Merge feat/p7-times: Phase 7 Wave D (real dir/symlink time preservation making -O/-J meaningful; secluded-args -> Impossible/Divergence; PROTOCOL 2.17.0)

src/shared/config.h

@@ -543,8 +543,28 @@ typedef struct Config {
  * new trailing bytes would desynchronize on the frame boundary, and the strict
  * same-version handshake (config_receive rejects a mismatched version before
  * parsing anything else) is what keeps a 2.16 client and a 2.15 server from
- * ever reaching that state. */
-#define PROTOCOL_VERSION "2.16.0"
+ * ever reaching that state.
+ *
+ * Times Wave (P7 Wave D): 2.16.0 -> 2.17.0.
+ *
+ * WHY the bump, grounded in the wire: this wave makes -O/--omit-dir-times and
+ * -J/--omit-link-times REAL by adding directory and symlink time preservation.
+ * The config-frame LAYOUT is unchanged (the omit flags already crossed the
+ * wire), but the FRAME STREAM gains a new terminal frame: after all file data
+ * and the optional delete manifest, the sender transmits STATUS_DIR_TIMES
+ * frame(s) (each a count followed by (path, metadata) pairs, chunked so no
+ * frame exceeds the receiver's MAX_MANIFEST_ENTRIES bound) carrying every
+ * source directory's captured times, so the receiver can apply them AFTER all of a
+ * directory's children have been written (writing a child bumps the parent's
+ * mtime).  Symlink entries already carry their metadata on the STATUS_SYMLINK
+ * frame; the receiver now applies it (utimensat/lchown with
+ * AT_SYMLINK_NOFOLLOW) unless -J is set.  Any change to the frame sequence must
+ * bump the protocol version: a 2.16 peer that does not know STATUS_DIR_TIMES
+ * would desynchronize on the unknown frame, and the strict same-version
+ * handshake (config_receive rejects a mismatched version before parsing
+ * anything else) is what keeps a 2.17 client and a 2.16 server from ever
+ * reaching that state. */
+#define PROTOCOL_VERSION "2.17.0"
 #define DEFAULT_CHUNK_SIZE (10 * 1024 * 1024)
 /* Upper bound on total basis-dir entries (rsync caps --link-dest at 20). */
 #define MAX_BASIS_DIRS 64

src/shared/file.c

@@ -149,6 +149,7 @@ File* file_create(const char* path) {
   file->metadata = NULL;
   file->skip = false;
   file->is_dir = false;
+  file->dir_time_only = false;
   file->basis_link = NULL;
   file->link_group = 0;
   file->link_first = false;

src/shared/file_receive.c

@@ -551,6 +551,18 @@ FileSaveResult file_save_to_disk_full(const char* root_directory, const File* fi
     return FILE_SAVE_ERROR;
   }
 
+  /* P7 Wave D #1: a STATUS_DIR_TIMES entry is RECORD-ONLY.  The scanner
+     captures every traversed directory -- including empty ones whose parents
+     were never created by a child write and directories pruned by
+     -m/--prune-empty-dirs.  Creating them here would resurrect empty
+     directories (an -a behavior change) and could abort the whole transfer on a
+     pre-existing regular file/symlink at the mirror path.  Short-circuit before
+     any device/write-devices/directory branch and report it as skipped so the
+     sink still accumulates its metadata for the deferred DirTimeList
+     application, but create nothing. */
+  if (file->dir_time_only)
+    return FILE_SAVE_SKIPPED;
+
   /* Device/special node (--devices/--specials): recreate the node instead of
      writing content (privilege-gated, confined, rdev-validated). */
   if (file->is_special)
@@ -621,6 +633,12 @@ FileSaveResult file_save_to_disk_full(const char* root_directory, const File* fi
     }
     ok = file_symlink_at_secure(link_path, target);
     free(target);
+    /* P7 Wave D: apply the symlink's own metadata with no-follow primitives
+       (utimensat/lchown/fchmodat AT_SYMLINK_NOFOLLOW).  -J/--omit-link-times
+       suppresses the timestamps; ownership stays gated by the identity policy.
+       A symlink has no children, so this can be applied immediately. */
+    if (ok && config && config->use_metadata)
+      file_restore_symlink_metadata(link_path, file->metadata, config->omit_link_times);
     free(link_path);
     return ok ? FILE_SAVE_WRITTEN : FILE_SAVE_ERROR;
   }
@@ -2137,12 +2155,119 @@ File* file_receive(const Config* config, int file_descriptor) {
   return file;
 }
 
