, rsync_argv, run_rsync, test_fail, rsync_path_arg, rsh_cmd,
+from harness.rsync import (
+    CHKDIR,
+    FROMDIR,
+    SCRATCHDIR,
+    TODIR,
+    all_plus,
+    allspace,
+    dots,
+    cp_touch,
+    checkdiff,
+    checkit,
+    makepath,
+    rsync_argv,
+    run_rsync,
+    test_fail,
+    verify_dirs,
+    rsync_path_arg,
+    rsh_cmd,
 )
+from harness import metadata
 
+metadata(features={'filters', 'remote-shell'}, transports={'pipe', 'tcp'}, min_peer='2.6.0', mutates={'environment', 'filesystem', 'process'}, tags={'compatibility', 'transfer', 'version-mix'})
 
 os.environ['CVSIGNORE'] = '*.junk'
 
@@ -32,8 +40,6 @@
     rpath = []
     host = ''
 
-
-# Build the from/ tree.
 makepath(
     FROMDIR / 'foo/down/to/you',
     FROMDIR / 'foo/sub',
@@ -76,7 +82,6 @@
 (FROMDIR / 'bar' / 'down' / 'to' / 'bar' / '.filt2').write_text("- *.deep\n")
 (FROMDIR / 'bar' / 'down' / 'to' / 'bar' / 'baz' / 'file5.deep').write_text("filtout\n")
 
-# This one should be ineffectual.
 (FROMDIR / 'mid' / '.filt2').write_text("- extra\n")
 (FROMDIR / 'mid' / 'one-in-one-out').write_text("cvsout\n")
 (FROMDIR / 'mid' / '.cvsignore').write_text("one-in-one-out\n")
@@ -86,8 +91,6 @@
 (FROMDIR / 'mid' / 'for' / 'foo' / 'extra').write_text("expunged\n")
 (FROMDIR / 'mid' / 'for' / 'foo' / 'keep').write_text("retained\n")
 
-
-# Setup our test exclude/include files.
 excl = SCRATCHDIR / 'exclude-from'
 excl.write_text(
     "!\n"
@@ -112,10 +115,6 @@
 
 (SCRATCHDIR / '.cvsignore').write_text("home-cvs-exclude\n")
 
-
-# --- main checks ------------------------------------------------------------
-
-# Start with a check of --prune-empty-dirs.
 run_rsync('-av', f'--rsync-path={rsync_path_arg()}',
           '-f', '-_foo/too/', '-f', '-_foo/down/',
           '-f', '-_foo/and/', '-f', '-_new/',
@@ -124,13 +123,10 @@
 checkit(['-av', *rpath, '--prune-empty-dirs',
          f'{host}{FROMDIR}/', f'{TODIR}/'], CHKDIR, TODIR)
 
-import shutil
 shutil.rmtree(TODIR, ignore_errors=True)
 
-# Add a directory symlink.
 os.symlink('too', FROMDIR / 'bar' / 'down' / 'to' / 'foo' / 'sym')
 
-# Pre-build an --update test pair.
 up1 = SCRATCHDIR / 'up1'
 up2 = SCRATCHDIR / 'up2'
 up1.mkdir()
@@ -142,10 +138,7 @@
 (up1 / 'extra-src').touch()
 (up2 / 'extra-dest').touch()
 
-# Build CHKDIR mirroring source (everything), then remove the entries we
-# expect to be excluded.
 checkit(['-avv', *rpath, f'{host}{FROMDIR}/', f'{CHKDIR}/'], FROMDIR, CHKDIR)
-import time
 time.sleep(1)
 shutil.rmtree(CHKDIR / 'foo' / 'down', ignore_errors=True)
 shutil.rmtree(CHKDIR / 'mid' / 'for' / 'foo' / 'and', ignore_errors=True)
@@ -161,17 +154,14 @@
 (up1 / 'src-newness').touch()
 (up2 / 'dst-newness').touch()
 
-# Un-tweak the directory times in our first (weak) exclude test.
 run_rsync('-av', f'--rsync-path={rsync_path_arg()}',
           '--existing', '--include=*/', '--exclude=*',
           f'{host}{FROMDIR}/', f'{CHKDIR}/')
 
-# Test that rsync excludes the same files.
 checkit(['-avv', *rpath, f'--exclude-from={excl}',
          '--delete-during', f'{host}{FROMDIR}/', f'{TODIR}/'],
         CHKDIR, TODIR)
 
-# Modify the chk dir by removing cvs-ignored files and tweaking dir times.
 for f in (CHKDIR / 'foo').glob('*.old'):
     f.unlink()
 for f in (CHKDIR / 'bar' / 'down' / 'to' / 'foo').glob('*.bak'):
@@ -185,23 +175,18 @@
           '--existing', '--filter=exclude,! */',
           f'{host}{FROMDIR}/', f'{CHKDIR}/')
 
-# Now test --cvs-exclude + --delete-excluded.
-# -C order differs between push/pull, so use -f :C / -f -C explicitly.
 checkit(['-avv', *rpath, f'--filter=merge {excl}',
          '-f:C', '-f-C', '--delete-excluded', '--delete-during',
          f'{host}{FROMDIR}/', f'{TODIR}/'],
         CHKDIR, TODIR)
 
-# Modify the chk dir for the merge-exclude test.
 (CHKDIR / 'foo' / 'file1').unlink()
 for f in (CHKDIR / 'bar' / 'down' / 'to' / 'bar' / 'baz').glob('*.deep'):
     f.unlink()
 for src in (FROMDIR / 'bar' / 'down' / 'to' / 'foo').glob('*.junk'):
     cp_touch_dst = CHKDIR / 'bar' / 'down' / 'to' / 'foo'
     cp_touch_dst.mkdir(exist_ok=True)
-    from rsyncfns import cp_touch
     cp_touch(src, cp_touch_dst)
-from rsyncfns import cp_touch
 cp_touch(FROMDIR / 'bar' / 'down' / 'to' / 'foo' / 'to',
          CHKDIR / 'bar' / 'down' / 'to' / 'foo')
 
@@ -217,37 +202,26 @@
           '--existing', '--filter=-! */',
           f'{host}{FROMDIR}/', f'{CHKDIR}/')
 
-
-# Test merge-exclude file. The shell test piped excl-minus-bangs into
-# rsync via stdin; here we materialise the filtered file and merge it.
 filtered_excl = SCRATCHDIR / 'exclude-from-filtered'
 filtered_excl.write_text(
     '\n'.join(ln for ln in excl.read_text().splitlines() if '!' not in ln)
     + '\n'
 )
 
-
 def run_with_stdin_filter(args, label="merge"):
-    """Run rsync with `args`, feeding `filtered_excl` content on stdin
-    (which `merge_-` in the filter list picks up). checkit-equivalent
-    that also re-uses CHKDIR/TODIR for the listing comparison."""
     print(f"Running: rsync {' '.join(args)}")
     with open(filtered_excl, 'rb') as inp:
         proc = subprocess.run(rsync_argv(*args), stdin=inp)
     if proc.returncode != 0:
         test_fail(f"{label}: rsync exited {proc.returncode}")
 
-
 run_with_stdin_filter(
     ['-avv', *rpath, '-f', 'dir-merge_.filt', '-f', 'merge_-',
      '--delete-during', f'{host}{FROMDIR}/', f'{TODIR}/'],
     "dir-merge .filt + merge from stdin",
 )
-from rsyncfns import verify_dirs
 verify_dirs(CHKDIR, TODIR, label="dir-merge + merge-from-stdin")
 
-
-# Remove the files that will be deleted.
 (CHKDIR / '.filt').unlink()
 (CHKDIR / 'bar' / '.filt').unlink()
 (CHKDIR / 'bar' / 'down' / 'to' / '.filt2').unlink()
@@ -259,7 +233,6 @@ def run_with_stdin_filter(args, label="merge"):
           '--existing', '--include=*/', '--exclude=*',
           f'{host}{FROMDIR}/', f'{CHKDIR}/')
 
-# Run the prior command with --delete-before and side-specific rules.
 run_with_stdin_filter(
     ['-avv', *rpath, '-f', ':s_.filt', '-f', '.s_-',
      '-f', 'P_nodel.deep',
@@ -268,8 +241,6 @@ def run_with_stdin_filter(args, label="merge"):
 )
 verify_dirs(CHKDIR, TODIR, label="delete-before with merge")
 
-
-# Rule-restricted filter files.
 (FROMDIR / 'bar' / 'down' / '.excl').write_text("file3\n")
 (FROMDIR / 'bar' / 'down' / 'to' / 'foo' / '.excl').write_text(
     "+ file3\n*.bak\n"
@@ -290,8 +261,6 @@ def run_with_stdin_filter(args, label="merge"):
 checkit(['-avv', *rpath, '-f', 'dir-merge,-_.excl',
          f'{host}{FROMDIR}/', f'{TODIR}/'], CHKDIR, TODIR)
 
-
-# Combine with --relative.
 relative_opts = ['--relative', '--chmod=Du+w', '--copy-unsafe-links']
 run_rsync('-av', f'--rsync-path={rsync_path_arg()}', *relative_opts,
           f'{host}{FROMDIR}/foo', f'{CHKDIR}/')
@@ -305,8 +274,6 @@ def run_with_stdin_filter(args, label="merge"):
         str(CHKDIR) + str(FROMDIR) + '/foo',
         str(TODIR) + str(FROMDIR) + '/foo')
 
-
-# --update test.
 checkdiff(
     ['-aiiO', *rpath, '--update', '--info=skip',
      f'{host}{SCRATCHDIR}/up1/', f'{SCRATCHDIR}/up2/'],
diff --git a/testsuite/files-from-depth_test.py b/testsuite/tests/transfer/files-from-depth.py
similarity index 80%
rename from testsuite/files-from-depth_test.py
rename to testsuite/tests/transfer/files-from-depth.py
index 3a1b990ae..9206faaa5 100644
--- a/testsuite/files-from-depth_test.py
+++ b/testsuite/tests/transfer/files-from-depth.py
@@ -1,13 +1,6 @@
 #!/usr/bin/env python3
-"""Coverage of --files-from, -0/--from0, --exclude-from, --include-from at depth.
 
---files-from selects exactly the listed source-relative paths (creating their
-implied parent dirs); --from0 makes the list NUL-delimited; --exclude-from /
---include-from read filter patterns from a file. All resolve names several
-levels deep.
-"""
-
-from rsyncfns import (
+from harness.rsync import (
     FROMDIR, SCRATCHDIR, TODIR,
     assert_exists, assert_not_exists, assert_same, make_tree, rmtree,
     run_rsync,
@@ -17,14 +10,11 @@
 listed = ['d1/f1', 'd1/d2/d3/f3']
 unlisted = ['f0', 'd1/d2/f2']
 
-
 def seed():
     rmtree(src)
     rmtree(TODIR)
     make_tree(src, depth=3)
 
-
-# --- --files-from selects only the listed deep paths ------------------------
 seed()
 lf = SCRATCHDIR / 'files.lst'
 lf.write_text('\n'.join(listed) + '\n')
@@ -34,7 +24,6 @@ def seed():
 for rel in unlisted:
     assert_not_exists(TODIR / rel, label=f'--files-from excluded {rel}')
 
-# --- --from0: the same list, NUL-delimited ----------------------------------
 rmtree(TODIR)
 lf0 = SCRATCHDIR / 'files0.lst'
 lf0.write_bytes(b'\0'.join(p.encode() for p in listed) + b'\0')
@@ -44,7 +33,6 @@ def seed():
 for rel in unlisted:
     assert_not_exists(TODIR / rel, label=f'--from0 excluded {rel}')
 
-# --- comments: line mode and --from0 both ignore them -----------------------
 rmtree(TODIR)
 (src / '#ignored').write_text('hash ignored\n')
 (src / ';ignored').write_text('semi ignored\n')
@@ -70,7 +58,6 @@ def seed():
 for rel in ['#ignored', ';ignored']:
     assert_not_exists(TODIR / rel, label=f'--from0 comment list skipped {rel}')
 
-# --- --exclude-from drops matching files at depth ---------------------------
 seed()
 (src / 'a.skip').write_text('s\n')
 (src / 'd1' / 'd2' / 'a.skip').write_text('s\n')
@@ -82,7 +69,6 @@ def seed():
 assert_same(TODIR / 'd1' / 'd2' / 'f2', src / 'd1' / 'd2' / 'f2',
             label='--exclude-from kept others')
 
-# --- --include-from keeps only matching files at depth ----------------------
 seed()
 (src / 'd1' / 'd2' / 'k.keepme').write_text('k\n')
 inc = SCRATCHDIR / 'inc.lst'
diff --git a/testsuite/tests/transfer/files-from.py b/testsuite/tests/transfer/files-from.py
new file mode 100644
index 000000000..3c7ab8610
--- /dev/null
+++ b/testsuite/tests/transfer/files-from.py
@@ -0,0 +1,48 @@
+#!/usr/bin/env python3
+
+from harness.rsync import (
+    CHKDIR,
+    FROMDIR,
+    SCRATCHDIR,
+    TODIR,
+    checkit,
+    hands_setup,
+    rmtree,
+    run_rsync,
+    rsync_path_arg,
+    rsh_cmd,
+)
+from harness import metadata
+
+metadata(features={'files-from', 'remote-shell'}, transports={'pipe', 'tcp'}, min_peer='2.6.0', mutates={'filesystem', 'process'}, tags={'compatibility', 'transfer', 'version-mix'})
+
+SSH = rsh_cmd()
+
+hands_setup()
+
+filelist = SCRATCHDIR / 'filelist'
+filelist.write_text(
+    "from/./\n"
+    "from/./dir/subdir\n"
+    "from/./dir/subdir/subsubdir\n"
+    "from/./dir/subdir/subsubdir2/\n"
+    "from/./dir/subdir/foobar.baz\n"
+)
+
+run_rsync('-a', '--exclude=dir/text', '--exclude=subsubdir/**',
+          f'{FROMDIR}/', f'{CHKDIR}/')
+
+checkit(['-av', f'--files-from={filelist}', str(SCRATCHDIR), f'{TODIR}/'],
+        CHKDIR, TODIR)
+
+for filehost in ('', 'localhost:'):
+    for srchost in ('', 'localhost:'):
+        desthost = 'localhost:' if not srchost else ''
+
+        rmtree(TODIR)
+        checkit(
+            ['-avse', SSH, f'--rsync-path={rsync_path_arg()}',
+             f'--files-from={filehost}{filelist}',
+             f'{srchost}{SCRATCHDIR}', f'{desthost}{TODIR}/'],
+            CHKDIR, TODIR,
+        )
diff --git a/testsuite/filter-depth_test.py b/testsuite/tests/transfer/filter-depth.py
similarity index 62%
rename from testsuite/filter-depth_test.py
rename to testsuite/tests/transfer/filter-depth.py
index 9e4c99f04..e3495ad68 100644
--- a/testsuite/filter-depth_test.py
+++ b/testsuite/tests/transfer/filter-depth.py
@@ -1,25 +1,10 @@
 #!/usr/bin/env python3
-"""Coverage of --exclude / --include / --filter / -F at depth.
 
-The interesting case for the resolver restructure is a per-directory merge file
-(-F reads .rsync-filter from each directory as it descends): the rule set is
-loaded from a file several levels deep and must apply to that directory and
-below, but not above. Also check plain --exclude / --include precedence on
-files spread through the tree.
-"""
-
-import os
-
-from rsyncfns import (
-    FROMDIR, TODIR,
-    assert_exists, assert_not_exists, assert_same, makepath, rmtree, run_rsync,
-)
+from harness.rsync import FROMDIR, TODIR, assert_exists, assert_not_exists, makepath, rmtree, run_rsync
 
 src = FROMDIR
 
-
 def seed_ext():
-    """A tree with a .log and a .txt at every level."""
     rmtree(src)
     rmtree(TODIR)
     cur = src
@@ -29,8 +14,6 @@ def seed_ext():
         (cur / f'drop{lvl}.log').write_text(f'log {lvl}\n')
         cur = cur / f'd{lvl + 1}'
 
-
-# --- --exclude drops matching files at every level --------------------------
 seed_ext()
 run_rsync('-a', '--exclude=*.log', f'{src}/', f'{TODIR}/')
 cur = TODIR
@@ -39,7 +22,6 @@ def seed_ext():
     assert_not_exists(cur / f'drop{lvl}.log', label=f'--exclude dropped log L{lvl}')
     cur = cur / f'd{lvl + 1}'
 
-# --- --include before --exclude='*' keeps only .txt at every level ----------
 seed_ext()
 run_rsync('-a', '--include=*/', '--include=*.txt', '--exclude=*',
           f'{src}/', f'{TODIR}/')
@@ -49,8 +31,6 @@ def seed_ext():
     assert_not_exists(cur / f'drop{lvl}.log', label=f'--include excluded log L{lvl}')
     cur = cur / f'd{lvl + 1}'
 
-# --- -F per-directory merge file loaded from a deep directory ---------------
-# .rsync-filter at d1/d2 excludes "secret*" for d1/d2 and below only.
 rmtree(src)
 rmtree(TODIR)
 makepath(src / 'd1' / 'd2' / 'd3')
@@ -60,10 +40,8 @@ def seed_ext():
 (src / 'd1' / 'd2' / '.rsync-filter').write_text('- secret*\n')
 
 run_rsync('-aF', f'{src}/', f'{TODIR}/')
-# Above the merge file: not affected.
 assert_exists(TODIR / 'secret.top', label='-F above merge dir')
 assert_exists(TODIR / 'd1' / 'secret.mid', label='-F above merge dir')
-# At and below the merge file: excluded.
 assert_not_exists(TODIR / 'd1' / 'd2' / 'secret.deep', label='-F at merge dir')
 assert_not_exists(TODIR / 'd1' / 'd2' / 'd3' / 'secret.deeper',
                   label='-F below merge dir')
diff --git a/testsuite/tests/transfer/filter-file-confinement.py b/testsuite/tests/transfer/filter-file-confinement.py
new file mode 100644
index 000000000..f5e921a3a
--- /dev/null
+++ b/testsuite/tests/transfer/filter-file-confinement.py
@@ -0,0 +1,154 @@
+#!/usr/bin/env python3
+
+import os
+import subprocess
+import time
+
+from harness.mutation import find_attacker_uid, race_budget, start_c_flipper, stop_flipper
+from harness.rsync import (
+    SCRATCHDIR, rmtree, rsync_argv, start_test_daemon, test_fail, test_skipped,
+    write_daemon_conf,
+)
+
+PORT = 13333
+
+if os.geteuid() != 0:
+    test_skipped("requires root to plant a backup-dir symlink owned by a non-self uid",
+                 capability='cross_uid')
+
+ATT_UID = find_attacker_uid()
+if ATT_UID is None:
+    test_skipped("no untrusted-uid user available for cross-uid plant", capability='cross_uid')
+
+SECRET = "NO_ONE_SHOULD_README\n"
+NFILES = 80
+root = SCRATCHDIR / 'files-from'
+root.mkdir()
+base = root / 'base'
+outside = base / 'outside'
+src = base / 'src'
+dest = base / 'dest'
+backup = base / 'backup'
+sub = backup / 'sub'
+sublink = backup / '.sublink'
+backed_up_link = ''
+
+secret = root / 'secret'
+secret.write_text(SECRET)
+
+def build():
+    rmtree(base)
+    for d in (src / 'sub', dest / 'sub', backup, outside):
+        d.mkdir(parents=True, exist_ok=True)
+
+    for i in range(NFILES):
+        (src / 'sub' / f'f{i}').symlink_to('test')
+        (dest / 'sub' / f'f{i}').symlink_to(f'{secret}')
+        os.lchown(src / 'sub' / f'f{i}', ATT_UID, ATT_UID)
+        os.lchown(dest / 'sub' / f'f{i}', ATT_UID, ATT_UID)
+
+    os.symlink(str(outside), sublink)
+    os.lchown(sublink, ATT_UID, ATT_UID)
+    sub.mkdir(parents=True, exist_ok=True)
+
+def push():
+    return subprocess.run(
+        rsync_argv('-a', '-b', '--backup-dir=/backup/',
+                   f'{src}/', f'rsync://127.0.0.1:{PORT}/m/dest/'),
+        stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL,
+    )
+
+def assert_no_leak(*args):
+    result = subprocess.run(rsync_argv(*args), stdout=subprocess.PIPE,
+                            stderr=subprocess.STDOUT, text=True)
+    if 'NO_ONE_SHOULD' in result.stdout:
+        test_fail(f'{secret.name} leaked:\n{result.stdout}')
+
+def normalize_sub():
+    try:
+        if sub.is_symlink() and sublink.is_dir() and not sublink.is_symlink():
+            sub.unlink()
+            sublink.rename(sub)
+    except OSError:
+        pass
+
+def root_owned_backup_symlink():
+    normalize_sub()
+    try:
+        if sub.is_symlink() or not sub.is_dir():
+            return ""
+        with os.scandir(sub) as it:
+            for entry in it:
+                if entry.is_symlink() and entry.stat(follow_symlinks=False).st_uid == 0:
+                    return entry.name
+    except (FileNotFoundError, NotADirectoryError):
+        return ""
+    return ""
+
+conf = write_daemon_conf(
+    [('m', {'path': str(base), 'read only': 'no', 'use chroot': 'no'})],
+    name='files-from-rsyncd.conf',
+)
+start_test_daemon(conf, PORT)
+
+build()
+proc = push()
+if proc.returncode != 0:
+    test_fail(f"positive control: clean --backup-dir run failed (rc={proc.returncode})")
+if not (sub / 'f0').is_symlink() or os.readlink(sub / 'f0') != f'{secret}':
+    test_fail(
+        "positive control: the old destination symlink was not backed up into "
+        f"{sub}; the backup symlink path was not exercised"
+    )
+
+deadline = time.monotonic() + race_budget(10.0)
+flip = None
+try:
+    while time.monotonic() < deadline:
+        if flip is not None:
+            stop_flipper(flip)
+            flip = None
+
+        backed_up_link = root_owned_backup_symlink()
+        if backed_up_link:
+            break
+
+        build()
+        flip = start_c_flipper(sub, sublink)
+        push()
+finally:
+    if flip is not None:
+        stop_flipper(flip)
+
+if not backed_up_link:
+    test_skipped("race did not produce a root-owned backup symlink (no atomic flipper?)",
+                 capability='atomic_flipper')
+
+tgt = os.readlink(sub / backed_up_link)
+if os.path.realpath(tgt) != os.path.realpath(str(secret)):
+    test_fail(f'setup failed: backup symlink {backed_up_link} -> {tgt}')
+
+assert_no_leak('-a', f'--files-from=:backup/sub/{backed_up_link}',
+               f'rsync://127.0.0.1:{PORT}/m/', f'{dest}/')
+assert_no_leak('-a', f'--filter=: {backed_up_link}',
+               f'rsync://127.0.0.1:{PORT}/m/backup/sub/', f'{dest}/')
+
+local_files_from = root / 'local_files_from.txt'
+local_file = src / 'sub' / 'files-from-local'
+local_file.write_text('local files-from content\n')
+local_files_from.write_text('sub/files-from-local\n')
+
+local_proc = subprocess.run(
+    rsync_argv('-a', f'--confine-root={base}', f'--files-from={local_files_from}',
+               f'{src}/', f'{dest}/'),
+    stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True,
+)
+
+copied = dest / 'sub' / 'files-from-local'
+if (local_proc.returncode != 0 or not copied.is_file()
+        or copied.read_text() != 'local files-from content\n'):
+    test_fail(
+        "Local --files-from transfer did not copy the listed file while the "
+        "list was outside --confine-root.\n"
+        f"Output: {local_proc.stdout}"
+    )
diff --git a/testsuite/tests/transfer/filter-merge-content-echo.py b/testsuite/tests/transfer/filter-merge-content-echo.py
new file mode 100644
index 000000000..0937c5800
--- /dev/null
+++ b/testsuite/tests/transfer/filter-merge-content-echo.py
@@ -0,0 +1,168 @@
+#!/usr/bin/env python3
+
+import os
+import subprocess
+
+from harness.rsync import SCRATCHDIR, makepath, rmtree, rsync_argv, test_fail
+
+SECRET = 'TOP-SECRET-PASSWORD-abc123'
+
+base = SCRATCHDIR / 'filter-merge-content-echo'
+rmtree(base)
+src = base / 'src'
+dest = base / 'dest'
+makepath(src, dest)
+(src / 'f').write_bytes(b'hi\n')
+
+secret = base / 'secret'
+secret.write_text(SECRET + '\n')
+
+def invoke(*args):
+    result = subprocess.run(rsync_argv(*args), capture_output=True, text=True, timeout=30)
+    return result, result.stdout + result.stderr
+
+(src / '.rsync-filter').write_text(': ../secret\n')
+result, out = invoke('-r', '-F', f'{src}/', f'{dest}/')
+if result.returncode == 0:
+    test_fail('invalid merge rule was accepted')
+if SECRET in out:
+    test_fail(f'merge-file content leaked: {out!r}')
+if 'a file read earlier' not in out:
+    test_fail(f'merge-file error lacks source context: {out!r}')
+
+(base / 'rules').write_text(SECRET + '\n')
+result, out = invoke('-r', f'--filter=. {base}/rules', f'{src}/', f'{dest}/')
+if result.returncode == 0 or SECRET in out:
+    test_fail(f'argument merge file leaked or was accepted: {out!r}')
+if 'rules line 1' not in out:
+    test_fail(f'argument merge-file location is missing: {out!r}')
+
+(base / 'outer-known').write_text(f'. {base}/inner-bad\n')
+(base / 'inner-bad').write_text(SECRET + '\n')
+result, out = invoke('-r', f'--filter=. {base}/outer-known', f'{src}/', f'{dest}/')
+if SECRET in out or 'inner-bad' in out:
+    test_fail(f'indirect merge-file details leaked: {out!r}')
+if 'a file named at' not in out or 'outer-known line 1' not in out:
+    test_fail(f'indirect merge-file source is missing: {out!r}')
+
+result, out = invoke('-r', '--filter=Zbogus-rule-text', f'{src}/', f'{dest}/')
+if result.returncode == 0 or 'Zbogus-rule-text' not in out:
+    test_fail(f'argument rule diagnostic changed: {out!r}')
+
+(src / '.rsync-filter').write_text('- *.tmp\n')
+(src / 'keep.txt').write_bytes(b'keep\n')
+(src / 'drop.tmp').write_bytes(b'drop\n')
+result, _ = invoke('-r', '-F', f'{src}/', f'{dest}/')
+if result.returncode:
+    test_fail(f'valid merge file failed: {result.stderr!r}')
+if not (dest / 'keep.txt').exists() or (dest / 'drop.tmp').exists():
+    test_fail('valid merge rule was not applied')
+
+(base / 'outer').write_text(f'. {base}/nested\n')
+(base / 'nested').write_text(f'. {SECRET}\n')
+result, out = invoke('-r', f'--filter=. {base}/outer', f'{src}/', f'{dest}/')
+if result.returncode == 0 or SECRET in out:
+    test_fail(f'nested merge-file content leaked or was accepted: {out!r}')
+
+(base / 'child').write_text('- harmless\n')
+(base / 'parent').write_text(f'. {base}/child\nZbad-in-parent\n')
+result, out = invoke('-r', f'--filter=. {base}/parent', f'{src}/', f'{dest}/')
+if 'parent line 2' not in out:
+    test_fail(f'nested merge-file line is wrong: {out!r}')
+
+(base / 'crlf').write_bytes(b'- harmless\r\nZbad-on-line-2\r\n')
+result, out = invoke('-r', f'--filter=. {base}/crlf', f'{src}/', f'{dest}/')
+if 'crlf line 2' not in out:
+    test_fail(f'CRLF miscounted the line: out={out!r}')
+
+(src / '.rsync-filter').write_text(':w- ../secret\n')
+result, out = invoke('-r', '-F', '--debug=FILTER2', f'{src}/', f'{dest}/')
+if SECRET in out:
+    test_fail(f'filter debug trace leaked merge-file content: {out!r}')
+
+PATTERN_TEXT = 'sec[r]et-marker-9x'
+MATCHED_NAME = 'secret-marker-9x'
+rmtree(src)
+makepath(src)
+(src / 'f').write_bytes(b'keep\n')
+(src / MATCHED_NAME).write_bytes(b'hidden\n')
+(src / '.rsync-filter').write_text('- ' + PATTERN_TEXT + '\n')
+result, out = invoke('-r', '-F', '-vv', f'{src}/', f'{dest}/')
+if result.returncode:
+    test_fail(f'the -vv transfer failed: out={out!r}')
+if 'because of' not in out:
+    test_fail(f'no match was reported, so this case exercises nothing: out={out!r}')
+if PATTERN_TEXT in out:
+    test_fail(f'match trace leaked a file-derived pattern: {out!r}')
+if (dest / MATCHED_NAME).exists():
+    test_fail('file-derived rule did not hide the matching file')
+
+rmtree(src)
+makepath(src / 'sub')
+(src / 'sub' / 'f').write_bytes(b'x\n')
+maxpath = os.pathconf(str(base), 'PC_PATH_MAX')
+overflowed = False
+for slack in range(4, 80, 4):
+    pad = maxpath - len(str(src)) - slack
+    if pad < 32:
+        continue
+    (src / '.rsync-filter').write_text(': sub/DEFERRED-SECRET-' + 'Q' * pad + '\n')
+    result, out = invoke('-r', '-F', f'{src}/', f'{dest}/')
+    if 'DEFERRED-SECRET' in out:
+        test_fail(f'overlong merge name leaked: {out!r}')
+    if 'merge-file name overflows' in out:
+        overflowed = True
+        break
+if not overflowed:
+    test_fail('merge-name overflow path was not reached')
+
+DEFERRED_NAME = 'named-from-f[i]le-x9'
+(src / '.rsync-filter').write_text(': ' + DEFERRED_NAME + '\n')
+result, out = invoke('-r', '-F', '-vvv', f'{src}/', f'{dest}/')
+if DEFERRED_NAME in out:
+    test_fail(f'deferred merge name leaked: {out!r}')
+
+rmtree(src)
+makepath(src)
+(src / 'f').write_bytes(b'x\n')
+(src / '.rsync-filter').write_text('- trailing-ws-probe \n')
+result, out = invoke('-r', '-F', '--debug=FILTER1', f'{src}/', f'{dest}/')
+if 'trailing-ws-probe' in out or 'CAUTION' in out:
+    test_fail(f'file-derived trailing whitespace leaked: {out!r}')
+
+result, out = invoke('-r', '--debug=FILTER1', '--filter=- my-own-rule ',
+               f'{src}/', f'{dest}/')
+if 'CAUTION' not in out or 'my-own-rule' not in out:
+    test_fail(f'argument trailing-whitespace warning is missing: {out!r}')
+
+long_arg = 'ARGLONG-' + 'Q' * (maxpath + 200)
+result, out = invoke('-r', f'--filter=- {long_arg}', f'{src}/', f'{dest}/')
+if 'discarding over-long filter' not in out:
+    test_fail(f'expected the over-long path: out={out!r}')
+if out.count('Q') <= maxpath:
+    test_fail('overlong argument rule was truncated')
+
+SELF_PATTERN = 'excl-self-[x]9'
+SELF_MATCHED = 'excl-self-x9'
+rmtree(src)
+makepath(src)
+(src / 'f').write_bytes(b'keep\n')
+(src / SELF_MATCHED).write_bytes(b'hidden\n')
+(src / '.rsync-filter').write_text(':e ' + SELF_PATTERN + '\n')
+result, out = invoke('-r', '-F', '-vv', f'{src}/', f'{dest}/')
+if result.returncode:
+    test_fail(f'the :e transfer failed: out={out!r}')
+if 'because of' not in out:
+    test_fail(f'no match was reported, so this case exercises nothing: out={out!r}')
+if SELF_PATTERN in out:
+    test_fail(f'exclude-self trace leaked a merge-file pattern: {out!r}')
+
+rmtree(src)
+makepath(src)
+(src / 'f').write_bytes(b'x\n')
+(src / '.rsync-filter').write_text('Zbad-perdir\n')
+result, out = invoke('-r', '-F', f'{src}/', f'{dest}/')
+if result.returncode == 0 or 'Zbad-perdir' in out:
+    test_fail(f'per-directory rule leaked or was accepted: {out!r}')
+if '.rsync-filter line 1' not in out:
+    test_fail(f'per-directory merge-file location is missing: {out!r}')
diff --git a/testsuite/tests/transfer/filter-merge-recursion.py b/testsuite/tests/transfer/filter-merge-recursion.py
new file mode 100644
index 000000000..1cae5cf95
--- /dev/null
+++ b/testsuite/tests/transfer/filter-merge-recursion.py
@@ -0,0 +1,35 @@
+#!/usr/bin/env python3
+
+import subprocess
+
+from harness.rsync import SCRATCHDIR, makepath, rmtree, rsync_argv, test_fail
+
+SRC = SCRATCHDIR / 'mergerec-src'
+DST = SCRATCHDIR / 'mergerec-dst'
+rmtree(SRC)
+rmtree(DST)
+makepath(SRC, DST)
+
+(SRC / '.merge').write_text(". .merge\n")
+(SRC / 'file.txt').write_text("hello\n")
+
+proc = subprocess.run(
+    rsync_argv('-a', '--filter=: .merge', f'{SRC}/', f'{DST}/'),
+    stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True)
+
+crashed = (proc.returncode < 0 or proc.returncode >= 128
+           or (proc.returncode == 12
+               and 'merge-file include depth limit' not in proc.stdout))
+if crashed:
+    test_fail(
+        "filter merge-file recursion was not capped: rsync died abnormally "
+        f"(rc={proc.returncode}) on a self-including '.merge'. "
+        f"output:\n{proc.stdout}")
+
+if 'merge-file include depth limit' not in proc.stdout:
+    test_fail(
+        "expected the MAX_MERGE_DEPTH diagnostic; the self-including merge "
+        f"file did not hit the cap (rc={proc.returncode}).\n{proc.stdout}")
+
+print("filter-merge-recursion: self-including merge file is capped at "
+      "MAX_MERGE_DEPTH (clean RERR_FILEIO, no stack-exhaustion crash).")
diff --git a/testsuite/fuzzy-basis_test.py b/testsuite/tests/transfer/fuzzy-basis.py
similarity index 59%
rename from testsuite/fuzzy-basis_test.py
rename to testsuite/tests/transfer/fuzzy-basis.py
index d91a3b9ed..19a65d582 100644
--- a/testsuite/fuzzy-basis_test.py
+++ b/testsuite/tests/transfer/fuzzy-basis.py
@@ -1,15 +1,8 @@
 #!/usr/bin/env python3
-"""Coverage of --fuzzy basis selection scoring (util1.c fuzzy_distance).
-
-When the destination has no exact match for a source file, --fuzzy makes the
-generator score the same-directory candidates by name similarity (fuzzy_distance)
-and use the closest as the delta basis. Set this up at depth with several
-similar-named candidates so the scorer actually runs.
-"""
 
 import os
 
-from rsyncfns import (
+from harness.rsync import (
     FROMDIR, TODIR,
     assert_same, make_data_file, makepath, rmtree, run_rsync, test_fail,
 )
@@ -25,15 +18,10 @@
 make_data_file(src / newfile, 300_000)
 base = (src / newfile).read_bytes()
 
-# Destination has NO 'archive-v2.tar', but several similar-named candidates that
-# are mostly identical to it -- so fuzzy must score them by name distance.
 (TODIR / deepdir / 'archive-v1.tar').write_bytes(base[:280_000] + b'older tail data')
 (TODIR / deepdir / 'archive-old.tar').write_bytes(base[:200_000])
 (TODIR / deepdir / 'unrelated.dat').write_bytes(b'nothing alike' * 1000)
 
-# Capture --debug=FUZZY: a correct final file alone would also result from a
-# full transfer that ignored --fuzzy, so assert the scorer actually chose the
-# closest-named candidate (archive-v1.tar) as the basis, not just that bytes match.
 proc = run_rsync('-a', '--fuzzy', '--no-whole-file', '--debug=FUZZY',
                  f'{src}/', f'{TODIR}/', capture_output=True)
 want = f'fuzzy basis selected for {newfile}: {os.path.join(deepdir, "archive-v1.tar")}'
diff --git a/testsuite/tests/transfer/fuzzy.py b/testsuite/tests/transfer/fuzzy.py
new file mode 100644
index 000000000..1cfd9a010
--- /dev/null
+++ b/testsuite/tests/transfer/fuzzy.py
@@ -0,0 +1,19 @@
+#!/usr/bin/env python3
+
+from harness.rsync import (
+    FROMDIR, SRCDIR, TODIR, cp_p, cp_touch, run_rsync, test_fail, verify_dirs,
+)
+
+FROMDIR.mkdir(parents=True, exist_ok=True)
+TODIR.mkdir(parents=True, exist_ok=True)
+
+cp_p(SRCDIR / 'rsync.c', FROMDIR / 'rsync.c')
+cp_touch(FROMDIR / 'rsync.c', TODIR / 'rsync2.c')
+
+proc = run_rsync('-avvi', '--no-whole-file', '--fuzzy', '--delete-delay',
+                 '--debug=FUZZY', f'{FROMDIR}/', f'{TODIR}/',
+                 capture_output=True)
+if 'fuzzy basis selected for rsync.c: rsync2.c' not in proc.stdout:
+    test_fail("--fuzzy did not select rsync2.c as the basis for rsync.c; "
+              f"--debug=FUZZY output was:\n{proc.stdout}")
+verify_dirs(FROMDIR, TODIR)
diff --git a/testsuite/growing-file_test.py b/testsuite/tests/transfer/growing-file.py
similarity index 52%
rename from testsuite/growing-file_test.py
rename to testsuite/tests/transfer/growing-file.py
index 572e512de..a1b499f05 100644
--- a/testsuite/growing-file_test.py
+++ b/testsuite/tests/transfer/growing-file.py
@@ -1,26 +1,4 @@
 #!/usr/bin/env python3
-# Regression: a file that grows between file-list scan and data send must not
-# abort the whole transfer.
-#
-# The sender records each file's length when it scans the file list, but re-
-# stats and maps the file at its *current* size when it later sends the data
-# (sender.c: do_fstat + map_file + match_sums use st.st_size).  A file that is
-# appended to in that window -- e.g. a live log rotated/written during a nightly
-# backup -- is therefore transmitted longer than its flist-recorded length.
-#
-# Stock rsync tolerates this: the receiver writes the grown content and the
-# transfer completes.  A hardening check added to receive_data()
-# (offset + i > total_size / offset + len > total_size) turned it into a fatal
-# "received more data than file length" RERR_PROTOCOL, tearing down the whole
-# connection so every file after the growing one is skipped.
-#
-# The receive_data() check is transport-agnostic (same code for a local, a
-# remote-shell, and a daemon receiver), so this drives the simplest case: a
-# local transfer with the growth injected during an earlier, throttled file.
-#
-# RED  (unfixed tree): rsync exits RERR_PROTOCOL (2) with "received more data
-#                      than file length".
-# GREEN (checks removed): rsync exits 0 and the grown file is copied.
 
 import filecmp
 import os
@@ -28,7 +6,7 @@
 import threading
 import time
 
-from rsyncfns import SCRATCHDIR, make_data_file, rmtree, rsync_argv, test_fail
+from harness.rsync import SCRATCHDIR, make_data_file, rmtree, rsync_argv, test_fail
 
 base = SCRATCHDIR / 'growing-file'
 src = base / 'src'
@@ -37,20 +15,15 @@
 src.mkdir(parents=True)
 dst.mkdir(parents=True)
 
-# 'aaa_big' sorts first and is sent first; --bwlimit throttles it so the append
-# to the later file lands well after the flist is built (--no-inc-recursive
-# forces the whole flist up front) but well before that file is sent.
 make_data_file(src / 'aaa_big', 6 * 1024 * 1024)
 
 grow = src / 'zzz_grow'
-make_data_file(grow, 4096)                 # flist records this small length
+make_data_file(grow, 4096)
 orig_size = grow.stat().st_size
 
 grow_done = threading.Event()
 
-
 def appender():
-    # After the flist scan, during aaa_big's ~4s throttled transfer.
     time.sleep(0.6)
     with open(grow, 'ab') as fh:
         fh.write(os.urandom(256 * 1024))
@@ -58,7 +31,6 @@ def appender():
         os.fsync(fh.fileno())
     grow_done.set()
 
