feat: complete session preferences and PAM fixture gates

legacy/go/auth/faillock.go

@@ -1,7 +1,3 @@
-// auth — faillock integration.
-//
-// Reads /etc/security/faillock.conf for deny count, executes
-// faillock --user to get tally, supports --reset via admin bypass.
 package auth
 
 import (

legacy/go/auth/pam.go

@@ -1,9 +1,4 @@
-// auth — PAM authentication with CGO bindings.
-//
-// Uses runtime.LockOSThread to prevent goroutine migration during
-// PAM transactions, as PAM modules rely on thread-local storage.
-//
-// Mirrors vendor/src/auth/pam.rs and vendor/src/auth/mod.rs.
+// Keep each PAM transaction on one OS thread. PAM modules can use thread-local state.
 package auth
 
 /*
@@ -12,11 +7,11 @@ package auth
 #include <stdlib.h>
 #include <stdint.h>
 
-// Match the //export-generated signature.
+// Match the signature that cgo generates for //export.
 extern int latchd_pam_conv(int, struct pam_message **,
                             struct pam_response **, void *);
 
-// Store a uintptr_t handle in C heap so the Go GC never sees a Go pointer.
+// Store the numeric handle in C memory. Do not pass a Go pointer to PAM.
 static void *storeHandle(uintptr_t h) {
 	uintptr_t *p = malloc(sizeof(uintptr_t));
 	if (p) *p = h;

legacy/go/auth/utmpx.go

@@ -1,6 +1,3 @@
-// auth — UTMPX user accounting (glibc only).
-//
-// Mirrors vendor/src/auth/utmpx.rs.
 package auth
 
 /*

legacy/go/auth/utmpx_time.h

@@ -1,7 +1,4 @@
-// Helper: assign seconds + microseconds to utmpx's ut_tv field.
-// The C compiler handles the type conversion, so this works whether
-// ut_tv is struct timeval (long tv_sec/tv_usec) or the compat struct
-// (__uint32_t tv_sec / __int32_t tv_usec).
+// Let the C compiler convert values for either native or compatibility ut_tv fields.
 
 #include <stdint.h>
 static inline void latchd_set_utmpx_time(struct utmpx *ut, int64_t sec, int32_t usec) {