+/* ---- P7 Wave D: deferred directory times ---- */
+
+void dir_time_list_init(DirTimeList* list) {
+  if (!list)
+    return;
+  list->paths = NULL;
+  list->entries = NULL;
+  list->count = 0;
+  list->capacity = 0;
+}
+
+void dir_time_list_free(DirTimeList* list) {
+  if (!list)
+    return;
+  for (size_t i = 0; i < list->count; i++)
+    free(list->paths[i]);
+  free(list->paths);
+  free(list->entries);
+  list->paths = NULL;
+  list->entries = NULL;
+  list->count = 0;
+  list->capacity = 0;
+}
+
+bool dir_time_list_add(DirTimeList* list, const char* wire_path, const FileMetadata* metadata) {
+  if (!list || !wire_path || !metadata)
+    return true; /* nothing to remember; never a hard error */
+  if (list->count == list->capacity) {
+    size_t new_capacity = list->capacity == 0 ? 16 : list->capacity * 2;
+    if (new_capacity < list->capacity)
+      return false;
+    /* Assign each grown array as soon as its realloc succeeds: the old block is
+       already freed by then, so discarding the pointer would dangle.  capacity
+       is advanced only after BOTH reallocs succeed, so a partial failure leaves
+       capacity no larger than the entries allocation (the paths array may be
+       over-allocated, which is harmless) -- never a mismatched list the next
+       add could write past. */
+    char** grown_paths = realloc(list->paths, new_capacity * sizeof(char*));
+    if (!grown_paths)
+      return false;
+    list->paths = grown_paths;
+    FileMetadata* grown_entries = realloc(list->entries, new_capacity * sizeof(FileMetadata));
+    if (!grown_entries)
+      return false;
+    list->entries = grown_entries;
+    list->capacity = new_capacity;
+  }
+  char* copy = str_dup(wire_path);
+  if (!copy)
+    return false;
+  list->paths[list->count] = copy;
+  list->entries[list->count] = *metadata;
+  list->count++;
+  return true;
+}
+
+void dir_time_list_apply(const DirTimeList* list, const char* root_directory) {
+  if (!list || !root_directory)
+    return;
+  for (size_t i = 0; i < list->count; i++) {
+    char* dir_path = path_cat(root_directory, list->paths[i]);
+    if (!dir_path)
+      continue;
+    char* leaf = NULL;
+    /* The parent walk is fd-relative and O_NOFOLLOW, so a symlink planted in a
+       parent component can never redirect the utimensat outside the root. */
+    int parent_fd = file_open_secure_parent(dir_path, &leaf, false);
+    if (parent_fd < 0) {
+      free(dir_path);
+      continue;
+    }
+    /* A dir-time entry only records metadata: the directory is (deliberately)
+       not created from it, so an empty source directory (or one pruned by
+       -m/--prune-empty-dirs) may well not exist here.  Skip absent paths
+       QUIETLY rather than warning for every one, and apply the times only to a
+       real directory that does exist.  AT_SYMLINK_NOFOLLOW keeps a same-named
+       symlink from being followed; a pre-existing regular file/symlink is not a
+       directory, so it is left completely untouched. */
+    struct stat st;
+    if (fstatat(parent_fd, leaf, &st, AT_SYMLINK_NOFOLLOW) != 0 || !S_ISDIR(st.st_mode)) {
+      close(parent_fd);
+      free(leaf);
+      free(dir_path);
+      continue;
+    }
+    struct timespec times[2] = {
+        {.tv_sec = 0, .tv_nsec = UTIME_OMIT},
+        {.tv_sec = list->entries[i].mtime_sec, .tv_nsec = list->entries[i].mtime_nsec}};
+    if (list->entries[i].atime_valid) {