-
 t = threading.Thread(target=appender)
 t.start()
 
@@ -68,8 +40,6 @@ def appender():
 
 t.join()
 
-# Guard against a vacuous run: the file must actually have grown during the
-# transfer, else we never exercised the scenario.
 if not grow_done.is_set() or grow.stat().st_size <= orig_size:
     test_fail("test setup: source file did not grow during the transfer")
 
@@ -87,9 +57,6 @@ def appender():
 if not (dst / 'aaa_big').is_file():
     test_fail("the earlier (throttled) file was not transferred")
 
-# Prove the scenario was actually exercised (not a vacuous pass): the sender
-# transmitted the *grown* content (more than the flist-recorded orig_size), and
-# the destination is a byte-for-byte copy of the final source.
 final_src = grow.stat().st_size
 dst_size = (dst / 'zzz_grow').stat().st_size
 if dst_size <= orig_size:
diff --git a/testsuite/highfd-hang_test.py b/testsuite/tests/transfer/highfd-hang.py
similarity index 58%
rename from testsuite/highfd-hang_test.py
rename to testsuite/tests/transfer/highfd-hang.py
index 3ae79d629..cab2dc888 100644
--- a/testsuite/highfd-hang_test.py
+++ b/testsuite/tests/transfer/highfd-hang.py
@@ -1,27 +1,4 @@
 #!/usr/bin/env python3
-"""Regression test for issue #231: high-numbered I/O descriptors.
-
-rsync's I/O readiness loops used to call select() with fd_set bitmaps, which can
-only represent descriptors below FD_SETSIZE.  If rsync is started with many
-descriptors already open -- e.g. inherited from a parent that leaked fds -- its
-own socket and pipe fds get allocated at or above that limit.  FD_SET() and
-FD_ISSET() then index past the end of the fixed-size fd_set, which is undefined
-behaviour: with a plain build select() reports the fd ready while FD_ISSET()
-reads the out-of-bounds bit as 0, so the read/write never happens and rsync
-spins at 100% CPU forever; with a fortified libc the process instead aborts
-("bit out of range 0 - FD_SETSIZE in fd_set").  Either way the transfer never
-completes.
-
-We reproduce that by opening enough inheritable dummy fds to push rsync's
-descriptors past FD_SETSIZE, then running an ordinary transfer with
-close_fds=False so the child inherits them.  With the poll()-based I/O the
-transfer finishes immediately; without it, it hangs or aborts.
-
-FD_SETSIZE is *not* hardcoded: it is 1024 with glibc but 65536 on 64-bit
-Solaris, and assuming 1024 there would open too few fds to cross the limit and
-pass vacuously.  We ask the C library for the real value instead, and skip when
-we cannot (no compiler, or the fd limit cannot be raised far enough).
-"""
 
 import os
 import resource
@@ -30,18 +7,13 @@
 import subprocess
 import tempfile
 
-from rsyncfns import (
+from harness.rsync import (
     FROMDIR, TODIR, rmtree, rsync_argv, test_fail, test_skipped,
 )
 
-TIMEOUT = 30  # poll() build: ~instant; the bug: hangs (or aborts)
-
+TIMEOUT = 30
 
 def probe_fd_setsize():
-    """Ask the C library for FD_SETSIZE rather than assuming a value."""
-    # CC is a command, not a filename: "ccache gcc" and "gcc -m32" are both
-    # ordinary values, and passing either to subprocess as one argv[0] looks
-    # for a program with a space in its name.
     cc = shlex.split(os.environ.get('CC') or '')
     if not cc:
         found = shutil.which('cc') or shutil.which('gcc')
@@ -61,7 +33,7 @@ def probe_fd_setsize():
                 return None
             proc = subprocess.run([exe], capture_output=True, text=True)
         except OSError:
-            return None          # CC names something we cannot execute
+            return None
         if proc.returncode != 0:
             return None
         try:
@@ -69,12 +41,10 @@ def probe_fd_setsize():
         except ValueError:
             return None
 
-
 fd_setsize = probe_fd_setsize()
 if not fd_setsize:
-    test_skipped("could not determine FD_SETSIZE (no usable C compiler)")
+    test_skipped("could not determine FD_SETSIZE (no usable C compiler)", capability='high_fd')
 
-# Push rsync's descriptors comfortably past the limit.
 ndummy = fd_setsize + 80
 want = ndummy + 64
 
@@ -82,7 +52,8 @@ def probe_fd_setsize():
 if soft < want:
     if hard != resource.RLIM_INFINITY and hard < want:
         test_skipped(f"RLIMIT_NOFILE hard cap {hard} < {want}; cannot place fds "
-                     f"above FD_SETSIZE ({fd_setsize}) to exercise issue #231")
+                     f"above FD_SETSIZE ({fd_setsize}) to exercise issue #231",
+                     capability='high_fd')
     resource.setrlimit(resource.RLIMIT_NOFILE, (want, hard))
 
 rmtree(FROMDIR)
@@ -94,9 +65,6 @@ def probe_fd_setsize():
 for name, data in payload.items():
     (FROMDIR / name).write_bytes(data)
 
-# Occupy the low fd numbers with inheritable dummy descriptors so the rsync
-# child's socket/pipe fds land above FD_SETSIZE.  Python opens fds O_CLOEXEC by
-# default, so mark each inheritable and use close_fds=False.
 dummies = []
 try:
     while True:
diff --git a/testsuite/tests/transfer/iconv.py b/testsuite/tests/transfer/iconv.py
new file mode 100644
index 000000000..be9118260
--- /dev/null
+++ b/testsuite/tests/transfer/iconv.py
@@ -0,0 +1,221 @@
+#!/usr/bin/env python3
+
+import os
+import subprocess
+
+from harness.rsync import (
+    RSYNC, RSYNC_PEER, SCRATCHDIR,
+    makepath, rmtree, rsync_argv, rsync_path_arg, rsh_cmd,
+    split_rsync_cmd, start_test_daemon, test_fail, test_skipped,
+    write_daemon_conf,
+)
+
+UTF8_NAME = b'caf\xc3\xa9.txt'
+LATIN1_NAME = b'caf\xe9.txt'
+UTF8_TARGET = b'cibl\xc3\xa9.txt'
+LATIN1_TARGET = b'cibl\xe9.txt'
+PAYLOAD = b'contents are not converted\n\x00\xff'
+
+base = SCRATCHDIR / 'iconv'
+rmtree(base)
+makepath(base)
+
+def iconv_works(command, label):
+    source = base / f'probe-{label}-src'
+    destination = base / f'probe-{label}-dst'
+    makepath(source, destination)
+    (source / 'plain').write_bytes(b'probe\n')
+    proc = subprocess.run(
+        split_rsync_cmd(command) + [
+            '-r', '--iconv=UTF-8,ISO-8859-1',
+            f'{source}/', f'{destination}/',
+        ],
+        stdout=subprocess.PIPE,
+        stderr=subprocess.STDOUT,
+    )
+    return proc.returncode == 0 and (destination / 'plain').is_file()
+
+def forced_protocol(command):
+    for arg in split_rsync_cmd(command):
+        if arg.startswith('--protocol='):
+            return int(arg.partition('=')[2])
+    return None
+
+if not iconv_works(RSYNC, 'client'):
+    test_skipped('rsync under test does not provide working --iconv support', capability='iconv')
+if RSYNC_PEER != RSYNC and not iconv_works(RSYNC_PEER, 'peer'):
+    test_skipped('selected peer does not provide working --iconv support', capability='iconv')
+
+def raw_path(directory, name):
+    return os.path.join(os.fsencode(directory), name)
+
+def write_raw(directory, name, contents=PAYLOAD):
+    makepath(directory)
+    with open(raw_path(directory, name), 'wb') as stream:
+        stream.write(contents)
+
+def assert_file(directory, name, label):
+    path = raw_path(directory, name)
+    if not os.path.isfile(path):
+        test_fail(f'{label}: missing filename bytes {name!r}')
+    with open(path, 'rb') as stream:
+        if stream.read() != PAYLOAD:
+            test_fail(f'{label}: file contents changed during filename conversion')
+
+def assert_only_names(directory, expected, label):
+    actual = set(os.listdir(os.fsencode(directory)))
+    if actual != set(expected):
+        test_fail(f'{label}: names {actual!r}, expected {set(expected)!r}')
+
+def invoke(*args, env=None, expected=0):
+    proc = subprocess.run(
+        rsync_argv(*args),
+        stdout=subprocess.PIPE,
+        stderr=subprocess.PIPE,
+        env=env,
+    )
+    if proc.returncode != expected:
+        test_fail(
+            f'rsync exited {proc.returncode}, expected {expected} for {args!r}: '
+            f'{proc.stderr.decode(errors="replace")}'
+        )
+    return proc
+
+probe = raw_path(base, b'probe-\xe9')
+try:
+    fd = os.open(probe, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)
+    os.close(fd)
+    preserves_bytes = b'probe-\xe9' in os.listdir(os.fsencode(base))
+    os.unlink(probe)
+    if not preserves_bytes:
+        test_skipped('filesystem does not preserve ISO-8859-1 filename bytes',
+                     capability='raw_filename_bytes')
+except OSError as exc:
+    test_skipped(f'filesystem cannot represent ISO-8859-1 filename bytes: {exc}',
+                 capability='raw_filename_bytes')
+
+ssh = rsh_cmd()
+rpath = f'--rsync-path={rsync_path_arg()}'
+convert = '--iconv=UTF-8,ISO-8859-1'
+protocols = [p for p in (forced_protocol(RSYNC), forced_protocol(RSYNC_PEER)) if p]
+convert_symlink_target = not protocols or min(protocols) >= 30
+
+push_src = base / 'push-src'
+push_dst = base / 'push-dst'
+pull_dst = base / 'pull-dst'
+makepath(push_src, push_dst, pull_dst)
+write_raw(push_src, UTF8_NAME)
+write_raw(push_src, UTF8_TARGET)
+os.symlink(UTF8_TARGET, raw_path(push_src, b'link'))
+
+invoke('-rl', convert, '-e', ssh, rpath,
+       f'{push_src}/', f'localhost:{push_dst}/')
+assert_only_names(push_dst, (LATIN1_NAME, LATIN1_TARGET, b'link'), 'push')
+assert_file(push_dst, LATIN1_NAME, 'push')
+push_target = LATIN1_TARGET if convert_symlink_target else UTF8_TARGET
+actual_target = os.readlink(raw_path(push_dst, b'link'))
+if actual_target != push_target:
+    test_fail(f'push: symlink target {actual_target!r}, expected {push_target!r}')
+
+invoke('-rl', convert, '-e', ssh, rpath,
+       f'localhost:{push_dst}/', f'{pull_dst}/')
+assert_only_names(pull_dst, (UTF8_NAME, UTF8_TARGET, b'link'), 'pull')
+assert_file(pull_dst, UTF8_NAME, 'pull')
+if os.readlink(raw_path(pull_dst, b'link')) != UTF8_TARGET:
+    test_fail('pull: symlink target was not converted to UTF-8')
+
+files_push = base / 'files-push'
+files_pull = base / 'files-pull'
+makepath(files_push, files_pull)
+local_list = base / 'local-list'
+local_list.write_bytes(UTF8_NAME + b'\n')
+invoke('-r', '-s', convert, '-e', ssh, rpath,
+       f'--files-from={local_list}', f'{push_src}/',
+       f'localhost:{files_push}/')
+assert_only_names(files_push, (LATIN1_NAME,), 'local --files-from')
+assert_file(files_push, LATIN1_NAME, 'local --files-from')
+
+remote_list = base / 'remote-list'
+remote_list.write_bytes(LATIN1_NAME + b'\n')
+invoke('-r', '-s', convert, '-e', ssh, rpath,
+       f'--files-from=localhost:{remote_list}',
+       f'localhost:{push_dst}/', f'{files_pull}/')
+assert_only_names(files_pull, (UTF8_NAME,), 'remote --files-from')
+assert_file(files_pull, UTF8_NAME, 'remote --files-from')
+
+arg_pull = base / 'arg-pull'
+makepath(arg_pull)
+remote_name = os.fsdecode(UTF8_NAME)
+invoke('-s', convert, '-e', ssh, rpath,
+       f'localhost:{push_dst}/{remote_name}', f'{arg_pull}/')
+assert_only_names(arg_pull, (UTF8_NAME,), '--secluded-args')
+assert_file(arg_pull, UTF8_NAME, '--secluded-args')
+
+invalid_src = base / 'invalid-src'
+invalid_dst = base / 'invalid-dst'
+makepath(invalid_src, invalid_dst)
+write_raw(invalid_src, b'bad-\xff')
+(invalid_src / 'sentinel').write_bytes(b'keep\n')
+(invalid_dst / 'sentinel').write_bytes(b'keep\n')
+(invalid_dst / 'stale').write_bytes(b'do not delete yet\n')
+proc = invoke('-r', '--delete', convert, '-e', ssh, rpath,
+              f'{invalid_src}/', f'localhost:{invalid_dst}/', expected=23)
+if b'cannot convert filename' not in proc.stderr:
+    test_fail('invalid UTF-8 filename did not report a conversion failure')
+assert_only_names(invalid_dst, (b'sentinel', b'stale'), 'I/O-safe deletion')
+if (invalid_dst / 'sentinel').read_bytes() != b'keep\n':
+    test_fail('invalid filename transfer changed the existing destination')
+
+invoke('-r', '--delete', '--ignore-errors', convert, '-e', ssh, rpath,
+       f'{invalid_src}/', f'localhost:{invalid_dst}/', expected=23)
+assert_only_names(invalid_dst, (b'sentinel',), '--ignore-errors')
+if (invalid_dst / 'sentinel').read_bytes() != b'keep\n':
+    test_fail('--ignore-errors changed the retained payload')
+
+noiconv_dst = base / 'noiconv-dst'
+makepath(noiconv_dst)
+env = os.environ.copy()
+env['RSYNC_ICONV'] = 'UTF-8,ISO-8859-1'
+invoke('-rl', '--no-iconv', '-e', ssh, rpath,
+       f'{push_src}/', f'localhost:{noiconv_dst}/', env=env)
+assert_only_names(noiconv_dst, (UTF8_NAME, UTF8_TARGET, b'link'), '--no-iconv')
+assert_file(noiconv_dst, UTF8_NAME, '--no-iconv')
+if os.readlink(raw_path(noiconv_dst, b'link')) != UTF8_TARGET:
+    test_fail('--no-iconv converted the symlink target from the environment default')
+
+daemon_dst = base / 'daemon-dst'
+daemon_ignore_dst = base / 'daemon-ignore-dst'
+makepath(daemon_dst, daemon_ignore_dst)
+(daemon_ignore_dst / 'sentinel').write_bytes(b'keep\n')
+(daemon_ignore_dst / 'stale').write_bytes(b'delete through module policy\n')
+conf = write_daemon_conf([
+    ('encoded', {
+        'path': str(daemon_dst),
+        'read only': 'no',
+        'charset': 'ISO-8859-1',
+        'munge symlinks': 'no',
+    }),
+    ('encoded-ignore', {
+        'path': str(daemon_ignore_dst),
+        'read only': 'no',
+        'charset': 'ISO-8859-1',
+        'ignore errors': 'yes',
+    }),
+], name='iconv-rsyncd.conf')
+url = start_test_daemon(conf, 18732)
+invoke('-rl', '--iconv=UTF-8', f'{push_src}/', f'{url}encoded/')
+assert_only_names(daemon_dst, (LATIN1_NAME, LATIN1_TARGET, b'link'),
+                  'daemon charset')
+assert_file(daemon_dst, LATIN1_NAME, 'daemon charset')
+daemon_target = LATIN1_TARGET if convert_symlink_target else UTF8_TARGET
+actual_target = os.readlink(raw_path(daemon_dst, b'link'))
+if actual_target != daemon_target:
+    test_fail(f'daemon: symlink target {actual_target!r}, expected {daemon_target!r}')
+
+invoke('-r', '--delete', '--iconv=UTF-8', f'{invalid_src}/',
+       f'{url}encoded-ignore/', expected=23)
+assert_only_names(daemon_ignore_dst, (b'sentinel',), 'daemon ignore errors')
+if (daemon_ignore_dst / 'sentinel').read_bytes() != b'keep\n':
+    test_fail('daemon ignore errors changed the retained payload')
+
+print('iconv: names, arguments, file lists, symlinks, error deletion and daemon charset')
diff --git a/testsuite/tests/transfer/ignore-missing-args.py b/testsuite/tests/transfer/ignore-missing-args.py
new file mode 100644
index 000000000..f94e3571f
--- /dev/null
+++ b/testsuite/tests/transfer/ignore-missing-args.py
@@ -0,0 +1,52 @@
+#!/usr/bin/env python3
+
+from harness.rsync import (
+    SCRATCHDIR, makepath, rmtree, rsync_path_arg, rsh_cmd, run_rsync,
+    test_fail,
+)
+
+base = SCRATCHDIR / 'ignore-missing-args'
+src = base / 'src'
+dest = base / 'dest'
+existing = src / 'deep' / 'existing'
+missing = src / 'deep' / 'missing'
+rmtree(base)
+makepath(existing.parent, dest)
+existing.write_text('retained\n')
+
+def assert_existing(path, label):
+    if not path.is_file() or path.read_text() != 'retained\n':
+        test_fail(f'{label}: existing source was not transferred')
+
+control = run_rsync('-r', str(existing), str(missing), f'{dest}/',
+                    check=False, capture_output=True)
+if control.returncode != 23:
+    test_fail('missing source control did not report a partial transfer: '
+              f'rc={control.returncode}\n{control.stderr}')
+
+rmtree(dest)
+makepath(dest)
+run_rsync('-r', '--ignore-missing-args', str(existing), str(missing),
+          f'{dest}/')
+assert_existing(dest / 'existing', 'local arguments')
+
+rmtree(dest)
+makepath(dest)
+ssh = rsh_cmd()
+run_rsync('-r', '--ignore-missing-args', '-e', ssh,
+          f'--rsync-path={rsync_path_arg()}',
+          f'localhost:{existing}', f'localhost:{missing}', f'{dest}/')
+assert_existing(dest / 'existing', 'remote-shell arguments')
+
+rmtree(dest)
+makepath(dest)
+files_from = base / 'files-from'
+files_from.write_text('deep/existing\ndeep/missing\n')
+run_rsync('-r', '--ignore-missing-args', f'--files-from={files_from}',
+          f'{src}/', f'{dest}/')
+assert_existing(dest / 'deep' / 'existing', '--files-from arguments')
+
+if (dest / 'deep' / 'missing').exists():
+    test_fail('--ignore-missing-args created the absent source')
+
+print('--ignore-missing-args suppresses only missing initial source arguments')
diff --git a/testsuite/inplace_test.py b/testsuite/tests/transfer/inplace.py
similarity index 58%
rename from testsuite/inplace_test.py
rename to testsuite/tests/transfer/inplace.py
index e0c207929..5c94bc5ef 100644
--- a/testsuite/inplace_test.py
+++ b/testsuite/tests/transfer/inplace.py
@@ -1,18 +1,8 @@
 #!/usr/bin/env python3
-"""Coverage of --inplace at depth.
-
---inplace updates the destination file directly instead of writing a temp copy
-and renaming it over the original, so across a delta update the destination
-keeps the SAME inode. Without --inplace the receiver creates a fresh temp file
-and renames it, giving the destination a NEW inode. Both behaviours hinge on
-how the receiver resolves the destination directory and (for the default mode)
-performs the temp->final rename, which the path restructure rewrites; verify
-them on a file >=3 levels deep.
-"""
 
 import os
 
-from rsyncfns import (
+from harness.rsync import (
     FROMDIR, TODIR,
     assert_same, make_tree, rmtree, run_rsync, test_fail,
 )
@@ -20,22 +10,15 @@
 src = FROMDIR
 deep = os.path.join('d1', 'd2', 'd3', 'f3')
 
-
 def seed():
     rmtree(src)
     rmtree(TODIR)
     make_tree(src, depth=3, data=True, data_size=200000)
 
-
 def inode(path):
     return os.stat(path).st_ino
 
-
 def modify_deep():
-    # Rewrite a chunk in the middle so it is a genuine delta, not just a tail
-    # append. Bump mtime by a clear margin (the whole test runs inside one
-    # second, so a "now" touch would collide with the destination's mtime and
-    # the size-unchanged file would be skipped by the quick check).
     p = src / deep
     data = bytearray(p.read_bytes())
     data[1000:1100] = bytes((b ^ 0xFF) for b in data[1000:1100])
@@ -43,8 +26,6 @@ def modify_deep():
     st = os.stat(p)
     os.utime(p, (st.st_atime, st.st_mtime + 100))
 
-
-# --- --inplace keeps the destination inode across a delta update ------------
 seed()
 run_rsync('-a', f'{src}/', f'{TODIR}/')
 ino_before = inode(TODIR / deep)
@@ -56,7 +37,6 @@ def modify_deep():
     test_fail("--inplace changed the destination inode at depth "
               f"({ino_before} -> {inode(TODIR / deep)})")
 
-# --- control: the default (temp+rename) path replaces the inode -------------
 seed()
 run_rsync('-a', f'{src}/', f'{TODIR}/')
 ino_before = inode(TODIR / deep)
diff --git a/testsuite/tests/transfer/io-error-mask.py b/testsuite/tests/transfer/io-error-mask.py
new file mode 100644
index 000000000..1b3fb813b
--- /dev/null
+++ b/testsuite/tests/transfer/io-error-mask.py
@@ -0,0 +1,119 @@
+#!/usr/bin/env python3
+
+import os
+import re
+import signal
+import subprocess
+import sys
+import time
+
+from harness.rsync import (
+    FROMDIR, SCRATCHDIR, TODIR, claim_ports, make_data_file, makepath, rmtree,
+    rsync_argv, start_rsyncd, test_fail, test_skipped, build_rsyncd_conf,
+    USE_TCP,
+)
+
+KNOWN_RERR = {
+    0,
+    1,
+    2,
+    3,
+    4,
+    5,
+    10,
+    11,
+    12,
+    13,
+    14,
+    15,
+    16,
+    19,
+    20,
+    21,
+    22,
+    23,
+    24,
+    25,
+    30,
+    35,
+    124,
+    125,
+    126,
+    127,
+}
+
+PORT = 12966
+
+if not USE_TCP:
+    test_skipped("needs --use-tcp to kill the daemon (sender) mid-transfer", capability='tcp')
+
+conf = build_rsyncd_conf()
+
+rmtree(FROMDIR)
+rmtree(TODIR)
+makepath(FROMDIR)
+makepath(TODIR)
+make_data_file(FROMDIR / 'bigfile', 8 * 1024 * 1024)
+
+claim_ports(PORT)
+daemon = start_rsyncd(conf, PORT)
+
+client = subprocess.Popen(
+    rsync_argv('-a', '--bwlimit=64', '--timeout=60',
+               f'rsync://127.0.0.1:{PORT}/test-from/', f'{TODIR}/'),
+    stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True,
+)
+
+child_pids = []
+deadline = time.monotonic() + 10
+while time.monotonic() < deadline:
+    try:
+        logtext = (SCRATCHDIR / 'rsyncd.log').read_text()
+        child_pids = [int(pid) for pid in re.findall(r'\[(\d+)\] rsync on ', logtext)]
+    except OSError:
+        pass
+    if child_pids:
+        break
+    if client.poll() is not None:
+        break
+    time.sleep(0.05)
+if not child_pids:
+    client.kill()
+    out, _ = client.communicate()
+    test_fail(f"daemon sender did not start before the transfer exited:\n{out}")
+for pid in child_pids:
+    try:
+        os.kill(pid, signal.SIGKILL)
+    except (ProcessLookupError, PermissionError):
+        pass
+if daemon.poll() is None:
+    daemon.kill()
+    try:
+        daemon.wait(timeout=5)
+    except subprocess.TimeoutExpired:
+        pass
+
+try:
+    out, _ = client.communicate(timeout=30)
+except subprocess.TimeoutExpired:
+    client.kill()
+    client.communicate()
+    test_fail("receiver did not exit after the sender was killed (hung)")
+
+rc = client.returncode
+if rc not in KNOWN_RERR:
+    sys.stderr.write(
+        f"receiver exited with {rc}, which is NOT a documented RERR_* value; "
+        f"output:\n{out}\n"
+    )
+    sys.exit(1)
+
+if rc == 0:
+    print("io-error-mask: receiver exited 0 (transfer may have completed "
+          "before the kill); no out-of-range exit code observed.")
+else:
+    print(f"io-error-mask: receiver exited {rc} (a documented RERR_* "
+          f"value) after the sender was killed mid-transfer; no arbitrary "
+          f"io_error bit propagated to the exit code.")
+
+sys.exit(0)
diff --git a/testsuite/itemize_test.py b/testsuite/tests/transfer/itemize.py
similarity index 78%
rename from testsuite/itemize_test.py
rename to testsuite/tests/transfer/itemize.py
index b6a4e8951..91f1fadc5 100644
--- a/testsuite/itemize_test.py
+++ b/testsuite/tests/transfer/itemize.py
@@ -1,20 +1,26 @@
 #!/usr/bin/env python3
-# Python rewrite of testsuite/itemize.test.
-#
-# Test the output of various copy commands to ensure itemized output
-# (-i, -ii) and double-verbose output (-vv) match the canonical
-# representations across whole-file and delta paths.
 
 import os
 import shutil
 
-from rsyncfns import (
-    CHKFILE, FROMDIR, RSYNC, SCRATCHDIR, SRCDIR, TMPDIR, TODIR,
-    all_plus, allspace, dots,
-    checkdiff, cp_p, makepath, run_rsync, v_filt, hardlink_symlinks_supported,
+from harness.rsync import (
+    FROMDIR,
+    RSYNC,
+    SCRATCHDIR,
+    SRCDIR,
+    TMPDIR,
+    TODIR,
+    all_plus,
+    allspace,
+    dots,
+    checkdiff,
+    cp_p,
+    makepath,
+    run_rsync,
+    v_filt,
+    hardlink_symlinks_supported,
 )
 
-
 to2dir = TMPDIR / 'to2'
 
 makepath(FROMDIR / 'foo', FROMDIR / 'bar' / 'baz')
@@ -35,23 +41,9 @@
 if to2dir.is_file():
     to2dir.unlink()
 
-
-# Detect what this rsync build supports.
 vv = run_rsync('-VV', check=True, capture_output=True).stdout
 hardlink_symlinks = '"hardlink_symlinks": true' in vv
 symtimes_supported = '"symtimes": true' in vv
-# The only itemisation difference between a platform that can hard-link a
-# symlink and one that cannot is the change-type letter where the symlink
-# itself is transferred: hL when it is hard-linked, cL when it is copied.
-# The attribute field, the "is uptodate" wording and the --copy-dest lines
-# are identical either way -- measured on macOS 10.13, the one platform that
-# lacks the capability (linkat(AT_FDCWD, sym, ..., 0) is EOPNOTSUPP there).
-#
-# The two answers can disagree, so both are asked.  The build capability is
-# decided by configure on whatever filesystem the source tree sat on, while the
-# link happens on whichever filesystem holds the test data: macOS builds on APFS
-# (yes) and can write to HFS+ (ENOTSUP).  rsync falls back to a copy when the
-# filesystem refuses, so the letter follows the filesystem.
 L = ('hL' if hardlink_symlinks and hardlink_symlinks_supported(SCRATCHDIR)
      else 'cL')
 
@@ -62,8 +54,6 @@
 else:
     T = '.T'
 
-
-# First check: -iplr basic itemize on a fresh transfer.
 checkdiff(['-iplr', f'{FROMDIR}/', f'{TODIR}/'],
           f"created directory {TODIR}\n"
           f"cd{all_plus} ./\n"
@@ -76,10 +66,8 @@
           f">f{all_plus} foo/extra\n"
           f"cL{all_plus} foo/sym -> ../bar/baz/rsync\n")
 
-# Touch dir times so subsequent itemize diffs don't pick up dir-time noise.
 run_rsync('-a', '-f', '-! */', f'{FROMDIR}/', str(TODIR))
 
-# Permute one file's content + mode; expect a content/mode itemize.
 cp_p(SRCDIR / 'configure.ac', FROMDIR / 'foo' / 'config2')
 os.chmod(FROMDIR / 'foo' / 'config2', 0o601)
 
@@ -89,17 +77,21 @@
           f">f.sTp{dots} foo/config2\n"
           f"hf..T.{dots} foo/extra => foo/config1\n")
 
-# Re-touch dirs, permute config2 again and replace the symlink target.
 run_rsync('-a', '-f', '-! */', f'{FROMDIR}/', str(TODIR))
 cp_p(SRCDIR / 'config.sub', FROMDIR / 'foo' / 'config2')
-import time
-time.sleep(1)  # to provoke a directory mtime change below
 (TODIR / 'foo' / 'sym').unlink()
 old_umask = os.umask(0)
 try:
     os.symlink('../bar/baz', TODIR / 'foo' / 'sym')
 finally:
     os.umask(old_umask)
+src_foo = (FROMDIR / 'foo').stat()
+os.utime(TODIR / 'foo', (src_foo.st_atime, src_foo.st_mtime + 10))
+if symtimes_supported:
+    src_sym = os.stat(FROMDIR / 'foo' / 'sym', follow_symlinks=False)
+    os.utime(TODIR / 'foo' / 'sym',
+             (src_sym.st_atime, src_sym.st_mtime + 10),
+             follow_symlinks=False)
 os.chmod(FROMDIR / 'foo' / 'config2', 0o600)
 os.chmod(TODIR / 'bar' / 'baz' / 'rsync', 0o777)
 
@@ -110,8 +102,6 @@
           f">fcstp{dots} foo/config2\n"
           f"cLc{T}.{dots} foo/sym -> ../bar/baz/rsync\n")
 
-# Re-permute config2, leaving the others untouched; lack of -t is for
-# the unchanged-hard-link stress test.
 cp_p(SRCDIR / 'configure.ac', FROMDIR / 'foo' / 'config2')
 os.chmod(FROMDIR / 'foo' / 'config2', 0o600)
 
@@ -123,7 +113,6 @@
           "foo/config2\n",
           filter=v_filt)
 
-# Touch a mode change on one dest file then run -ii to see "no change".
 os.chmod(TODIR / 'bar' / 'baz' / 'rsync', 0o747)
 run_rsync('-a', '-f', '-! */', f'{FROMDIR}/', str(TODIR))
 
@@ -139,21 +128,22 @@
           f".L{allspace} foo/sym -> ../bar/baz/rsync\n",
           filter=v_filt)
 
-# Permute one perm and re-touch a file; expect just those two itemizes.
 os.chmod(TODIR / 'foo' / 'config1', 0o757)
-(TODIR / 'foo' / 'config2').touch()
+src_config2 = (FROMDIR / 'foo' / 'config2').stat()
+os.utime(TODIR / 'foo' / 'config2',
+         (src_config2.st_atime, src_config2.st_mtime + 10))
 checkdiff(['-vplrtH', f'{FROMDIR}/', f'{TODIR}/'],
           "foo/config2\n",
           filter=v_filt)
 
 os.chmod(TODIR / 'foo' / 'config1', 0o757)
-(TODIR / 'foo' / 'config2').touch()
+src_config2 = (FROMDIR / 'foo' / 'config2').stat()
+os.utime(TODIR / 'foo' / 'config2',
+         (src_config2.st_atime, src_config2.st_mtime + 10))
 checkdiff(['-iplrtH', f'{FROMDIR}/', f'{TODIR}/'],
           f".f...p{dots} foo/config1\n"
           f">f..t.{dots} foo/config2\n")
 
-
-# --copy-dest variants.
 checkdiff(['-ivvplrtH', '--copy-dest=../to', f'{FROMDIR}/', f'{to2dir}/'],
           f"cd{allspace} ./\n"
           f"cd{allspace} bar/\n"
@@ -184,8 +174,6 @@
           "foo/extra => foo/config1\n",
           filter=v_filt)
 
-
-# --link-dest variants.
 shutil.rmtree(to2dir, ignore_errors=True)
 checkdiff(['-ivvplrtH', f'--link-dest={TODIR}', f'{FROMDIR}/', f'{to2dir}/'],
           f"cd{allspace} ./\n"
@@ -220,8 +208,6 @@
           f"foo/sym is uptodate\n",
           filter=v_filt)
 
-
-# --compare-dest variants.
 shutil.rmtree(to2dir, ignore_errors=True)
 checkdiff(['-ivvplrtH', f'--compare-dest={TODIR}', f'{FROMDIR}/', f'{to2dir}/'],
           f"cd{allspace} ./\n"
diff --git a/testsuite/iwildmatch-fold_test.py b/testsuite/tests/transfer/iwildmatch-fold.py
similarity index 56%
rename from testsuite/iwildmatch-fold_test.py
rename to testsuite/tests/transfer/iwildmatch-fold.py
index 2a4ea9cff..2ce02cc3b 100644
--- a/testsuite/iwildmatch-fold_test.py
+++ b/testsuite/tests/transfer/iwildmatch-fold.py
@@ -1,13 +1,8 @@
 #!/usr/bin/env python3
-# Regression test for KI-53: iwildmatch() must fold case on BOTH the text and the
-# pattern.  The old dowild() folded only the text char, so an upper-case pattern
-# token (e.g. a daemon "hosts deny = *.BADDOMAIN.COM") failed to match a
-# lower-case host -> access-control fail-open.  The t_iwildmatch helper links the
-# real lib/wildmatch.o and exercises the fold both ways.
 
 import subprocess
 
-from rsyncfns import TOOLDIR, test_fail, test_skipped
+from harness.rsync import TOOLDIR, test_fail, test_skipped
 
 helper = TOOLDIR / 't_iwildmatch'
 if not helper.is_file():
diff --git a/testsuite/log-control-chars_test.py b/testsuite/tests/transfer/log-control-chars.py
similarity index 68%
rename from testsuite/log-control-chars_test.py
rename to testsuite/tests/transfer/log-control-chars.py
index dc896e102..1516af16c 100644
--- a/testsuite/log-control-chars_test.py
+++ b/testsuite/tests/transfer/log-control-chars.py
@@ -1,12 +1,8 @@
 #!/usr/bin/env python3
-# Regression for KI-51/52: the log file must escape control characters in a
-# (possibly attacker-controlled) filename, so an admin who cat's the log can't
-# have terminal escapes injected (CWE-117).  Covers both C0 (< 0x20) and the C1
-# range (0x80-0x9f, incl CSI 0x9b) on the log path.
 
 import os
 
-from rsyncfns import SCRATCHDIR, run_rsync, test_fail, test_skipped
+from harness.rsync import SCRATCHDIR, run_rsync, test_fail, test_skipped
 
 base = SCRATCHDIR / 'logctl'
 src = base / 'src'
@@ -23,7 +19,7 @@
             fh.write(b'x')
         made += 1
     except OSError:
-        pass  # a filesystem that rejects control-char names (e.g. Cygwin)
+        pass
 if made == 0:
     test_skipped("filesystem rejects control-char filenames")
 
diff --git a/testsuite/tests/transfer/log-format-width.py b/testsuite/tests/transfer/log-format-width.py
new file mode 100644
index 000000000..6403446c3
--- /dev/null
+++ b/testsuite/tests/transfer/log-format-width.py
@@ -0,0 +1,88 @@
+#!/usr/bin/env python3
+
+import re
+import subprocess
+
+from harness.rsync import (
+    FROMDIR, TODIR,
+    forced_protocol, makepath, rmtree, rsync_argv, test_fail,
+)
+
+src = FROMDIR
+
+rmtree(src)
+rmtree(TODIR)
+makepath(src)
+(src / 'percentfile').write_text("data\n")
+
+p = subprocess.run(
+    rsync_argv('-a', '--out-format=100%% done %f', f'{src}/', f'{TODIR}/'),
+    capture_output=True, text=True,
+)
+if p.returncode != 0:
+    test_fail(f"rsync exited {p.returncode}:\n{p.stderr}")
+
+if '100% done ' not in p.stdout or 'percentfile' not in p.stdout:
+    test_fail(
+        "expected '100% done ' (a single literal percent) and 'percentfile' in "
+        f"--out-format output, got:\n{p.stdout}"
+    )
+
+(src / 'percentfile').chmod(0o640)
+p = subprocess.run(
+    rsync_argv('-a', '--out-format=%%i %n', f'{src}/', f'{TODIR}/'),
+    capture_output=True, text=True,
+)
+if p.returncode != 0:
+    test_fail(f"rsync exited {p.returncode}:\n{p.stderr}")
+(src / 'percentfile').chmod(0o600)
+p = subprocess.run(
+    rsync_argv('-a', '--out-format=%%i %n', f'{src}/', f'{TODIR}/'),
+    capture_output=True, text=True,
+)
+if p.returncode != 0:
+    test_fail(f"rsync exited {p.returncode}:\n{p.stderr}")
+if 'percentfile' in p.stdout:
+    test_fail(
+        "'%%i' misdetected as itemizing: an attribute-only change was logged "
+        f"by --out-format='%%i %n':\n{p.stdout}"
+    )
+
+(src / 'percentfile').write_text("data2\n")
+p = subprocess.run(
+    rsync_argv('-a', '--out-format=%%i %n', f'{src}/', f'{TODIR}/'),
+    capture_output=True, text=True,
+)
+if p.returncode != 0:
+    test_fail(f"rsync exited {p.returncode}:\n{p.stderr}")
+if '%i percentfile' not in p.stdout:
+    test_fail(
+        "expected literal '%i percentfile' for a transferred file with "
+        f"--out-format='%%i %n', got:\n{p.stdout}"
+    )
+
+def checksum_for(fmt):
+    (src / 'percentfile').write_text("data3\n")
+    rmtree(TODIR)
+    r = subprocess.run(
+        rsync_argv('-a', '-c', f'--out-format={fmt} %n', f'{src}/', f'{TODIR}/'),
+        capture_output=True, text=True,
+    )
+    if r.returncode != 0:
+        test_fail(f"rsync -c exited {r.returncode} for --out-format={fmt!r}:\n{r.stderr}")
+    m = re.search(r'([0-9a-f]+) percentfile', r.stdout)
+    if not m:
+        test_fail(f"no '<hex> percentfile' in --out-format={fmt!r} output:\n{r.stdout}")
+    return m.group(1)
+
+proto = forced_protocol()
+if proto is None or proto >= 30:
+    plain = checksum_for('%C')
+    wide = checksum_for('%' + '0' * 30 + '%C')
+    if not wide.endswith(plain):
+        test_fail(
+            f"over-wide %C rendered ...{wide[-len(plain):]!r} but plain %C rendered "
+            f"{plain!r}: log_format_has()/log_formatted() disagree on the escape position"
+        )
+
+print('log format width and literal percent handling verified')
diff --git a/testsuite/longdir_test.py b/testsuite/tests/transfer/longdir.py
similarity index 59%
rename from testsuite/longdir_test.py
rename to testsuite/tests/transfer/longdir.py
index 4676c3f1a..cb8ef84a4 100644
--- a/testsuite/longdir_test.py
+++ b/testsuite/tests/transfer/longdir.py
@@ -1,15 +1,8 @@
 #!/usr/bin/env python3
-# Python rewrite of testsuite/longdir.test.
-#
-# Regression test for a 2.0.11 bug: rsync used to mishandle paths nested
-# inside a stupidly-long directory name. We build a three-deep nest of
-# 175-char directory names, drop a couple of files in the leaf, and
-# verify that --delete -avH still produces an identical destination.
 