+      times[0].tv_sec = list->entries[i].atime_sec;
+      times[0].tv_nsec = list->entries[i].atime_nsec;
+    }
+    if (utimensat(parent_fd, leaf, times, AT_SYMLINK_NOFOLLOW) != 0) {
+      char* escaped_path = output_escape(dir_path, log_get_8_bit_output());
+      log_message(LOG_LEVEL_WARNING, "Failed to set directory timestamps on %s: %s",
+                  escaped_path ? escaped_path : "<allocation failed>", strerror(errno));
+      free(escaped_path);
+    }
+    close(parent_fd);
+    free(leaf);
+    free(dir_path);
+  }
+}
+
 /* Receive an explicit directory entry (--dirs): a STATUS_MKDIR frame carries
-   only the destination path; the entry carries no payload.  The same path
-   validation as a regular file applies (non-empty, relative-or-mirrored, no
-   traversal), and the created File is routed through the regular store_file
-   sink so single-threaded and -m receivers handle directories identically. */
-File* file_receive_directory(int file_descriptor) {
+   the destination path and, when metadata is negotiated, the directory's
+   metadata frame.  The same path validation as a regular file applies
+   (non-empty, relative-or-mirrored, no traversal), and the created File is
+   routed through the regular store_file sink so single-threaded and -m
+   receivers handle directories identically.  The metadata is NOT applied here:
+   the sink accumulates it into a DirTimeList that is applied only after the
+   whole transfer (children would otherwise clobber the directory mtime). */
+File* file_receive_directory(int file_descriptor, const Config* config) {
   char* path = receive_wire_str(file_descriptor);
   if (path == NULL)
     return NULL;
@@ -2159,6 +2284,50 @@ File* file_receive_directory(int file_descriptor) {
   if (file == NULL)
     return NULL;
   file->is_dir = true;
+  if (config && config->use_metadata) {
+    int meta_ok = 1;
+    file->metadata = metadata_receive(file_descriptor, &meta_ok);
+    if (!meta_ok) {
+      file_destroy(file);
+      return NULL;
+    }
+  }
+  return file;
+}
+
+/* Receive one directory-time entry from a STATUS_DIR_TIMES frame: the
+ * destination-relative wire path and (when metadata is negotiated) the
+ * directory's metadata frame.  The created File is an is_dir, dir_time_only
+ * entry routed through the regular store_file sink: the sink records its
+ * metadata into the deferred DirTimeList but never creates the directory (the
+ * scanner captures every traversed directory, including empty ones).  Unlike a
+ * STATUS_MKDIR entry, this one must not create anything. */
+File* file_receive_dir_time(int file_descriptor, const Config* config) {
+  char* path = receive_wire_str(file_descriptor);
+  if (path == NULL)
+    return NULL;
+  if (path[0] == '\0' || (!file_get_trust_sender() && has_path_traversal(path))) {
+    char* escaped_path = output_escape(path, log_get_8_bit_output());
+    log_message(LOG_LEVEL_ERROR, "Invalid received directory-time path: %s",
+                escaped_path ? escaped_path : "<allocation failed>");
+    free(escaped_path);
+    free(path);
+    return NULL;
+  }
+  File* file = file_create(path);
+  free(path);
+  if (!file)
+    return NULL;
+  file->is_dir = true;
+  file->dir_time_only = true;
+  if (config && config->use_metadata) {
+    int meta_ok = 1;
+    file->metadata = metadata_receive(file_descriptor, &meta_ok);
+    if (!meta_ok) {
+      file_destroy(file);
+      return NULL;
+    }
+  }
   return file;
 }
 

src/shared/file_receive.h

@@ -8,13 +8,40 @@
 /* Server-side file receive/save path. */
 
 File* file_receive(const Config* config, int file_descriptor);
-File* file_receive_directory(int file_descriptor);
+File* file_receive_directory(int file_descriptor, const Config* config);
+File* file_receive_dir_time(int file_descriptor, const Config* config);
 File* file_receive_hardlink(int file_descriptor);
 File* file_receive_symlink(int file_descriptor, const Config* config);
 File* file_receive_special(int file_descriptor);
 bool file_special_rdev_valid(int32_t major, int32_t minor, mode_t mode);
 File* receive_incremental_check(int fd, const Config* config, bool* skipped);
 
+/* P7 Wave D directory-time accumulator.  The receiver collects the metadata of
+ * every directory it creates/receives (STATUS_MKDIR with metadata and/or the
+ * trailing STATUS_DIR_TIMES frame(s)) and applies the times only at the END of the
+ * transfer, after all children have been written and after the delete /
+ * --delay-updates phases have committed (writing or removing a child bumps the
+ * parent's mtime).  -O/--omit-dir-times skips the application entirely.  The
+ * list owns deep copies of the paths and metadata; freed on every path. */
+typedef struct {
+  char** paths;          /* owned, destination-relative wire paths */
+  FileMetadata* entries; /* owned, parallel to paths */
+  size_t count;
+  size_t capacity;
+} DirTimeList;
+
+void dir_time_list_init(DirTimeList* list);
+void dir_time_list_free(DirTimeList* list);
+/* Deep-copy one directory's path + metadata into the list.  Returns false on
+ * allocation failure (the caller fails the transfer). */
+bool dir_time_list_add(DirTimeList* list, const char* wire_path, const FileMetadata* metadata);
+/* Apply every accumulated directory's mtime (and atime when captured) beneath
+ * `root_directory`, confined fd-relative.  Best-effort per entry: an absent
+ * directory (an empty/pruned source dir that was deliberately not created) or a
+ * non-directory at the path is skipped QUIETLY, an unreachable one with a
+ * warning, and never fatal. */
+void dir_time_list_apply(const DirTimeList* list, const char* root_directory);
+
 /* A received delete-manifest frame: the keep-set (`keeps`, destination-relative
    paths the sender transferred/keeps) plus `protected`, destination-relative
    prefixes the sender asks the receiver never to delete (paths excluded on the

src/shared/file_types.h

@@ -42,6 +42,14 @@ typedef struct {
   /* True when this entry is an explicit directory entry (--dirs mode): the
    * receiver creates the directory instead of writing a regular file. */
   bool is_dir;
+  /* Receiver-only (P7 Wave D): this is a STATUS_DIR_TIMES entry.  It carries a
+   * traversed source directory's metadata for DEFERRED application, but must
+   * NEVER create the directory: the scanner captures every traversed directory
+   * (including empty ones whose parents no child write created), so creation
+   * would resurrect the empty dirs that FastSync deliberately never transfers.
+   * file_save_to_disk_full short-circuits such an entry as FILE_SAVE_SKIPPED,
+   * and the sink still accumulates the metadata into its DirTimeList. */
+  bool dir_time_only;
   /* Receiver-only, --link-dest: when set, install the destination entry as a
    * hard link to this absolute (root-confined) path instead of writing
    * `data`.  The matching code has already verified the link target's content

src/shared/identity.c

@@ -2,6 +2,7 @@
 #include "log.h"
 #include "utils.h"
 #include <errno.h>
+#include <fcntl.h>
 #include <grp.h>
 #include <limits.h>
 #include <pwd.h>
@@ -370,16 +371,11 @@ static bool identity_map_lookup(const IdentityMap* map, int count, int32_t sourc
   return false;
 }
 