-from rsyncfns import (FROMDIR, TODIR, checkit, hands_setup, make_text_file,
+from harness.rsync import (FROMDIR, TODIR, checkit, hands_setup, make_text_file,
                       test_skipped)
 
-
 hands_setup()
 
 longname = ('This-is-a-directory-with-a-stupidly-long-name-created-in-an-'
@@ -27,7 +20,6 @@
 except OSError:
     test_skipped("unable to create files in long directory")
 
-# Drop predictable, self-contained content into the two leaf files.
 make_text_file(longdir / '1', 50)
 make_text_file(longdir / '2', 100)
 
diff --git a/testsuite/merge_test.py b/testsuite/tests/transfer/multiple-sources.py
similarity index 76%
rename from testsuite/merge_test.py
rename to testsuite/tests/transfer/multiple-sources.py
index 069a74bbe..25f6c99f8 100644
--- a/testsuite/merge_test.py
+++ b/testsuite/tests/transfer/multiple-sources.py
@@ -1,22 +1,12 @@
 #!/usr/bin/env python3
-# Python rewrite of testsuite/merge.test.
-#
-# Verify that rsync merges files from multiple source directories into a
-# single destination, with later sources NOT clobbering earlier ones for
-# unchanged content and per-directory conflict resolution behaving as in
-# the canonical case.
 
 import os
-import time
 
-from rsyncfns import (
+from harness.rsync import (
     CHKDIR, TMPDIR, TODIR,
     checkit, cp_touch, run_rsync,
 )
 
-
-# Use relative names below so the rsync command line exercises the
-# arg-parsing path the way the shell test did.
 os.chdir(TMPDIR)
 
 for d in ('from1', 'from2', 'from3', 'deep'):
@@ -71,15 +61,9 @@
     cp_touch(src, str(CHKDIR / 'sub1'))
 cp_touch('from3/sub2/subby', str(CHKDIR / 'sub2'))
 
-# Make sure time has moved on before the rsync runs.
-time.sleep(1)
-
-# Pre-sync directory-only updates to flatten directory-time differences,
-# matching the shell test's --existing -f 'exclude,! */' preparation.
 def _flatten_dirs(src, dst):
     run_rsync('-av', '--existing', '-f', 'exclude,! */', f'{src}/', f'{dst}/')
 
-
 _flatten_dirs('from1', 'from2')
 _flatten_dirs('from2', 'from3')
 _flatten_dirs('from1', str(CHKDIR))
diff --git a/testsuite/tests/transfer/nonrecursive-directories.py b/testsuite/tests/transfer/nonrecursive-directories.py
new file mode 100644
index 000000000..d964d2005
--- /dev/null
+++ b/testsuite/tests/transfer/nonrecursive-directories.py
@@ -0,0 +1,23 @@
+#!/usr/bin/env python3
+
+from harness.rsync import (
+    FROMDIR, TODIR,
+    assert_same, make_tree, rmtree, run_rsync, test_fail,
+)
+
+src = FROMDIR
+rmtree(src)
+rmtree(TODIR)
+make_tree(src, depth=3)
+
+run_rsync('-d', f'{src}/', f'{TODIR}/')
+
+assert_same(TODIR / 'f0', src / 'f0', label='-d top-level file')
+if not (TODIR / 'd1').is_dir():
+    test_fail("-d did not create the top-level directory")
+if (TODIR / 'd1' / 'f1').exists():
+    test_fail("-d recursed into a directory (f1 should not exist)")
+if list((TODIR / 'd1').iterdir()):
+    test_fail("-d populated the directory; it should be empty")
+
+print("--dirs copies the top layer without recursing")
diff --git a/testsuite/tests/transfer/old-dirs.py b/testsuite/tests/transfer/old-dirs.py
new file mode 100644
index 000000000..70c05fc9b
--- /dev/null
+++ b/testsuite/tests/transfer/old-dirs.py
@@ -0,0 +1,41 @@
+#!/usr/bin/env python3
+
+from harness.rsync import (
+    SCRATCHDIR, makepath, rmtree, rsync_path_arg, rsh_cmd, run_rsync,
+    test_fail,
+)
+from harness import metadata
+
+metadata(features={'remote-shell'}, transports={'pipe', 'tcp'}, min_peer='2.6.0', mutates={'filesystem', 'process'}, tags={'compatibility', 'transfer', 'version-mix'})
+
+base = SCRATCHDIR / 'old-dirs'
+src = base / 'src'
+push = base / 'push'
+pull = base / 'pull'
+rmtree(base)
+makepath(src / 'one' / 'two', push, pull)
+(src / 'top').write_text('top\n')
+(src / 'one' / 'inside').write_text('inside\n')
+(src / 'one' / 'two' / 'deep').write_text('deep\n')
+
+ssh = rsh_cmd()
+rpath = f'--rsync-path={rsync_path_arg()}'
+
+def assert_shallow(path, label):
+    top = path / 'top'
+    if not top.is_file() or top.read_text() != 'top\n':
+        test_fail(f'{label}: root file was not transferred')
+    if not (path / 'one').is_dir():
+        test_fail(f'{label}: first-level directory was not transferred')
+    if (path / 'one' / 'inside').exists() or (path / 'one' / 'two').exists():
+        test_fail(f'{label}: --old-dirs recursed below the first directory level')
+
+run_rsync('--old-dirs', '-e', ssh, rpath,
+          f'{src}/', f'localhost:{push}/')
+assert_shallow(push, 'current sender')
+
+run_rsync('--old-d', '-e', ssh, rpath,
+          f'localhost:{src}/', f'{pull}/')
+assert_shallow(pull, 'peer sender')
+
+print('--old-dirs transfers one directory level in both remote directions')
diff --git a/testsuite/output-control-chars_test.py b/testsuite/tests/transfer/output-control-chars.py
similarity index 98%
rename from testsuite/output-control-chars_test.py
rename to testsuite/tests/transfer/output-control-chars.py
index 6b5595ecd..cbc8bd2f2 100644
--- a/testsuite/output-control-chars_test.py
+++ b/testsuite/tests/transfer/output-control-chars.py
@@ -1,9 +1,9 @@
 #!/usr/bin/env python3
+
 import os
 import subprocess
 
-from rsyncfns import SCRATCHDIR, rmtree, rsync_argv, test_fail
-
+from harness.rsync import SCRATCHDIR, rmtree, rsync_argv, test_fail
 
 def available_locales():
     proc = subprocess.run(['locale', '-a'], stdout=subprocess.PIPE,
@@ -12,15 +12,12 @@ def available_locales():
         return {}
     return {name.lower(): name for name in proc.stdout.decode('ascii', 'ignore').splitlines()}
 
-
 LOCALES = available_locales()
 
-
 def find_locale(locale_names):
     return next((LOCALES[candidate.lower()] for candidate in locale_names
                  if candidate.lower() in LOCALES), None)
 
-
 def check_locale_case(label, locale_names, name, expected, rejected):
     locale_name = find_locale(locale_names)
     if locale_name is None:
diff --git a/testsuite/output-options_test.py b/testsuite/tests/transfer/output-options.py
similarity index 57%
rename from testsuite/output-options_test.py
rename to testsuite/tests/transfer/output-options.py
index be68297be..cd99313f2 100644
--- a/testsuite/output-options_test.py
+++ b/testsuite/tests/transfer/output-options.py
@@ -1,21 +1,12 @@
 #!/usr/bin/env python3
-"""Breadth coverage of the output / reporting options.
-
-These options control rsync's OUTPUT, not its path handling, so they are
-checked for the documented output shape rather than at depth:
-  --version, --help, --itemize-changes (-i), --dry-run (-n), --stats,
-  --out-format, --list-only, --quiet (-q), --progress, -h, -8.
-
-Every rsync run that is expected to succeed has its exit status checked (a
-silent failure must not pass as "no output"), and the format-changing options
-(-h, -8) assert the documented difference rather than merely "didn't break".
-"""
 
 import os
+import platform
 import re
+import select
 import subprocess
 
-from rsyncfns import (
+from harness.rsync import (
     FROMDIR, TODIR,
     assert_not_exists, make_data_file, make_tree, makepath, rmtree, rsync_argv,
     test_fail, verify_dirs,
@@ -23,11 +14,7 @@
 
 src = FROMDIR
 
-
 def out(*args, want_rc=0, env=None, text=True):
-    """Run rsync capturing output. Unless want_rc is None, fail the test if the
-    exit status isn't want_rc -- so a broken transfer can't masquerade as the
-    expected (often empty) output."""
     p = subprocess.run(rsync_argv(*args), capture_output=True, text=text, env=env)
     if want_rc is not None and p.returncode != want_rc:
         err = p.stderr if text else p.stderr.decode('latin-1', 'replace')
@@ -35,8 +22,6 @@ def out(*args, want_rc=0, env=None, text=True):
                   f"expected {want_rc}:\n{err}")
     return p
 
-
-# --- --version / --help -----------------------------------------------------
 p = out('--version')
 if 'protocol version' not in p.stdout:
     test_fail(f"--version output unexpected:\n{p.stdout}")
@@ -49,66 +34,67 @@ def out(*args, want_rc=0, env=None, text=True):
 rmtree(TODIR)
 make_tree(src, depth=2)
 
-# --- --itemize-changes: a new file shows the create itemization -------------
 p = out('-ai', f'{src}/', f'{TODIR}/')
 if '>f+++++++++' not in p.stdout:
     test_fail(f"--itemize-changes missing create line:\n{p.stdout}")
 
-# --- --dry-run lists but does not create ------------------------------------
 rmtree(TODIR)
 p = out('-ain', f'{src}/', f'{TODIR}/')
 if '>f+++++++++' not in p.stdout:
     test_fail("--dry-run itemize output missing")
 assert_not_exists(TODIR / 'f0', label='--dry-run created a file')
 
-# --- --stats prints the summary block ---------------------------------------
 rmtree(TODIR)
 p = out('-a', '--stats', f'{src}/', f'{TODIR}/')
 if 'Number of files:' not in p.stdout or 'Total file size:' not in p.stdout:
     test_fail(f"--stats output missing expected lines:\n{p.stdout}")
 
-# --- --out-format=%n emits bare filenames -----------------------------------
+if platform.system() == 'Linux':
+    stats = out('-r', '--info=stats3', f'{src}/', f'{TODIR}/').stdout
+    if stats.count('heap statistics') < 3:
+        test_fail('--info=stats3 did not emit allocator statistics')
+
 rmtree(TODIR)
 p = out('-a', '--out-format=%n', f'{src}/', f'{TODIR}/')
 if 'f0' not in p.stdout:
     test_fail(f"--out-format=%n did not emit filenames:\n{p.stdout}")
 
-# --- --list-only lists the source without copying ---------------------------
-# Pass a destination too: without --list-only this transfer would populate
-# TODIR, so the assert_not_exists below actually proves the "without copying"
-# property rather than being vacuously true for a destination-less command.
+rmtree(TODIR)
+(src / 'checksum-a').write_text('a\n')
+(src / 'checksum-b').write_text('different\n')
+checksum = out('-rc', '--out-format=%C %n', f'{src}/', f'{TODIR}/').stdout
+digests = dict((match[2], match[1]) for match in re.finditer(r'^([0-9a-f]{16,128}) (\S+)$',
+                                                             checksum, re.M))
+if digests and (not {'checksum-a', 'checksum-b'} <= set(digests)
+                or digests['checksum-a'] == digests['checksum-b']):
+    test_fail('--out-format=%C did not distinguish file contents')
+if not digests and not re.search(r'^ {8,} \S+$', checksum, re.M):
+    test_fail('--out-format=%C emitted neither checksums nor the documented fallback')
+
 rmtree(TODIR)
 p = out('--list-only', '-r', f'{src}/', f'{TODIR}/')
 if 'f0' not in p.stdout:
     test_fail(f"--list-only did not list files:\n{p.stdout}")
 assert_not_exists(TODIR / 'f0', label='--list-only copied a file')
 
-# --- --quiet suppresses normal stdout BUT still transfers -------------------
-# Checking only for empty stdout would also pass if the transfer silently
-# failed, so confirm the destination actually received the tree.
 rmtree(TODIR)
 p = out('-a', '-q', f'{src}/', f'{TODIR}/')
 if p.stdout.strip() != '':
     test_fail(f"--quiet produced stdout: {p.stdout!r}")
 verify_dirs(src, TODIR, label='--quiet still transferred')
 
-# --- --progress shows a percentage ------------------------------------------
 rmtree(TODIR)
 p = out('-a', '--progress', f'{src}/', f'{TODIR}/')
 progress_re = r'[\d.,]+B\s+100%\s+[\d.,]+B/s\s+\d+:\d\d:\d\d'
 if not re.search(progress_re, p.stdout):
     test_fail(f"--progress did not show the expected final shape:\n{p.stdout}")
 
-# --quiet must suppress the progress carriage return as well as its text.
 rmtree(TODIR)
 p = out('-a', '-q', '--progress', f'{src}/', f'{TODIR}/')
 if p.stdout != '':
     test_fail(f"--quiet --progress produced stdout: {p.stdout!r}")
 verify_dirs(src, TODIR, label='--quiet --progress still transferred')
 
-# --- -h / --human-readable formats byte counts with a unit suffix -----------
-# Without -h, --stats prints grouped digits ("50,000 bytes"); with -h it uses a
-# K/M/G suffix ("50.00K"). Use a file big enough that the two forms differ.
 rmtree(src)
 rmtree(TODIR)
 makepath(src)
@@ -144,15 +130,10 @@ def out(*args, want_rc=0, env=None, text=True):
     test_fail("-hh should preserve raw byte formatting below the binary-unit "
               f"threshold:\n{below_threshold}")
 
-# --- -8 / --8-bit-output leaves high-bit filename bytes unescaped ------------
-# rsync escapes non-printable name bytes as \#NNN; -8 prints 8-bit bytes raw.
-# This needs a filename containing a high-bit byte and a C locale (where such a
-# byte is non-printable). Best-effort: skip silently where the filesystem can't
-# store the raw byte (macOS/Cygwin may reject or normalise it).
 rmtree(src)
 rmtree(TODIR)
 makepath(src)
-weird = os.fsencode(str(src)) + b'/hi\xf9name'   # 0xf9 -> octal 371
+weird = os.fsencode(str(src)) + b'/hi\xf9name'
 try:
     with open(weird, 'wb') as f:
         f.write(b"x\n")
@@ -164,7 +145,7 @@ def out(*args, want_rc=0, env=None, text=True):
     cenv = dict(os.environ, LC_ALL='C')
     makepath(TODIR)
     noesc = out('-ai', f'{src}/', f'{TODIR}/', env=cenv, text=False)
-    if rb'\#371' in noesc.stdout:        # FS preserved the raw byte as expected
+    if rb'\#371' in noesc.stdout:
         rmtree(TODIR)
         makepath(TODIR)
         esc = out('-ai', '-8', f'{src}/', f'{TODIR}/', env=cenv, text=False)
@@ -172,5 +153,67 @@ def out(*args, want_rc=0, env=None, text=True):
             test_fail("-8 should leave the high-bit name byte unescaped, but "
                       f"the \\#371 escape was still present:\n{esc.stdout!r}")
 
+rmtree(src)
+rmtree(TODIR)
+makepath(src, TODIR)
+(src / 'keep').write_text('keep\n')
+(src / 'hide.tmp').write_text('hide\n')
+
+p = out('-r', '--info=name1', f'{src}/', f'{TODIR}/')
+if 'keep' not in p.stdout or 'hide.tmp' not in p.stdout:
+    test_fail(f"--info=name1 did not report transferred names:\n{p.stdout}")
+
+rmtree(TODIR)
+makepath(TODIR)
+p = out('-r', '--exclude=*.tmp', '--debug=filter1',
+        f'{src}/', f'{TODIR}/')
+filter_msg = '[sender] hiding file hide.tmp because of pattern *.tmp'
+if filter_msg not in p.stdout or filter_msg in p.stderr:
+    test_fail('--debug=filter1 did not use the default stdout route')
+
+rmtree(TODIR)
+makepath(TODIR)
+p = out('-r', '--exclude=*.tmp', '--debug=filter1', '--stderr=all',
+        f'{src}/', f'{TODIR}/')
+if filter_msg not in p.stderr or filter_msg in p.stdout:
+    test_fail('--stderr=all did not route debug output exclusively to stderr')
+
+rmtree(src)
+rmtree(TODIR)
+makepath(src, TODIR)
+(src / 'a-small').write_text('small\n')
+make_data_file(src / 'z-large', 256 * 1024)
+proc = subprocess.Popen(
+    rsync_argv('-r', '--outbuf=L', '--out-format=%n', '--bwlimit=128',
+               f'{src}/', f'{TODIR}/'),
+    stdout=subprocess.PIPE,
+    stderr=subprocess.PIPE,
+    text=True,
+)
+ready, _, _ = select.select([proc.stdout], [], [], 5)
+if not ready:
+    proc.kill()
+    proc.communicate()
+    test_fail('--outbuf=L did not flush a complete output line within 5 seconds')
+first_line = proc.stdout.readline()
+if not first_line.strip() or not first_line.endswith('\n'):
+    proc.kill()
+    proc.communicate()
+    test_fail(f'--outbuf=L returned an incomplete line: {first_line!r}')
+if proc.poll() is not None:
+    stdout, stderr = proc.communicate()
+    test_fail('--outbuf=L transfer finished before buffering could be observed: '
+              f'{first_line + stdout!r} {stderr!r}')
+try:
+    stdout, stderr = proc.communicate(timeout=10)
+except subprocess.TimeoutExpired:
+    proc.kill()
+    proc.communicate()
+    test_fail('--outbuf=L transfer did not finish within 10 seconds')
+if proc.returncode != 0:
+    test_fail(f'--outbuf=L transfer exited {proc.returncode}: {stderr}')
+if not (TODIR / 'z-large').is_file():
+    test_fail('--outbuf=L transfer did not finish copying the payload')
+
 print("output-options: version/help/-i/-n/--stats/--out-format/--list-only/"
-      "-q/--progress/-h/-8 verified")
+      "-q/--progress/-h/-8/--info/--debug/--stderr/--outbuf verified")
diff --git a/testsuite/tests/transfer/partial-dir-abs-delta.py b/testsuite/tests/transfer/partial-dir-abs-delta.py
new file mode 100644
index 000000000..fe2d83c1f
--- /dev/null
+++ b/testsuite/tests/transfer/partial-dir-abs-delta.py
@@ -0,0 +1,45 @@
+#!/usr/bin/env python3
+
+import filecmp
+import shutil
+import subprocess
+
+from harness.rsync import (
+    SCRATCHDIR, make_data_file, makepath, rmtree, rsync_argv, test_fail,
+)
+
+src = SCRATCHDIR / 'pdsrc'
+dst = SCRATCHDIR / 'pddst'
+partial = SCRATCHDIR / 'pdpartial'
+for d in (src, dst, partial):
+    rmtree(d)
+makepath(src, dst, partial)
+
+make_data_file(src / 'big.dat', 1200 * 1024)
+shutil.copy2(src / 'big.dat', partial / 'big.dat')
+with open(partial / 'big.dat', 'r+b') as fh:
+    fh.seek(600000)
+    fh.write(b'PARTIALDIR_BASIS_DELTA')
+
+proc = subprocess.run(
+    rsync_argv('-a', '--no-whole-file', '--partial',
+               f'--partial-dir={partial}', f'{src}/', f'{dst}/'),
+    stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True)
+out = proc.stdout or ''
+print(out)
+
+if 'failed verification' in out or 'lseek returned' in out:
+    test_fail(
+        '#724/#725: absolute --partial-dir delta resume failed:\n' + out)
+
+got = dst / 'big.dat'
+if proc.returncode != 0:
+    test_fail(f"absolute --partial-dir delta transfer failed (rc="
+              f"{proc.returncode}); the data was likely stranded in the "
+              f"partial-dir:\n{out}")
+if not got.is_file():
+    test_fail(f"destination file {got} was not created -- data stranded in the "
+              f"absolute --partial-dir (the #724/#725 symptom)")
+if not filecmp.cmp(str(src / 'big.dat'), str(got), shallow=False):
+    test_fail("destination content differs from source after an absolute "
+              "--partial-dir delta resume")
diff --git a/testsuite/partial_nowrite_test.py b/testsuite/tests/transfer/partial-no-write.py
similarity index 63%
rename from testsuite/partial_nowrite_test.py
rename to testsuite/tests/transfer/partial-no-write.py
index 107a6ed2e..e8403a8b7 100644
--- a/testsuite/partial_nowrite_test.py
+++ b/testsuite/tests/transfer/partial-no-write.py
@@ -1,7 +1,4 @@
 #!/usr/bin/env python3
-#
-# Test that --partial and --delay-updates work as expected when then
-# permissions of the destination file prevent writing to it.
 
 import os
 from pathlib import Path
@@ -10,7 +7,7 @@
 import sys
 import tempfile
 
-from rsyncfns import make_data_file, cp_p, makepath, checkit, RSYNC, TMPDIR, get_testuid, get_rootuid
+from harness.rsync import make_data_file, cp_p, makepath, checkit, RSYNC, TMPDIR, get_testuid, get_rootuid
 
 BASEDIR = TMPDIR
 
@@ -30,14 +27,6 @@
 
 is_root = get_testuid() == get_rootuid()
 
-# As root the read-only dest temp wouldn't deny the write (root bypasses DAC),
-# so the EACCES path under test never fires.  On Linux we can drop
-# CAP_DAC_OVERRIDE with setpriv inside a private mount namespace to force it;
-# where that isn't possible -- non-Linux, Python < 3.12, no mount privilege, or
-# a build dir the cap-dropped root can't even traverse (owned by an
-# unprivileged user with restrictive perms, e.g. a CI tree owned by the ssh
-# user at 0700) -- just run as root: the transfer still succeeds, it merely
-# doesn't exercise the chmod-retry path here (non-root runs do).
 _cwd_st = os.stat(os.getcwd())
 _cwd_traversable = ((_cwd_st.st_uid == 0 and _cwd_st.st_mode & 0o100)
                     or _cwd_st.st_mode & 0o001)
@@ -61,10 +50,9 @@
             subprocess.run(['mount', '--bind', tempdir, cwd], check=True)
             subprocess.run(['umount', tempdir], check=True)
             os.rmdir(tempdir)
-        import rsyncfns
-        rsyncfns.RSYNC = "setpriv --inh-caps -all --bounding-set -all " + RSYNC
+        from harness import rsync
+        rsync.RSYNC = "setpriv --inh-caps -all --bounding-set -all " + RSYNC
     except (OSError, subprocess.CalledProcessError):
-        pass  # mount namespace denied (unprivileged container) -- run as root
-
+        pass
 
 checkit(['-avv', '--partial', '--delay-updates', f'{FROMDIR}/', f'{TODIR}/'], FROMDIR, TODIR)
diff --git a/testsuite/partial-protected-regular-retry-linux_test.py b/testsuite/tests/transfer/partial-protected-regular-retry-linux.py
similarity index 88%
rename from testsuite/partial-protected-regular-retry-linux_test.py
rename to testsuite/tests/transfer/partial-protected-regular-retry-linux.py
index 0cb80c2fd..e0e6bfefa 100644
--- a/testsuite/partial-protected-regular-retry-linux_test.py
+++ b/testsuite/tests/transfer/partial-protected-regular-retry-linux.py
@@ -1,39 +1,21 @@
 #!/usr/bin/env python3
-"""PoC: EACCES recovery must retain partial-dir ownership policy (Linux).
-
-Linux twin of partial-protected-regular-retry-policy_test.py, which runs only
-under dyld interposing.  It covers the recovery arm that test cannot reach:
-the fs.protected_regular compatibility retry, i.e. the "#ifdef linux" arm of
-recv_files(), which is not compiled on Darwin.  Between them the two tests
-cover both arms (Darwin's first EACCES goes straight to the generic
-read-only-file chmod-and-reopen recovery, there being no Linux arm there).
-
-The one-inplace partial leaf is first opened through the operator ownership
-walk.  The hook models an EACCES from that O_CREAT open and swaps the partial
-directory for a symlink in the exact recovery window.  A retry that drops to
-the ordinary resolver follows the new parent with no ownership check and
-writes the remote payload into a different file; one that keeps the walk
-refuses the foreign-owned symlink.
-"""
 
 import os
 import platform
 import subprocess
 
-from rsyncfns import (
+from harness.rsync import (
     SCRATCHDIR, forced_protocol, rmtree, rsync_argv, test_fail, test_skipped,
 )
 
-
 if platform.system() != 'Linux':
-    test_skipped('LD_PRELOAD partial EACCES recovery hook is Linux-only')
+    test_skipped('LD_PRELOAD partial EACCES recovery hook is Linux-only',
+                 capability='linux_interpose')
 
-# one_inplace staging needs inplace_partial, which is negotiated through the
-# protocol-30 CF_INPLACE_PARTIAL_DIR capability flag.  Below that the receiver
-# uses the ordinary tmpfile path and the recovery under test never runs.
 _proto = forced_protocol()
 if _proto is not None and _proto < 30:
-    test_skipped(f'one-inplace partial staging needs protocol >= 30 (forced {_proto})')
+    test_skipped(f'one-inplace partial staging needs protocol >= 30 (forced {_proto})',
+                 capability='protocol_30')
 
 hook_code = r'''
 #define _GNU_SOURCE
@@ -415,7 +397,6 @@
 }
 '''
 
-
 def run():
     base = SCRATCHDIR / 'partial-protected-regular-retry-linux'
     rmtree(base)
@@ -449,7 +430,8 @@ def run():
         ['cc', '-shared', '-fPIC', '-o', str(hook_lib), str(hook_src), '-ldl'],
         stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True)
     if build.returncode != 0:
-        test_skipped(f'cannot build LD_PRELOAD partial retry hook: {build.stdout!r}')
+        test_skipped(f'cannot build LD_PRELOAD partial retry hook: {build.stdout!r}',
+                     capability='linux_interpose')
 
     run_env = os.environ.copy()
     run_env.update({
@@ -474,23 +456,15 @@ def run():
         held.rename(partial)
 
     ctx = f'rc={result.returncode}, output={result.stdout!r}'
-    # A negative returncode is death by signal.  That is never a reason to skip:
-    # the hook killing the process under test is a bug in the hook, and reporting
-    # it as "not loaded" is exactly how a SIGSEGV on AlmaLinux 8 hid for weeks --
-    # the marker is written by the hook, so a crash before that looks identical
-    # to the hook never having loaded.
     if result.returncode is not None and result.returncode < 0:
         test_fail(f'rsync died by signal {-result.returncode} under the '
                   f'LD_PRELOAD hook ({ctx})')
     if not markers['load'].exists():
-        test_skipped(f'LD_PRELOAD hook was not loaded ({ctx})')
+        test_skipped(f'LD_PRELOAD hook was not loaded ({ctx})', capability='linux_interpose')
     if not markers['eacces'].exists():
         test_fail('positive control failed: receiver did not open the existing '
                   f'partial file with O_CREAT ({ctx})')
 
-    # The escape check must come before the ownership-walk control below: on a
-    # vulnerable build no walk runs at all, and that has to be reported as the
-    # escape it is rather than as an inconclusive control failure.
     observed = (secret / 'victim').read_bytes()
     if observed == new_source:
         test_fail('EACCES recovery dropped partial-dir ownership policy and '
@@ -501,12 +475,9 @@ def run():
         test_fail('an unconfined retry opened the victim through the raced '
                   f'partial-dir symlink ({ctx})')
 
-    # Anti-vacuity: nothing was overwritten -- prove that is the ownership walk
-    # refusing the swap, not the scenario failing to arm.
     if not markers['foreign'].exists():
         test_fail('inconclusive: the recovery never inspected the raced '
                   f'partial-dir symlink, so no ownership check ran ({ctx})')
 
-
 run()
 print('protected_regular compatibility retry retained partial-dir ownership policy')
diff --git a/testsuite/partial-protected-regular-retry-policy_test.py b/testsuite/tests/transfer/partial-protected-regular-retry-policy.py
similarity index 91%
rename from testsuite/partial-protected-regular-retry-policy_test.py
rename to testsuite/tests/transfer/partial-protected-regular-retry-policy.py
index a6843cb7b..137906ef2 100644
--- a/testsuite/partial-protected-regular-retry-policy_test.py
+++ b/testsuite/tests/transfer/partial-protected-regular-retry-policy.py
@@ -1,26 +1,16 @@
 #!/usr/bin/env python3
-"""PoC: EACCES recovery must retain partial-dir ownership policy.
-
-The one-inplace partial path is initially opened through the operator ownership
-walk.  Model an EACCES from that O_CREAT open, then replace the partial
-directory with an attacker symlink.  The production recovery opens drop to the
-ordinary resolver, which follows the new parent without an ownership check and
-can overwrite a different module file through the returned descriptor.  On
-Linux the first recovery is the fs.protected_regular compatibility retry; the
-generic read-only-file chmod-and-open recovery has the same policy requirement.
-"""
 
 import os
 import platform
 import subprocess
 
-from rsyncfns import (
+from harness.rsync import (
     SCRATCHDIR, rmtree, rsync_argv, test_fail, test_skipped,
 )
 
-
 if platform.system() != 'Darwin':
-    test_skipped('deterministic partial EACCES recovery uses dyld interposing')
+    test_skipped('deterministic partial EACCES recovery uses dyld interposing',
+                 capability='darwin_interpose')
 
 base = SCRATCHDIR / 'partial-protected-regular-retry-policy'
 rmtree(base)
@@ -256,8 +246,6 @@
 if observed != secret_data:
     test_fail(f'outside-policy target has unexpected contents after retry: '
               f'rc={result.returncode}, output={result.stdout!r}')
-# Anti-vacuity, checked only after the escape assertions above: a vulnerable
-# build runs no ownership walk at all, so this must not pre-empt them.
 if not foreign_check_marker.exists():
     test_fail('inconclusive: the recovery never inspected the raced partial-dir '
               f'symlink, so no ownership check ran: rc={result.returncode}, '
diff --git a/testsuite/partial_test.py b/testsuite/tests/transfer/partial.py
similarity index 63%
rename from testsuite/partial_test.py
rename to testsuite/tests/transfer/partial.py
index 1c8e9531a..fb91fb5e3 100644
--- a/testsuite/partial_test.py
+++ b/testsuite/tests/transfer/partial.py
@@ -1,22 +1,11 @@
 #!/usr/bin/env python3
-"""Coverage of --partial / --partial-dir at depth and across directory
-boundaries.
-
---partial keeps a partially transferred file so a later run can resume it.
---partial-dir=DIR keeps the partial in DIR instead of the destination file:
-a RELATIVE dir is created in (and removed from) each destination file's own
-directory; an ABSOLUTE dir is a reserved location that holds partials by
-basename. All of this is parent- and cross-directory path resolution -- what
-the resolver restructure rewrites -- so exercise it on a file several levels
-deep, with the absolute partial-dir kept OUTSIDE the destination tree.
-"""
 
 import os
 import signal
 import subprocess
 import time
 
-from rsyncfns import (
+from harness.rsync import (
     FROMDIR, SCRATCHDIR, TODIR,
     assert_same, make_data_file, makepath, rmtree, rsync_argv, run_rsync,
     test_fail,
@@ -27,28 +16,17 @@
 deep = os.path.join(deepdir, 'f3')
 FULL = 12_000_000
 
-
 def seed_big():
     rmtree(src)
     rmtree(TODIR)
     makepath(src / deepdir)
     make_data_file(src / deep, FULL)
 
-
 def is_prefix(partial) -> bool:
     pb = partial.read_bytes()
     return 0 < len(pb) < FULL and (src / deep).read_bytes()[:len(pb)] == pb
 
-
 def interrupt_transfer(extra_args, partial_path):
-    """Start a deliberately slow transfer, SIGTERM it once the receiver's
-    in-progress temp (.f3.XXXXXX) has some data, and wait for `partial_path`
-    (where this mode keeps the partial) to materialise.
-
-    The bandwidth limit is low so the multi-second transfer cannot finish
-    before we interrupt it -- important under a loaded parallel run (-j16),
-    where the polling loop can lag by seconds. We then poll for the partial,
-    since rsync moves it into place from its exit_cleanup handler."""
     proc = subprocess.Popen(
         rsync_argv('-a', '--no-whole-file', '--bwlimit=400', *extra_args,
                    f'{src}/', f'{TODIR}/'),
@@ -58,7 +36,7 @@ def interrupt_transfer(extra_args, partial_path):
     deadline = time.monotonic() + 30
     while time.monotonic() < deadline:
         if proc.poll() is not None:
-            break                       # exited before we caught it
+            break
         if tdir.is_dir():
             temps = [p for p in tdir.glob('.f3.*')
                      if p.is_file() and p.stat().st_size > 0]
@@ -71,15 +49,12 @@ def interrupt_transfer(extra_args, partial_path):
     if not caught:
         test_fail("never caught an in-progress temp (transfer finished too "
                   "fast to interrupt)")
-    # rsync moves the partial into place from exit_cleanup; give it a moment.
     pdeadline = time.monotonic() + 5
     while time.monotonic() < pdeadline:
         if partial_path.is_file() and partial_path.stat().st_size > 0:
             return
         time.sleep(0.05)
 
-
-# --- 1. --partial (no dir): partial kept in the dest file itself, at depth --
 seed_big()
 interrupt_transfer(['--partial'], TODIR / deep)
 if not (TODIR / deep).is_file() or not is_prefix(TODIR / deep):
@@ -87,7 +62,6 @@ def interrupt_transfer(extra_args, partial_path):
 run_rsync('-a', '--partial', '--no-whole-file', f'{src}/', f'{TODIR}/')
 assert_same(TODIR / deep, src / deep, label='--partial resume')
 
-# --- 2. relative --partial-dir at depth: deterministic clean pre-seed -------
 rmtree(src)
 rmtree(TODIR)
 makepath(src / deepdir, TODIR / deepdir / '.rsync-partial')
@@ -100,7 +74,6 @@ def interrupt_transfer(extra_args, partial_path):
 if (TODIR / deepdir / '.rsync-partial').exists():
     test_fail("relative --partial-dir not removed after the partial was used")
 
-# --- 3. relative --partial-dir at depth: interrupt then resume -------------
 seed_big()
 part = TODIR / deepdir / '.rsync-partial' / 'f3'
 interrupt_transfer(['--partial-dir=.rsync-partial'], part)
@@ -110,8 +83,7 @@ def interrupt_transfer(extra_args, partial_path):
           f'{src}/', f'{TODIR}/')
 assert_same(TODIR / deep, src / deep, label='rel partial-dir resume')
 
-# --- 4. absolute --partial-dir OUTSIDE the tree (cross-dir): interrupt write -
-ext = SCRATCHDIR / 'partials'      # sibling of from/ and to/ -- outside both
+ext = SCRATCHDIR / 'partials'
 rmtree(ext)
 ext.mkdir()
 seed_big()
@@ -120,16 +92,12 @@ def interrupt_transfer(extra_args, partial_path):
     test_fail("absolute --partial-dir did not write the partial to the "
               "outside-tree dir")
 
-# --- 5. absolute --partial-dir delta resume completes (regression guard) ----
-# A delta (--no-whole-file) resume from an absolute, outside-tree partial-dir
-# used to fail whole-file verification forever: the receiver couldn't open the
-# absolute basis, so matched blocks were dropped from the verify checksum.
 rmtree(src)
 rmtree(TODIR)
 rmtree(ext)
 makepath(src / deepdir, ext)
 make_data_file(src / deep, 1_000_000)
-(ext / 'f3').write_bytes((src / deep).read_bytes()[:400_000])   # clean prefix
+(ext / 'f3').write_bytes((src / deep).read_bytes()[:400_000])
 run_rsync('-a', f'--partial-dir={ext}', '--no-whole-file', f'{src}/', f'{TODIR}/')
 assert_same(TODIR / deep, src / deep, label='abs partial-dir delta resume')
 if (ext / 'f3').exists():
diff --git a/testsuite/peer-legacy-implied-delete-scope_test.py b/testsuite/tests/transfer/peer-legacy-implied-delete-scope.py
similarity index 74%
rename from testsuite/peer-legacy-implied-delete-scope_test.py
rename to testsuite/tests/transfer/peer-legacy-implied-delete-scope.py
index 7f6c350b9..de70ba238 100644
--- a/testsuite/peer-legacy-implied-delete-scope_test.py
+++ b/testsuite/tests/transfer/peer-legacy-implied-delete-scope.py
@@ -1,22 +1,14 @@
 #!/usr/bin/env python3
-"""Protocol 29 must not let a sender enlarge scoped --delete.
-
-The protocol-30 receiver downgrades an implied parent that a malicious sender
-marks as a content directory.  The legacy branch has no XMIT_NO_CONTENT_DIR
-bit and currently trusts XMIT_TOP_DIR, even though the receiver's implied
-filter says that the directory is only a parent of the requested leaf.
-"""
 
 import socket
 import subprocess
 import threading
 
-from rsyncfns import (
+from harness.rsync import (
     SCRATCHDIR, claim_ports, makepath, require_tcp, rmtree, rsync_argv,
     test_fail,
 )
-import rsync_proto as rp
-
+from harness import protocol as rp
 
 PORT = 13303
 
@@ -27,7 +19,6 @@
 rmtree(base)
 makepath(base)
 
-
 def pull(label, forged_top_dir):
     dest = base / label
     makepath(dest / 'dir')
@@ -50,7 +41,6 @@ def serve():
             )
             peer.handshake(seed=0x12345678)
 
-            # Protocol 29 daemon argv is newline-framed and blank-terminated.
             while peer._readline():
                 pass
 
@@ -65,15 +55,12 @@ def serve():
                     length=0, protocol=29,
                 ).encode()
                 + rp.end_of_flist(0, 29)
-                + rp.w_int(0)  # protocol-29 post-flist io_error
+                + rp.w_int(0)
             )
-            # Deletion runs from the received flist before transfer data is
-            # needed.  End the remaining phases cleanly enough for the client
-            # to finish or report an ordinary stream error.
             peer.send_data(flist + rp.w_int(rp.NDX_DONE) * 4)
             peer.drain(timeout=3)
             peer.close()
-        except Exception as exc:  # noqa: BLE001
+        except Exception as exc:
             state['err'] = repr(exc)
 
     thread = threading.Thread(target=serve, daemon=True)
@@ -92,7 +79,6 @@ def serve():
         listener.close()
     return sentinel.exists(), proc, state
 
-
 control_survived, control_proc, control_state = pull('control', False)
 attack_survived, attack_proc, attack_state = pull('attack', True)
 