-void identity_apply_ownership(int fd, int32_t source_uid, int32_t source_gid) {
-  /* Ownership application is OFF unless the client requested an identity flag.
-   * This is the controlled gate: a default (or plain -M) transfer never changes
-   * ownership, byte-for-byte preserving FastSync's existing behavior. */
-  if (!identity_active_enabled() || fd < 0)
-    return;
-  struct stat st;
-  if (fstat(fd, &st) != 0)
-    return;
-
+/* Resolve the target ownership from the negotiated policy against the entry's
+ * current stat.  Shared by the fd (regular file) and no-follow (symlink) apply
+ * paths.  Returns false when no side is to be changed. */
+static bool identity_resolve_targets(const struct stat* st, int32_t source_uid, int32_t source_gid,
+                                     uid_t* out_uid, gid_t* out_gid) {
   bool set_uid = false;
   bool set_gid = false;
   uid_t uid = 0;
@@ -431,29 +427,62 @@ void identity_apply_ownership(int fd, int32_t source_uid, int32_t source_gid) {
   }
 
   if (!set_uid && !set_gid)
-    return;
+    return false;
   /* An unset side keeps the file's current id so the other side can change. */
   if (!set_uid)
-    uid = st.st_uid;
+    uid = st->st_uid;
   if (!set_gid)
-    gid = st.st_gid;
+    gid = st->st_gid;
+  /* Only change ownership when the target differs (avoid needless syscalls and
+   * any chance of clearing setuid/setgid on an already-correct entry). */
+  if (st->st_uid == uid && st->st_gid == gid)
+    return false;
+  *out_uid = uid;
+  *out_gid = gid;
+  return true;
+}
 
-  /* Only call fchown when the target differs (avoid needless syscalls and any
-   * chance of clearing setuid/setgid on an already-correct file). */
-  if (st.st_uid == uid && st.st_gid == gid)
+static void identity_log_chown_failure(const char* what, uid_t uid, gid_t gid) {
+  /* EPERM/EACCES are expected when the receiver is not privileged (e.g. the CI
+   * `nobody` user): warn and continue, never abort the transfer.  Any other
+   * error (EIO/EROFS/ENOSPC/...) is a real failure and must not be silently
+   * downgraded to a warning. */
+  if (errno == EPERM || errno == EACCES)
+    log_message(LOG_LEVEL_WARNING, "could not apply ownership (uid=%ld gid=%ld): %s; leaving as-is",
+                (long)uid, (long)gid, strerror(errno));
+  else
+    log_message(LOG_LEVEL_ERROR, "failed to apply ownership on %s (uid=%ld gid=%ld): %s", what,
+                (long)uid, (long)gid, strerror(errno));
+}
+
+void identity_apply_ownership(int fd, int32_t source_uid, int32_t source_gid) {
+  /* Ownership application is OFF unless the client requested an identity flag.
+   * This is the controlled gate: a default (or plain -M) transfer never changes
+   * ownership, byte-for-byte preserving FastSync's existing behavior. */
+  if (!identity_active_enabled() || fd < 0)
     return;
+  struct stat st;
+  if (fstat(fd, &st) != 0)
+    return;
+  uid_t uid;
+  gid_t gid;
+  if (!identity_resolve_targets(&st, source_uid, source_gid, &uid, &gid))
+    return;
+  if (fchown(fd, uid, gid) != 0)
+    identity_log_chown_failure("file", uid, gid);
+}
 
-  if (fchown(fd, uid, gid) != 0) {
-    /* EPERM/EACCES are expected when the receiver is not privileged (e.g. the
-     * CI `nobody` user): warn and continue, never abort the transfer.  Any
-     * other error (EIO/EROFS/ENOSPC/...) is a real failure and must not be
-     * silently downgraded to a warning. */
-    if (errno == EPERM || errno == EACCES)
-      log_message(LOG_LEVEL_WARNING,
-                  "could not apply ownership (uid=%ld gid=%ld): %s; leaving as-is", (long)uid,
-                  (long)gid, strerror(errno));
-    else
-      log_message(LOG_LEVEL_ERROR, "failed to apply ownership (uid=%ld gid=%ld): %s", (long)uid,
-                  (long)gid, strerror(errno));
-  }
-}
+void identity_apply_ownership_link(int parent_fd, const char* leaf, int32_t source_uid,
+                                   int32_t source_gid) {
+  if (!identity_active_enabled() || parent_fd < 0 || !leaf)
+    return;
+  struct stat st;
+  if (fstatat(parent_fd, leaf, &st, AT_SYMLINK_NOFOLLOW) != 0)
+    return;
+  uid_t uid;
+  gid_t gid;
+  if (!identity_resolve_targets(&st, source_uid, source_gid, &uid, &gid))
+    return;
+  if (fchownat(parent_fd, leaf, uid, gid, AT_SYMLINK_NOFOLLOW) != 0)
+    identity_log_chown_failure("symlink", uid, gid);
+}

src/shared/identity.h

@@ -55,6 +55,13 @@ bool identity_active_enabled(void);
  * never fatal (rsync parity: the transfer must not abort). */
 void identity_apply_ownership(int fd, int32_t source_uid, int32_t source_gid);
 