@@ -104,10 +90,7 @@ def serve():
 
 if not attack_survived:
     test_fail(
-        'malicious protocol-29 sender marked implied parent dir as '
-        'XMIT_TOP_DIR and expanded scoped --delete from dir/file to dir/, '
-        'deleting receiver-owned must-survive; the protocol-30 implied-parent '
-        'downgrade was not applied to the legacy branch; '
+        'protocol-29 sender expanded scoped --delete and removed must-survive; '
         f'control rc={control_proc.returncode}, attack rc={attack_proc.returncode}, '
         f'control server={control_state!r}, attack server={attack_state!r}, '
         f'attack output={attack_proc.stdout}{attack_proc.stderr}')
diff --git a/testsuite/tests/transfer/preallocate.py b/testsuite/tests/transfer/preallocate.py
new file mode 100644
index 000000000..9b3bc7c90
--- /dev/null
+++ b/testsuite/tests/transfer/preallocate.py
@@ -0,0 +1,120 @@
+#!/usr/bin/env python3
+
+import os
+
+from harness.rsync import (
+    FROMDIR, TODIR,
+    allocated_size, assert_same, make_data_file, makepath, rmtree, run_rsync, test_fail,
+    test_skipped,
+)
+
+src = FROMDIR
+deep = os.path.join('d1', 'd2', 'd3', 'f')
+
+rmtree(src)
+rmtree(TODIR)
+makepath(src)
+(src / 'probe').write_text("x\n")
+if run_rsync('-a', '--preallocate', f'{src}/', f'{TODIR}/',
+             check=False, capture_output=True).returncode != 0:
+    test_skipped("--preallocate not supported on this platform", capability='preallocate')
+
+def punch_frees(offset, length, size):
+    import ctypes
+    import ctypes.util
+    KEEP_SIZE, PUNCH_HOLE = 0x01, 0x02
+    p = src / 'punch-probe'
+    fd = -1
+    try:
+        libc = ctypes.CDLL(ctypes.util.find_library('c') or 'libc.so.6',
+                           use_errno=True)
+        libc.fallocate64.argtypes = [ctypes.c_int, ctypes.c_int,
+                                     ctypes.c_longlong, ctypes.c_longlong]
+        fd = os.open(p, os.O_CREAT | os.O_RDWR | os.O_TRUNC, 0o644)
+        os.write(fd, os.urandom(size))
+        before = os.fstat(fd).st_blocks
+        ret = libc.fallocate64(fd, PUNCH_HOLE | KEEP_SIZE, offset, length)
+        return ret == 0 and os.fstat(fd).st_blocks < before
+    except (OSError, AttributeError, ValueError):
+        return False
+    finally:
+        if fd >= 0:
+            os.close(fd)
+        try:
+            os.unlink(p)
+        except OSError:
+            pass
+
+can_punch = punch_frees(0, 65536, 65536)
+
+def seed_plain(size=1_000_000):
+    rmtree(src)
+    rmtree(TODIR)
+    makepath(src / 'd1' / 'd2' / 'd3')
+    make_data_file(src / deep, size)
+
+def seed_holey(head=4096, hole=2 * 1024 * 1024, tail=4096):
+    rmtree(src)
+    rmtree(TODIR)
+    makepath(src / 'd1' / 'd2' / 'd3')
+    with open(src / deep, 'wb') as f:
+        f.write(os.urandom(head))
+        f.write(b'\0' * hole)
+        f.write(os.urandom(tail))
+
+seed_plain()
+run_rsync('-a', '--preallocate', f'{src}/', f'{TODIR}/')
+assert_same(TODIR / deep, src / deep, label='--preallocate content')
+
+seed_holey()
+run_rsync('-a', '--preallocate', '--sparse', f'{src}/', f'{TODIR}/')
+assert_same(TODIR / deep, src / deep, label='--preallocate --sparse content')
+if can_punch and allocated_size(TODIR / deep) >= os.path.getsize(TODIR / deep):
+    test_fail(f"--preallocate --sparse left the file fully allocated "
+              f"(allocated {allocated_size(TODIR / deep)} for a "
+              f"{os.path.getsize(TODIR / deep)}-byte file); the preallocated "
+              "extent's zero run was not punched into a hole")
+
+seed_plain()
+run_rsync('-a', f'{src}/', f'{TODIR}/')
+data = bytearray((src / deep).read_bytes())
+data[200_000:800_000] = b'\0' * 600_000
+(src / deep).write_bytes(bytes(data))
+st = os.stat(src / deep)
+os.utime(src / deep, (st.st_atime, st.st_mtime + 100))
+run_rsync('-a', '--inplace', '--sparse', '--no-whole-file', f'{src}/', f'{TODIR}/')
+assert_same(TODIR / deep, src / deep, label='--inplace --sparse content')
+if can_punch and allocated_size(TODIR / deep) >= os.path.getsize(TODIR / deep):
+    test_fail(f"--inplace --sparse did not punch the zero run: allocated "
+              f"{allocated_size(TODIR / deep)} for a {os.path.getsize(TODIR / deep)}"
+              "-byte file")
+
+rmtree(src)
+rmtree(TODIR)
+makepath(src / 'd1' / 'd2' / 'd3', TODIR / 'd1' / 'd2' / 'd3')
+with open(src / deep, 'wb') as source, open(TODIR / deep, 'wb') as dest:
+    for _ in range(256):
+        block = os.urandom(4096) + b'\0' * 24576 + os.urandom(4096)
+        source.write(block)
+        dest.write(block)
+
+can_punch_interior = can_punch and punch_frees(4096, 24576, 32768)
+if can_punch and not can_punch_interior:
+    print("preallocate: interior-hole assertion skipped: this filesystem's "
+          "allocation unit cannot free a 24 KiB run inside a 32 KiB block")
+
+matched_size = os.path.getsize(TODIR / deep)
+matched_before = allocated_size(TODIR / deep)
+run_rsync('-a', '--ignore-times', '--inplace', '--sparse', '--no-whole-file',
+          '--block-size=32768', f'{src}/', f'{TODIR}/')
+assert_same(TODIR / deep, src / deep,
+            label='--inplace --sparse matched-block content')
+matched_after = allocated_size(TODIR / deep)
+if (can_punch_interior and matched_before >= matched_size
+        and matched_after * 2 >= matched_before):
+    test_fail(f"--inplace --sparse left matching interior zero runs allocated: "
+              f"{matched_after} of {matched_before} bytes remain allocated "
+              f"after a {matched_size}-byte matched-block update")
+
+print("preallocate: --preallocate (do_fallocate) + sparse hole-punching "
+      "(do_punch_hole) verified at depth")
diff --git a/testsuite/protected-regular_test.py b/testsuite/tests/transfer/protected-regular.py
similarity index 72%
rename from testsuite/protected-regular_test.py
rename to testsuite/tests/transfer/protected-regular.py
index 4094534b2..385ee45d3 100644
--- a/testsuite/protected-regular_test.py
+++ b/testsuite/tests/transfer/protected-regular.py
@@ -1,10 +1,4 @@
 #!/usr/bin/env python3
-# Python rewrite of testsuite/protected-regular.test.
-#
-# Modern Linux kernels can set fs.protected_regular = {1,2}, which
-# blocks O_CREAT|O_WRONLY opens of files in world-writable sticky
-# directories that the opener doesn't own. rsync --inplace must still
-# be able to write into these files; this test guards that path.
 
 import os
 import shutil
@@ -12,19 +6,19 @@
 import sys
 from pathlib import Path
 
-from rsyncfns import TMPDIR, run_rsync, test_fail, test_skipped
-
+from harness.rsync import TMPDIR, run_rsync, test_fail, test_skipped
 
 pr_path = Path('/proc/sys/fs/protected_regular')
 if not pr_path.is_file():
-    test_skipped("Can't find protected_regular setting (only available on Linux)")
+    test_skipped("Can't find protected_regular setting (only available on Linux)",
+                 capability='protected_regular')
 
 try:
     pr_lvl = pr_path.read_text().strip()
 except OSError:
-    test_skipped("Can't check if fs.protected_regular is enabled")
+    test_skipped("Can't check if fs.protected_regular is enabled", capability='protected_regular')
 if pr_lvl == '0':
-    test_skipped("fs.protected_regular is not enabled")
+    test_skipped("fs.protected_regular is not enabled", capability='protected_regular')
 
 workdir = TMPDIR / 'files'
 workdir.mkdir(parents=True, exist_ok=True)
@@ -33,19 +27,14 @@
 (workdir / 'src').write_text("Source\n")
 (workdir / 'dst').write_text("")
 
-
 def _chown_5001(path: Path) -> bool:
-    """Try to chown(2) `path` to uid 5001. Returns True on success."""
     try:
         os.chown(path, 5001, -1)
         return True
     except PermissionError:
         return False
 
-
 if not _chown_5001(workdir / 'dst'):
-    # Not root: fall back to re-running ourselves under unshare with a
-    # uid mapping (Linux user-namespace trick). Only attempt once.
     if not os.environ.get('RSYNC_UNSHARED'):
         unshare = shutil.which('unshare')
         if unshare is not None:
@@ -59,7 +48,7 @@ def _chown_5001(path: Path) -> bool:
                     timeout=5,
                 )
             except subprocess.TimeoutExpired:
-                test_skipped("Can't chown (unshare probe timed out)")
+                test_skipped("Can't chown (unshare probe timed out)", capability='protected_regular')
             if probe.returncode == 0:
                 print("Re-running under unshare with UID mapping...")
                 env = os.environ.copy()
@@ -71,15 +60,13 @@ def _chown_5001(path: Path) -> bool:
                      sys.executable, __file__],
                     env,
                 )
-    test_skipped("Can't chown (need root or unshare with uidmap)")
+    test_skipped("Can't chown (need root or unshare with uidmap)", capability='protected_regular')
 
 print(f"Contents of {workdir}:")
 subprocess.run(['ls', '-al', str(workdir)])
 
 run_rsync('--inplace', str(workdir / 'src'), str(workdir / 'dst'))
 
-# A zero exit isn't enough: confirm --inplace actually wrote the source bytes
-# into the protected destination (a no-op/short write would also exit 0).
 dst_content = (workdir / 'dst').read_text()
 if dst_content != "Source\n":
     test_fail(f"--inplace did not write the source content into the protected "
diff --git a/testsuite/xrsync_test.py b/testsuite/tests/transfer/protocol-client.py
similarity index 53%
rename from testsuite/xrsync_test.py
rename to testsuite/tests/transfer/protocol-client.py
index 952a3dbee..b65821ffb 100644
--- a/testsuite/xrsync_test.py
+++ b/testsuite/tests/transfer/protocol-client.py
@@ -1,31 +1,21 @@
 #!/usr/bin/env python3
-# Tests for xrsync.py -- the small runnable rsync client built on rsync_proto.
-# Drives a real rsyncd through xrsync's own code paths (in-process main()):
-#   * list     -- the module's entries appear, sorted, with the symlink target
-#   * pull      -- *.pdf download, byte-identical, mtime + symlink preserved
-#   * push      -- upload regular files, byte-identical on the daemon
-#   * hook      -- a DaemonClient subclass replaces one protocol step
-#                  (make_file_token_stream) and the daemon's md5 verification
-#                  rejects the corrupted push -- proving the seam works while
-#                  xrsync drives the rest.
-# Needs a real TCP daemon (raw-socket client), so skipped without --use-tcp.
 
 import io
 import os
 from contextlib import redirect_stdout
 
-from rsyncfns import (
+from harness.rsync import (
     SCRATCHDIR, claim_ports, makepath, require_tcp, rmtree, start_test_daemon,
     test_fail, write_daemon_conf,
 )
-import rsync_proto as rp
-import xrsync
+from harness import protocol as rp
+from harness import protocol_client
 
 PORT = 12968
-require_tcp("xrsync speaks the daemon protocol over a raw TCP socket; run with --use-tcp")
+require_tcp("the protocol client uses a raw TCP socket; run with --use-tcp")
 claim_ports(PORT)
 
-base = SCRATCHDIR / 'xrsync'
+base = SCRATCHDIR / 'protocol-client'
 rmtree(base)
 mod = base / 'mod'
 makepath(mod / 'sub')
@@ -38,42 +28,37 @@
 (mod / 'note.txt').write_bytes(NOTE)
 (mod / 'sub' / 'c.pdf').write_bytes(CSUB)
 os.symlink('a.pdf', mod / 'link.pdf')
-MTIME = 1609556645          # 2021-01-02 03:04:05
+MTIME = 1609556645
 os.utime(mod / 'a.pdf', (MTIME, MTIME))
 os.utime(mod / 'b.pdf', (MTIME, MTIME))
 
 conf = write_daemon_conf([
     ('mod', {'path': str(mod), 'read only': 'no', 'use chroot': 'no'}),
-], name='xrsync.conf')
+], name='protocol-client.conf')
 start_test_daemon(conf, PORT)
 
 COMMON = ['--port', str(PORT)]
 
-
-# --- 1. list ----------------------------------------------------------------
 buf = io.StringIO()
 with redirect_stdout(buf):
-    rc = xrsync.main(COMMON + ['-l', 'localhost::mod/'])
+    rc = protocol_client.main(COMMON + ['-l', 'localhost::mod/'])
 listing = buf.getvalue()
 if rc != 0:
-    test_fail(f"xrsync list returned {rc}\n{listing}")
+        test_fail(f"protocol client list returned {rc}\n{listing}")
 for name in ('a.pdf', 'b.pdf', 'note.txt', 'link.pdf', 'sub'):
     if name not in listing:
-        test_fail(f"xrsync list missing {name!r}:\n{listing}")
+        test_fail(f"protocol client list missing {name!r}:\n{listing}")
 if 'link.pdf -> a.pdf' not in listing:
-    test_fail(f"xrsync list did not resolve the symlink target:\n{listing}")
-# entries must be in rsync's sorted order (name is the 3rd field: perms size name)
+    test_fail(f"protocol client list did not resolve the symlink target:\n{listing}")
 names = [ln.split()[2] for ln in listing.splitlines() if ln.strip()]
 if names != sorted(names):
-    test_fail(f"xrsync list not in sorted order: {names}")
-
+    test_fail(f"protocol client list not in sorted order: {names}")
 
-# --- 2. pull (download) -----------------------------------------------------
 pull_dest = base / 'pull'
 makepath(pull_dest)
-rc = xrsync.main(COMMON + ['-a', 'localhost::mod/*.pdf', str(pull_dest)])
+rc = protocol_client.main(COMMON + ['-a', 'localhost::mod/*.pdf', str(pull_dest)])
 if rc != 0:
-    test_fail(f"xrsync pull returned {rc}")
+    test_fail(f"protocol client pull returned {rc}")
 if (pull_dest / 'a.pdf').read_bytes() != A:
     test_fail("pulled a.pdf content mismatch")
 if (pull_dest / 'b.pdf').read_bytes() != B:
@@ -87,44 +72,33 @@
 if (pull_dest / 'note.txt').exists():
     test_fail("pull of *.pdf should not have fetched note.txt")
 
-
-# --- 3. push (upload) -------------------------------------------------------
 push_src = base / 'push'
 makepath(push_src)
 U1 = b'uploaded one\n'
 U2 = os.urandom(5000)
 (push_src / 'u1.txt').write_bytes(U1)
 (push_src / 'u2.bin').write_bytes(U2)
-rc = xrsync.main(COMMON + [str(push_src / 'u1.txt'), str(push_src / 'u2.bin'),
+rc = protocol_client.main(COMMON + [str(push_src / 'u1.txt'), str(push_src / 'u2.bin'),
                            'localhost::mod/'])
 if rc != 0:
-    test_fail(f"xrsync push returned {rc}")
+    test_fail(f"protocol client push returned {rc}")
 if (mod / 'u1.txt').read_bytes() != U1:
     test_fail("pushed u1.txt content mismatch")
 if (mod / 'u2.bin').read_bytes() != U2:
     test_fail("pushed u2.bin (random) content mismatch")
 
-
-# --- 4. hookability: swap one protocol step ---------------------------------
 class CorruptingClient(rp.DaemonClient):
-    """Replaces just the file token stream with corrupted bytes; everything
-    else (handshake, flist, request loop, md5) is xrsync's.  The daemon's
-    whole-file md5 must then reject the transfer."""
-
     def make_file_token_stream(self, content):
         return super().make_file_token_stream(b'X' * len(content))
 
-
-rc = xrsync.main(COMMON + [str(push_src / 'u1.txt'), 'localhost::mod/hooked.txt'],
+rc = protocol_client.main(COMMON + [str(push_src / 'u1.txt'), 'localhost::mod/hooked.txt'],
                  client_factory=CorruptingClient)
 landed = mod / 'hooked.txt'
 if landed.exists() and landed.read_bytes() == U1:
     test_fail("the corrupting hook did not take effect -- the daemon accepted "
               "the original content, so make_file_token_stream was not used")
-# The daemon discards a failed-verification file, so it must not match U1.
 if landed.exists() and landed.read_bytes() not in (b'X' * len(U1),):
-    # tolerate the daemon keeping the corrupted bytes; just never the original
     pass
 
-print("xrsync: list + pull + push round-trip against rsyncd, and the "
+print("protocol client: list + pull + push round-trip against rsyncd, and the "
       "make_file_token_stream hook is honoured (corrupt push rejected by md5).")
diff --git a/testsuite/prune-empty-dirs_test.py b/testsuite/tests/transfer/prune-empty-dirs.py
similarity index 71%
rename from testsuite/prune-empty-dirs_test.py
rename to testsuite/tests/transfer/prune-empty-dirs.py
index c53adfbd1..ef603c9b3 100644
--- a/testsuite/prune-empty-dirs_test.py
+++ b/testsuite/tests/transfer/prune-empty-dirs.py
@@ -1,25 +1,16 @@
 #!/usr/bin/env python3
-"""Coverage of -m / --prune-empty-dirs at depth.
 
---prune-empty-dirs drops directory chains that would end up empty at the
-destination -- both chains that are empty in the source and chains that become
-empty because a filter excluded their only files. Populated chains are kept.
-"""
-
-from rsyncfns import (
+from harness.rsync import (
     FROMDIR, TODIR,
     assert_not_exists, assert_same, makepath, rmtree, run_rsync,
 )
 
 src = FROMDIR
 
-
 def reseed():
     rmtree(src)
     rmtree(TODIR)
 
-
-# --- a deep empty chain is pruned; a deep populated chain is kept ------------
 reseed()
 makepath(src / 'empty' / 'e1' / 'e2', src / 'full' / 'd1' / 'd2')
 (src / 'full' / 'd1' / 'd2' / 'file').write_text("data\n")
@@ -29,7 +20,6 @@ def reseed():
 assert_same(TODIR / 'full' / 'd1' / 'd2' / 'file',
             src / 'full' / 'd1' / 'd2' / 'file', label='-m kept populated chain')
 
-# --- a chain emptied by an exclude filter is also pruned --------------------
 reseed()
 makepath(src / 'mixed' / 'sub', src / 'onlylogs' / 'sub')
 (src / 'mixed' / 'sub' / 'keep.txt').write_text("k\n")
diff --git a/testsuite/read-batch-pipe_test.py b/testsuite/tests/transfer/read-batch-pipe.py
similarity index 61%
rename from testsuite/read-batch-pipe_test.py
rename to testsuite/tests/transfer/read-batch-pipe.py
index 505678a7e..c4368cc49 100644
--- a/testsuite/read-batch-pipe_test.py
+++ b/testsuite/tests/transfer/read-batch-pipe.py
@@ -1,35 +1,29 @@
 #!/usr/bin/env python3
-"""--read-batch process substitution /dev/fd/ pipe must not crash with strict file-type checks."""
+
 import os
 import shlex
 import shutil
 import subprocess
-import tempfile
 import sys
 from pathlib import Path
 
-from rsyncfns import SCRATCHDIR, makepath, rmtree, rsync_argv, test_fail, test_skipped
+from harness.rsync import SCRATCHDIR, makepath, rmtree, rsync_argv, test_fail, test_skipped
 
-# We require bash specifically because standard POSIX /bin/sh does not
-# guarantee support for <(...) process substitution syntax.
 if not sys.platform.startswith('linux'):
-    test_skipped('This test requires Linux platform')
+    test_skipped('This test requires Linux platform', capability='proc_fd')
 
 bash = shutil.which('bash')
 if bash is None:
-    test_skipped('bash is unavailable, cannot test process substitution')
+    test_skipped('bash is unavailable, cannot test process substitution', capability='proc_fd')
 
-# runtests.py exports POSIXLY_CORRECT=1, and bash before 5.1 disables process
-# substitution in POSIX mode -- the very syntax bash is required for here.
 bash_env = {k: v for k, v in os.environ.items() if k != 'POSIXLY_CORRECT'}
-# Verify the host bash actually supports process substitution
 probe = subprocess.run(
     [bash, '-c', 'cat <(echo "probe")'],
     env=bash_env,
     capture_output=True)
 
 if probe.returncode != 0:
-    test_skipped('bash process substitution is not supported on this system')
+    test_skipped('bash process substitution is not supported on this system', capability='proc_fd')
 
 base = Path(SCRATCHDIR / 'rsync-batch-fifo')
 src = base / 'src'
@@ -37,24 +31,17 @@
 batch_file = base / 'update.batch'
 makepath(src, dest)
 
-# 1. Create dummy data
 (src / 'payload.txt').write_text('batch payload data\n')
 
-# 2. Generate a valid batch file so `cat` actually has a real file to read.
-# Note: This operation also copies the file to `dest` as a side effect.
 subprocess.run([*rsync_argv('-a', f'--write-batch={batch_file}'), f'{src}/', f'{dest}/'], check=True)
 
-# must wipe and recreate the destination directory so the test can 
-# properly prove that --read-batch recreates the files from scratch.
 rmtree(dest)
 makepath(dest)
 
-# 3. Now we can test reading it via bash process substitution
 rsync_base_cmd = shlex.join(rsync_argv('-a'))
 batch_path = shlex.quote(str(batch_file))
 dest_path = shlex.quote(str(dest) + '/')
 
-# Construct the bash command: rsync -a --read-batch=<(cat /path/to/batch) /dest/
 bash_script = f"{rsync_base_cmd} --read-batch=<(cat {batch_path}) {dest_path}"
 
 try:
@@ -71,7 +58,6 @@
 
 ctx = f'rc={proc_read.returncode}, stderr={proc_read.stderr.strip()!r}'
 
-# Evaluate result against the strict S_ISREG check bug
 if proc_read.returncode != 0:
     rmtree(base)
     test_fail(f'rsync crashed reading batch file from pipe ({ctx})')
diff --git a/testsuite/readonly-partial-abort-mode-regression_test.py b/testsuite/tests/transfer/readonly-partial-abort-mode.py
similarity index 85%
rename from testsuite/readonly-partial-abort-mode-regression_test.py
rename to testsuite/tests/transfer/readonly-partial-abort-mode.py
index 92eac9479..d1b0fe8e6 100644
--- a/testsuite/readonly-partial-abort-mode-regression_test.py
+++ b/testsuite/tests/transfer/readonly-partial-abort-mode.py
@@ -1,13 +1,4 @@
 #!/usr/bin/env python3
-"""An aborted in-place update must not relax an existing file's mode.
-
-The proposed-3.5 receiver retries an EACCES output open by chmod'ing an
-existing output or in-place partial file to 0600.  This test's fake remote
-sender closes after the receiver has requested the file and before sending any
-file-data token.  The transfer must fail, but mode 0444 must survive.  A normal
-successful --inplace update of a read-only file is also checked so that the
-3.5 compatibility feature remains intact.
-"""
 
 import os
 import select
@@ -15,15 +6,13 @@
 import subprocess
 import sys
 
-import rsync_proto as rp
-from rsyncfns import SCRATCHDIR, makepath, rmtree, rsync_argv, test_fail
-
+from harness import protocol as rp
+from harness.rsync import SCRATCHDIR, makepath, rmtree, rsync_argv, test_fail, test_skipped
 
 CF_INPLACE_PARTIAL_DIR = 1 << 6
 FNAMECMP_PARTIAL_DIR = 0x81
 ITEM_BASIS_TYPE_FOLLOWS = 1 << 11
 
-
 def write_all(data):
     view = memoryview(data)
     while view:
@@ -32,7 +21,6 @@ def write_all(data):
             raise RuntimeError("short write to rsync client")
         view = view[n:]
 
-
 def read_exact(n, timeout=10):
     out = bytearray()
     while len(out) < n:
@@ -45,14 +33,11 @@ def read_exact(n, timeout=10):
         out += chunk
     return bytes(out)
 
-
 def frame(payload):
     word = ((rp.MPLEX_BASE + rp.MSG_DATA) << 24) | len(payload)
     return struct.pack("<I", word) + payload
 
-
 def wait_for_generator_request():
-    """Consume multiplexed client output until index 0's request appears."""
     data = bytearray()
     for _ in range(256):
         word = struct.unpack("<I", read_exact(4))[0]
@@ -68,7 +53,6 @@ def wait_for_generator_request():
             break
     raise RuntimeError(f"generator did not request index 0: {data[:64].hex()}")
 
-
 def fake_sender(basis_type):
     write_all(rp.w_int(30))
     client_protocol = struct.unpack("<i", read_exact(4))[0]
@@ -88,7 +72,6 @@ def fake_sender(basis_type):
     response += rp.w_sum_head(0, 0, 0, 0)
     write_all(frame(bytes(response)))
 
-
 fake_arg = next((arg for arg in sys.argv if arg.startswith("--fake-server=")), None)
 if fake_arg:
     try:
@@ -99,16 +82,13 @@ def fake_sender(basis_type):
         sys.exit(2)
     sys.exit(0)
 
-
 if os.geteuid() == 0:
-    print("SKIP: root bypasses the read-only output-file precondition")
-    sys.exit(77)
+    test_skipped("root bypasses the read-only output-file precondition", capability='nonroot')
 
-base = SCRATCHDIR / "readonly-partial-abort-mode-regression"
+base = SCRATCHDIR / 'readonly-partial-abort-mode'
 rmtree(base)
 script = os.path.abspath(__file__)
 
-
 def run_abort_case(scenario):
     dest = base / scenario / "dest"
     if scenario == "partial":
@@ -139,7 +119,6 @@ def run_abort_case(scenario):
         )
     return failures
 
-
 def run_success_case():
     source = base / "success" / "source"
     dest = base / "success" / "dest"
@@ -163,7 +142,6 @@ def run_success_case():
         failures.append(f"successful read-only --inplace update left mode {mode:04o}")
     return failures
 
-
 failures = run_abort_case("inplace") + run_abort_case("partial") + run_success_case()
 if failures:
     test_fail("\n\n".join(failures))
diff --git a/testsuite/tests/transfer/remote-logging.py b/testsuite/tests/transfer/remote-logging.py
new file mode 100644
index 000000000..6ba91c0d5
--- /dev/null
+++ b/testsuite/tests/transfer/remote-logging.py
@@ -0,0 +1,52 @@
+#!/usr/bin/env python3
+
+from harness.rsync import (
+    SCRATCHDIR, makepath, rmtree, rsync_path_arg, rsh_cmd, run_rsync, test_fail,
+)
+
+base = SCRATCHDIR / 'remote-logging'
+src = base / 'src'
+local_dst = base / 'local-dst'
+push_dst = base / 'push-dst'
+pull_dst = base / 'pull-dst'
+rmtree(base)
+makepath(src, local_dst, push_dst, pull_dst)
+(src / 'payload').write_text('payload\n')
+
+ssh = rsh_cmd()
+rpath = f'--rsync-path={rsync_path_arg()}'
+
+def assert_log(path, marker, label):
+    if not path.is_file():
+        test_fail(f'{label}: log file was not created')
+    text = path.read_text()
+    if f'{marker}:payload' not in text:
+        test_fail(f'{label}: formatted payload entry missing from {text!r}')
+
+def assert_payload(directory, label):
+    path = directory / 'payload'
+    if not path.is_file() or path.read_text() != 'payload\n':
+        test_fail(f'{label}: payload was not transferred')
+
+local_log = base / 'local.log'
+run_rsync('-r', f'--log-file={local_log}', '--log-file-format=LOCAL:%n',
+          f'{src}/', f'{local_dst}/')
+assert_log(local_log, 'LOCAL', 'client log')
+assert_payload(local_dst, 'client log')
+
+push_log = base / 'push-remote.log'
+run_rsync('-r', '-e', ssh, rpath,
+          f'--remote-option=--log-file={push_log}',
+          '--remote-option=--log-file-format=PUSH:%n',
+          f'{src}/', f'localhost:{push_dst}/')
+assert_log(push_log, 'PUSH', 'remote receiver log')
+assert_payload(push_dst, 'remote receiver log')
+
+pull_log = base / 'pull-remote.log'
+run_rsync('-r', '-e', ssh, rpath,
+          f'-M--log-file={pull_log}', f'-M--log-file-format=PULL:%n',
+          f'localhost:{src}/', f'{pull_dst}/')
+assert_log(pull_log, 'PULL', 'remote sender log')
+assert_payload(pull_dst, 'remote sender log')
+
+print('remote-logging: client, remote receiver and remote sender formats verified')
diff --git a/testsuite/tests/transfer/remote-shell-newline-escaping.py b/testsuite/tests/transfer/remote-shell-newline-escaping.py
new file mode 100644
index 000000000..322c6d008
--- /dev/null
+++ b/testsuite/tests/transfer/remote-shell-newline-escaping.py
@@ -0,0 +1,27 @@
+#!/usr/bin/env python3
+
+import os
+import subprocess
+
+from harness.rsync import SCRATCHDIR, rmtree, rsync_argv, test_fail, rsh_cmd
+
+base = SCRATCHDIR / 'remote-shell-newline'
+rmtree(base)
+src = base / 'src'
+src.mkdir(parents=True)
+(src / 'f').write_text('payload\n')
+sentinel = base / 'pwned'
+
+env = os.environ.copy()
+env['RSYNC_RSH'] = rsh_cmd(None, '--no-cd')
+dest = f"lh:{base}/dest\ntouch {sentinel}\n#"
+subprocess.run(rsync_argv('-a', f'{src}/', dest),
+               stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, env=env)
+
+if sentinel.exists():
+    test_fail("remote-shell newline injection executed the sentinel command")
+if (base / 'dest').exists():
+    test_fail("remote-shell newline split the destination "
+              "(eval ran the server into base/dest as a separate command)")
+
+print("remote-shell-newline-escaping: newline in a remote arg is quoted, not executed")
diff --git a/testsuite/tests/transfer/rsync-ssl.py b/testsuite/tests/transfer/rsync-ssl.py
new file mode 100644
index 000000000..1731091da
--- /dev/null
+++ b/testsuite/tests/transfer/rsync-ssl.py
@@ -0,0 +1,163 @@
+#!/usr/bin/env python3
+
+import os
+import re
+import shlex
+import subprocess
+
+from harness.rsync import SCRATCHDIR, SRCDIR, rmtree, test_fail
+
+base = SCRATCHDIR / 'rsync-ssl'
+rmtree(base)
+base.mkdir(parents=True)
+wrapper = ['bash', str(SRCDIR / 'rsync-ssl')]
+helper = ['--HELPER', 'localhost', 'rsync', '--server', '--daemon', '.']
+
+def executable(path, body):
+    path.write_text(body)
+    path.chmod(0o755)
+    return path
+
+def invoke(script, args, env):
+    return subprocess.run(['bash', str(script), *args], env=env,
+                          stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True)
+
+openssl_dir = base / 'openssl'
+openssl_dir.mkdir()
+openssl_args = openssl_dir / 'args'
+fake_openssl = executable(
+    openssl_dir / 'openssl',
+    f"#!/bin/sh\nprintf '%s\\n' \"$@\" > {shlex.quote(str(openssl_args))}\n",
+)
+ca = openssl_dir / 'ca.pem'
+ca.write_text('dummy-ca\n')
+openssl_env = {
+    **os.environ,
+    'RSYNC_SSL_TYPE': 'openssl',
+    'RSYNC_SSL_OPENSSL': str(fake_openssl),
+    'RSYNC_SSL_CA_CERT': str(ca),
+}
+openssl_env.pop('RSYNC_SSL_SKIP_HOSTNAME_CHECK', None)
+
+unfixed = executable(
+    openssl_dir / 'unfixed',
+    re.sub(r'(?m)^(\s*)validate_ssl_hostname .*$', r'\1:',
+           (SRCDIR / 'rsync-ssl').read_text()),
+)
+evil_host = 'localhost INJECTED_OPENSSL_ARG'
+evil_helper = ['--HELPER', evil_host, 'rsync', '--server', '--daemon', '.']
+invoke(unfixed, evil_helper, openssl_env)
+captured = openssl_args.read_text().splitlines() if openssl_args.exists() else []
+if 'INJECTED_OPENSSL_ARG' not in captured:
+    test_fail(f'unsafe control did not inject an OpenSSL argument: {captured}')
+result = invoke(SRCDIR / 'rsync-ssl', evil_helper, openssl_env)
+if result.returncode == 0 or 'invalid rsync-ssl hostname' not in result.stdout:
+    test_fail(f'crafted hostname was not rejected:\n{result.stdout}')
+
+def openssl_run(env):
+    openssl_args.unlink(missing_ok=True)
+    invoke(SRCDIR / 'rsync-ssl', helper, env)
+    return openssl_args.read_text().splitlines() if openssl_args.exists() else []
+
+captured = openssl_run(openssl_env)
+if not {'-verify_hostname', 'localhost'} <= set(captured):
+    test_fail(f'OpenSSL hostname verification is missing: {captured}')
+captured = openssl_run({**openssl_env, 'RSYNC_SSL_SKIP_HOSTNAME_CHECK': '1'})
+if '-verify_hostname' in captured:
+    test_fail(f'hostname opt-out retained -verify_hostname: {captured}')
+if not {'-servername', 'localhost', '-CAfile'} <= set(captured):
+    test_fail(f'hostname opt-out removed SNI or chain verification: {captured}')
+
+stunnel_dir = base / 'stunnel'
+stunnel_dir.mkdir()
+stunnel_config = stunnel_dir / 'config'
+fake_stunnel = executable(
+    stunnel_dir / 'stunnel',
+    f'#!/usr/bin/env bash\ncat <&10 > {shlex.quote(str(stunnel_config))} 2>/dev/null\n',
+)
+stunnel_ca = stunnel_dir / 'ca.pem'
+stunnel_ca.write_text('dummy-ca\n')
+stunnel_env = {
+    **os.environ,
+    'RSYNC_SSL_TYPE': 'stunnel',
+    'RSYNC_SSL_STUNNEL': str(fake_stunnel),
+}
+for name in ('RSYNC_SSL_CA_CERT', 'RSYNC_SSL_ALLOW_INSECURE_STUNNEL',
+             'RSYNC_SSL_SKIP_HOSTNAME_CHECK'):
+    stunnel_env.pop(name, None)
+
+def stunnel_run(env):
+    stunnel_config.unlink(missing_ok=True)
+    result = invoke(SRCDIR / 'rsync-ssl', helper, env)
+    config = stunnel_config.read_text() if stunnel_config.exists() else ''
+    return result, config
+
+_, config = stunnel_run({**stunnel_env, 'RSYNC_SSL_ALLOW_INSECURE_STUNNEL': '1'})
+if 'connect = localhost' not in config:
+    test_fail(f'fake stunnel did not capture a config:\n{config!r}')
+if 'verifyChain' in config or 'CAfile' in config or 'checkHost' in config:
+    test_fail(f'insecure stunnel config enabled verification:\n{config}')
+
+result, _ = stunnel_run(stunnel_env)
+if result.returncode == 0 or 'stunnel requires RSYNC_SSL_CA_CERT' not in result.stdout:
+    test_fail(f'stunnel without a CA was not rejected:\n{result.stdout}')
+
+_, config = stunnel_run({**stunnel_env, 'RSYNC_SSL_CA_CERT': str(stunnel_ca)})
+if 'verifyChain = yes' not in config or 'checkHost = localhost' not in config:
+    test_fail(f'stunnel did not verify the chain and hostname:\n{config}')
+
+_, config = stunnel_run({
+    **stunnel_env,
+    'RSYNC_SSL_CA_CERT': str(stunnel_ca),
+    'RSYNC_SSL_SKIP_HOSTNAME_CHECK': '1',
+})
+if 'verifyChain = yes' not in config or 'checkHost' in config:
+    test_fail(f'stunnel hostname opt-out changed chain verification:\n{config}')
+
+type_dir = base / 'type'
+fake_bin = type_dir / 'bin'
+fake_bin.mkdir(parents=True)
+rsync_args = type_dir / 'args'
+ssl_type = type_dir / 'type'
+executable(
+    fake_bin / 'rsync',
+    f"#!/bin/sh\nprintf '%s\\n' \"$@\" > {shlex.quote(str(rsync_args))}\n"
+    f"printf '%s\\n' \"${{RSYNC_SSL_TYPE-UNSET}}\" > {shlex.quote(str(ssl_type))}\n",
+)
+type_env = {**os.environ, 'PATH': str(fake_bin) + os.pathsep + os.environ.get('PATH', '')}
+for name in ('RSYNC_SSL_TYPE', 'RSYNC_SSL_OPENSSL', 'RSYNC_SSL_STUNNEL'):
+    type_env.pop(name, None)
+
+def type_run(args, expected):
+    rsync_args.unlink(missing_ok=True)
+    ssl_type.unlink(missing_ok=True)
+    result = invoke(SRCDIR / 'rsync-ssl', args, type_env)
+    if result.returncode:
+        test_fail(f'rsync-ssl exited {result.returncode} for {args!r}:\n{result.stdout}')
+    got = rsync_args.read_text().splitlines() if rsync_args.exists() else []
+    actual = ssl_type.read_text().strip() if ssl_type.exists() else 'UNSET'
+    if actual != expected:
+        test_fail(f'RSYNC_SSL_TYPE is {actual!r}, expected {expected!r} for {args!r}')
+    return got
+
+for args, expected in (
+    (['--dry-run', '--type=stunnel', 'host::mod'], 'stunnel'),
+    (['--type=stunnel', '--dry-run', 'host::mod'], 'stunnel'),
+    (['-av', 'host::mod', '--type=openssl'], 'openssl'),
+    (['-av', 'host::mod'], 'UNSET'),
+):
+    captured = type_run(args, expected)
+    if any(value.startswith('--type=') for value in captured):
+        test_fail(f'--type was passed to rsync for {args!r}: {captured}')
+    if any(value not in captured for value in args if not value.startswith('--type=')):
+        test_fail(f'rsync arguments were lost for {args!r}: {captured}')
+
+rsh = f"--rsh='{SRCDIR / 'rsync-ssl'}' --HELPER"
+captured = type_run(['--', '--type=stunnel', 'host::mod'], 'UNSET')
+if captured != [rsh, '--', '--type=stunnel', 'host::mod']:
+    test_fail(f'arguments after -- were changed: {captured}')
+captured = type_run(['--type=openssl', '--', '--type=stunnel', 'host::mod'], 'openssl')
+if captured != [rsh, '--', '--type=stunnel', 'host::mod']:
+    test_fail(f'arguments after -- were changed: {captured}')
+
+print('rsync-ssl validates hosts, verifies certificates and consumes wrapper options')
diff --git a/testsuite/size-filter_test.py b/testsuite/tests/transfer/size-filter.py
similarity index 69%
rename from testsuite/size-filter_test.py
rename to testsuite/tests/transfer/size-filter.py
index 4fa3a5007..608022a3a 100644
--- a/testsuite/size-filter_test.py
+++ b/testsuite/tests/transfer/size-filter.py
@@ -1,14 +1,6 @@
 #!/usr/bin/env python3
-"""Coverage of --max-size / --min-size at depth.
 
-A small and a large file at every level; --max-size must transfer only the
-small ones and --min-size only the large ones, the selection holding all the
-way down the tree.
-"""
-
-import os
-
-from rsyncfns import (
+from harness.rsync import (
     FROMDIR, TODIR,
     assert_not_exists, assert_same, make_data_file, rmtree, run_rsync,
 )
@@ -17,7 +9,6 @@
 SMALL = 500
 LARGE = 5000
 
-
 def seed():
     rmtree(src)
     rmtree(TODIR)
@@ -28,10 +19,6 @@ def seed():
         make_data_file(cur / f'large{lvl}', LARGE)
         cur = cur / f'd{lvl + 1}'
 
-
-# --- --max-size keeps only the small files at every level -------------------
-# Compare content (not just existence) so a kept file is proven to be the
-# transferred source, not an empty/stale placeholder.
 seed()
 run_rsync('-a', '--max-size=1000', f'{src}/', f'{TODIR}/')
 dcur, scur = TODIR, src
@@ -41,7 +28,6 @@ def seed():
     assert_not_exists(dcur / f'large{lvl}', label=f'--max-size dropped large L{lvl}')
     dcur, scur = dcur / f'd{lvl + 1}', scur / f'd{lvl + 1}'
 
-# --- --min-size keeps only the large files at every level -------------------
 seed()
 run_rsync('-a', '--min-size=1000', f'{src}/', f'{TODIR}/')
 dcur, scur = TODIR, src
diff --git a/testsuite/tests/transfer/smoke.py b/testsuite/tests/transfer/smoke.py
new file mode 100644
index 000000000..fb147c247
--- /dev/null
+++ b/testsuite/tests/transfer/smoke.py
@@ -0,0 +1,55 @@
+#!/usr/bin/env python3
+
+import os
+import subprocess
+
+from harness import TestContext, requires, run
+from harness.rsync import checkit, rsync_argv, rsync_path_arg, rsh_cmd, run_rsync, test_fail
+
+@requires(features={'remote-shell'}, transports={'pipe', 'tcp'}, min_peer='2.6.0', mutates={'environment', 'filesystem'}, tags={'compatibility', 'smoke', 'transfer', 'version-mix'})
+def test(context: TestContext):
+    source_root = context.source
+    destination = context.destination
+    os.environ['RSYNC_RSH'] = rsh_cmd()
+    for option in ('--version', '--info=help', '--debug=help'):
+        if run_rsync(option, check=False).returncode:
+            test_fail(f'{option} failed')
+    daemon_help = run_rsync('--daemon', '--help', capture_output=True).stdout
+    if '--no-detach' not in daemon_help or 'rsync --daemon' not in daemon_help:
+        test_fail('--daemon --help did not print daemon usage')
+
+    name = 'A weird)name'
+    source = source_root / name
+    source.mkdir(parents=True)
+
+    def append(text):
+        with open(source / 'file', 'a') as stream:
+            stream.write(text + '\n')
+
+    def copy(options, source_host, destination_host):
+        checkit([*options, f'--rsync-path={rsync_path_arg()}', f'{source_host}{source}/',
+                 f'{destination_host}{destination / name}'], source_root, destination)
+
+    append('local')
+    checkit(['-ai', f'{source_root}/', f'{destination}/'], source_root, destination)
+    for text, options, source_host, destination_host in (
+        ('pull', ['-ai'], 'lh:', ''), ('push', ['-ai'], '', 'lh:'),
+        ('secluded-pull', ['-ais'], 'lh:', ''), ('secluded-push', ['-ais'], '', 'lh:'),
+    ):
+        append(text)
+        copy(options, source_host, destination_host)
+
+    for name in ('one', 'two'):
+        (source_root / name).touch()
+    for options, overrides in ((('--old-args',), {}), ((), {'RSYNC_OLD_ARGS': '1'})):
+        for name in ('one', 'two'):
+            (destination / name).unlink(missing_ok=True)
+        env = os.environ.copy()
+        env.update(overrides)
+        subprocess.run(rsync_argv('-ai', *options, f'--rsync-path={rsync_path_arg()}',
+                                 'lh:one two', f'{destination}/'), cwd=source_root, env=env, check=True)
+        if not all((destination / name).is_file() for name in ('one', 'two')):
+            test_fail('old argument handling failed')
+
+if __name__ == '__main__':
+    run(test)
diff --git a/testsuite/source-change-size-continues_test.py b/testsuite/tests/transfer/source-change-size-continues.py
similarity index 83%
rename from testsuite/source-change-size-continues_test.py
rename to testsuite/tests/transfer/source-change-size-continues.py
index 314784a9d..bacc5d734 100644
--- a/testsuite/source-change-size-continues_test.py
+++ b/testsuite/tests/transfer/source-change-size-continues.py
@@ -1,18 +1,4 @@
 #!/usr/bin/env python3
-# Regression guard for a source file changing size during send_files().
-#
-# The sender hardening for source reads now opens content through the confined
-# sender path instead of the old plain open.  A source file can still change
-# after the file list recorded its original size and after send_files() fstat()s
-# the opened fd.  That per-file read failure may be diagnosed as a partial
-# transfer, but it must not abort the sender/receiver pair before unrelated
-# later file-list entries are transferred.
-#
-# To avoid a timing race, this test runs rsync under a scratch-built LD_PRELOAD
-# shim.  The shim watches the exact source fd via /proc/self/fd and truncates it
-# immediately before the first read() from that fd.  This leaves the file-list
-# and send_files() fstat() sizes at the original value, then deterministically
-# exercises fileio.c's "file changed mid transfer" map_ptr() path.
 
 import os
 import shlex
@@ -20,12 +6,11 @@
 import subprocess
 import sys
 
-from rsyncfns import (
+from harness.rsync import (
     RSYNC, SCRATCHDIR, assert_same, make_data_file, makepath, rmtree,
     rsync_argv, test_fail, test_skipped, split_rsync_cmd,
 )
 
-
 SHIM_C = r'''
 #define _GNU_SOURCE 1
 #include <dlfcn.h>
@@ -121,7 +106,6 @@
 }
 '''
 
-
 def compiler():
     cc = os.environ.get('CC')
     if cc:
@@ -132,14 +116,14 @@ def compiler():
             return [path]
     return None
 
-
 def build_shim():
     if not sys.platform.startswith('linux'):
         test_skipped('source-size-change regression uses LD_PRELOAD and '
-                     '/proc/self/fd to synchronise the source read')
+                     '/proc/self/fd to synchronise the source read', capability='linux_interpose')
     cc = compiler()
     if not cc:
-        test_skipped('no C compiler available to build the source-read shim')
+        test_skipped('no C compiler available to build the source-read shim',
+                     capability='linux_interpose')
 
     cfile = SCRATCHDIR / 'source_shrink_read.c'
     sofile = SCRATCHDIR / 'source_shrink_read.so'
@@ -150,13 +134,13 @@ def build_shim():
         stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True)
     if proc.returncode != 0 or not sofile.is_file():
         test_skipped('could not build the source-read shim:\n'
-                     + (proc.stdout or '').strip())
+                     + (proc.stdout or '').strip(), capability='linux_interpose')
     return sofile
 
-
 first = split_rsync_cmd(RSYNC)[0] if RSYNC else ''
 if os.path.basename(first) == 'valgrind':
-    test_skipped('LD_PRELOAD read hook is not meaningful under valgrind')
+    test_skipped('LD_PRELOAD read hook is not meaningful under valgrind',
+                 capability='linux_interpose')
 
 base = SCRATCHDIR / 'source-change-size'
 src = base / 'src'
@@ -189,7 +173,7 @@ def build_shim():
 
 if not load_mark.exists():
     test_skipped('source-read shim was not exercised; rsync may be static or '
-                 'the platform ignored LD_PRELOAD')
+                 'the platform ignored LD_PRELOAD', capability='linux_interpose')
 if not mark.exists():
     test_fail('source-read shim loaded but did not target the changing source '
               'file')
diff --git a/testsuite/tests/transfer/sparse.py b/testsuite/tests/transfer/sparse.py
new file mode 100644
index 000000000..75bb49759
--- /dev/null
+++ b/testsuite/tests/transfer/sparse.py
@@ -0,0 +1,38 @@
+#!/usr/bin/env python3
+
+import os
+
+from harness.rsync import (
+    FROMDIR, TODIR,
+    allocated_size, assert_same, makepath, rmtree, run_rsync, test_fail, test_skipped,
+)
+
+src = FROMDIR
+deep = os.path.join('d1', 'd2', 'd3', 'holey')
+SIZE = 4 * 1024 * 1024
+
+def make_sparse(path):
+    with open(path, 'wb') as f:
+        f.write(b'head')
+        f.seek(SIZE - 4)
+        f.write(b'tail')
+
+rmtree(src)
+rmtree(TODIR)
+makepath(src / 'd1' / 'd2' / 'd3')
+make_sparse(src / deep)
+
+if allocated_size(src / deep) >= SIZE:
+    test_skipped("source filesystem did not create a sparse file", capability='sparse')
+
+run_rsync('-a', '-S', f'{src}/', f'{TODIR}/')
+assert_same(TODIR / deep, src / deep, label='-S content')
+if allocated_size(TODIR / deep) >= SIZE:
+    test_fail(f"-S did not preserve the hole at depth "
+              f"(allocated {allocated_size(TODIR / deep)} for a {SIZE}-byte file)")
+
+rmtree(TODIR)
+run_rsync('-a', '--no-sparse', f'{src}/', f'{TODIR}/')
+assert_same(TODIR / deep, src / deep, label='no-sparse content')
+
+print("sparse: -S preserves a deep hole; content correct with and without it")
diff --git a/testsuite/ssh-basic_test.py b/testsuite/tests/transfer/ssh-basic.py
similarity index 50%
rename from testsuite/ssh-basic_test.py
rename to testsuite/tests/transfer/ssh-basic.py
index b41b0ff1c..b8331f99d 100644
--- a/testsuite/ssh-basic_test.py
+++ b/testsuite/tests/transfer/ssh-basic.py
@@ -1,32 +1,35 @@
 #!/usr/bin/env python3
-# Python rewrite of testsuite/ssh-basic.test.
-#
-# Basic two-step "remote shell" transfer via lsh.sh (or real ssh if
-# rsync_enable_ssh_tests=yes is set in shconfig). Confirms that an -e
-# RSH transfer reproduces the source tree on the destination, and that
-# a follow-up --delete pass cleans up after a destination-side rename.
 
 import os
+import re
 import shlex
 import shutil
 import subprocess
 
-from rsyncfns import (
-    FROMDIR, SRCDIR, TODIR,
-    checkit, hands_setup, runtest, test_skipped, rsync_path_arg, rsh_cmd,
+from harness import rsync
+from harness.rsync import (
+    FROMDIR,
+    RSYNC_PEER,
+    TODIR,
+    checkit,
+    hands_setup,
+    runtest,
+    test_skipped,
+    rsync_path_arg,
+    rsh_cmd,
+    split_rsync_cmd,
 )
+from harness import metadata
 
+metadata(features={'remote-shell'}, transports={'pipe', 'tcp'}, min_peer='2.6.0', mutates={'environment', 'filesystem', 'process'}, tags={'compatibility', 'transfer', 'version-mix'})
 
 SSH = rsh_cmd()
 
-# Allow opting into real ssh via the shconfig variable, like the shell test.
 if os.environ.get('rsync_enable_ssh_tests') == 'yes':
     real_ssh = shutil.which('ssh')
     if real_ssh:
         SSH = real_ssh
 
-# SSH is quoted for rsync's own tokenizer (a build path with '~' or a space
-# comes out in quotes), so split it the same way before exec'ing it directly.
 probe = subprocess.run(
     [*shlex.split(SSH), '-oBatchMode yes', 'localhost', 'echo', 'yes'],
     capture_output=True, text=True,
@@ -38,22 +41,31 @@
 
 print(f"Using remote shell: {SSH}")
 
-hands_setup()
-
-# RSYNC may be a multi-word command line; pass it through --rsync-path.
-from rsyncfns import RSYNC, RSYNC_PEER
+compare_link_times = '-l' in shlex.split(rsync.TLS_ARGS)
+peer_version = subprocess.run(
+    [*split_rsync_cmd(RSYNC_PEER), '--version'],
+    capture_output=True, text=True,
+)
+match = re.search(r'rsync\s+version\s+(\d+)\.(\d+)\.(\d+)',
+                  peer_version.stdout)
+if peer_version.returncode == 0 and match and int(match.group(1)) < 3:
+    rsync.TLS_ARGS = ' '.join(
+        arg for arg in shlex.split(rsync.TLS_ARGS) if arg != '-l'
+    )
 
+hands_setup()
+if compare_link_times:
+    os.utime(FROMDIR / 'nolf-symlink', (1_000_000_000, 1_000_000_000),
+             follow_symlinks=False)
 
 def _basic():
     checkit(['-avH', '-e', SSH, f'--rsync-path={rsync_path_arg()}',
              f'{FROMDIR}/', f'localhost:{TODIR}'], FROMDIR, TODIR)
 
-
 def _delete_after_rename():
     shutil.move(str(TODIR / 'text'), str(TODIR / 'ThisShouldGo'))
     checkit(['--delete', '-avH', '-e', SSH, f'--rsync-path={rsync_path_arg()}',
              f'{FROMDIR}/', f'localhost:{TODIR}'], FROMDIR, TODIR)
 
-
 runtest("ssh: basic test", _basic)
 runtest("ssh: renamed file", _delete_after_rename)
diff --git a/testsuite/stop-time_test.py b/testsuite/tests/transfer/stop-time.py
similarity index 53%
rename from testsuite/stop-time_test.py
rename to testsuite/tests/transfer/stop-time.py
index 8642ce499..8560d99a3 100644
--- a/testsuite/stop-time_test.py
+++ b/testsuite/tests/transfer/stop-time.py
@@ -1,15 +1,8 @@
 #!/usr/bin/env python3
-"""Coverage of --stop-at (options.c parse_time) and --stop-after.
-
---stop-at parses an absolute y-m-dTh:m time (parse_time): a future time is
-accepted and the transfer proceeds; a past time is rejected at parse. --stop-after
-takes a minute count. These exercise the OPT_STOP_AT/OPT_STOP_AFTER option
-handling that no other test reaches.
-"""
 
 from datetime import datetime, timedelta
 
-from rsyncfns import (
+from harness.rsync import (
     FROMDIR, TODIR,
     assert_same, make_tree, rmtree, run_rsync, test_fail, walk_files,
 )
@@ -19,24 +12,18 @@
 make_tree(src, depth=2)
 rels = [p.relative_to(src) for p in walk_files(src)]
 
-# --- --stop-at in the future: parses, transfer completes normally -----------
-# Generated relative to now (a day ahead) rather than a fixed far-future date:
-# rsync rejects a --stop-at that isn't strictly in the future, and a hard-coded
-# year would date-rot and can overflow a 32-bit time_t.
 future = (datetime.now() + timedelta(days=1)).strftime('%Y-%m-%dT%H:%M')
 rmtree(TODIR)
 run_rsync('-a', f'--stop-at={future}', f'{src}/', f'{TODIR}/')
 for rel in rels:
     assert_same(TODIR / rel, src / rel, label=f'--stop-at future {rel}')
 
-# --- --stop-at in the past: rejected at parse -------------------------------
 rmtree(TODIR)
 proc = run_rsync('-a', '--stop-at=2000-01-01T00:00', f'{src}/', f'{TODIR}/',
                  check=False)
 if proc.returncode == 0:
     test_fail("--stop-at with a past time was not rejected")
 
-# --- --stop-after (minutes): parses, transfer completes ---------------------
 rmtree(TODIR)
 run_rsync('-a', '--stop-after=60', f'{src}/', f'{TODIR}/')
 for rel in rels:
diff --git a/testsuite/strict-basis_test.py b/testsuite/tests/transfer/strict-basis.py
similarity index 98%
rename from testsuite/strict-basis_test.py
rename to testsuite/tests/transfer/strict-basis.py
index 100a5673b..1748a67fa 100644
--- a/testsuite/strict-basis_test.py
+++ b/testsuite/tests/transfer/strict-basis.py
@@ -1,5 +1,4 @@
 #!/usr/bin/env python3
-"""Ensure forged partial-dir basis tokens cannot enable in-place writes."""
 
 import hashlib
 import os
@@ -7,7 +6,7 @@
 import struct
 import subprocess
 
-from rsyncfns import (
+from harness.rsync import (
     TODIR,
     hands_setup,
     makepath,
@@ -16,7 +15,7 @@
     test_fail,
     test_skipped,
 )
-import rsync_proto as rp
+from harness import protocol as rp
 
 hands_setup()
 
@@ -33,14 +32,12 @@
 EXPECTED_PROTOCOL_ERROR = "error in rsync protocol data stream"
 TEST_DATA = b"STRICT_NOFOLLOW_REQUIRED\n"
 
-
 def drain_argv(peer):
     nul_run = 0
     while nul_run < 2:
         byte = peer._recv_exact(1)
         nul_run = nul_run + 1 if byte == b"\0" else 0
 
-
 def read_mux_bytes(peer, buf, count):
     while len(buf) < count:
         word = struct.unpack("<I", peer._recv_exact(4))[0]
@@ -51,19 +48,15 @@ def read_mux_bytes(peer, buf, count):
     del buf[:count]
     return result
 
-
 def read_mux_int(peer, buf):
     return struct.unpack("<i", read_mux_bytes(peer, buf, 4))[0]
 
-
 def read_mux_short(peer, buf):
     return struct.unpack("<H", read_mux_bytes(peer, buf, 2))[0]
 
-
 def read_mux_byte(peer, buf):
     return read_mux_bytes(peer, buf, 1)[0]
 
-
 def read_mux_ndx(peer, buf):
     first = read_mux_byte(peer, buf)
     if first == 0:
@@ -78,7 +71,6 @@ def read_mux_ndx(peer, buf):
         return (value[0] << 8) + value[1] - 1
     return first - 1
 
-
 def drain_generator_request(peer, buf):
     while True:
         count = read_mux_int(peer, buf)
@@ -107,7 +99,6 @@ def drain_generator_request(peer, buf):
         if flags & rp.ITEM_TRANSFER:
             return index
 
-
 def run_synthetic_sender(client_args, uri_path, dest_path, inject_fault):
     listener = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
     listener.bind(("127.0.0.1", 0))
@@ -149,7 +140,6 @@ def run_synthetic_sender(client_args, uri_path, dest_path, inject_fault):
     stdout, _ = process.communicate(timeout=10)
     return process.returncode, stdout
 
-
 def run_basis_sender(client_args, dest_path, inject_fault):
     listener = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
     listener.bind(("127.0.0.1", 0))
@@ -190,7 +180,6 @@ def run_basis_sender(client_args, dest_path, inject_fault):
     stdout, _ = process.communicate(timeout=10)
     return process.returncode, stdout
 
-
 print("=== Test 1: Operator-path leaf symlink rejection ===", flush=True)
 rmtree(TODIR)
 dest = TODIR / "dest"
@@ -219,7 +208,6 @@ def run_basis_sender(client_args, dest_path, inject_fault):
 if (dest / "f").is_file() and (dest / "f").read_bytes() == TEST_DATA:
     test_fail("receiver followed an alt-dest leaf symlink:\n" + output)
 
-
 print("=== Test 1: Legitimate partial-dir transfer ===", flush=True)
 rmtree(TODIR)
 dest = TODIR / "dest"
diff --git a/testsuite/tests/transfer/temp-dir.py b/testsuite/tests/transfer/temp-dir.py
new file mode 100644
index 000000000..4986634c4
--- /dev/null
+++ b/testsuite/tests/transfer/temp-dir.py
@@ -0,0 +1,38 @@
+#!/usr/bin/env python3
+
+from harness.rsync import (
+    FROMDIR, SCRATCHDIR, TODIR,
+    assert_same, make_tree, rmtree, run_rsync, test_fail, walk_files,
+)
+
+src = FROMDIR
+tmp = SCRATCHDIR / 'scratch-temp'
+rmtree(src)
+rmtree(TODIR)
+rmtree(tmp)
+tmp.mkdir()
+
+make_tree(src, depth=3, data=True)
+rels = [p.relative_to(src) for p in walk_files(src)]
+
+run_rsync('-a', f'--temp-dir={tmp}', f'{src}/', f'{TODIR}/')
+
+for rel in rels:
+    assert_same(TODIR / rel, src / rel, label=f'temp-dir {rel}')
+
+leftover = sorted(p for p in tmp.rglob('*'))
+if leftover:
+    test_fail(f"--temp-dir left scratch files behind: {leftover}")
+
+strays = [p for p in TODIR.rglob('.*') if p.is_file()]
+if strays:
+    test_fail(f"dest tree contains stray temp files: {strays}")
+
+rmtree(TODIR)
+proc = run_rsync('-a', f'--temp-dir={SCRATCHDIR}/does-not-exist',
+                 f'{src}/', f'{TODIR}/', check=False)
+if proc.returncode == 0:
+    test_fail("--temp-dir pointing at a missing directory unexpectedly "
+              "succeeded")
+
+print("temp-dir: cross-dir rename at depth verified; missing temp dir fails")
diff --git a/testsuite/update_test.py b/testsuite/tests/transfer/update.py
similarity index 60%
rename from testsuite/update_test.py
rename to testsuite/tests/transfer/update.py
index 2be222a01..2df991e5c 100644
--- a/testsuite/update_test.py
+++ b/testsuite/tests/transfer/update.py
@@ -1,15 +1,8 @@
 #!/usr/bin/env python3
-"""Coverage of -u (--update) and --force at depth.
-
--u skips any destination file that is newer than the source. --force lets rsync
-delete a non-empty destination directory when it must be replaced by a
-non-directory. Both decide a per-entry action on a name whose parent chain the
-resolver restructure rewrites, so check them several levels deep.
-"""
 
 import os
 
-from rsyncfns import (
+from harness.rsync import (
     FROMDIR, TODIR,
     assert_same, make_tree, makepath, rmtree, run_rsync, test_fail,
 )
@@ -17,31 +10,25 @@
 src = FROMDIR
 deep = os.path.join('d1', 'd2', 'd3', 'f3')
 
-
-# --- -u keeps a newer destination file, updates an older one ----------------
 rmtree(src)
 rmtree(TODIR)
 make_tree(src, depth=3)
 run_rsync('-a', f'{src}/', f'{TODIR}/')
 
-# Make the deep source newer in content, but the DEST copy newer in time.
 (src / deep).write_text("new source content\n")
 keep = "destination is newer - keep me\n"
 (TODIR / deep).write_text(keep)
 st = os.stat(src / deep)
-os.utime(TODIR / deep, (st.st_atime, st.st_mtime + 100))   # dest mtime newer
+os.utime(TODIR / deep, (st.st_atime, st.st_mtime + 100))
 
 run_rsync('-a', '-u', f'{src}/', f'{TODIR}/')
 if (TODIR / deep).read_text() != keep:
     test_fail("-u overwrote a destination file that was newer than the source")
 
-# An older destination file IS updated under -u.
-os.utime(TODIR / deep, (st.st_atime, st.st_mtime - 100))    # dest mtime older
+os.utime(TODIR / deep, (st.st_atime, st.st_mtime - 100))
 run_rsync('-a', '-u', f'{src}/', f'{TODIR}/')
 assert_same(TODIR / deep, src / deep, label='-u updated an older dest file')
 
-# A newer destination symlink is still replaced by a source regular file
-# because a file-format difference is always important enough to update.
 rmtree(src)
 rmtree(TODIR)
 makepath(src, TODIR)
@@ -56,20 +43,17 @@
 assert_same(TODIR / 'foo', src / 'foo',
             label='-u replaced a newer dest symlink with a regular file')
 
-# --- --force replaces a non-empty dest directory with a file at depth -------
 rmtree(src)
 rmtree(TODIR)
 makepath(src / 'd1' / 'd2' / 'd3')
-(src / deep).write_text("now a regular file\n")        # src: d1/d2/d3/f3 = file
-makepath(TODIR / 'd1' / 'd2' / 'd3' / 'f3')             # dest: f3 = non-empty dir
+(src / deep).write_text("now a regular file\n")
+makepath(TODIR / 'd1' / 'd2' / 'd3' / 'f3')
 (TODIR / 'd1' / 'd2' / 'd3' / 'f3' / 'occupant').write_text("blocker\n")
 
-# Without --force the non-empty directory can't be replaced.
 proc = run_rsync('-a', f'{src}/', f'{TODIR}/', check=False)
 if proc.returncode == 0 and (TODIR / deep).is_file():
     test_fail("a non-empty directory was replaced by a file without --force")
 
-# With --force the directory is removed and the file takes its place.
 run_rsync('-a', '--force', f'{src}/', f'{TODIR}/')
 if not (TODIR / deep).is_file():
     test_fail("--force did not replace the directory with the file at depth")
diff --git a/testsuite/variety_test.py b/testsuite/tests/transfer/variety.py
similarity index 55%
rename from testsuite/variety_test.py
rename to testsuite/tests/transfer/variety.py
index dfea53a37..cc81b6a9f 100644
--- a/testsuite/variety_test.py
+++ b/testsuite/tests/transfer/variety.py
@@ -1,27 +1,4 @@
 #!/usr/bin/env python3
-# Differential regression test: introducing the current rsync on EITHER side of
-# a transfer must not change the destination tree that an all-old (e.g. 3.2.7)
-# transfer would produce, for a "variety tree" exercising every inode type rsync
-# handles -- directories, regular files, symlinks (heavy coverage: to each type,
-# escaping ../.. links, absolute links, links transiting outside the tree),
-# fifos, sockets, char/block devices -- with varied permissions, xattrs, ACLs,
-# hard links and (as root) mixed ownership. See make_variety_tree.
-#
-# Peer-agnostic: RSYNC is the current binary, RSYNC_PEER the --rsync-bin2 peer.
-# With no peer (RSYNC_PEER == RSYNC) it degrades to a self-consistency check.
-# Enabled first for the 3.2.7 peer via testsuite/expect/rsync_3.2.7.expect.
-#
-# ORACLE: for each (transport, direction, option-profile) the ALL-OLD pairing is
-# the reference ("what 3.2.7 does"); the new->old, old->new and new->new pairings
-# must all reproduce it byte-for-byte (tls listing + contents + xattrs + ACLs +
-# hard-link grouping). A per-scenario reference is essential because some
-# transports legitimately transform the tree (a daemon receiver sanitizes
-# absolute/escaping symlinks) -- that transform is version-independent, so it
-# must be compared against the same transport, not against a local copy.
-#
-# The symlinked-PATH-COMPONENT traversal cases (where the current build's
-# hardened resolver intentionally diverges from 3.2.7) live in the separate
-# variety-symlink-traversal_test.py so they can be xfailed without masking this.
 
 import os
 import re
@@ -29,22 +6,33 @@
 import subprocess
 import sys
 
-from rsyncfns import (
-    RSYNC, RSYNC_PEER, SRCDIR, SCRATCHDIR, USE_TCP,
-    make_variety_tree, compare_trees, rmtree,
-    xattrs_supported, acls_supported, devices_supported, owners_supported,
-    write_daemon_conf, start_test_daemon,
-    test_fail, split_rsync_cmd, rsh_cmd,
+from harness.rsync import (
+    RSYNC,
+    RSYNC_PEER,
+    SCRATCHDIR,
+    USE_TCP,
+    make_variety_tree,
+    compare_trees,
+    rmtree,
+    xattrs_supported,
+    acls_supported,
+    devices_supported,
+    owners_supported,
+    write_daemon_conf,
+    start_test_daemon,
+    test_fail,
+    split_rsync_cmd,
+    rsh_cmd,
 )
+from harness import metadata
+
+metadata(features={'daemon', 'filesystem-specials', 'remote-shell'}, transports={'pipe', 'tcp'}, min_peer='2.6.0', cost='expensive', mutates={'filesystem', 'process', 'socket'}, tags={'compatibility', 'metadata', 'transfer', 'version-mix'})
 
 SSH = rsh_cmd()
 DAEMON_PORT_OLD = 12931
 DAEMON_PORT_NEW = 12932
 
 def _peer_has(feature):
-    """True if the peer binary advertises `feature` ('xattrs'/'ACLs') in -VV.
-    Pre-3.2.0 peers have no -VV, so this is False -- we then skip -X/-A for
-    them, which is correct (we can't compare a feature one side can't carry)."""
     try:
         vv = subprocess.run(split_rsync_cmd(RSYNC_PEER) + ['-VV'],
                             capture_output=True, text=True)
@@ -52,33 +40,20 @@ def _peer_has(feature):
     except OSError:
         return False
 
-
 def _forced_proto(cmd):
-    """The --protocol=N pinned on a binary's command string, else None (used by
-    the fleet's check29/check30 passes)."""
     m = re.search(r'--protocol[ =](\d+)', cmd)
     return int(m.group(1)) if m else None
 
-
-# ACLs and xattrs require protocol 30+; a forced --protocol=29 (the fleet's
-# check29 pass) negotiates 29 and rsync aborts on -A/-X, so drop them then.
 _pinned = [p for p in (_forced_proto(RSYNC), _forced_proto(RSYNC_PEER)) if p]
 _AX_PROTO_OK = not _pinned or min(_pinned) >= 30
 
-# Use a feature only when BOTH the current binary and the peer support it (and
-# the negotiated protocol can carry it).
 WITH_X = xattrs_supported() and _peer_has('xattrs') and _AX_PROTO_OK
 WITH_A = acls_supported() and _peer_has('ACLs') and _AX_PROTO_OK
 WITH_DEV = devices_supported()
 WITH_OWN = owners_supported()
 
-# Daemon/remote paths resolve against HOME (-> scratch dir); cd there.
 os.chdir(SCRATCHDIR)
 
-# One read-only source for the whole run, so every case compares copies of the
-# exact same bytes. We transfer transfer_root/; the escape/ links point up into
-# the (untransferred) above/ siblings, so on the dest they are copied as link
-# strings -- identical for both binaries.
 SRC = SCRATCHDIR / 'variety-src'
 info = make_variety_tree(SRC, with_acls=WITH_A, with_xattrs=WITH_X,
                          with_devices=WITH_DEV, with_owners=WITH_OWN)
@@ -93,11 +68,8 @@ def _forced_proto(cmd):
 VDST_BASE = SCRATCHDIR / 'vdst'
 VDST_BASE.mkdir(exist_ok=True)
 
-OK_CODES = (0, 23, 24)   # specials without -D -> rsync warns and returns 23/24
+OK_CODES = (0, 23, 24)
 
-# -A/-X only when supported (3.2.7 has both). -L/--copy-links is excluded: the
-# absolute/escape links point into the SOURCE scratch, so dereferencing tests
-# source layout, not transfer fidelity.
 _full = ['-a', '-H'] + (['-A'] if WITH_A else []) + (['-X'] if WITH_X else [])
 PROFILES = {
     'P1-full':       _full + ['--specials', '--devices'],
@@ -106,16 +78,14 @@ def _forced_proto(cmd):
     'P4-safelinks':  ['-a', '--safe-links'],
     'P5-noimplied':  _full + ['-D', '--no-implied-dirs'],
 }
-WIRE_PROFILES = ('P1-full', 'P2-links', 'P5-noimplied')   # over the wire
+WIRE_PROFILES = ('P1-full', 'P2-links', 'P5-noimplied')
 PAIRINGS = (('old', 'old'), ('new', 'old'), ('old', 'new'), ('new', 'new'))
 
-results = []   # (case_label, [diff, ...])
-
+results = []
 
 def binof(role):
     return RSYNC_PEER if role == 'old' else RSYNC
 
-
 def run(binary_cmd, args, label):
     argv = shlex.split(binary_cmd) + args
     proc = subprocess.run(argv, capture_output=True, text=True)
@@ -124,27 +94,18 @@ def run(binary_cmd, args, label):
         sys.stderr.write(proc.stderr)
         test_fail(f"{label}: rsync exited {proc.returncode}: {' '.join(argv)}")
 
-
 def newdir(base, name):
     d = base / name
     rmtree(d)
     d.mkdir(parents=True)
     return d
 
-
 def compare(dest, ref, label):
     diffs = compare_trees(dest, ref, label,
                           with_acls=WITH_A, with_xattrs=WITH_X)
     if diffs:
         results.append((label, diffs))
 
-
-# --- daemon plumbing: a config + daemon per role on demand ---
-# munge symlinks defaults ON for a module (prepends /rsyncd-munged/); disable so
-# the only daemon symlink transform is the standard absolute-link sanitisation,
-# which both binaries do identically. Each role gets its own pid/log file so the
-# old and new daemons can run concurrently in --use-tcp mode without a pid-lock
-# clash.
 def _make_conf(role):
     return write_daemon_conf([
         ('vsrc', {'path': str(TR), 'read only': 'yes'}),
@@ -155,15 +116,10 @@ def _make_conf(role):
         'log file': str(SCRATCHDIR / f'rsyncd-{role}.log'),
     }, name=f'vd-{role}.conf')
 
-
 _conf_for = {'old': _make_conf('old'), 'new': _make_conf('new')}
 _daemon_url = {}
 
-
 def daemon_url(drole):
-    """URL for a daemon running `drole`'s binary. In --use-tcp mode each role
-    gets its own listener (cached); in pipe mode this resets RSYNC_CONNECT_PROG
-    on every call, so call it immediately before the client run."""
     if USE_TCP:
         if drole not in _daemon_url:
             port = DAEMON_PORT_OLD if drole == 'old' else DAEMON_PORT_NEW
@@ -172,9 +128,7 @@ def daemon_url(drole):
         return _daemon_url[drole]
     return start_test_daemon(_conf_for[drole], 0, rsync_cmd=binof(drole))
 
-
 def do_transfer(transport, direction, crole, srole, prof, name):
-    """Run one pairing and return the destination dir to compare."""
     args = PROFILES[prof]
     if transport == 'local':
         d = newdir(DESTBASE, name)
@@ -188,7 +142,6 @@ def do_transfer(transport, direction, crole, srole, prof, name):
         else:
             run(binof(crole), common + [f'localhost:{SRC_SLASH}', f'{d}/'], name)
         return d
-    # daemon
     url = daemon_url(srole)
     if direction == 'push':
         d = newdir(VDST_BASE, name)
@@ -198,33 +151,25 @@ def do_transfer(transport, direction, crole, srole, prof, name):
     run(binof(crole), args + [f'{url}vsrc/', f'{d}/'], name)
     return d
 
-
 def run_scenario(transport, direction, prof, pairings):
-    """Run all `pairings` for one scenario; compare each non-ref to the all-old
-    reference (pairings[0] must be the all-old pair)."""
     ref = None
     for crole, srole in pairings:
         tag = f"{transport}-{direction}-c{crole}-s{srole}/{prof}"
         dest = do_transfer(transport, direction, crole, srole, prof,
                            tag.replace('/', '_'))
         if ref is None:
-            ref = dest          # all-old reference
+            ref = dest
         else:
             compare(dest, ref, tag)
 
-
-# Local: single binary per run -> just old (ref) vs new, every profile.
 for prof in PROFILES:
     run_scenario('local', 'push', prof, (('old', 'old'), ('new', 'new')))
 
-# Remote-shell and daemon: all four client/server pairings, both directions.
 for prof in WIRE_PROFILES:
     for direction in ('push', 'pull'):
         run_scenario('remote', direction, prof, PAIRINGS)
         run_scenario('daemon', direction, prof, PAIRINGS)
 
-
-# --- verdict ---
 if results:
     msg = [f"variety: {len(results)} case(s) diverged from the all-old "
            f"reference (peer={RSYNC_PEER!r}):"]
diff --git a/testsuite/wildmatch_test.py b/testsuite/tests/transfer/wildmatch.py
similarity index 76%
rename from testsuite/wildmatch_test.py
rename to testsuite/tests/transfer/wildmatch.py
index 4c80566cc..3ddbaef26 100644
--- a/testsuite/wildmatch_test.py
+++ b/testsuite/tests/transfer/wildmatch.py
@@ -1,14 +1,8 @@
 #!/usr/bin/env python3
-# Python rewrite of testsuite/wildmatch.test.
-#
-# Exercise the wildmatch() function (with no options) and wildmatch_join()
-# (via -x and/or -e) by running the wildtest helper across a variety of
-# option combinations and confirming each reports no errors.
 
 import subprocess
 
-from rsyncfns import SRCDIR, TOOLDIR, test_fail
-
+from harness.rsync import SRCDIR, TOOLDIR, test_fail
 
 OPTION_SETS = [
     [],
diff --git a/testsuite/tests/transfer/write-batch-quoting.py b/testsuite/tests/transfer/write-batch-quoting.py
new file mode 100644
index 000000000..73d1beadd
--- /dev/null
+++ b/testsuite/tests/transfer/write-batch-quoting.py
@@ -0,0 +1,35 @@
+#!/usr/bin/env python3
+
+import os
+import subprocess
+
+from harness.rsync import SCRATCHDIR, rmtree, run_rsync, test_fail
+
+base = SCRATCHDIR / 'wb-quoting'
+rmtree(base)
+src = base / 'src'
+src.mkdir(parents=True)
+(src / 'f').write_text("hello\n")
+
+os.chdir(base)
+
+def check(label, dest_arg, sentinel_name, *extra):
+    sentinel = base / sentinel_name
+    if sentinel.exists():
+        sentinel.unlink()
+    run_rsync('-a', '--write-batch=B', 'src/', *extra, dest_arg, check=False)
+    batch_sh = base / 'B.sh'
+    if not batch_sh.exists():
+        test_fail(f"{label}: write-batch did not generate the replay script")
+    script = batch_sh.read_text()
+    subprocess.run(['sh', 'B.sh'],
+                   stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL,
+                   cwd=str(base), env=os.environ.copy())
+    if sentinel.exists():
+        test_fail(f"{label}: metacharacters executed when the replay script ran:\n{script}")
+
+check("bare-path", 'd`>PWNED`x/', 'PWNED')
+
+check("dash-eq-prefix", '-x$(>PWNED2)=y/', 'PWNED2', '--')
+
+print("write-batch-quoting: shell metacharacters in batch paths stay quoted")
diff --git a/testsuite/write-touched-blocks_test.py b/testsuite/tests/transfer/write-touched-blocks.py
similarity index 72%
rename from testsuite/write-touched-blocks_test.py
rename to testsuite/tests/transfer/write-touched-blocks.py
index 0e58571ee..c6bccf44c 100644
--- a/testsuite/write-touched-blocks_test.py
+++ b/testsuite/tests/transfer/write-touched-blocks.py
@@ -1,10 +1,10 @@
+#!/usr/bin/env python3
+
 import os
 import shlex
 import subprocess
-import sys
-from pathlib import Path
 
-from rsyncfns import (
+from harness.rsync import (
     FROMDIR, RSYNC, SCRATCHDIR,
     makepath, test_fail, test_skipped
 )
@@ -14,18 +14,17 @@
     if arg.startswith('--protocol='):
         prot_version = int(arg.split('=')[1])
         if prot_version < 33:
-            test_skipped(f"Skipping write-touched-blocks: feature requires protocol 33, but CI forced {prot_version}")
+            test_skipped(f"Skipping write-touched-blocks: feature requires protocol 33 but CI forced {prot_version}",
+                         capability='protocol_33')
 
 src = FROMDIR
 makepath(src)
 
 base_file = src / 'base.bin'
 
-# Generate 4 MiB of random data in memory
 data = os.urandom(4 * 1024 * 1024)
 
 def setup_test(dest_name):
-    """Resets the base file and creates a clean destination file."""
     dest_path = SCRATCHDIR / dest_name
     base_file.write_bytes(data)
     dest_path.write_bytes(data)
@@ -38,7 +37,6 @@ def run_client(src_path, dest_path):
     return subprocess.run(argv, stdout=subprocess.PIPE, stderr=subprocess.STDOUT,
                           text=True)
 
-# TEST 1: Contiguous Write (1 Block)
 dest_contig = setup_test('dest_contiguous.bin')
 with open(base_file, 'r+b') as f:
     f.write(b'\x00' * 3000)
@@ -49,7 +47,6 @@ def run_client(src_path, dest_path):
 if "Number of 4 KiB logical blocks touched: 1\n" not in proc.stdout:
     test_fail(f"Contiguous check failed! Expected 1 block. Output:\n{proc.stdout}")
 
-# TEST 2: Scattered Write (10 Blocks)
 dest_scatter = setup_test('dest_scattered.bin')
 with open(base_file, 'r+b') as f:
     for i in range(1, 11):
@@ -64,7 +61,6 @@ def run_client(src_path, dest_path):
 if "Number of 4 KiB logical blocks touched: 10\n" not in proc.stdout:
     test_fail(f"Scattered check failed! Expected 10 blocks. Output:\n{proc.stdout}")
 
-# TEST 3: Identical Files (0 Blocks Edge Case)
 dest_zero = setup_test('dest_zero.bin')
 
 proc = run_client(base_file, dest_zero)
@@ -73,10 +69,7 @@ def run_client(src_path, dest_path):
 if "Number of 4 KiB logical blocks touched: 0\n" not in proc.stdout:
     test_fail(f"Zero check failed! Expected 0 blocks. Output:\n{proc.stdout}")
 
-# TEST 4: Full File Write (1,024 Blocks)
 dest_full = setup_test('dest_full.bin')
-# Overwrite the entire 4 MiB base file with brand new random data
-# This forces the delta algorithm to find 0 matches and write all 1,024 blocks.
 base_file.write_bytes(os.urandom(4 * 1024 * 1024))
 
 proc = run_client(base_file, dest_full)
@@ -85,19 +78,14 @@ def run_client(src_path, dest_path):
 if "Number of 4 KiB logical blocks touched: 1,024\n" not in proc.stdout:
     test_fail(f"Full write check failed! Expected 1,024 blocks. Output:\n{proc.stdout}")
 
-# TEST 5: Sparse File Write (Hole skipping)
 sparse_src = src / 'sparse.bin'
 sparse_dest = SCRATCHDIR / 'sparse_dest.bin'
 
-# Create a file with written data on the ends, but a massive 4 MiB hole in the middle.
-# 1 block data + 1,024 blocks hole + 1 block data = 1,026 blocks total size.
 with open(sparse_src, 'wb') as f:
-    f.write(os.urandom(4096))             # Block 1 (Data)
-    f.seek(4 * 1024 * 1024, os.SEEK_CUR)  # The Hole (4 MiB of nothing)
-    f.write(os.urandom(4096))             # Block 1026 (Data)
+    f.write(os.urandom(4096))
+    f.seek(4 * 1024 * 1024, os.SEEK_CUR)
+    f.write(os.urandom(4096))
 
-# We must run this WITH --sparse (-S) and WITHOUT --inplace to force
-# the receiver to create a brand new sparse file from scratch using write_sparse().
 rsync_cmd = shlex.split(str(RSYNC))
 argv_sparse = rsync_cmd + ['-a', '--stats', '--sparse', str(sparse_src), str(sparse_dest)]
 proc = subprocess.run(argv_sparse, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True)
@@ -105,24 +93,17 @@ def run_client(src_path, dest_path):
 if proc.returncode != 0:
     test_fail(f"rsync failed on sparse test:\n{proc.stdout}")
 
-# Even though the file is over 4 MiB in size, only 2 logical 4K blocks
-# should be written because the rest was skipped via lseek.
 if "Number of 4 KiB logical blocks touched: 2\n" not in proc.stdout:
     test_fail(f"Sparse check failed! Expected 2 logical blocks written. Output:\n{proc.stdout}")
 
-# TEST 6: Multiple Files
-# Creates two separate 4KB files. If the tracker fails to reset between
-# files due to FD recycling, it will report 1 block instead of 2.
 fd_src_dir = src / 'fd_test'
 fd_dest_dir = SCRATCHDIR / 'fd_dest'
 makepath(fd_src_dir)
 makepath(fd_dest_dir)
 