+/* P7 Wave D: the no-follow (symlink) counterpart.  Resolves the same
+ * usermap/groupmap/chown/numeric-ids policy but applies it with
+ * fchownat(..., AT_SYMLINK_NOFOLLOW) so a symlink's own ownership is changed
+ * without ever dereferencing it.  A no-op unless an identity flag is active. */
+void identity_apply_ownership_link(int parent_fd, const char* leaf, int32_t source_uid,
+                                   int32_t source_gid);
+
 /* Receiver-side wire validation of the resolved identity fields. */
 bool identity_wire_valid(const Config* config);
 

src/shared/metadata.c

@@ -357,6 +357,43 @@ void file_restore_metadata(const char* path, const FileMetadata* metadata,
   }
 }
 
+void file_restore_symlink_metadata(const char* path, const FileMetadata* metadata,
+                                   bool omit_link_times) {
+  if (path == NULL || metadata == NULL)
+    return;
+  char* leaf = NULL;
+  int parent_fd = file_open_secure_parent(path, &leaf, false);
+  if (parent_fd < 0)
+    return;
+  /* Ownership (only when the identity policy is active) via lchown semantics:
+     fchownat with AT_SYMLINK_NOFOLLOW never dereferences the link. */
+  identity_apply_ownership_link(parent_fd, leaf, (int32_t)metadata->uid, (int32_t)metadata->gid);
+  /* Symlink mode: not settable on Linux (fchmodat AT_SYMLINK_NOFOLLOW returns
+     EOPNOTSUPP/ENOTSUP); attempt it for platforms that support it and quietly
+     ignore the unsupported case so the transfer never fails over it. */
+  mode_t link_mode = metadata->mode & 0777;
+  if (fchmodat(parent_fd, leaf, link_mode, AT_SYMLINK_NOFOLLOW) != 0 && errno != EOPNOTSUPP &&
+      errno != ENOTSUP && errno != ENOSYS) {
+    log_message(LOG_LEVEL_DEBUG, "Could not set symlink mode on %s: %s", path, strerror(errno));
+  }
+  if (!omit_link_times) {
+    struct timespec times[2] = {{.tv_sec = 0, .tv_nsec = UTIME_OMIT},
+                                {.tv_sec = metadata->mtime_sec, .tv_nsec = metadata->mtime_nsec}};
+    if (metadata->atime_valid) {
+      times[0].tv_sec = metadata->atime_sec;
+      times[0].tv_nsec = metadata->atime_nsec;
+    }
+    if (utimensat(parent_fd, leaf, times, AT_SYMLINK_NOFOLLOW) != 0) {
+      char* escaped_path = output_escape(path, log_get_8_bit_output());
+      log_message(LOG_LEVEL_WARNING, "Failed to set symlink timestamps on %s: %s",
+                  escaped_path ? escaped_path : "<allocation failed>", strerror(errno));
+      free(escaped_path);
+    }
+  }
+  close(parent_fd);
+  free(leaf);
+}
+
 bool file_restore_metadata_fd(int fd, const FileMetadata* metadata, bool preserve_executability) {
   if (fd < 0 || metadata == NULL)
     return metadata == NULL;