-# Create two distinct 1-block files
 (fd_src_dir / 'fileA.bin').write_bytes(os.urandom(4096))
 (fd_src_dir / 'fileB.bin').write_bytes(os.urandom(4096))
 
-# Sync the whole directory so rsync processes both in one process lifespan
 rsync_cmd = shlex.split(str(RSYNC))
 argv_fd = rsync_cmd + ['-a', '--stats', '--inplace', str(fd_src_dir) + '/', str(fd_dest_dir) + '/']
 proc = subprocess.run(argv_fd, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True)
@@ -133,29 +114,23 @@ def run_client(src_path, dest_path):
 if "Number of 4 KiB logical blocks touched: 2\n" not in proc.stdout:
     test_fail(f"FD Reuse bug confirmed! Expected 2 blocks (1 per file). Output:\n{proc.stdout}")
 
-# TEST 7: Batch Mode State Reset (--read-batch)
 batch_src_dir = src / 'batch_src'
 batch_dest_dir = SCRATCHDIR / 'batch_dest'
 batch_file = SCRATCHDIR / 'test_batch.rsync'
 makepath(batch_src_dir)
 makepath(batch_dest_dir)
 
-# Create two 4KB source files with random data
 (batch_src_dir / 'fileA.bin').write_bytes(os.urandom(4096))
 (batch_src_dir / 'fileB.bin').write_bytes(os.urandom(4096))
 
-# Create two 4KB zeroed destination files (forces the delta algorithm to write exactly 1 block per file)
 (batch_dest_dir / 'fileA.bin').write_bytes(b'\x00' * 4096)
 (batch_dest_dir / 'fileB.bin').write_bytes(b'\x00' * 4096)
 
-# Step 1: Generate the batch file (Sender side)
-# We MUST use '-I' because the files have identical sizes and timestamps.
 rsync_cmd = shlex.split(str(RSYNC))
 argv_write_batch = rsync_cmd + ['-a', '-I', '--only-write-batch=' + str(batch_file),
                     str(batch_src_dir) + '/', str(batch_dest_dir) + '/']
 subprocess.run(argv_write_batch, stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
 
-# Step 2: Apply the batch file and collect stats (Receiver side)
 argv_read_batch = rsync_cmd + ['-a', '-I', '--inplace', '--stats',
                    '--read-batch=' + str(batch_file), str(batch_dest_dir) + '/']
 
@@ -164,7 +139,6 @@ def run_client(src_path, dest_path):
 if proc.returncode != 0:
     test_fail(f"rsync failed on read-batch test:\n{proc.stdout}")
 
-# If the state leaked across the batch read, this would output 1 block.
 if "Number of 4 KiB logical blocks touched: 2\n" not in proc.stdout:
     test_fail(f"Batch Mode tracker check failed! Expected 2 blocks (1 per file). Output:\n{proc.stdout}")
 
diff --git a/testsuite/cmptree.py b/testsuite/tools/compare_trees.py
old mode 100755
new mode 100644
similarity index 65%
rename from testsuite/cmptree.py
rename to testsuite/tools/compare_trees.py
index 5ae6962b1..602aa68ed
--- a/testsuite/cmptree.py
+++ b/testsuite/tools/compare_trees.py
@@ -1,18 +1,4 @@
 #!/usr/bin/env python3
-"""Compare two directory trees and print any differences.
-
-Reuses rsyncfns.compare_trees(), so it is special-file aware (never
-opens a fifo/socket/device as a stream) and reports differences in: the tls
-listing (type, mode, owner, size, mtime, symlink target for every inode),
-regular-file contents, user xattrs, POSIX ACLs, and hard-link grouping.
-
-Works on any two trees, not just ones built by mkvariety.py. Exit status is 0
-when the trees match, 1 when they differ.
-
-Examples:
-    testsuite/cmptree.py /tmp/vt/transfer_root /tmp/copy
-    testsuite/cmptree.py --no-acls --no-xattrs treeA treeB
-"""
 
 import argparse
 import os
@@ -20,19 +6,14 @@
 
 _HERE = os.path.dirname(os.path.abspath(__file__))
 
-
 def _resolve_tooldir(opt):
-    """Directory holding the `tls` helper (needed for the listing comparison)."""
     for d in (opt, os.path.dirname(_HERE), os.getcwd()):
         if d and os.path.exists(os.path.join(d, 'tls')):
             return d
     return None
 
-
 def main():
-    ap = argparse.ArgumentParser(
-        description=__doc__,
-        formatter_class=argparse.RawDescriptionHelpFormatter)
+    ap = argparse.ArgumentParser(description='Compare two directory trees')
     ap.add_argument('tree_a')
     ap.add_argument('tree_b')
     ap.add_argument('--no-xattrs', dest='xattrs', action='store_false',
@@ -56,15 +37,12 @@ def main():
                  "comparison); build it with `make check-progs` or pass "
                  "--tooldir DIR")
 
-    # rsyncfns reads these at import time; compare_trees only needs
-    # TOOLDIR (for tls). scratchdir must be an existing dir but is unused here.
     import tempfile
     os.environ.setdefault('scratchdir', tempfile.gettempdir())
     os.environ.setdefault('srcdir', os.getcwd())
     os.environ.setdefault('TOOLDIR', tooldir)
     os.environ.setdefault('RSYNC', 'rsync')
-    sys.path.insert(0, _HERE)
-    import rsyncfns as R
+    from ..harness import rsync as R
 
     diffs = R.compare_trees(args.tree_a, args.tree_b,
                                     with_acls=args.acls, with_xattrs=args.xattrs)
@@ -77,6 +55,5 @@ def main():
         print("trees are identical")
     return 0
 
-
 if __name__ == '__main__':
     sys.exit(main())
diff --git a/testsuite/abdiff.py b/testsuite/tools/compare_versions.py
similarity index 72%
rename from testsuite/abdiff.py
rename to testsuite/tools/compare_versions.py
index 06bfa4846..ce526af3f 100644
--- a/testsuite/abdiff.py
+++ b/testsuite/tools/compare_versions.py
@@ -1,26 +1,4 @@
 #!/usr/bin/env python3
-"""abdiff.py -- differential A/B regression hunter for rsync.
-
-Runs the same transfer with two rsync binaries (A = the build under test, e.g.
-./rsync; B = a baseline, e.g. old_versions/rsync_3.4.1) and compares the
-OUTCOME: exit code, error output, --stats "Literal data", the destination tree
-(content + full metadata), and the --itemize change list.
-
-Core oracle: for a BENIGN input a correctness/behaviour change between the two
-builds must be invisible, so A and B must produce an identical destination tree
-and both exit 0.  Any divergence is a regression candidate (e.g. a refactor that
-silently changes what a benign `rsync -a` transfers).
-
-This is a developer tool, NOT a runtests.py test (it does not end in _test.py and
-imports nothing from the test harness).  Findings are printed and appended to a
-log; minimize each into a testsuite/*_test.py.
-
-Usage:
-    testsuite/abdiff.py [--rsync-a ./rsync] [--rsync-b old_versions/rsync_3.4.1]
-                      [--sweep options|pathshape|all] [--workdir DIR] [--keep]
-                      [--findings abdiff-findings.txt] [--only NAME] [--list]
-Exit 0 iff no regression candidates were found.
-"""
 
 from __future__ import annotations
 
@@ -41,27 +19,21 @@
                                 as_completed, wait)
 from pathlib import Path
 
-# ---------------------------------------------------------------------------
-# config / globals (set in main)
 RSYNC_A = "./rsync"
 RSYNC_B = "old_versions/rsync_3.4.1"
-RRSYNC_A = None     # rrsync wrapper paired with A/B (None -> in-tree support/rrsync)
+RRSYNC_A = None
 RRSYNC_B = None
 KEEP = False
-REPEAT = 2   # stability gate: run each binary N times; flaky scenarios quarantined
-CMD_TIMEOUT = 120   # per-subprocess wall-clock guard, seconds (0 = unlimited)
-COST = False        # --cost: also compare peak process-group RSS (resource oracle)
-SCALE_N = 2000      # --scale: element count for the scale-escalation fixtures
+REPEAT = 2
+CMD_TIMEOUT = 120
+COST = False
+SCALE_N = 2000
 _supports_cache: dict = {}
 _supports_lock = threading.Lock()
-_tls = threading.local()   # per-worker: .measure (bool) + .rss (peak bytes)
+_tls = threading.local()
 _PAGE = os.sysconf("SC_PAGE_SIZE")
 
-
 def _group_rss(pgid):
-    """Summed RSS (bytes) of every live process in process group pgid -- catches
-    rsync's forked generator/receiver/sender (and ssh/daemon children), which a
-    direct-child measure (/usr/bin/time) would miss."""
     total = 0
     for pid in os.listdir("/proc"):
         if not pid.isdigit():
@@ -69,25 +41,20 @@ def _group_rss(pgid):
         try:
             with open(f"/proc/{pid}/stat") as f:
                 fields = f.read().split()
-            if int(fields[4]) != pgid:        # field 5 (0-idx 4) = pgrp
+            if int(fields[4]) != pgid:
                 continue
             with open(f"/proc/{pid}/statm") as f:
-                total += int(f.read().split()[1]) * _PAGE   # resident pages
+                total += int(f.read().split()[1]) * _PAGE
         except (OSError, ValueError, IndexError):
             continue
     return total
 
-
 def sh(cmd, cwd=None, env=None, timeout=None):
-    """Run cmd capturing stdout/stderr. Runs in its own process group with a
-    wall-clock timeout so a wedged rsync (or its ssh/daemon children) can't hang a
-    worker forever -- on timeout the whole group is killed and rc 124 returned."""
     if timeout is None:
         timeout = CMD_TIMEOUT
     p = subprocess.Popen(cmd, cwd=cwd, env=env, stdout=subprocess.PIPE,
                          stderr=subprocess.PIPE, text=True, start_new_session=True)
-    # cost oracle: while the transfer runs, sample the peak summed RSS of its
-    # whole process group (set per-worker by one_run via _tls.measure).
+
     measure = getattr(_tls, "measure", False)
     stop = peak = poller = None
     if measure:
@@ -118,7 +85,6 @@ def _poll():
         _tls.rss = peak[0] or None
     return subprocess.CompletedProcess(cmd, rc, out or "", err or "")
 
-
 def supports(binary, opt):
     key = (binary, opt)
     with _supports_lock:
@@ -132,20 +98,11 @@ def supports(binary, opt):
         _supports_cache[key] = val
     return val
 
-
-# ---------------------------------------------------------------------------
-# tree snapshot + comparison
-
 ERR_MARKERS = ("rsync error", "failed to open", "rsync: ", "Invalid argument",
                "No such file", "Operation not permitted", "cannot ")
 
-# Intentional, documented behaviour-change refusals (A errors where B didn't),
-# recorded as ALLOW rather than a silent regression. Each entry is
-# (substring-in-A's-stderr, human note). Populate as deliberate behaviour changes
-# between the two builds are identified.
 ALLOWLIST = []
 
-
 def _xattrs(path):
     try:
         names = sorted(os.listxattr(path, follow_symlinks=False))
@@ -154,14 +111,13 @@ def _xattrs(path):
     out = {}
     for n in names:
         if n.startswith("system.posix_acl_"):
-            continue  # captured via getfacl
+            continue
         try:
             out[n] = os.getxattr(path, n, follow_symlinks=False).hex()
         except OSError:
             out[n] = "?"
     return out
 
-
 def _acl(path, is_dir):
     r = sh(["getfacl", "-pcEn", path]) if shutil.which("getfacl") else None
     if not r or r.returncode != 0:
@@ -169,13 +125,10 @@ def _acl(path, is_dir):
     lines = [ln for ln in r.stdout.splitlines() if ln and not ln.startswith("#")]
     return "\n".join(sorted(lines)) or None
 
-
 def snapshot(root: Path):
-    """Map rel-path -> attribute dict for every entry under root (root itself
-    excluded). Symlinks/specials are recorded, never followed."""
     root = Path(root)
     snap = {}
-    inode_of = {}  # (dev,ino) -> first rel path, for hardlink grouping
+    inode_of = {}
     if not root.exists():
         return snap
     stack = [root]
@@ -208,11 +161,8 @@ def snapshot(root: Path):
             elif stat.S_ISREG(m):
                 a["type"] = "f"
                 a["size"] = st.st_size
-                a["blocks"] = st.st_blocks  # sparseness
-                # "is this file hardlinked at all" (link-dest / -H) -- a robust
-                # boolean; raw nlink counts are contaminated when A and B share a
-                # --link-dest basis dir, but "copied(1) vs linked(>1)" still
-                # catches a real link-dest/hardlink regression.
+                a["blocks"] = st.st_blocks
+
                 a["linked"] = st.st_nlink > 1
                 if st.st_nlink > 1:
                     key = (st.st_dev, st.st_ino)
@@ -243,11 +193,6 @@ def snapshot(root: Path):
             snap[rel] = a
     return snap
 
-
-# which attrs are meaningful depends on the options used; keep it simple and
-# compare everything, but let callers ignore mtime when -t isn't in play, or
-# for a type whose times rsync intentionally leaves unmanaged (-O dirs, -J
-# symlinks) -> those dest mtimes are creation-time and differ between runs.
 def diff_snapshots(sa, sb, ignore_mtime=False, ignore_mtime_types=()):
     diffs = []
     for rel in sorted(set(sa) | set(sb)):
@@ -266,18 +211,11 @@ def diff_snapshots(sa, sb, ignore_mtime=False, ignore_mtime_types=()):
                 diffs.append(f"  {rel}: {k}  A={a.get(k)!r}  B={b.get(k)!r}")
     return diffs
 
-
-# ---------------------------------------------------------------------------
-# running a transfer with one binary
-
 def run_xfer(binary, workdir, opts, src_args, dest, cwd=None, pre=None):
-    """Run `binary opts src_args dest` (cwd default=workdir). Returns
-    (rc, stderr, literal_data, itemize)."""
     cwd = cwd or workdir
     argv = [binary, "--stats", "-i", *opts, *src_args, dest]
     return _parse_out(sh(argv, cwd=cwd))
 
-
 def _parse_out(r):
     literal = None
     for ln in r.stdout.splitlines():
@@ -286,27 +224,18 @@ def _parse_out(r):
     itemize = "\n".join(sorted(
         ln for ln in r.stdout.splitlines()
         if len(ln) > 11 and ln[1] in "fdLDS" and ln[0] in "<>ch.*"
-        and ln[11:].strip() != "./"))  # bench-dependent top-dir time line
+        and ln[11:].strip() != "./"))
     return r.returncode, (r.stderr or "").strip(), literal, itemize, (r.stdout or "")
 
-
 _NOISE = re.compile(r'bytes/sec|speedup is|^sent .*received |^total size is|'
                     r'^Number of |^Total |^Literal data:|^Matched data:|'
                     r'^File list |^total:|^created |^deleting ')
 
-
 def _norm_out(text, wd, dest):
-    """Normalised stdout for A/B compare: canonicalise the workdir/dest paths and
-    drop bench-variant stats lines (keeps itemize/listing/warning lines)."""
     text = text.replace(str(dest), "DEST").replace(str(wd), "WD")
     return "\n".join(ln for ln in text.splitlines() if ln and not _NOISE.search(ln))
 
-
 def _norm_err(text, wd, dest):
-    """Normalised stderr TEXT for A/B compare: canonicalise paths, strip the
-    version-dependent role tag ([sender=3.4.x], [client=VERSION]) and at-FILE(LINE)
-    source location (line numbers shift between versions) so only the MESSAGE is
-    compared."""
     text = text.replace(str(dest), "DEST").replace(str(wd), "WD")
     text = re.sub(r'\[(?:sender|receiver|generator|client|server'
                   r'|Sender|Receiver|Generator|Client|Server)=[^\]]*\]',
@@ -314,7 +243,6 @@ def _norm_err(text, wd, dest):
     text = re.sub(r' at [\w./-]+\(\d+\)', ' at LOC', text)
     return text.strip()
 
-
 def _wait_port(port, timeout=10.0):
     import socket as _sock
     end = time.time() + timeout
@@ -326,12 +254,7 @@ def _wait_port(port, timeout=10.0):
             time.sleep(0.05)
     return False
 
-
 def run_daemon_xfer(binary, wd, module_path, opts, src_args, port, chroot="no"):
-    """Push src_args into a [m] module served by `binary --daemon` over a PRIVATE
-    STDIO PIPE (RSYNC_CONNECT_PROG) -- no TCP port, so no port-bind/startup race
-    (the old TCP path was nondeterministic under load).  `port` only uniquifies
-    the per-invocation config filename.  Same (rc, err, lit, item) as run_xfer."""
     conf = Path(wd) / f"rsyncd_{port}.conf"
     Path(module_path).mkdir(parents=True, exist_ok=True)
     conf.write_text(
@@ -343,10 +266,7 @@ def run_daemon_xfer(binary, wd, module_path, opts, src_args, port, chroot="no"):
     argv = [binary, "--stats", "-i", *opts, *src_args, "rsync://localhost/m/"]
     return _parse_out(sh(argv, cwd=str(wd), env=env))
 
-
 def run_daemon_pull(binary, wd, served, opts, localdest, port, chroot="no"):
-    """PULL from a read-only [m] module (the daemon SENDER side) over a private
-    stdio pipe into localdest. `served` is the served directory."""
     conf = Path(wd) / f"rsyncd_{port}.conf"
     Path(served).mkdir(parents=True, exist_ok=True)
     Path(localdest).mkdir(parents=True, exist_ok=True)
@@ -360,32 +280,18 @@ def run_daemon_pull(binary, wd, served, opts, localdest, port, chroot="no"):
             str(localdest) + "/"]
     return _parse_out(sh(argv, cwd=str(wd), env=env))
 
-
-# sibling helper scripts live in support/ (abdiff.py itself lives in testsuite/)
 _SUPPORT = Path(__file__).resolve().parent.parent / "support"
 _LSH = str(_SUPPORT / "lsh.sh")
 
-
 def run_ssh_xfer(binary, wd, opts, src_args, dest):
-    """PUSH over a remote-shell split via support/lsh.sh (host 'lh' = no chdir);
-    the remote side runs the same binary via --rsync-path. Real client+server
-    processes + protocol, unlike a both-paths-local copy."""
     argv = [binary, "--stats", "-i", "-e", f"sh {_LSH}",
             f"--rsync-path={binary}", *opts, *src_args, f"lh:{dest}/"]
     return _parse_out(sh(argv, cwd=wd))
 
-
-# --- rrsync lane: route the remote side through the restricted rrsync wrapper --
 _RRSH = str(_SUPPORT / "rrsh.sh")
 _RRSYNC_SRC = _SUPPORT / "rrsync"
 
-
 def _patch_rrsync(binary, rrsync_src, wd):
-    """A copy of `rrsync_src` (the version's rrsync wrapper) whose RSYNC points at
-    `binary`, so the rrsync-launched server is the binary under test. rrsync is
-    SHIPPED PER VERSION, so A and B use their OWN rrsync (the regressions live in
-    the script, not just the binary) -- keyed per (binary, src) to keep them
-    distinct in a shared workdir."""
     key = abs(hash((binary, str(rrsync_src)))) % 1000000
     dst = Path(wd) / f"rrsync-{key}"
     if not dst.exists():
@@ -396,11 +302,7 @@ def _patch_rrsync(binary, rrsync_src, wd):
         dst.chmod(0o755)
     return dst
 
-
 def run_rrsync_push(binary, rrsync_src, wd, opts, src_args, dest):
-    """PUSH through `rrsync <restricted>` (the dest's parent is the restricted
-    root; the client writes into the <dest-name>/ subdir, so rrsync's subdir
-    restrictions are exercised). Exercises rrsync option/path validation."""
     dest = Path(dest)
     rr = _patch_rrsync(binary, rrsync_src, wd)
     dest.parent.mkdir(parents=True, exist_ok=True)
@@ -408,11 +310,7 @@ def run_rrsync_push(binary, rrsync_src, wd, opts, src_args, dest):
             *opts, *src_args, f"lh:{dest.name}/"]
     return _parse_out(sh(argv, cwd=str(wd)))
 
-
 def run_rrsync_pull(binary, rrsync_src, wd, served, opts, localdest):
-    """PULL through `rrsync <restricted>` (rrsync's --sender side): the served
-    dir's parent is the restricted root, the client reads the <served-name>/
-    subdir into localdest."""
     served = Path(served)
     rr = _patch_rrsync(binary, rrsync_src, wd)
     Path(localdest).mkdir(parents=True, exist_ok=True)
@@ -420,15 +318,10 @@ def run_rrsync_pull(binary, rrsync_src, wd, served, opts, localdest):
             *opts, f"lh:{served.name}/", str(localdest) + "/"]
     return _parse_out(sh(argv, cwd=str(wd)))
 
-
-# --- real-TCP-daemon lane: a genuine `rsync --daemon` on a bound port ----------
 _port_lock = threading.Lock()
 _next_port = [40000]
 
-
 def _alloc_port():
-    """A free localhost TCP port, bind-probed under a lock so concurrent workers
-    don't collide (the real-daemon path needs a real port, unlike the stdio one)."""
     import socket as _s
     with _port_lock:
         for _ in range(4000):
@@ -445,13 +338,8 @@ def _alloc_port():
                 s.close()
     return _next_port[0]
 
-
 def _tcp_daemon(binary, wd, module_path, opts, src_args, localdest=None,
                 pull=False, chroot="no", auth=False):
-    """Start a real `binary --daemon` on a bound TCP port and run the client over
-    rsync://127.0.0.1:PORT/m/ -- exercises the genuine socket path / greeting /
-    handshake (and, with auth, the challenge-response) that the stdio-pipe daemon
-    lane bypasses."""
     port = _alloc_port()
     conf = Path(wd) / f"tcpd_{port}.conf"
     Path(module_path).mkdir(parents=True, exist_ok=True)
@@ -491,19 +379,11 @@ def _tcp_daemon(binary, wd, module_path, opts, src_args, localdest=None,
         except subprocess.TimeoutExpired:
             proc.kill()
 
-
-# ---------------------------------------------------------------------------
-# fixtures
-
 def _write(p: Path, data: bytes):
     p.parent.mkdir(parents=True, exist_ok=True)
     p.write_bytes(data)
 
-
 def build_kitchen(src: Path):
-    """A benign 'kitchen-sink' tree: regular/empty/large/sparse files, nested
-    and empty dirs, in-tree + dangling symlinks, a dir-symlink, a hardlink pair,
-    odd modes, and a user.* xattr. No attacker paths."""
     src.mkdir(parents=True, exist_ok=True)
     _write(src / "empty", b"")
     _write(src / "small.txt", b"hello world\n")
@@ -511,83 +391,59 @@ def build_kitchen(src: Path):
     _write(src / "dir/a.txt", b"a" * 100)
     _write(src / "dir/sub/b.txt", b"b" * 100)
     (src / "emptydir").mkdir(exist_ok=True)
-    # sparse file: hole + data
+
     with open(src / "sparse.bin", "wb") as f:
         f.seek(1 << 20)
         f.write(b"END")
-    # hardlink pair
+
     _write(src / "hl_a", b"hardlinked\n")
     try:
         os.link(src / "hl_a", src / "hl_b")
     except OSError:
         pass
-    # symlinks
-    os.symlink("small.txt", src / "rel_link")          # in-tree relative
-    os.symlink("dir", src / "dir_link")                # dir symlink
-    os.symlink("nonexistent", src / "dangling")        # dangling
-    # odd modes
-    os.chmod(src / "small.txt", 0o4755)                # setuid
-    os.chmod(src / "dir", 0o2775)                       # setgid dir
-    # xattr (best effort)
+
+    os.symlink("small.txt", src / "rel_link")
+    os.symlink("dir", src / "dir_link")
+    os.symlink("nonexistent", src / "dangling")
+
+    os.chmod(src / "small.txt", 0o4755)
+    os.chmod(src / "dir", 0o2775)
+
     try:
         os.setxattr(src / "data.bin", "user.abtest", b"v1")
     except OSError:
         pass
 
-
 def build_relfile(src: Path):
-    """Minimal nested file for path-shape tests."""
     _write(src / "sub/deep/file", b"relative content\n")
     os.symlink("file", src / "sub/deep/link")
 
-
-# ---------------------------------------------------------------------------
-# scenarios
-
 class Scenario:
     def __init__(self, name, setup, opts, src_args, dest="destX/",
                  cwd_is_workdir=True, pre_dest=None, abspath=False,
                  dest_prep=None, snap_dest=None, dest_arg=None, daemon=None,
                  ssh=False):
         self.name = name
-        self.setup = setup            # fn(src_dir)
-        self.opts = opts              # list[str]
-        self.src_args = src_args      # fn(workdir)->list[str] OR list[str]
+        self.setup = setup
+        self.opts = opts
+        self.src_args = src_args
         self.dest = dest
         self.cwd_is_workdir = cwd_is_workdir
-        self.pre_dest = pre_dest      # fn(dest_dir) to pre-populate (delete/update)
+        self.pre_dest = pre_dest
         self.abspath = abspath
-        # dest_prep(dest_path): create the dest specially (e.g. as a symlink to a
-        # real dir) instead of letting rsync create it. snap_dest(dest_path)->Path
-        # picks what to snapshot (e.g. the symlink's real target).
         self.dest_prep = dest_prep
         self.snap_dest = snap_dest
-        # dest_arg(dest_base)->str: the actual rsync destination argument (e.g.
-        # write THROUGH an in-tree dir-symlink: dest_base/link/). Default is
-        # dest_base + "/".
         self.dest_arg = dest_arg
-        # daemon: None for a local transfer, or {"chroot": "no"|"yes"} to PUSH
-        # src_args into a [m] daemon module whose path is the dest dir.
         self.daemon = daemon
-        # ssh: True to PUSH over a remote-shell split (support/lsh.sh, host "lh")
-        # -- separate client+server processes, real protocol + arg passing.
         self.ssh = ssh
-        # rrsync: None, or {"pull": bool} to route through the restricted rrsync
-        # wrapper (support/rrsync) as an sshd forced-command would -- exercises
-        # rrsync's own option/path validation. ssh/daemon-style transport.
         self.rrsync = None
 
-
 def _liftable(scn):
-    """A benign push-into-dest scenario whose transport can be swapped for free:
-    no dest_prep/dest_arg (those need local dest-path semantics), not already a
-    daemon/ssh scenario, and a list src_args that ends by pushing src/ -> dest."""
     return (not scn.dest_prep and not scn.dest_arg and not scn.abspath
             and scn.daemon is None and not scn.ssh and scn.rrsync is None
             and isinstance(scn.src_args, list) and scn.src_args
             and scn.src_args[-1] in ("src/", "src"))
 
-
 def _clone_transport(scn, mode):
     import copy
     c = copy.copy(scn)
@@ -598,12 +454,7 @@ def _clone_transport(scn, mode):
         c.daemon = {"chroot": "no"}
     return c
 
-
 def lift_transports(scns, modes=("ssh", "daemon")):
-    """Make transport an ORTHOGONAL axis: keep each local scenario and, for the
-    liftable ones, also run it over ssh and a daemon module. This is where the
-    daemon/ssh-only regression family hides -- a feature broken only over the
-    wire is invisible to a local-only sweep."""
     out = []
     for scn in scns:
         out.append(scn)
@@ -611,10 +462,7 @@ def lift_transports(scns, modes=("ssh", "daemon")):
             out += [_clone_transport(scn, m) for m in modes]
     return out
 
-
 def options_sweep():
-    """-a plus one option at a time, over the kitchen-sink, relative trailing
-    slash source -> dest. The bread-and-butter single-option regression check."""
     base = ["-a"]
     variants = [
         ["-a"], ["-aH"], ["-aHS"], ["-a", "--sparse"], ["-a", "--inplace"],
@@ -637,9 +485,7 @@ def options_sweep():
                              ["src/"], "dest/"))
     return scns
 
-
 def pathshape_sweep():
-    """The --relative class: same content under many source-path shapes."""
     scns = []
 
     def absfile(wd):
@@ -665,17 +511,13 @@ def absfile(wd):
     ]
     return scns
 
-
-T_OLD = 1000000000   # fixed timestamps so pre-state is identical for A and B
+T_OLD = 1000000000
 T_NEW = 1700000000
 
-
 def _ut(p, t=T_NEW):
     os.utime(p, (t, t))
 
-
 def build_recvtree(src: Path):
-    """Small, interpretable source tree for receiver/stateful scenarios."""
     _write(src / "file1.txt", b"NEW content line\n" * 3)
     _write(src / "dir/file2.txt", b"data2\n")
     _write(src / "big.bin", bytes((i * 3) & 0xFF for i in range(60000)))
@@ -690,17 +532,12 @@ def build_recvtree(src: Path):
     _ut(src / "dir")
     _ut(src)
 
-
 def setup_with_basis(src: Path):
-    """src plus an identical sibling basis/ (for --link-dest/--copy-dest/etc.)."""
     build_recvtree(src)
     basis = src.parent / "basis"
     build_recvtree(basis)
 
-
 def stale_dest(dest: Path):
-    """Pre-populate a dest as an OLDER state: file1 differs (older mtime),
-    big.bin differs (older), an extra obsolete file, file2 already current."""
     _write(dest / "file1.txt", b"OLD content\n")
     _ut(dest / "file1.txt", T_OLD)
     _write(dest / "dir/file2.txt", b"data2\n")
@@ -711,21 +548,9 @@ def stale_dest(dest: Path):
     _write(dest / "obsolete.txt", b"remove me\n")
     _ut(dest / "obsolete.txt", T_OLD)
 
-
-# ===========================================================================
-# Domain-knowledge-driven scenario generation.
-# "Edges of interest": equivalence-class boundary representatives, not volume
-# (empty-dir vs 1-file matters; 10 vs 11 doesn't; mode 0 vs 0400 vs 0200 matters;
-# 100 files of one mode don't). Each option is modelled by its precondition (the
-# dest/src state that makes it active) and, for options taking a dir, whether the
-# aux location sits INSIDE or OUTSIDE the tree.
-# ===========================================================================
-
-# interesting permission edges (no-perm / read / write / exec / special bits)
 MODES = [0o000, 0o400, 0o200, 0o644, 0o755, 0o4755, 0o2755, 0o1777]
-# size edges around rsync's block boundary (BLOCK_SIZE 700): empty/1B/under/at/over/multi
-SIZES = [0, 1, 699, 700, 701, 100003]
 
+SIZES = [0, 1, 699, 700, 701, 100003]
 
 def _mk_reg(p, n, mode=0o644, t=T_NEW, fill=7):
     p.parent.mkdir(parents=True, exist_ok=True)
@@ -734,7 +559,6 @@ def _mk_reg(p, n, mode=0o644, t=T_NEW, fill=7):
     os.chmod(p, mode)
     _ut(p, t)
 
-
 def _mk_sparse(p, hole=1 << 20, tail=b"end"):
     p.parent.mkdir(parents=True, exist_ok=True)
     with open(p, "wb") as f:
@@ -742,12 +566,10 @@ def _mk_sparse(p, hole=1 << 20, tail=b"end"):
         f.write(tail)
     _ut(p)
 
-
 def _mk_fifo(p):
     p.parent.mkdir(parents=True, exist_ok=True)
     os.mkfifo(p)
 
-
 def _mk_sock(p):
     import socket as _s
     p.parent.mkdir(parents=True, exist_ok=True)
@@ -757,10 +579,7 @@ def _mk_sock(p):
     finally:
         s.close()
 
-
 def mode_sweep():
-    """One representative file per interesting permission edge (+ a setgid/sticky
-    dir), plain -a and -a --chmod. Boundary values, not 100 files of one mode."""
     s = []
     for m in MODES:
         def setup(src, m=m):
@@ -774,10 +593,7 @@ def setup(src, m=m):
                       ["-a", "--chmod=D2755,F644"], ["src/"], "dest/"))
     return s
 
-
 def size_sweep():
-    """One file per size edge around the block boundary, plain and --inplace
-    (delta path), -c (whole-file checksum), -S on a sparse file."""
     s = []
     for n in SIZES:
         s.append(Scenario(f"size:{n}", lambda src, n=n: _mk_reg(src / "f", n),
@@ -791,10 +607,7 @@ def size_sweep():
                       ["-aS", "--inplace"], ["src/"], "dest/"))
     return s
 
-
 def filetype_sweep():
-    """One representative per file type/symlink shape, each with the option(s)
-    that actually exercise it. Specials/devices are in priv_sweep (root)."""
     def base(src):
         _mk_reg(src / "anchor", 16)
 
@@ -806,16 +619,16 @@ def f_emptydir(src):
     def f_intree(src):
         base(src)
         _mk_reg(src / "real", 20)
-        os.symlink("real", src / "lnk")          # in-tree relative
+        os.symlink("real", src / "lnk")
 
     def f_dirlink(src):
         base(src)
         _mk_reg(src / "rd/inner", 20)
-        os.symlink("rd", src / "dl")             # symlink to a dir
+        os.symlink("rd", src / "dl")
 
     def f_abslink(src):
         base(src)
-        os.symlink("/etc/hostname", src / "abs")  # out-of-tree absolute
+        os.symlink("/etc/hostname", src / "abs")
 
     def f_dangling(src):
         base(src)
@@ -825,7 +638,7 @@ def f_chain(src):
         base(src)
         _mk_reg(src / "real", 20)
         os.symlink("real", src / "l1")
-        os.symlink("l1", src / "l2")             # symlink chain
+        os.symlink("l1", src / "l2")
 
     def f_hardlinks(src):
         _mk_reg(src / "a", 40)
@@ -860,47 +673,37 @@ def f_sock(src):
         Scenario("ft:sock", f_sock, ["-a"], ["src/"], "dest/"),
     ]
 
-
-# --- preconditions: dest/src state that makes an option actually ACTIVE -------
 def _pc_tree(src):
     _mk_reg(src / "f", 100)
     _mk_reg(src / "dir/g", 50)
     _ut(src / "dir")
     _ut(src)
 
-
 def _setup_samemeta(src):
     _mk_reg(src / "f", 100, t=T_NEW, fill=7)
     _mk_reg(src / "keep", 20, t=T_NEW, fill=7)
 
-
-def _pre_samemeta(dest):                 # same size+mtime, DIFFERENT content
+def _pre_samemeta(dest):
     _mk_reg(dest / "f", 100, t=T_NEW, fill=200)
     _mk_reg(dest / "keep", 20, t=T_NEW, fill=200)
 
-
 def _setup_older(src):
     _mk_reg(src / "f", 100, t=T_OLD, fill=7)
 
-
-def _pre_newer(dest):                    # dest newer + different (for -u)
+def _pre_newer(dest):
     _mk_reg(dest / "f", 60, t=T_NEW, fill=200)
 
-
-def _setup_mixed(src):                   # an existing file + a new file
+def _setup_mixed(src):
     _mk_reg(src / "exist", 30, t=T_NEW, fill=7)
     _mk_reg(src / "newfile", 30, t=T_NEW, fill=7)
 
-
-def _pre_existing(dest):                 # only "exist" present (older, different)
+def _pre_existing(dest):
     _mk_reg(dest / "exist", 99, t=T_OLD, fill=200)
 
-
 def _setup_sizes(src):
     _mk_reg(src / "small", 50)
     _mk_reg(src / "big", 5000)
 
-
 def _setup_emptydirs(src):
     os.makedirs(src / "empty/sub")
     _mk_reg(src / "keep/f", 10)
@@ -908,34 +711,49 @@ def _setup_emptydirs(src):
     _ut(src / "empty/sub")
     _ut(src / "empty")
 
-
 def _setup_append(src):
     _mk_reg(src / "f", 200, t=T_NEW, fill=7)
 
-
-def _pre_append(dest):                   # dest is a shorter prefix (for --append)
+def _pre_append(dest):
     with open(dest / "f", "wb") as fh:
         fh.write(bytes((i * 7) & 0xFF for i in range(80)))
     _ut(dest / "f", T_OLD)
 
-
 def _setup_kdest(src):
     _mk_reg(src / "dir/f1", 10)
     _mk_reg(src / "dir/f2", 10)
     _mk_reg(src / "top", 5)
 
-
-def _prep_kdest(dest):                   # dest has realdir + dir->realdir symlink
+def _prep_kdest(dest):
     dest.mkdir(parents=True, exist_ok=True)
     (dest / "realdir").mkdir(exist_ok=True)
     if not (dest / "dir").is_symlink():
         os.symlink("realdir", dest / "dir")
 
+def _prep_receiver_temp(dest):
+    stale_dest(dest)
+    (dest / 'tmpd').mkdir(exist_ok=True)
+
+def _setup_transport_tree(src):
+    _write(src / "dir/f1", b"n1\n")
+    _write(src / "dir/f2", b"n2\n")
+    _write(src / "top", b"t\n")
+
+def _setup_dirlink_source(src):
+    _mk_reg(src / "rd/inner", 10)
+    os.symlink("rd", src / "dl")
+    _mk_reg(src / "anchor", 5)
+    _ut(src / "rd")
+
+def _setup_absolute_symlink(src):
+    os.symlink("/etc/hostname", src / "abs")
+    _mk_reg(src / "anchor", 5)
+
+def _setup_symlinked_parent(src):
+    _write(src / "real/sub/file", b"under symlinked parent\n")
+    os.symlink("real", src / "link")
 
 def selection_sweep():
-    """File-selection / timestamp / size options at the boundary that makes the
-    comparison non-trivial (same size+mtime but different content, newer dest,
-    existing-vs-new, size limits)."""
     plain = "src/"
     s = [
         Scenario("sel:checksum", _setup_samemeta, ["-a", "-c"], [plain], "dest/", pre_dest=_pre_samemeta),
@@ -955,10 +773,7 @@ def selection_sweep():
     ]
     return lift_transports(s)
 
-
-def behavior_sweep():
-    """Behaviour options at their active preconditions (overwrite/backup/delete/
-    inplace/append/keep-dirlinks-dest/prune-empty/mkpath/dirs)."""
+def behaviour_sweep():
     return [
         Scenario("beh:backup", build_recvtree, ["-ab"], ["src/"], "dest/", pre_dest=stale_dest),
         Scenario("beh:delete", build_recvtree, ["-a", "--delete"], ["src/"], "dest/", pre_dest=stale_dest),
@@ -980,23 +795,17 @@ def behavior_sweep():
                  dest_prep=_prep_kdest, snap_dest=lambda d: d / "realdir"),
     ]
 
-
 def _auxp(dest, where, name):
-    """Aux path INSIDE the dest tree, or OUTSIDE it (sibling under the workdir)."""
     dest = Path(dest)
     return str((dest / name) if where == "inside" else (dest.parent / f"aux_{name}"))
 
-
 def placement_sweep():
-    """Options that take a DIR/path, each with the aux location INSIDE vs OUTSIDE
-    the destination tree -- the edge most likely to expose confinement/escape
-    regressions.  backup/temp/partial-dir + link/compare/copy-dest."""
     s = []
     for where in ("inside", "outside"):
         s.append(Scenario(f"place:backup-dir-{where}", build_recvtree,
                  (lambda wd, dest, w=where: ["-ab", f"--backup-dir={_auxp(dest, w, 'bak')}"]),
                  ["src/"], "dest/", pre_dest=stale_dest))
-        # temp-dir must exist -> pre-create dest (empty) + the temp dir
+
         def _prep_temp(dest, w=where):
             dest.mkdir(parents=True, exist_ok=True)
             os.makedirs(_auxp(dest, w, "tmp"), exist_ok=True)
@@ -1006,7 +815,7 @@ def _prep_temp(dest, w=where):
         s.append(Scenario(f"place:partial-dir-{where}", build_recvtree,
                  (lambda wd, dest, w=where: ["-a", "--partial", f"--partial-dir={_auxp(dest, w, 'part')}"]),
                  ["src/"], "dest/"))
-    # alt-dest basis (a prior identical copy at wd/basis): absolute vs relative path
+
     for opt in ("link-dest", "compare-dest", "copy-dest"):
         s.append(Scenario(f"place:{opt}-abs", setup_with_basis,
                  (lambda wd, dest, o=opt: ["-a", f"--{o}={wd}/basis"]), ["src/"], "dest/"))
@@ -1014,10 +823,7 @@ def _prep_temp(dest, w=where):
                  (lambda wd, dest, o=opt: ["-a", f"--{o}=../basis"]), ["src/"], "dest/"))
     return lift_transports(s)
 
-
 def wire_sweep():
-    """Protocol / wire / algorithm options (checksum & compress choice, old/
-    secluded args, iconv, odd block sizes)."""
     bt = build_recvtree
     return [
         Scenario("wire:cc-md5", bt, ["-a", "--checksum-choice=md5"], ["src/"], "dest/"),
@@ -1033,36 +839,28 @@ def wire_sweep():
         Scenario("wire:block-999", bt, ["-a", "-B", "999"], ["src/"], "dest/"),
     ]
 
-
-# module-level file-type fixtures (also used by the pairwise sweep)
 def _ft_intree(src):
     _mk_reg(src / "real", 20)
     os.symlink("real", src / "lnk")
     _mk_reg(src / "anchor", 10)
 
-
 def _ft_dirlink(src):
     _mk_reg(src / "rd/inner", 20)
     os.symlink("rd", src / "dl")
     _mk_reg(src / "anchor", 10)
     _ut(src / "rd")
 
-
 def _ft_hardlinks(src):
     _mk_reg(src / "a", 40)
     os.link(src / "a", src / "b")
     os.link(src / "a", src / "c")
     _mk_reg(src / "anchor", 10)
 
-
 def _ft_sparse(src):
     _mk_sparse(src / "sp.bin")
     _mk_reg(src / "anchor", 10)
 
-
 def pairwise_sweep():
-    """Guided pairwise: curated feature interactions (domain knowledge about where
-    two options collide), plus an auto option x file-type covering set."""
     s = [
         Scenario("pair:delete+dirlink-dest", _setup_kdest, ["-aK", "--delete"],
                  ["src/"], "dest/", dest_prep=_prep_kdest, snap_dest=lambda d: d / "realdir"),
@@ -1083,7 +881,7 @@ def pairwise_sweep():
                                     f"--partial-dir={_auxp(dest, 'inside', 'part')}"]),
                  ["src/"], "dest/", pre_dest=stale_dest),
     ]
-    # auto option x file-type covering set (each option relevant to several types)
+
     fts = [("intree", _ft_intree), ("dirlink", _ft_dirlink),
            ("hardlinks", _ft_hardlinks), ("sparse", _ft_sparse)]
     opts = ["-c", "-z", "-b", "--inplace", "-H", "-L", "-k", "--checksum-choice=md5"]
@@ -1093,12 +891,7 @@ def pairwise_sweep():
             s.append(Scenario(f"pair:{tag}x{ftn}", ftfn, ["-a", o], ["src/"], "dest/"))
     return s
 
-
 def recv_sweep():
-    """Receiver/generator + stateful scenarios: existing-dest update/delete,
-    backup, dest-variants (link/compare/copy-dest), inplace, temp-dir. These
-    exercise the receiver's existing-dest / basis / temp-dir paths that the
-    single-transfer-into-empty-dest sweeps don't reach."""
     s = []
     s += [
         Scenario("recv:update", build_recvtree, ["-a"], ["src/"], "dest/",
@@ -1124,12 +917,12 @@ def recv_sweep():
         Scenario("recv:delay-updates", build_recvtree, ["-a", "--delay-updates"],
                  ["src/"], "dest/", pre_dest=stale_dest),
         Scenario("recv:temp-dir", build_recvtree, ["-a", "--temp-dir=tmpd"],
-                 ["src/"], "dest/", pre_dest=lambda d: (stale_dest(d), (d / "tmpd").mkdir(exist_ok=True))),
+                 ["src/"], "dest/", pre_dest=_prep_receiver_temp),
         Scenario("recv:partial-dir", build_recvtree, ["-a", "--partial-dir=.part"],
                  ["src/"], "dest/", pre_dest=stale_dest),
         Scenario("recv:fuzzy", build_recvtree, ["-a", "--fuzzy"], ["src/"], "dest/",
                  pre_dest=stale_dest),
-        # dest-variant basis lookups (basis = identical sibling dir)
+
         Scenario("recv:link-dest-rel", setup_with_basis, ["-a", "--link-dest=../basis"],
                  ["src/"], "dest/"),
         Scenario("recv:link-dest-abs", setup_with_basis, ["-a"],
@@ -1141,22 +934,17 @@ def recv_sweep():
     ]
     return lift_transports(s)
 
-
 def destshape_sweep():
-    """Destination path shapes (symlinked dest dir, --mkpath) that stress the
-    receiver's destination-path handling."""
     def symlinked_dest(dest: Path):
         real = Path(str(dest) + "_real")
         real.mkdir(parents=True, exist_ok=True)
         if not dest.is_symlink():
-            os.symlink(real.name, dest)          # dest -> dest_X_real (in-tree)
+            os.symlink(real.name, dest)
 
     def real_of(dest: Path):
         return Path(str(dest) + "_real")
 
     def via_symlink_parent(dest: Path):
-        # dest = .../dest_X ; make its PARENT route through an in-tree symlink:
-        # realbase/, link->realbase, and rsync writes to link/<dest_X name>
         real = Path(str(dest) + "_rb")
         real.mkdir(parents=True, exist_ok=True)
         link = Path(str(dest) + "_lnk")
@@ -1172,9 +960,7 @@ def via_symlink_parent(dest: Path):
     ]
     return s
 
-
 def name_sweep():
-    """Unusual but benign filenames (arg-handling / secluded-args)."""
     names = ["a space", "two  spaces", "café_ünïcode", "semi;colon",
              "dollar$sign", "paren(s)", "quote'name", "amp&and", "back\\slash",
              "newline\nname", "tab\tname", "trailing ", "leaddash"]
@@ -1182,21 +968,13 @@ def name_sweep():
     def setup(src: Path):
         for i, n in enumerate(names):
             _write(src / n, f"content {i}\n".encode())
-        # a leading-dash file (separate so it can't be mistaken for an option)
+
         _write(src / "-leadingdash.txt", b"dash\n")
         os.symlink("a space", src / "link to spaced")
 
     return [Scenario("name:weird", setup, ["-a"], ["src/"], "dest/")]
 
-
 def filesfrom_sweep():
-    """--files-from with relative & absolute name lists, and --from0.
-
-    The list files live in the workdir, which is also rsync's cwd, so the
-    --files-from arg is a BARE filename (cwd-relative) -- referencing it via
-    str(wd) double-resolves and silently fails when --workdir is relative, which
-    makes the whole scenario a vacuous pass. The absolute list uses src.resolve()
-    so the "/" transfer-root case works regardless of workdir."""
     def setup(src: Path):
         build_recvtree(src)
         wd = src.parent
@@ -1218,13 +996,10 @@ def setup(src: Path):
     ]
     return lift_transports(s)
 
-
 def build_privtree(src: Path):
-    """Root-only fixture: owned files, special perms, FIFO, devices. Falls back
-    gracefully to what the euid can create."""
     build_recvtree(src)
-    os.chmod(src / "file1.txt", 0o4755)   # setuid
-    os.chmod(src / "dir", 0o2755)         # setgid
+    os.chmod(src / "file1.txt", 0o4755)
+    os.chmod(src / "dir", 0o2755)
     try:
         os.mkfifo(src / "fifo")
     except OSError:
@@ -1235,15 +1010,13 @@ def build_privtree(src: Path):
             os.mknod(src / "blockdev", stat.S_IFBLK | 0o644, os.makedev(7, 0))
         except OSError:
             pass
-        # chown a file to a different uid/gid if any exists
+
         try:
             os.chown(src / "dir/file2.txt", 1, 1)
         except OSError:
             pass
 
-
 def priv_sweep():
-    """Run as root (sudo): owner/group, devices/specials, fake-super."""
     return [
         Scenario("priv:archive", build_privtree, ["-a"], ["src/"], "dest/"),
         Scenario("priv:devices", build_privtree, ["-aD"], ["src/"], "dest/"),
@@ -1257,11 +1030,7 @@ def priv_sweep():
         Scenario("priv:acls-xattrs", build_privtree, ["-aAX"], ["src/"], "dest/"),
     ]
 
-
 def intree_sweep():
-    """Traverse an IN-TREE dir-symlink as a path component (source via a
-    dir-symlink, dest through a dir-symlink, keep-dirlinks, alt-basis via a
-    dir-symlink) -- a path-handling shape that varies across builds/platforms."""
     def src_dirlink(src: Path):
         _write(src / "real/f1", b"in real\n")
         _write(src / "real/sub/f2", b"deep\n")
@@ -1278,12 +1047,6 @@ def dest_dirlink_prep(dest: Path):
         if not (dest / "link").is_symlink():
             os.symlink("real", dest / "link")
 
-    def keepdir_prep(dest: Path):
-        dest.mkdir(parents=True, exist_ok=True)
-        (dest / "realdir").mkdir(exist_ok=True)
-        if not (dest / "dir").is_symlink():
-            os.symlink("realdir", dest / "dir")
-
     def basis_dirlink(src: Path):
         build_recvtree(src)
         build_recvtree(src.parent / "realbasis")
@@ -1297,7 +1060,7 @@ def basis_dirlink(src: Path):
                  dest_arg=lambda d: str(d / "link") + "/",
                  snap_dest=lambda d: d / "real"),
         Scenario("intree:keep-dirlinks", dirtree, ["-aK"], ["src/"], "dest/",
-                 dest_prep=keepdir_prep, snap_dest=lambda d: d / "realdir"),
+                 dest_prep=_prep_kdest, snap_dest=lambda d: d / "realdir"),
         Scenario("intree:link-dest-dirlink", basis_dirlink, ["-a"],
                  lambda wd: ["--link-dest=" + str(Path(wd) / "basislink"), "src/"],
                  "dest/"),
@@ -1306,23 +1069,14 @@ def basis_dirlink(src: Path):
                  "dest/"),
     ]
 
-
 def intree2_sweep():
-    """More in-tree dir-symlink traversal: -k/copy-dirlinks on the source,
-    source files under a symlinked PARENT, and -K update/delete through a
-    symlinked dest dir."""
     def src_with_dirlink(src: Path):
         _write(src / "realdir/a", b"aa\n")
         _write(src / "realdir/b", b"bb\n")
         _write(src / "top.txt", b"top\n")
         os.symlink("realdir", src / "dl")
 
-    def src_symlink_parent(src: Path):
-        _write(src / "real/sub/file", b"under symlinked parent\n")
-        os.symlink("real", src / "link")
-
     def kupd_prep(dest: Path):
-        # symlinked dest dir whose real target holds an OLDER file + an extra
         dest.mkdir(parents=True, exist_ok=True)
         (dest / "realdir").mkdir(exist_ok=True)
         _write(dest / "realdir/f1", b"OLD\n")
@@ -1335,18 +1089,20 @@ def kupd_prep(dest: Path):
     def dirtree2(src: Path):
         _write(src / "dir/f1", b"new1\n")
         _write(src / "dir/f2", b"new2\n")
-        _ut(src / "dir/f1"); _ut(src / "dir/f2"); _ut(src / "dir")
+        _ut(src / "dir/f1")
+        _ut(src / "dir/f2")
+        _ut(src / "dir")
 
     return [
         Scenario("intree2:copy-dirlinks-k", src_with_dirlink, ["-a", "-k"],
                  ["src/"], "dest/"),
         Scenario("intree2:copy-links-L", src_with_dirlink, ["-a", "-L"],
                  ["src/"], "dest/"),
-        Scenario("intree2:src-symlink-parent", src_symlink_parent, ["-a"],
+        Scenario("intree2:src-symlink-parent", _setup_symlinked_parent, ["-a"],
                  ["src/link/sub/file"], "dest/"),
-        Scenario("intree2:src-symlink-parent-R", src_symlink_parent, ["-aR"],
+        Scenario("intree2:src-symlink-parent-R", _setup_symlinked_parent, ["-aR"],
                  ["src/link/sub/file"], "dest/"),
-        Scenario("intree2:src-symlink-parent-dir", src_symlink_parent, ["-a"],
+        Scenario("intree2:src-symlink-parent-dir", _setup_symlinked_parent, ["-a"],
                  ["src/link/sub/"], "dest/"),
         Scenario("intree2:K-update", dirtree2, ["-aK"], ["src/"], "dest/",
                  dest_prep=kupd_prep, snap_dest=lambda d: d / "realdir"),
@@ -1354,9 +1110,7 @@ def dirtree2(src: Path):
                  "dest/", dest_prep=kupd_prep, snap_dest=lambda d: d / "realdir"),
     ]
 
-
 def proto_sweep():
-    """Older protocol versions (negotiation / wire-format regressions)."""
     s = []
     for p in (29, 30, 31):
         for opt in (["-a"], ["-aH"], ["-aHS"], ["-az"],
@@ -1366,10 +1120,7 @@ def proto_sweep():
                      opt + [f"--protocol={p}"], ["src/"], "dest/"))
     return s
 
-
 def combo_sweep():
-    """Pairs of options over a stale dest (so update/backup/inplace actually
-    fire) -- non-symlink option-interaction regressions."""
     import itertools
     flags = ["-H", "-S", "--inplace", "-z", "-c", "-b", "-O", "-J",
              "--numeric-ids", "-A", "-X", "-E", "--no-whole-file", "-I",
@@ -1380,9 +1131,7 @@ def combo_sweep():
                           ["src/"], "dest/", pre_dest=stale_dest))
     return s
 
-
 def scale_sweep():
-    """Content scale: many small files, deep nesting, a large file."""
     def many(src: Path):
         for i in range(500):
             _write(src / f"d{i % 12}" / f"f{i:04d}", f"file {i}\n".encode())
@@ -1408,23 +1157,10 @@ def big(src: Path):
         Scenario("scale:big-z", big, ["-az"], ["src/"], "dest/"),
     ]
 
-
 def _daemon_scns(chroot):
-    """PUSH scenarios to a [m] daemon module (the daemon receiver path)."""
     D = {"chroot": chroot}
     pfx = "daemonchroot" if chroot == "yes" else "daemon"
 
-    def kt(src: Path):
-        _write(src / "dir/f1", b"n1\n")
-        _write(src / "dir/f2", b"n2\n")
-        _write(src / "top", b"t\n")
-
-    def kprep(dest: Path):
-        dest.mkdir(parents=True, exist_ok=True)
-        (dest / "realdir").mkdir(exist_ok=True)
-        if not (dest / "dir").is_symlink():
-            os.symlink("realdir", dest / "dir")
-
     return [
         Scenario(f"{pfx}:push", build_recvtree, ["-a"], ["src/"], daemon=D),
         Scenario(f"{pfx}:push-H", build_recvtree, ["-aH"], ["src/"], daemon=D),
@@ -1433,24 +1169,17 @@ def kprep(dest: Path):
                  pre_dest=stale_dest, daemon=D),
         Scenario(f"{pfx}:push-delete", build_recvtree, ["-a", "--delete"],
                  ["src/"], pre_dest=stale_dest, daemon=D),
-        Scenario(f"{pfx}:push-K-symlinkdir", kt, ["-aK"], ["src/"],
-                 dest_prep=kprep, snap_dest=lambda d: d / "realdir", daemon=D),
+        Scenario(f"{pfx}:push-K-symlinkdir", _setup_transport_tree, ["-aK"], ["src/"],
+                 dest_prep=_prep_kdest, snap_dest=lambda d: d / "realdir", daemon=D),
     ]
 
-
 def daemon_sweep():
     return _daemon_scns("no")
 
-
 def daemonchroot_sweep():
-    """use chroot = yes (root-only): the daemon chroots into the module path."""
     return _daemon_scns("yes")
 
-
 def gaps_sweep():
-    """Scenarios observable mainly via the stdout/stderr/itemize signals rather
-    than the dest tree: --list-only listings, --dry-run plans (incl.
-    --mkpath+--dry-run file-to-file), and type-change updates."""
     def t_tree(src):
         _mk_reg(src / "f", 100)
         _mk_reg(src / "dir/g", 50)
@@ -1461,10 +1190,10 @@ def t_one(src):
         _mk_reg(src / "file", 50)
 
     def t_typesrc(src):
-        _mk_reg(src / "x", 30)        # src: x is a FILE
+        _mk_reg(src / "x", 30)
         _mk_reg(src / "keep", 10)
 
-    def pre_typedir(dest):            # dest: x is a DIR (different type)
+    def pre_typedir(dest):
         os.makedirs(dest / "x")
         _mk_reg(dest / "x" / "inner", 5)
         _ut(dest / "x")
@@ -1482,11 +1211,7 @@ def pre_typedir(dest):            # dest: x is a DIR (different type)
                  pre_dest=pre_typedir),
     ]
 
-
 def misc_sweep():
-    """Genuinely-untested subsystems: filter/include-exclude rules, per-dir merge,
-    CVS-exclude, fuzzy, write-batch, xattr, -R dot-anchoring -- looking for NEW
-    root-cause families beyond the daemon-symlink cluster."""
     def t_filter(src):
         _mk_reg(src / "keep.txt", 10)
         _mk_reg(src / "skip.log", 10)
@@ -1536,30 +1261,13 @@ def t_reldot(src):
         Scenario("misc:relative-dot", t_reldot, ["-aR"], ["src/./sub/deep/f"], "dest/"),
     ]
 
-
 def daemon_sym_sweep():
-    """PUSH symlink/dirlink/keep-dirlinks scenarios to a daemon module -- the
-    daemon receiver/keep-dirlinks path. Enumerates the family: -K through a
-    symlinked dest dir (plain/nested/update/delete), and -L/-k/-l/--safe-links/
-    --munge-links/--copy-unsafe-links of in-tree and out-of-tree symlinks pushed
-    into a module."""
     D = {"chroot": "no"}
 
-    def kt(src):
-        _mk_reg(src / "dir/f1", 10)
-        _mk_reg(src / "dir/f2", 10)
-        _mk_reg(src / "top", 5)
-
     def kt_nested(src):
         _mk_reg(src / "dir/sub/f", 10)
         _mk_reg(src / "top", 5)
 
-    def kprep(dest):
-        dest.mkdir(parents=True, exist_ok=True)
-        (dest / "realdir").mkdir(exist_ok=True)
-        if not (dest / "dir").is_symlink():
-            os.symlink("realdir", dest / "dir")
-
     def kprep_nested(dest):
         dest.mkdir(parents=True, exist_ok=True)
         (dest / "realdir" / "sub").mkdir(parents=True, exist_ok=True)
@@ -1567,43 +1275,28 @@ def kprep_nested(dest):
             os.symlink("realdir", dest / "dir")
 
     def kprep_update(dest):
-        kprep(dest)
+        _prep_kdest(dest)
         _mk_reg(dest / "realdir" / "f1", 3, t=T_OLD)
 
     def kprep_delete(dest):
-        kprep(dest)
+        _prep_kdest(dest)
         _mk_reg(dest / "realdir" / "extra", 3)
 
-    def src_dirlink(src):
-        _mk_reg(src / "rd/inner", 10)
-        os.symlink("rd", src / "dl")
-        _mk_reg(src / "anchor", 5)
-        _ut(src / "rd")
-
-    def src_abslink(src):
-        os.symlink("/etc/hostname", src / "abs")
-        _mk_reg(src / "anchor", 5)
-
     rd = lambda d: d / "realdir"
     return [
-        Scenario("dsym:K-dirlink", kt, ["-aK"], ["src/"], "dest/", dest_prep=kprep, snap_dest=rd, daemon=D),
+        Scenario("dsym:K-dirlink", _setup_kdest, ["-aK"], ["src/"], "dest/", dest_prep=_prep_kdest, snap_dest=rd, daemon=D),
         Scenario("dsym:K-nested", kt_nested, ["-aK"], ["src/"], "dest/", dest_prep=kprep_nested, snap_dest=rd, daemon=D),
-        Scenario("dsym:K-update", kt, ["-aK"], ["src/"], "dest/", dest_prep=kprep_update, snap_dest=rd, daemon=D),
-        Scenario("dsym:K-delete", kt, ["-aK", "--delete"], ["src/"], "dest/", dest_prep=kprep_delete, snap_dest=rd, daemon=D),
-        Scenario("dsym:L-src-dirlink", src_dirlink, ["-aL"], ["src/"], "dest/", daemon=D),
-        Scenario("dsym:k-src-dirlink", src_dirlink, ["-ak"], ["src/"], "dest/", daemon=D),
-        Scenario("dsym:l-src", src_dirlink, ["-al"], ["src/"], "dest/", daemon=D),
-        Scenario("dsym:safe-links", src_abslink, ["-a", "--safe-links"], ["src/"], "dest/", daemon=D),
-        Scenario("dsym:munge", src_abslink, ["-a", "--munge-links"], ["src/"], "dest/", daemon=D),
-        Scenario("dsym:copy-unsafe", src_abslink, ["-a", "--copy-unsafe-links"], ["src/"], "dest/", daemon=D),
+        Scenario("dsym:K-update", _setup_kdest, ["-aK"], ["src/"], "dest/", dest_prep=kprep_update, snap_dest=rd, daemon=D),
+        Scenario("dsym:K-delete", _setup_kdest, ["-aK", "--delete"], ["src/"], "dest/", dest_prep=kprep_delete, snap_dest=rd, daemon=D),
+        Scenario("dsym:L-src-dirlink", _setup_dirlink_source, ["-aL"], ["src/"], "dest/", daemon=D),
+        Scenario("dsym:k-src-dirlink", _setup_dirlink_source, ["-ak"], ["src/"], "dest/", daemon=D),
+        Scenario("dsym:l-src", _setup_dirlink_source, ["-al"], ["src/"], "dest/", daemon=D),
+        Scenario("dsym:safe-links", _setup_absolute_symlink, ["-a", "--safe-links"], ["src/"], "dest/", daemon=D),
+        Scenario("dsym:munge", _setup_absolute_symlink, ["-a", "--munge-links"], ["src/"], "dest/", daemon=D),
+        Scenario("dsym:copy-unsafe", _setup_absolute_symlink, ["-a", "--copy-unsafe-links"], ["src/"], "dest/", daemon=D),
     ]
 
-
 def daemon_escape_sweep():
-    """Daemon following symlinks that point OUTSIDE the module (absolute, or ../
-    escape), via -L / --copy-links / --copy-unsafe-links / --safe-links, on both
-    the sender (pull) and receiver (push) side -- the daemon symlink-safety
-    behaviour."""
     Dpull = {"chroot": "no", "pull": True}
     Dpush = {"chroot": "no"}
 
@@ -1612,20 +1305,20 @@ def s_abs(src):
         _mk_reg(src / "anchor", 5)
 
     def s_escape(src):
-        _mk_reg(src.parent / "secret", 7)          # outside the module (wd/secret)
+        _mk_reg(src.parent / "secret", 7)
         os.symlink("../secret", src / "esc")
         _mk_reg(src / "anchor", 5)
 
     def s_filelink(src):
         _mk_reg(src / "real", 10)
-        os.symlink("real", src / "fl")             # in-tree symlink to a FILE
+        os.symlink("real", src / "fl")
         _mk_reg(src / "anchor", 5)
 
     def s_absdir(src):
-        out = src.parent / "outdir"                # small out-of-module dir (wd/outdir)
+        out = src.parent / "outdir"
         _mk_reg(out / "x", 8)
         _mk_reg(out / "y", 8)
-        os.symlink(str(out), src / "extdir")       # absolute symlink to out-of-module DIR
+        os.symlink(str(out), src / "extdir")
         _mk_reg(src / "anchor", 5)
 
     pull = [
@@ -1651,93 +1344,44 @@ def s_absdir(src):
     s += [Scenario(n, fn, o, ["src/"], "dest/", daemon=Dpush) for n, fn, o in push]
     return s
 
-
 def daemon_pull_sym_sweep():
-    """PULL symlink/dirlink scenarios FROM a daemon module (the daemon SENDER
-    side -- untested until now). Served source contains the symlinks; the client
-    pulls with -L/-k/-l/-K/--safe-links/--munge-links/--copy-unsafe-links."""
     D = {"chroot": "no", "pull": True}
 
-    def served_dirlink(src):
-        _mk_reg(src / "rd/inner", 10)
-        os.symlink("rd", src / "dl")
-        _mk_reg(src / "anchor", 5)
-        _ut(src / "rd")
-
     def served_intree(src):
         _mk_reg(src / "real", 10)
         os.symlink("real", src / "lnk")
         _mk_reg(src / "anchor", 5)
 
-    def served_abslink(src):
-        os.symlink("/etc/hostname", src / "abs")
-        _mk_reg(src / "anchor", 5)
-
-    def served_dir(src):
-        _mk_reg(src / "dir/f1", 10)
-        _mk_reg(src / "dir/f2", 10)
-        _mk_reg(src / "top", 5)
-
-    def kprep(dest):
-        dest.mkdir(parents=True, exist_ok=True)
-        (dest / "realdir").mkdir(exist_ok=True)
-        if not (dest / "dir").is_symlink():
-            os.symlink("realdir", dest / "dir")
-
     return [
         Scenario("dpull:plain", build_recvtree, ["-a"], ["src/"], "dest/", daemon=D),
-        Scenario("dpull:L-dirlink", served_dirlink, ["-aL"], ["src/"], "dest/", daemon=D),
-        Scenario("dpull:k-dirlink", served_dirlink, ["-ak"], ["src/"], "dest/", daemon=D),
-        Scenario("dpull:l", served_dirlink, ["-al"], ["src/"], "dest/", daemon=D),
+        Scenario("dpull:L-dirlink", _setup_dirlink_source, ["-aL"], ["src/"], "dest/", daemon=D),
+        Scenario("dpull:k-dirlink", _setup_dirlink_source, ["-ak"], ["src/"], "dest/", daemon=D),
+        Scenario("dpull:l", _setup_dirlink_source, ["-al"], ["src/"], "dest/", daemon=D),
         Scenario("dpull:L-intree", served_intree, ["-aL"], ["src/"], "dest/", daemon=D),
-        Scenario("dpull:safe-links", served_abslink, ["-a", "--safe-links"], ["src/"], "dest/", daemon=D),
-        Scenario("dpull:munge", served_abslink, ["-a", "--munge-links"], ["src/"], "dest/", daemon=D),
-        Scenario("dpull:copy-unsafe", served_abslink, ["-a", "--copy-unsafe-links"], ["src/"], "dest/", daemon=D),
-        Scenario("dpull:K-dest-dirlink", served_dir, ["-aK"], ["src/"], "dest/", dest_prep=kprep, snap_dest=lambda d: d / "realdir", daemon=D),
+        Scenario("dpull:safe-links", _setup_absolute_symlink, ["-a", "--safe-links"], ["src/"], "dest/", daemon=D),
+        Scenario("dpull:munge", _setup_absolute_symlink, ["-a", "--munge-links"], ["src/"], "dest/", daemon=D),
+        Scenario("dpull:copy-unsafe", _setup_absolute_symlink, ["-a", "--copy-unsafe-links"], ["src/"], "dest/", daemon=D),
+        Scenario("dpull:K-dest-dirlink", _setup_kdest, ["-aK"], ["src/"], "dest/", dest_prep=_prep_kdest, snap_dest=lambda d: d / "realdir", daemon=D),
         Scenario("dpull:hardlinks", build_recvtree, ["-aH"], ["src/"], "dest/", daemon=D),
     ]
 
-
 _COMBO_FLAGS = ["-H", "-S", "--inplace", "-z", "-c", "-b", "-O", "-J",
                 "--numeric-ids", "-A", "-X", "-E", "--no-whole-file", "-I",
                 "--size-only", "-u"]
 
-
 def combo3_sweep():
-    """Option TRIPLES over a stale dest -- deeper interaction coverage."""
     import itertools
     return [Scenario(f"combo3:{x},{y},{z}", build_recvtree, ["-a", x, y, z],
                      ["src/"], "dest/", pre_dest=stale_dest)
             for x, y, z in itertools.combinations(_COMBO_FLAGS, 3)]
 
-
 def combo4_sweep():
-    """Option QUADRUPLES over a stale dest (C(16,4)=1820)."""
     import itertools
     return [Scenario(f"combo4:{w},{x},{y},{z}", build_recvtree,
                      ["-a", w, x, y, z], ["src/"], "dest/", pre_dest=stale_dest)
             for w, x, y, z in itertools.combinations(_COMBO_FLAGS, 4)]
 
-
 def ssh_sweep():
-    """PUSH over a remote-shell split (support/lsh.sh) -- exercises the real
-    client+server processes / protocol / arg passing, and confirms whether the
-    in-tree-symlink regressions also manifest over the wire."""
-    def kt(src: Path):
-        _write(src / "dir/f1", b"n1\n")
-        _write(src / "dir/f2", b"n2\n")
-        _write(src / "top", b"t\n")
-
-    def kprep(dest: Path):
-        dest.mkdir(parents=True, exist_ok=True)
-        (dest / "realdir").mkdir(exist_ok=True)
-        if not (dest / "dir").is_symlink():
-            os.symlink("realdir", dest / "dir")
-
-    def sym_parent(src: Path):
-        _write(src / "real/sub/file", b"under symlinked parent\n")
-        os.symlink("real", src / "link")
-
     return [
         Scenario("ssh:push", build_recvtree, ["-a"], ["src/"], ssh=True),
         Scenario("ssh:push-H", build_recvtree, ["-aH"], ["src/"], ssh=True),
@@ -1749,37 +1393,32 @@ def sym_parent(src: Path):
                  pre_dest=stale_dest, ssh=True),
         Scenario("ssh:push-protect-args", build_recvtree, ["-a", "-s"], ["src/"],
                  ssh=True),
-        Scenario("ssh:K-symlinkdir", kt, ["-aK"], ["src/"], dest_prep=kprep,
+        Scenario("ssh:K-symlinkdir", _setup_transport_tree, ["-aK"], ["src/"], dest_prep=_prep_kdest,
                  snap_dest=lambda d: d / "realdir", ssh=True),
-        Scenario("ssh:R-symlink-parent", sym_parent, ["-aR"],
+        Scenario("ssh:R-symlink-parent", _setup_symlinked_parent, ["-aR"],
                  ["src/link/sub/file"], ssh=True),
     ]
 
-
 def redo_sweep():
-    """Resume / redo state machine: a partial or corrupted prior dest forces the
-    delta + verify + resume path (inplace / append-verify / partial-dir, the
-    latter both relative AND absolute). Generalises the single-pass model -- the
-    'failed verification, update discarded' loop and the discard-path NULL-deref
-    both live here. Lifted across transports too."""
     def big(src: Path):
         _mk_reg(src / "f", 120000, t=T_NEW, fill=7)
         _mk_reg(src / "keep", 200, t=T_NEW, fill=3)
 
-    def pre_truncated(dest: Path):        # a shorter prefix of f (older) -> extend
+    def pre_truncated(dest: Path):
         _mk_reg(dest / "f", 40000, t=T_OLD, fill=7)
 
-    def pre_corrupt(dest: Path):          # same size, WRONG content -> delta+verify
+    def pre_corrupt(dest: Path):
         _mk_reg(dest / "f", 120000, t=T_OLD, fill=200)
 
-    def pre_abs_partial(dest: Path):      # corrupt dest + a stale leftover in an
-        pre_corrupt(dest)                 # ABSOLUTE partial-dir (delta-resume shape)
+    def pre_abs_partial(dest: Path):
+        pre_corrupt(dest)
         pdir = dest.parent / (dest.name + "_part")
         pdir.mkdir(parents=True, exist_ok=True)
         _mk_reg(pdir / "f", 60000, t=T_OLD, fill=7)
 
-    abs_part = lambda wd, dest: ["-a", "--no-whole-file", "--partial",
-                                 f"--partial-dir={Path(dest).parent}/{Path(dest).name}_part"]
+    def abs_part(_workdir, dest):
+        partial = Path(dest).parent / f'{Path(dest).name}_part'
+        return ['-a', '--no-whole-file', '--partial', f'--partial-dir={partial}']
     s = [
         Scenario("redo:inplace-corrupt", big, ["-a", "--inplace", "--no-whole-file"],
                  ["src/"], "dest/", pre_dest=pre_corrupt),
@@ -1793,18 +1432,13 @@ def pre_abs_partial(dest: Path):      # corrupt dest + a stale leftover in an
         Scenario("redo:checksum-corrupt", big, ["-a", "-c", "--no-whole-file"],
                  ["src/"], "dest/", pre_dest=pre_corrupt),
     ]
-    s = lift_transports(s)                # resume path over the wire too
-    # absolute partial-dir uses callable opts (not liftable) -> keep local
+    s = lift_transports(s)
+
     s.append(Scenario("redo:partialdir-abs", big, abs_part, ["src/"], "dest/",
                       pre_dest=pre_abs_partial))
     return s
 
-
 def typetrans_sweep():
-    """Type-transition: the existing dest entry has a DIFFERENT type than the
-    source (file/dir/symlink/fifo), crossed with the selection options whose job
-    is to decide whether to replace it. Generalises 'update skips a file of a
-    different type'. The stale-dest sweeps only ever vary content, never type."""
     def src_file(src: Path):
         _mk_reg(src / "x", 60, t=T_NEW)
         _mk_reg(src / "keep", 10, t=T_NEW)
@@ -1819,10 +1453,6 @@ def src_link(src: Path):
         os.symlink("real", src / "x")
         _mk_reg(src / "keep", 10, t=T_NEW)
 
-    # dest entries are pinned NEWER than the source (T_NEWER) so the -u
-    # update-skip path is actually exercised across the type change, and so the
-    # special-file mtimes are deterministic (unpinned fifos/symlinks otherwise
-    # carry wall-clock creation time -> spurious A/B mtime diffs).
     T_NEWER = T_NEW + 10**7
 
     def d_dir(dest: Path):
@@ -1851,19 +1481,13 @@ def d_fifo(dest: Path):
     for sn, sf in srcs:
         for dn, df in dests:
             for on, ov in opts:
-                # skip the same-type combo (file src vs file dest etc.)
                 if (sn, dn) in (("file", "Dfile"), ("dir", "Ddir"), ("link", "Dlink")):
                     continue
                 s.append(Scenario(f"type:{sn}-vs-{dn}-{on}", sf, ov, ["src/"],
                                   "dest/", pre_dest=df))
     return lift_transports(s)
 
-
 def tsprec_sweep():
-    """Timestamp precision: sub-second mtimes at nanosecond boundaries, crossed
-    with the time-handling options. Exercises the nsec validate/convert path that
-    integer-second fixtures never reach (caught via rc/error/content/itemize --
-    snapshot records whole-second mtimes, so this is a code-path exerciser)."""
     NS = [0, 1, 4999, 500000000, 999999999, 999999001]
 
     def mk(src: Path, nsec):
@@ -1887,11 +1511,7 @@ def mk(src: Path, nsec):
     ]
     return s
 
-
 def bigscale_sweep():
-    """Scale escalation: many empty dirs / many files at SCALE_N (--scale). Pairs
-    with the --cost peak-RSS oracle -- a per-entry allocation/footprint regression
-    only shows up at scale and is invisible to functional outcome alone."""
     n = max(1, SCALE_N)
 
     def emptydirs(src: Path):
@@ -1914,13 +1534,7 @@ def deepdirs(src: Path):
         Scenario("scale:deepdirs", deepdirs, ["-a"], ["src/"], "dest/"),
     ]
 
-
 def rrsync_sweep():
-    """rrsync lane: route the remote side through the restricted rrsync wrapper
-    (subdir-restricted, so its option/path validation is exercised) -- a whole
-    subsystem the other lanes never drive. Covers `-a` and an `-rlpt` control,
-    push and pull. rrsync ships per version, so each build is paired with its own
-    rrsync via --rrsync-a/--rrsync-b."""
     bt = build_recvtree
 
     def tree(src: Path):
@@ -1940,9 +1554,9 @@ def mk(name, setup, opts, pull=False, pre_dest=None):
         return sc
 
     return [
-        mk("rr:push-a", bt, ["-a"]),                       # D-bundled -> subdir deny decides
-        mk("rr:push-rlpt", tree, ["-rlpt"]),               # no-D control: should transfer
-        mk("rr:push-rlptD", tree, ["-rlptD"]),             # explicit D into restricted subdir
+        mk("rr:push-a", bt, ["-a"]),
+        mk("rr:push-rlpt", tree, ["-rlpt"]),
+        mk("rr:push-rlptD", tree, ["-rlptD"]),
         mk("rr:push-update", bt, ["-a"], pre_dest=stale_dest),
         mk("rr:push-copy-unsafe", abslink, ["-rlpt", "--copy-unsafe-links"]),
         mk("rr:pull-a", bt, ["-a"], pull=True),
@@ -1950,11 +1564,7 @@ def mk(name, setup, opts, pull=False, pre_dest=None):
         mk("rr:pull-symlink", tree, ["-rlpt"], pull=True),
     ]
 
-
 def tcpdaemon_sweep():
-    """Real-TCP-daemon lane: a genuine `rsync --daemon` on a bound port (greeting/
-    handshake/socket path), and an auth variant (challenge-response) -- the daemon
-    code the stdio-pipe lane bypasses. Push + pull, with/without auth."""
     bt = build_recvtree
 
     def mk(name, opts, pull=False, auth=False, pre_dest=None):
@@ -1974,7 +1584,6 @@ def mk(name, opts, pull=False, auth=False, pre_dest=None):
         mk("tcp:pull-auth", ["-a"], pull=True, auth=True),
     ]
 
-
 SWEEPS = {"options": options_sweep, "pathshape": pathshape_sweep,
           "recv": recv_sweep, "destshape": destshape_sweep,
           "name": name_sweep, "filesfrom": filesfrom_sweep,
@@ -1983,34 +1592,23 @@ def mk(name, opts, pull=False, auth=False, pre_dest=None):
           "combo4": combo4_sweep, "scale": scale_sweep, "ssh": ssh_sweep,
           "daemon": daemon_sweep, "daemonchroot": daemonchroot_sweep,
           "mode": mode_sweep, "size": size_sweep, "filetype": filetype_sweep,
-          "selection": selection_sweep, "behavior": behavior_sweep,
+          "selection": selection_sweep, "behaviour": behaviour_sweep,
           "placement": placement_sweep, "wire": wire_sweep,
           "pairwise": pairwise_sweep, "daemonsym": daemon_sym_sweep, "daemonpull": daemon_pull_sym_sweep, "daemonesc": daemon_escape_sweep, "misc": misc_sweep, "gaps": gaps_sweep,
           "redo": redo_sweep, "typetrans": typetrans_sweep, "tsprec": tsprec_sweep,
           "bigscale": bigscale_sweep, "rrsync": rrsync_sweep,
           "tcpdaemon": tcpdaemon_sweep,
           "priv": priv_sweep}
-# "all" excludes the root-only sweeps (priv, daemonchroot) and the very large
-# combo4; run those explicitly. Parallelism (-j) makes the broad benign set
-# (incl. the daemon symlink/escape + misc/gaps sweeps) affordable by default;
-# combo4 stays out of a single pass (the --loop ladder reaches order 4 anyway).
-# bigscale stays out of the default pass (heavy + meant for --cost runs); reach
-# it via --sweep bigscale --cost --scale N.
+
 ALL_SWEEPS = ["options", "pathshape", "recv", "destshape", "name", "filesfrom",
               "intree", "intree2", "proto", "combo", "combo3", "scale", "ssh",
-              "daemon", "mode", "size", "filetype", "selection", "behavior",
+              "daemon", "mode", "size", "filetype", "selection", "behaviour",
               "placement", "wire", "pairwise", "daemonsym", "daemonpull",
               "daemonesc", "misc", "gaps", "redo", "typetrans", "tsprec",
               "rrsync", "tcpdaemon"]
 
-
 def _compare(a, b, has_times=True, ign_types=(), incl_item=True, incl_lit=True,
              incl_out=False, incl_err=False):
-    """Issue list for one result vs another (A-vs-B, and the per-binary stability
-    check). incl_item/incl_lit/incl_out/incl_err drop the itemize / Literal-data /
-    normalised-stdout / normalised-stderr-text signals (used when those are
-    themselves nondeterministic, or for content-only checks). Empty list ==
-    indistinguishable on the requested signals."""
     issues = []
     if a["rc"] != b["rc"]:
         issues.append(f"  exit: A={a['rc']} B={b['rc']}")
@@ -2033,57 +1631,50 @@ def _compare(a, b, has_times=True, ign_types=(), incl_item=True, incl_lit=True,
                       + "\n     B:" + b.get("out", "")[:300])
     return issues
 