src/shared/metadata.h

@@ -39,6 +39,14 @@ FileMetadata* metadata_receive(int file_descriptor, int* ok);
 void file_restore_metadata(const char* path, const FileMetadata* metadata,
                            bool preserve_executability);
 bool file_restore_metadata_fd(int fd, const FileMetadata* metadata, bool preserve_executability);
+/* P7 Wave D: apply a SYMLINK's own metadata using no-follow primitives only
+ * (utimensat/lchown/fchmodat with AT_SYMLINK_NOFOLLOW), confined fd-relative
+ * under the authorized root.  `omit_link_times` (-J/--omit-link-times)
+ * suppresses the timestamps; the link's mode/ownership are still attempted
+ * (ownership stays gated by the identity policy and by default is not applied).
+ * A null metadata or an unfollowable parent is a harmless no-op. */
+void file_restore_symlink_metadata(const char* path, const FileMetadata* metadata,
+                                   bool omit_link_times);
 
 /* Compare timestamps using rsync's whole-second modification window. */
 bool metadata_mtime_matches(time_t left_sec, long left_nsec, time_t right_sec, long right_nsec,

src/shared/multiprocessing.c

@@ -39,7 +39,14 @@ PipelineContextSender* pipeline_context_sender_create(Config* config, Queue* que
   atomic_init(&context->cancelled, false);
   protocol_session_init(&context->allocation_session, -1, -1);
   protocol_session_set_max_alloc(&context->allocation_session, config->max_alloc);
+  context->dir_entries = NULL;
+  context->dir_entries_mutex_init = false;
   int init = 0;
+  if (config->use_metadata) {
+    context->dir_entries = array_list_create(file_destroy);
+    if (!context->dir_entries)
+      goto fail;
+  }
   if (mtx_init(&context->mutex_scanner, mtx_plain) != thrd_success)
     goto fail;
   init++;
@@ -62,10 +69,17 @@ PipelineContextSender* pipeline_context_sender_create(Config* config, Queue* que
     goto fail;
   // cppcheck-suppress unreadVariable
   init++;
+  if (mtx_init(&context->dir_entries_mutex, mtx_plain) != thrd_success)
+    goto fail;
+  context->dir_entries_mutex_init = true;
   return context;
 
 fail:
   log_perror("Error initializing synchronization objects");
+  if (context->dir_entries_mutex_init)
+    mtx_destroy(&context->dir_entries_mutex);
+  if (context->dir_entries)
+    array_list_delete(context->dir_entries);
   if (init >= 6)
     cnd_destroy(&context->condition_not_empty_loader);
   if (init >= 5)
@@ -92,6 +106,10 @@ void pipeline_context_sender_destroy(PipelineContextSender* context) {
     array_list_delete(context->missing_args);
   if (context->remove_source_files)
     array_list_delete(context->remove_source_files);
+  if (context->dir_entries)
+    array_list_delete(context->dir_entries);
+  if (context->dir_entries_mutex_init)
+    mtx_destroy(&context->dir_entries_mutex);
   config_delete(context->config);
   queue_destroy(context->queue_scanner);
   queue_destroy(context->queue_loader);
@@ -117,6 +135,7 @@ PipelineContextReceiver* pipeline_context_receiver_create(Config* config, Queue*
   context->outcomes.entries = NULL;
   context->outcomes.count = 0;
   context->outcomes.capacity = 0;
+  dir_time_list_init(&context->dir_times);
   protocol_session_init(&context->session, file_descriptor, file_descriptor);
   protocol_session_set_ssl(&context->session, ssl);
   context->receiver_done = false;
@@ -155,6 +174,7 @@ void pipeline_context_receiver_destroy(PipelineContextReceiver* context) {
     delete_manifest_free(context->deferred_manifest);
   queue_destroy(context->queue);
   receiver_outcomes_destroy(&context->outcomes);
+  dir_time_list_free(&context->dir_times);
   mtx_destroy(&context->mutex);
   cnd_destroy(&context->condition_not_full);
   cnd_destroy(&context->condition_not_empty);
@@ -307,6 +327,24 @@ int write_thread(void* pipeline_context) {
         return thrd_error;
       }
     }
+    /* P7 Wave D: a directory's times are never applied inline (a later child
+       write would clobber them); accumulate the metadata here and let the
+       caller apply it once every writer has drained. */
+    if (result != FILE_SAVE_ERROR && file->is_dir && file->metadata &&
+        context->config->use_metadata && !context->config->omit_dir_times &&
+        !dir_time_list_add(&context->dir_times, file->path, file->metadata)) {
+      file_destroy(file);
+      pipeline_context_receiver_note_bytes_released(context, file_bytes);
+      mtx_lock(&context->mutex);
+      atomic_store(&context->cancelled, true);
+      context->receiver_done = true;
+      cnd_broadcast(&context->condition_not_full);
+      cnd_broadcast(&context->condition_not_empty);
+      mtx_unlock(&context->mutex);
+      free(root_directory);
+      protocol_session_unbind();
+      return thrd_error;
+    }
     /* Record the per-file outcome so a --remove-source-files sender learns
        which sources were actually written versus skipped on the receiver.
        Explicit directory entries and recreated device/special nodes have no