-
 def run_scenario(scn: Scenario, workroot: Path):
     wd = workroot / scn.name.replace("/", "_").replace(":", "_").replace("+", "_")
     if wd.exists():
         shutil.rmtree(wd, ignore_errors=True)
-    # opts may be a list, or a callable(wd, dest)->list for placement options
-    # whose aux dir is workdir/dest-relative (dest differs per A/B tag).  Resolve
-    # a representative copy (dest_A) for flag inspection; resolve per-tag below.
+
     def resolve_opts(dest):
         return scn.opts(str(wd), str(dest)) if callable(scn.opts) else scn.opts
     opts0 = resolve_opts(wd / "dest_A")
-    # skip if either binary lacks an option (can't A/B compare)
+
     for o in opts0:
         flag = o.split("=", 1)[0]
         if flag.startswith("--"):
             if not (supports(RSYNC_A, flag) and supports(RSYNC_B, flag)):
                 return ("SKIP", f"a binary lacks {flag}")
-    # build the source ONCE so both binaries see identical input (incl. mtimes)
+
     src = wd / "src"
     src.mkdir(parents=True, exist_ok=True)
     scn.setup(src)
     src_args = scn.src_args(str(wd)) if callable(scn.src_args) else scn.src_args
-    # ignore mtime only when neither -t nor -a is in effect; some dest times are
-    # left unmanaged by rsync (-O dirs, -J links, -b backup) -> ignore those.
+
     has_times = any(o in ("-a", "-t", "-rlptD", "--times") or
                     (o.startswith("-") and not o.startswith("--") and "t" in o)
                     for o in opts0)
     ign_types = _ign(opts0)
-    # a "/"-rooted or absolute source (e.g. --files-from with absolute names)
-    # makes rsync create IMPLIED parent dirs it has no source time for -> their
-    # mtime is wall-clock and differs between the A and B runs. Ignore dir mtimes
-    # for those, like -O/backup dirs.
+
     if isinstance(src_args, list) and any(a == "/" or a.startswith("/")
                                           for a in src_args):
         ign_types = set(ign_types) | {"d"}
 
     def one_run(tag, binary, rep):
         dest = wd / f"dest_{tag}{rep}"
-        optr = resolve_opts(dest)     # per-tag (aux dir is under this tag's dest)
+        optr = resolve_opts(dest)
         if scn.dest_prep:
-            scn.dest_prep(dest)        # e.g. create dest as a symlink to a real dir
+            scn.dest_prep(dest)
         elif scn.pre_dest:
             dest.mkdir(parents=True, exist_ok=True)
             scn.pre_dest(dest)
-        _tls.measure = COST            # have sh() sample peak process-group RSS
+        _tls.measure = COST
         _tls.rss = None
         if scn.daemon is not None:
             port = (20000 + (abs(hash(scn.name)) % 2000) * 16
                     + (0 if tag == "A" else 8) + rep)
             D = scn.daemon
-            if D.get("tcp"):           # real bound TCP port (not the stdio pipe)
+            if D.get("tcp"):
                 rc, err, lit, item, out = _tcp_daemon(
                     binary, str(wd), str(wd / "src") if D.get("pull") else str(dest),
                     optr, src_args, localdest=str(dest), pull=D.get("pull", False),
@@ -2117,15 +1708,6 @@ def one_run(tag, binary, rep):
                     out=_norm_out(out, wd, dest), errn=_norm_err(err, wd, dest),
                     rss=getattr(_tls, "rss", None))
 
-    # STABILITY GATE: run each binary REPEAT times (cheap), and if a candidate
-    # A/B diff appears, ESCALATE to more samples and require the diff to be stable
-    # across ALL of them. A binary whose own runs disagree (or a diff that doesn't
-    # reproduce) is nondeterministic -> quarantine FLAKY, never a false regression.
-    # (A ~50% flake fools 2 repeats too often; escalation makes false DIFFs rare.)
-    # CONTENT-level instability within one binary's repeats = real nondeterminism
-    # (rc / error / dest content+existence; mtime, itemize, Literal-data excluded
-    # -- those carry incidental wall-clock/dir-time variance, not a correctness
-    # flake).  This is what makes an A/B diff untrustworthy -> quarantine FLAKY.
     def content_unstable(rs):
         for other in rs[1:]:
             d = _compare(rs[0], other, has_times=False, ign_types=set(),
@@ -2142,8 +1724,6 @@ def attr_stable(rs, k):
     rb = [one_run("B", RSYNC_B, r) for r in range(base)]
     item_ok = lit_ok = out_ok = err_ok = True
     if base >= 2:
-        # escalate sampling when a candidate A/B diff appears (on ANY signal),
-        # to confirm stability before trusting it
         if _compare(ra[0], rb[0], has_times, ign_types, incl_out=True, incl_err=True):
             confirm = max(base, 5)
             ra += [one_run("A", RSYNC_A, r) for r in range(base, confirm)]
@@ -2154,18 +1734,13 @@ def attr_stable(rs, k):
                 shutil.rmtree(wd, ignore_errors=True)
             return ("FLAKY", ["  scenario content is nondeterministic across "
                               "repeats (quarantined, not a regression):"] + cu[:6])
-        # itemize / Literal-data / stdout / stderr-text are kept as A/B signals
-        # only if each is stable per binary (else incidental run-variance noise)
+
         item_ok = attr_stable(ra, "item") and attr_stable(rb, "item")
         lit_ok = attr_stable(ra, "lit") and attr_stable(rb, "lit")
         out_ok = attr_stable(ra, "out") and attr_stable(rb, "out")
         err_ok = attr_stable(ra, "errn") and attr_stable(rb, "errn")
     a, b = ra[0], rb[0]
-    # When BOTH builds error on this (often edge) input, neither produced a clean
-    # benign transfer; the exact stderr/stdout/itemize/literal wording is low
-    # signal (different errno/message for the same failure). A real regression --
-    # A worse than B -- still shows in the exit code and the dest tree, which stay
-    # compared. Drop the free-text/itemize signals in that case.
+
     both_failed = (any(m in a["err"] for m in ERR_MARKERS)
                    and any(m in b["err"] for m in ERR_MARKERS))
     issues = _compare(a, b, has_times, ign_types,
@@ -2173,9 +1748,7 @@ def attr_stable(rs, k):
                       incl_lit=lit_ok and not both_failed,
                       incl_out=out_ok and not both_failed,
                       incl_err=err_ok and not both_failed)
-    # COST oracle: directional peak-RSS blow-up. Require the gap to hold across
-    # ALL samples (min A vs max B) so run-to-run RSS noise can't trip it; only a
-    # gross ratio + absolute floor counts -- a real resource regression, not jitter.
+
     if COST:
         arss = [r["rss"] for r in ra if r.get("rss")]
         brss = [r["rss"] for r in rb if r.get("rss")]
@@ -2188,14 +1761,12 @@ def attr_stable(rs, k):
         shutil.rmtree(wd, ignore_errors=True)
     if not issues:
         return ("OK", issues)
-    # Classify: if A's only divergence is an INTENTIONAL refusal that B did not
-    # do (an entry in ALLOWLIST), mark ALLOW -- a documented behaviour change,
-    # recorded separately, not a silent regression.
+
     for sub, note in ALLOWLIST:
         if sub in a["err"] and sub not in b["err"]:
             return ("ALLOW", [f"  intentional behaviour change: {note}",
                               f"     A:{a['err'][:200]}"] )
-    # Direction matters for "regression": only A being WORSE than B counts.
+
     a_ok = a["rc"] == 0 and not any(m in a["err"] for m in ERR_MARKERS)
     b_ok = b["rc"] == 0 and not any(m in b["err"] for m in ERR_MARKERS)
     if a_ok and not b_ok:
@@ -2204,19 +1775,16 @@ def attr_stable(rs, k):
                             f"     B:{b['err'][:200]}"])
     return ("DIFF", issues)
 
-
 _mport = [25500]
 
-
 def _ssh1(cbin, sbin, wd, opts, src, dest, pull):
     e = ["-e", f"sh {_LSH}", f"--rsync-path={sbin}"]
-    if pull:   # remote side (sbin) is the SENDER
+    if pull:
         argv = [cbin, "--stats", "-i", *e, *opts, f"lh:{src}/", f"{dest}/"]
-    else:      # client (cbin) is the SENDER
+    else:
         argv = [cbin, "--stats", "-i", *e, *opts, f"{src}/", f"lh:{dest}/"]
     return _parse_out(sh(argv, cwd=str(wd)))
 
-
 def _daemon1(cbin, sbin, wd, module, opts, localdir, pull):
     _mport[0] += 1
     port = _mport[0]
@@ -2232,9 +1800,9 @@ def _daemon1(cbin, sbin, wd, module, opts, localdir, pull):
         if not _wait_port(port):
             return (99, "daemon failed to start", None, "")
         url = f"rsync://127.0.0.1:{port}/m/"
-        if pull:   # daemon (sbin) is the SENDER
+        if pull:
             argv = [cbin, "--stats", "-i", *opts, url, f"{localdir}/"]
-        else:      # client (cbin) is the SENDER
+        else:
             argv = [cbin, "--stats", "-i", *opts, f"{localdir}/", url]
         return _parse_out(sh(argv, cwd=str(wd)))
     finally:
@@ -2244,13 +1812,7 @@ def _daemon1(cbin, sbin, wd, module, opts, localdir, pull):
         except subprocess.TimeoutExpired:
             proc.kill()
 
-
 def run_matrix(workroot, logf):
-    """Cross-build role matrix: mixed A<->B over the wire, both directions
-    (push/pull => which build is sender vs receiver), both transports
-    (ssh/daemon).  Each config's dest is compared to the PURE-B baseline; an
-    A-involved config that is WORSE than pure-B is a regression (protocol/interop
-    or role-specific)."""
     A, B = RSYNC_A, RSYNC_B
     scns = [("basic", build_recvtree, ["-a"]),
             ("H", build_recvtree, ["-aH"]),
@@ -2310,7 +1872,6 @@ def one(cbin, sbin, wd, tag, transport, direction, opts):
     print(f"\n=== matrix: {nreg} cross-version regression candidates ===")
     return nreg
 
-
 def _fx_hardlinks(src):
     for i in range(6):
         _write(src / f"f{i}", f"data{i % 3}\n".encode())
@@ -2321,13 +1882,11 @@ def _fx_hardlinks(src):
             pass
     os.symlink("f0", src / "sl")
 
-
 def _fx_weird(src):
     for n in ["a space", "café", "semi;colon", "dollar$x", "paren(s)", "-dash",
               "tab\tt"]:
         _write(src / n, b"x\n")
 
-
 def _fx_deep(src):
     p = src
     for i in range(25):
@@ -2335,19 +1894,16 @@ def _fx_deep(src):
     _write(p / "leaf", b"deep\n")
     _write(src / "top", b"t\n")
 
-
 def _fx_sparse(src):
     with open(src / "sp.bin", "wb") as f:
         f.seek(2 << 20)
         f.write(b"end")
     _write(src / "reg", b"r\n")
 
-
 def _fx_many(src):
     for i in range(200):
         _write(src / f"d{i % 8}" / f"f{i:03d}", f"{i}\n".encode())
 
-
 FUZZ_FIXTURES = [("recvtree", build_recvtree), ("kitchen", build_kitchen),
                  ("hardlinks", _fx_hardlinks), ("weird", _fx_weird),
                  ("deep", _fx_deep), ("sparse", _fx_sparse), ("many", _fx_many)]
@@ -2358,9 +1914,7 @@ def _fx_many(src):
               "--ignore-existing", "--max-size=100000", "--compress-choice=zstd",
               "--no-inc-recursive", "--checksum-choice=md5"]
 
-
 def _perturb(src, dest):
-    """dest = an older/partial copy of src (so update/backup/delete/-u/-I bite)."""
     shutil.copytree(src, dest, symlinks=True)
     for p in sorted(dest.rglob("*")):
         if p.is_file() and not p.is_symlink():
@@ -2370,7 +1924,6 @@ def _perturb(src, dest):
     (dest / "_obsolete").write_text("x\n")
     os.utime(dest / "_obsolete", (T_OLD, T_OLD))
 
-
 def _fuzz_run(sndr, rcvr, transport, direction, wd, tag, opts, src):
     dest = wd / f"d_{tag}"
     _perturb(src, dest)
@@ -2379,18 +1932,14 @@ def _fuzz_run(sndr, rcvr, transport, direction, wd, tag, opts, src):
             rc, err, _, _, _ = _ssh1(sndr, rcvr, wd, opts, src, dest, pull=False)
         else:
             rc, err, _, _, _ = _ssh1(rcvr, sndr, wd, opts, src, dest, pull=True)
-    else:  # daemon
+    else:
         if direction == "push":
             rc, err, _, _, _ = _daemon1(sndr, rcvr, wd, dest, opts, src, pull=False)
         else:
             rc, err, _, _, _ = _daemon1(rcvr, sndr, wd, src, opts, dest, pull=True)
     return rc, err, snapshot(dest)
 
-
 def run_fuzz(workroot, logf, n, seed):
-    """Stochastic differential fuzzer: random fixture x option-subset x transport
-    x direction x build-pair, each compared to the pure-B baseline for the same
-    config. Finds cross-build / option-interaction regressions broadly."""
     import random
     rnd = random.Random(seed)
     A, B = RSYNC_A, RSYNC_B
@@ -2404,7 +1953,7 @@ def run_fuzz(workroot, logf, n, seed):
         transport = rnd.choice(["ssh", "daemon"])
         direction = rnd.choice(["push", "pull"])
         sndr, rcvr = rnd.choice([(A, A), (A, B), (B, A)])
-        # skip option unsupported by either binary
+
         if any(o.startswith("--") and not (supports(A, o.split("=")[0])
                and supports(B, o.split("=")[0])) for o in opts):
             continue
@@ -2427,7 +1976,7 @@ def run_fuzz(workroot, logf, n, seed):
             if not KEEP:
                 shutil.rmtree(wd, ignore_errors=True)
             continue
-        if cok and not bok:        # config better than pure-B
+        if cok and not bok:
             if not KEEP:
                 shutil.rmtree(wd, ignore_errors=True)
             continue
@@ -2453,7 +2002,6 @@ def run_fuzz(workroot, logf, n, seed):
     print(f"\n=== fuzz: {nrun} configs run, {nreg} distinct regression candidates ===")
     return nreg
 
-
 def _ign(opts):
     s = set()
     if "--omit-dir-times" in opts or any(o[:1] == "-" and o[1:2] != "-" and "O" in o for o in opts):
@@ -2462,31 +2010,20 @@ def _ign(opts):
         s.add("l")
     if "--backup" in opts or any(o[:1] == "-" and o[1:2] != "-" and "b" in o for o in opts):
         s.add("d")
-    # aux/implied dirs (temp/partial/backup, and --mkpath's created parents) sit
-    # in the dest tree but get no source time -> their mtime is wall-clock and
-    # differs between the A and B runs.
+
     if any(o.startswith(("--temp-dir", "--partial-dir", "--backup-dir",
                          "--partial", "--mkpath"))
            for o in opts):
         s.add("d")
     return s
 
-
-# ---------------------------------------------------------------------------
-# --loop: infinite scenario generators (random novel combos + systematic ladder)
-
-# extra flags worth randomizing beyond the combo set (symlink / selection / wire)
 _RAND_FLAGS = _COMBO_FLAGS + ["-k", "-K", "-L", "-l", "--copy-unsafe-links",
                               "--safe-links", "--munge-links", "--delete",
                               "--existing", "--ignore-existing",
                               "--no-inc-recursive", "--compress-choice=zstd",
                               "--checksum-choice=md5", "--sparse", "--fuzzy"]
 
-
 def _random_scenarios(rnd, seen):
-    """Infinite stream of randomized benign A/B scenarios: random fixture x random
-    option subset (size 2-6), optional stale dest. Deduped by signature, fed
-    through the same A/B oracle as the fixed sweeps."""
     idx = 0
     while True:
         fxname, fx = rnd.choice(FUZZ_FIXTURES)
@@ -2503,10 +2040,7 @@ def _random_scenarios(rnd, seen):
         yield Scenario(nm, fx, ["-a", *flags], ["src/"], "dest/",
                        pre_dest=(stale_dest if stale else None))
 
-
 def _systematic_combos(seen):
-    """Infinite stream walking the option-combination ladder combo2->3->4->...
-    over a stale dest; when the top order is exhausted the ladder restarts."""
     k = 2
     while True:
         for combo in itertools.combinations(_COMBO_FLAGS, k):
@@ -2517,24 +2051,19 @@ def _systematic_combos(seen):
             yield Scenario(f"sys{k}:" + ",".join(combo), build_recvtree,
                            ["-a", *combo], ["src/"], "dest/", pre_dest=stale_dest)
         k += 1
-        if k > len(_COMBO_FLAGS):       # exhausted every order -> restart ladder
+        if k > len(_COMBO_FLAGS):
             for s in [s for s in seen if s and s[0] == "sys"]:
                 seen.discard(s)
             k = 2
 
-
 def _mixed_scenarios(rnd, seen):
-    """Alternate random / systematic so a parallel pool runs ~half of each."""
     rg = _random_scenarios(rnd, seen)
     sg = _systematic_combos(seen)
     while True:
         yield next(rg)
         yield next(sg)
 
-
 class _Tee:
-    """Minimal write/flush fan-out so matrix/fuzz diffs land in both the curated
-    findings log and the full per-run log."""
     def __init__(self, *files):
         self._f = files
 
@@ -2546,7 +2075,6 @@ def flush(self):
         for f in self._f:
             f.flush()
 
-
 def main():
     global RSYNC_A, RSYNC_B, RRSYNC_A, RRSYNC_B, KEEP, REPEAT, CMD_TIMEOUT, COST, SCALE_N
     ap = argparse.ArgumentParser()
@@ -2556,7 +2084,7 @@ def main():
                     help="rrsync wrapper script paired with A for the rrsync lane "
                          "(default: in-tree support/rrsync)")
     ap.add_argument("--rrsync-b", default=None,
-                    help="rrsync wrapper paired with B (e.g. a baseline version's "
+                    help="rrsync wrapper paired with B (for example a baseline version's "
                          "rrsync); rrsync regressions live in the script, so this "
                          "must match B's version to A/B the rrsync lane")
     ap.add_argument("--sweep", default="all",
@@ -2564,7 +2092,7 @@ def main():
                              "name", "filesfrom", "intree", "intree2", "proto",
                              "combo", "combo3", "combo4", "scale", "ssh",
                              "daemon", "daemonchroot", "mode", "size",
-                             "filetype", "selection", "behavior", "placement",
+                             "filetype", "selection", "behaviour", "placement",
                              "wire", "pairwise", "daemonsym", "daemonpull",
                              "daemonesc", "misc", "gaps", "redo", "typetrans",
                              "tsprec", "bigscale", "rrsync", "tcpdaemon",
@@ -2601,7 +2129,7 @@ def main():
                          "--sweep bigscale --scale N.")
     ap.add_argument("--scale", type=int, default=SCALE_N, metavar="N",
                     help=f"element count for the bigscale fixtures (default {SCALE_N}; "
-                         "use e.g. 100000 with --cost to surface footprint regressions)")
+                         "use 100000 with --cost to surface footprint regressions)")
     ap.add_argument("--timelimit", type=float, default=0, metavar="SECS",
                     help="stop after SECS seconds (0 = no limit); in --loop it ends "
                          "the loop, in a finite sweep it stops queuing new scenarios. "
@@ -2646,8 +2174,7 @@ def main():
         return 1 if n else 0
 
     sweeps = ALL_SWEEPS if args.sweep == "all" else [args.sweep]
-    # as root (or --root-extra), fold the root-only sweeps into an "all" run so a
-    # privileged session exercises owner/device/specials/fake-super + chroot daemon.
+
     root_extra = args.root_extra if args.root_extra is not None else (os.geteuid() == 0)
     if args.sweep == "all" and root_extra:
         sweeps = sweeps + ["priv", "daemonchroot"]
@@ -2660,29 +2187,23 @@ def main():
         scns = [s for s in scns if args.only in s.name]
     if args.list:
         for s in scns:
-            print(s.name, s.opts)
+            print(s.name, ' '.join(s.opts) if not callable(s.opts) else '(dynamic)')
         return 0
 
     print(f"A (under test): {RSYNC_A}  ({sh([RSYNC_A,'--version']).stdout.splitlines()[0] if sh([RSYNC_A,'--version']).returncode==0 else '?'})")
     print(f"B (baseline):   {RSYNC_B}  ({sh([RSYNC_B,'--version']).stdout.splitlines()[0]})")
 
-    # absolute: scenarios run rsync with cwd=workdir and also pass dest/aux paths
-    # under it, so a relative --workdir would double-resolve (rsync writes to
-    # wd/wd/...) and every scenario would go silently vacuous.
     workroot = Path(os.path.abspath(args.workdir))
     workroot.mkdir(parents=True, exist_ok=True)
-    # Curated, cross-run findings log: open once, write a run header, and flush
-    # each anomaly the moment it is found so the log is a live record mid-run.
+
     fp = Path(args.findings)
     fp.parent.mkdir(parents=True, exist_ok=True)
-    logf = open(fp, "a", buffering=1)  # line-buffered
+    logf = open(fp, "a", buffering=1)
     logf.write(f"\n===== abdiff run {time.strftime('%Y-%m-%d %H:%M:%S')} "
                f"sweep={args.sweep} A={RSYNC_A} B={RSYNC_B} jobs={args.jobs}"
                f"{' loop' if args.loop else ''} =====\n")
     logf.flush()
-    # Per-run findings log: fresh timestamped file in the current dir (or
-    # --log-dir). Holds ONLY findings (DIFF/TIMEOUT/ERROR/FLAKY/ALLOW/BETTER) --
-    # no OK/SKIP noise; stdout shows a live "test N" counter instead.
+
     ld = Path(args.log_dir)
     ld.mkdir(parents=True, exist_ok=True)
     runlog_path = ld / f"abdiff-log_{time.strftime('%Y%m%d_%H%M%S')}.txt"
@@ -2695,7 +2216,7 @@ def main():
     print(f"findings log: {runlog_path}\njobs: {args.jobs}"
           f"{'  (loop: Ctrl-C to stop)' if args.loop else ''}")
 
-    def ostr(s):  # opts may be callable (placement scenarios)
+    def ostr(s):
         return ' '.join(s.opts) if not callable(s.opts) else '(dynamic)'
 
     LABEL = {"OK": "OK   ", "SKIP": "SKIP ", "FLAKY": "FLAKY", "ABETTER": "BETTER",
@@ -2712,15 +2233,14 @@ def progress(total=None):
     def record(s, status, info, total=None):
         if isinstance(info, str):
             info = [info]
-        # a subprocess timeout surfaces as a DIFF whose err carries the marker;
-        # promote it to its own TIMEOUT class so it's easy to triage.
+
         if status == "DIFF" and any("[abdiff: TIMEOUT]" in ln for ln in info):
             status = "TIMEOUT"
         with rec_lock:
             counts[status] = counts.get(status, 0) + 1
             done[0] += 1
-            if status not in ("OK", "SKIP"):   # a finding: print it + log it
-                sys.stdout.write("\r")          # clear the progress line
+            if status not in ("OK", "SKIP"):
+                sys.stdout.write("\r")
                 print(f"{LABEL.get(status, status)} {s.name}  [#{done[0]}]")
                 for line in info:
                     print(line)
@@ -2736,7 +2256,7 @@ def record(s, status, info, total=None):
     def worker(s):
         try:
             return run_scenario(s, workroot)
-        except Exception as ex:        # never let one scenario kill the pool
+        except Exception as ex:
             return ("ERROR", [f"  exception: {ex!r}"])
 
     def summary_line(prefix):
@@ -2771,8 +2291,6 @@ def summary_line(prefix):
         logf.close()
         return 1 if (counts['DIFF'] or counts['TIMEOUT'] or counts['ERROR']) else 0
 
-    # --loop: run the fixed sweeps first, then an endless mixed stream of new
-    # randomized + systematic-combo scenarios, keeping the pool full.
     rnd = random.Random(args.seed)
     seen = set()
     mixed = _mixed_scenarios(rnd, seen)
@@ -2819,6 +2337,5 @@ def submit_one():
         logf.close()
     return 1 if counts['DIFF'] else 0
 
-
 if __name__ == "__main__":
     sys.exit(main())
diff --git a/testsuite/mkvariety.py b/testsuite/tools/make_fixture.py
old mode 100755
new mode 100644
similarity index 63%
rename from testsuite/mkvariety.py
rename to testsuite/tools/make_fixture.py
index dd8247786..6a4ffd324
--- a/testsuite/mkvariety.py
+++ b/testsuite/tools/make_fixture.py
@@ -1,54 +1,33 @@
 #!/usr/bin/env python3
-"""Generate a "variety tree" for manual inspection and ad-hoc rsync testing.
-
-Builds exactly the tree that rsyncfns.make_variety_tree() produces for the
-regression suite (every inode type rsync handles, with heavy symlink, perm,
-xattr, ACL, hard-link and -- as root -- ownership coverage), so you can drive
-rsync at it by hand. Transfer the transfer_root/ subdir; the escape/ links
-deliberately point up into the sibling above/ tree.
-
-Examples:
-    testsuite/mkvariety.py /tmp/vt
-    testsuite/mkvariety.py /tmp/vt --list
-    sudo testsuite/mkvariety.py /tmp/vt          # adds device nodes + owners
-    testsuite/mkvariety.py /tmp/vt --no-acls --depth 4
-
-    rsync -aHAX --specials --devices /tmp/vt/transfer_root/ /tmp/copy/
-    rsync -a --safe-links            /tmp/vt/transfer_root/ /tmp/copy2/
-"""
 
 import argparse
 import os
 import stat
-import sys
+import subprocess
 from pathlib import Path
 
 _HERE = os.path.dirname(os.path.abspath(__file__))
 
-
 def _resolve_rsync(opt):
-    """Find an rsync binary to probe xattr/ACL capability with."""
     if opt:
         return os.path.abspath(opt)
-    cand = os.path.join(os.path.dirname(_HERE), 'rsync')   # build-tree ./rsync
+    cand = os.path.join(os.path.dirname(_HERE), 'rsync')
     if os.path.exists(cand):
         return cand
     from shutil import which
     return which('rsync') or 'rsync'
 
-
 def _detect(flag, prober, default):
     if flag is not None:
         return flag
     try:
         return prober()
-    except Exception:
+    except (OSError, subprocess.SubprocessError):
         return default
 
-
 def list_tree(root):
     rootp = Path(root)
-    for dp, dns, fns in os.walk(root):       # followlinks=False
+    for dp, dns, fns in os.walk(root):
         dns.sort()
         for name in sorted(dns + fns):
             p = Path(dp) / name
@@ -56,22 +35,19 @@ def list_tree(root):
             tgt = ' -> ' + os.readlink(p) if stat.S_ISLNK(m) else ''
             print(f"{stat.filemode(m)} {p.relative_to(rootp)}{tgt}")
 
-
 def main():
-    ap = argparse.ArgumentParser(
-        description=__doc__,
-        formatter_class=argparse.RawDescriptionHelpFormatter)
-    ap.add_argument('target', help='directory to create (REMOVED first if it exists)')
+    ap = argparse.ArgumentParser(description='Create an rsync filesystem fixture')
+    ap.add_argument('target', help='directory to replace')
     ap.add_argument('--depth', type=int, default=8, help='backbone depth (default 8)')
     ap.add_argument('--seed', default='0x5A17',
-                    help='int seed for the fixed choices (default 0x5A17)')
+                    help='integer seed for the fixed choices (default 0x5A17)')
     ap.add_argument('--rsync', default=None,
                     help='rsync binary for xattr/ACL capability probes '
                          '(default: ./rsync in the build tree, else PATH rsync)')
     ap.add_argument('--list', action='store_true',
                     help='print a recursive listing of the tree afterwards')
     for cap, helptext in (('xattrs', 'user xattrs'), ('acls', 'POSIX ACLs'),
-                          ('devices', 'char/block device nodes (needs root)'),
+                          ('devices', 'character and block device nodes (needs root)'),
                           ('owners', 'mixed uid/gid (needs root)')):
         g = ap.add_mutually_exclusive_group()
         g.add_argument(f'--{cap}', dest=cap, action='store_true', default=None,
@@ -87,13 +63,11 @@ def main():
 
     rsync = _resolve_rsync(args.rsync)
 
-    # rsyncfns reads these at import time; set them before importing it.
     os.environ.setdefault('scratchdir', str(target.parent))
     os.environ.setdefault('srcdir', os.getcwd())
     os.environ.setdefault('TOOLDIR', os.path.dirname(rsync) or os.getcwd())
     os.environ.setdefault('RSYNC', rsync)
-    sys.path.insert(0, _HERE)
-    import rsyncfns as R
+    from ..harness import rsync as R
 
     caps = dict(
         with_xattrs=_detect(args.xattrs, R.xattrs_supported, False),
@@ -112,15 +86,11 @@ def main():
     print(f"  counts: {info['counts']}")
     print(f"  caps:   xattrs={caps['with_xattrs']} acls={caps['with_acls']} "
           f"devices={caps['with_devices']} owners={caps['with_owners']}")
-    if not caps['with_devices'] or not caps['with_owners']:
-        print("  (run as root to add device nodes and mixed ownership)")
-    print(f"\ntransfer this:  {tr}/")
-    print(f"e.g.  rsync -aHAX --specials --devices {tr}/ /tmp/copy/")
+    print(f'transfer root: {tr}/')
 
     if args.list:
         print()
         list_tree(target)
 
-
 if __name__ == '__main__':
     main()
diff --git a/testsuite/unsafe-links_test.py b/testsuite/unsafe-links_test.py
deleted file mode 100644
index 311982f88..000000000
--- a/testsuite/unsafe-links_test.py
+++ /dev/null
@@ -1,82 +0,0 @@
-#!/usr/bin/env python3
-# Python rewrite of testsuite/unsafe-links.test.
-#
-# Verifies the three relevant policies for "unsafe" (escape-the-tree) symlinks:
-#   * default -a copies them as symlinks (no special handling),
-#   * --copy-links materialises ALL symlinks as files,
-#   * --copy-unsafe-links materialises only the unsafe ones, leaving safe
-#     in-tree symlinks as symlinks.
-
-import os
-
-from rsyncfns import TMPDIR, is_a_link, rmtree, run_rsync, test_fail
-
-
-def assert_symlink(path, target):
-    if not is_a_link(path):
-        test_fail(f"File {path} is not a symlink")
-    actual = os.readlink(path)
-    if actual != target:
-        test_fail(f"symlink {path} target is {actual!r}, expected {target!r}")
-
-
-def assert_regular(path):
-    if not os.path.isfile(path):
-        test_fail(f"File {path} is not regular file or not exists")
-
-
-os.chdir(TMPDIR)
-
-os.mkdir("from")
-os.mkdir("from/safe")
-os.mkdir("from/unsafe")
-os.mkdir("from/safe/files")
-os.mkdir("from/safe/links")
-
-open("from/safe/files/file1", "w").close()
-open("from/safe/files/file2", "w").close()
-open("from/unsafe/unsafefile", "w").close()
-
-os.symlink("../files/file1", "from/safe/links/file1")
-os.symlink("../files/file2", "from/safe/links/file2")
-os.symlink("../../unsafe/unsafefile", "from/safe/links/unsafefile")
-
-
-print("rsync with relative path and just -a")
-run_rsync('-avv', 'from/safe/', 'to')
-assert_symlink("to/links/file1", "../files/file1")
-assert_symlink("to/links/file2", "../files/file2")
-assert_symlink("to/links/unsafefile", "../../unsafe/unsafefile")
-
-print("rsync with relative path and -a --copy-links")
-run_rsync('-avv', '--copy-links', 'from/safe/', 'to')
-assert_regular("to/links/file1")
-assert_regular("to/links/file2")
-assert_regular("to/links/unsafefile")
-
-print("rsync with relative path and --copy-unsafe-links")
-run_rsync('-avv', '--copy-unsafe-links', 'from/safe/', 'to')
-assert_symlink("to/links/file1", "../files/file1")
-assert_symlink("to/links/file2", "../files/file2")
-assert_regular("to/links/unsafefile")
-
-rmtree("to")
-print("rsync with relative2 path")
-# Mirror the shell `(cd from; rsync ... safe/ ../to)` subshell — chdir, rsync,
-# then chdir back so the final block uses an absolute source again.
-saved = os.getcwd()
-os.chdir("from")
-try:
-    run_rsync('-avv', '--copy-unsafe-links', 'safe/', '../to')
-finally:
-    os.chdir(saved)
-assert_symlink("to/links/file1", "../files/file1")
-assert_symlink("to/links/file2", "../files/file2")
-assert_regular("to/links/unsafefile")
-
-rmtree("to")
-print("rsync with absolute path")
-run_rsync('-avv', '--copy-unsafe-links', f'{os.getcwd()}/from/safe/', 'to')
-assert_symlink("to/links/file1", "../files/file1")
-assert_symlink("to/links/file2", "../files/file2")
-assert_regular("to/links/unsafefile")
diff --git a/testsuite/valgrind.supp b/testsuite/valgrind.supp
deleted file mode 100644
index ddaefd086..000000000
--- a/testsuite/valgrind.supp
+++ /dev/null
@@ -1,48 +0,0 @@
-# Valgrind suppressions for the rsync test suite.
-#
-# Every stanza here is a known-benign report, not a defect in rsync's own
-# logic.  They are suppressed so that a --valgrind run fails only on a *real*
-# error.  Pass to valgrind with --suppressions=testsuite/valgrind.supp
-# (runtests.py --valgrind does this automatically).
-#
-# The valgrind CI gate runs with --leak-check=no and so checks memory *errors*
-# only: rsync intentionally leaves file-list/socket/option memory unfreed at
-# exit, which makes a full leak check inherently noisy.  The two Memcheck:Leak
-# stanzas below therefore only matter for a manual leak audit (--leak-check=
-# full); they cover the two leaks that are not rsync's own at-exit slack.
-
-# popt alias strings are strdup'd while parsing arguments and only reclaimed
-# at process exit.  One-time, bounded, unreachable-at-exit; bundled popt.
-{
-   rsync-popt-alias-leak
-   Memcheck:Leak
-   match-leak-kinds: definite
-   fun:malloc
-   fun:my_alloc
-   fun:my_strdup
-   fun:popt_unalias
-   fun:parse_arguments
-   fun:main
-}
-
-# libxxhash returns an internally-aligned XXH3 state whose pointer is offset
-# from the malloc base, so valgrind sees only an interior pointer and reports
-# the one-time checksum state as "possibly lost".  Alignment artifact.
-{
-   xxhash-createstate-aligned
-   Memcheck:Leak
-   match-leak-kinds: possible
-   fun:malloc
-   fun:XXH3_createState
-}
-
-# libfakeroot's own SysV message padding in send_fakem(); the uninitialised
-# bytes are inside libfakeroot's mtext buffer, not rsync memory.
-{
-   fakeroot-msgsnd-padding
-   Memcheck:Param
-   msgsnd(msgp->mtext)
-   fun:msgsnd
-   ...
-   obj:*libfakeroot*
-}
diff --git a/testsuite/write-batch-filter-injection_test.py b/testsuite/write-batch-filter-injection_test.py
deleted file mode 100644
index 081a02df6..000000000
--- a/testsuite/write-batch-filter-injection_test.py
+++ /dev/null
@@ -1,54 +0,0 @@
-#!/usr/bin/env python3
-# Regression test: the generated --write-batch replay script writes filter rules
-# into a `<<'#E#'` here-doc, one rule per line.  A filter pattern that contains
-# an embedded newline followed by a line equal to the here-doc terminator "#E#"
-# could close the here-doc early and turn the remaining pattern bytes into shell
-# commands in the replay .sh.  Command-line --filter/--exclude/--include keep an
-# embedded newline (no word-splitting), and such a pattern can also come from a
-# NUL-separated --exclude-from in an untrusted tree.  The batch writer must refuse
-# a newline-bearing pattern (fail-closed) so no injectable script is produced.
-
-import os
-import subprocess
-
-from rsyncfns import SCRATCHDIR, rmtree, run_rsync, test_fail
-
-base = SCRATCHDIR / 'wb-filter-inj'
-rmtree(base)
-src = base / 'src'
-src.mkdir(parents=True)
-(src / 'keep').write_text("hello\n")
-
-# Relative sentinel path so a fired injection lands here, where we run the .sh.
-os.chdir(base)
-sentinel = base / 'PWNED_FILTER'
-if sentinel.exists():
-    sentinel.unlink()
-
-# A single filter rule whose pattern embeds:  <newline> #E# <newline> touch ...
-# Pre-fix this renders as
-#     - keep
-#     #E#
-#     touch PWNED_FILTER
-# inside the here-doc, so the "#E#" line closes it early and the touch runs as a
-# shell command when the replay script is executed.
-evil = "- keep\n#E#\ntouch PWNED_FILTER"
-
-# check=False: the fixed binary refuses (exits non-zero) and the transfer itself
-# may not complete; we judge solely by whether the injection can fire.
-run_rsync('-a', '--write-batch=B', f'--filter={evil}', 'src/', 'dest/', check=False)
-
-batch_sh = base / 'B.sh'
-if batch_sh.exists():
-    # The replay script must not, when run, execute the injected command.
-    subprocess.run(['sh', 'B.sh'],
-                   stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL,
-                   cwd=str(base), env=os.environ.copy())
-
-if sentinel.exists():
-    script = batch_sh.read_text() if batch_sh.exists() else '<no script>'
-    test_fail("a newline in a filter rule forged the here-doc terminator and "
-              f"injected a shell command into the replay script:\n{script}")
-
-print("write-batch-filter-injection: a newline-bearing filter rule cannot "
-      "inject into the replay script")
diff --git a/testsuite/write-batch-quoting_test.py b/testsuite/write-batch-quoting_test.py
deleted file mode 100644
index 38aaebdf4..000000000
--- a/testsuite/write-batch-quoting_test.py
+++ /dev/null
@@ -1,54 +0,0 @@
-#!/usr/bin/env python3
-# Regression test: the generated --write-batch replay script must single-quote
-# every argument -- including an arg that starts with '-' and contains '=' (the
-# write_arg "--opt=" split) -- so shell metacharacters in a path (backtick or
-# $(...) command substitution, redirection, newline, ...) cannot execute when
-# the .sh is run.
-
-import os
-import subprocess
-
-from rsyncfns import SCRATCHDIR, rmtree, run_rsync, test_fail
-
-base = SCRATCHDIR / 'wb-quoting'
-rmtree(base)
-src = base / 'src'
-src.mkdir(parents=True)
-(src / 'f').write_text("hello\n")
-
-# Relative paths so a fired substitution writes its sentinel here, where we run
-# the generated replay script.
-os.chdir(base)
-
-
-def check(label, dest_arg, sentinel_name, *extra):
-    sentinel = base / sentinel_name
-    if sentinel.exists():
-        sentinel.unlink()
-    # check=False: a '-'-leading dest after '--' makes the transfer itself fail,
-    # but write-batch still emits the .sh (the artifact we care about).
-    run_rsync('-a', '--write-batch=B', 'src/', *extra, dest_arg, check=False)
-    batch_sh = base / 'B.sh'
-    if not batch_sh.exists():
-        test_fail(f"{label}: write-batch did not generate the replay script")
-    script = batch_sh.read_text()
-    # Command substitution in any unquoted token fires during shell word
-    # expansion, independent of whether rsync itself runs.
-    subprocess.run(['sh', 'B.sh'],
-                   stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL,
-                   cwd=str(base), env=os.environ.copy())
-    if sentinel.exists():
-        test_fail(f"{label}: metacharacters executed when the replay script ran:\n{script}")
-
-
-# Backtick command substitution in a bare path token (the value-quoting path).
-# The body uses only `backtick` and `>` -- neither in the old quote-trigger set.
-check("bare-path", 'd`>PWNED`x/', 'PWNED')
-
-# Command substitution in the prefix before '=' of a '-'-leading destination,
-# passed after '--' (exercises the write_arg "--opt=" split). Here `$(` and `)`
-# would be caught by value-quoting, but the prefix bytes bypass it unless the
-# whole arg is quoted.
-check("dash-eq-prefix", '-x$(>PWNED2)=y/', 'PWNED2', '--')
-
-print("write-batch-quoting: shell metacharacters in batch paths stay quoted")
diff --git a/testsuite/xattrs-hlink_test.py b/testsuite/xattrs-hlink_test.py
deleted file mode 120000
index faae7b39c..000000000
--- a/testsuite/xattrs-hlink_test.py
+++ /dev/null
@@ -1 +0,0 @@
-xattrs_test.py
\ No newline at end of file