src/shared/multiprocessing.h

@@ -67,6 +67,13 @@ typedef struct {
    * before it reads the manifest, so no additional synchronization is needed
    * to suppress the manifest. */
   bool scan_stopped_early;
+  /* P7 Wave D: captured source directory times, filled by the scanner thread
+   * (and its parallel workers, guarded by dir_entries_mutex) and drained by the
+   * sender thread in trailing STATUS_DIR_TIMES frame(s).  Owned by the
+   * context; NULL for non-metadata transfers. */
+  ArrayList* dir_entries;
+  mtx_t dir_entries_mutex;
+  bool dir_entries_mutex_init;
 } PipelineContextSender;
 
 typedef struct PipelineContextReceiver {
@@ -94,9 +101,13 @@ typedef struct PipelineContextReceiver {
      protocol stream but hands the manifest here instead of deleting while the
      disk writer may still be draining; the caller (server.c) commits the
      deletion after both threads have joined, so no extra is removed unless the
-      transfer truly succeeded.  NULL in the early delete modes (which delete at
-      the manifest). */
+     transfer truly succeeded.  NULL in the early delete modes (which delete at
+     the manifest). */
   DeleteManifest* deferred_manifest;
+  /* P7 Wave D: directory metadata collected by write_thread from received
+     directory entries.  Only write_thread mutates it (before it joins); the
+     caller (server.c) applies it after the delete/delay-updates phase. */
+  DirTimeList dir_times;
 } PipelineContextReceiver;
 
 PipelineContextSender* pipeline_context_sender_create(Config* config, Queue* queue_scanner,

src/shared/protocol.c

@@ -407,6 +407,12 @@ static const char* status_to_string(Status status) {
     return "APPEND_DATA";
   case STATUS_HARDLINK:
     return "HARDLINK";
+  case STATUS_SYMLINK:
+    return "SYMLINK";
+  case STATUS_SPECIAL:
+    return "SPECIAL";
+  case STATUS_DIR_TIMES:
+    return "DIR_TIMES";
   default:
     return "UNKNOWN";
   }

src/shared/protocol.h

@@ -103,7 +103,17 @@ enum NET_STATUS {
    * int32 rdev major/minor fields.  The receiver validates the kind and rdev,
    * confines the node below the receive root, and recreates it (mknod/mkfifo),
    * privilege-gating the mknod.  Protocol 2.13.0. */
-  STATUS_SPECIAL
+  STATUS_SPECIAL,
+  /* Directory-time superstructure (P7 Wave D, protocol 2.17.0): one or more
+   * trailing frames sent after all file data (and after the optional delete
+   * manifest) carrying the source directories' captured metadata so the
+   * receiver can apply directory mtimes/atimes AFTER all of a directory's
+   * children have been written.  Payload per frame: an int count, then count
+   * repetitions of (wire path string, metadata frame); an entry count larger
+   * than MAX_MANIFEST_ENTRIES is split across repeated frames.  The receiver
+   * defers the actual utimensat until its own delete/publish phase has
+   * committed, then skips the whole set when -O/--omit-dir-times is set. */
+  STATUS_DIR_TIMES
 };
 
 void io_set_fds(int read_fd, int write_fd);