feat(p7-output-fs): sparse hole preservation (-S), partial retention (-P), fake-super replay; block-size verified; crtimes/stderr -> Impossible/Divergence (Wave B)

- write_all_sparse: skips all-zero runs >= 4096 bytes via lseek(SEEK_CUR) and
  ftruncates the final size, wired into the atomic temp+rename and --inplace
  paths with no wire change (full image already in memory).
- --partial retention: on a save failure after the temp held data, rename the
  already-written temp to the destination path (best-effort; falls through to
  unlink; never retains when --partial is off) so --append/--append-verify can
  resume; tested by forcing futimens EINVAL with an out-of-range nsec.
- --block-size aliases --delta-block; verified config->delta_block_size is
  honored by the delta engine end-to-end (unit + integration tests).
- fake_super_restore_fd: parses and re-applies user.fastsync.stat fd-relative
  (fchown best-effort/non-root skipped, fchmod, futimens); a save under
  --fake-super now both records and re-applies.
- -N/--crtimes and --stderr=client promoted to a new 'Impossible/Divergence'
  status bucket (Summary: 136/2/4/3/2 = 147).
- cppcheck/clang-format clean; unit 37/37; integration 407 passed.

src/client/client_cli.c

@@ -1079,7 +1079,7 @@ int parse_args(Config* config, int argc, char* argv[], int* positional_args,
       if (config_add_pattern(&config->include_patterns, &config->include_count, argv[++i],
                              "--include") != 0)
         return -1;
-    } else if (opt_is(argv[i], "--delta-block", NULL)) {
+    } else if (opt_is(argv[i], "--delta-block", "--block-size")) {
       if (i + 1 >= argc) {
         log_message(LOG_LEVEL_ERROR, "missing argument for %s", argv[i]);
         return -1;

src/client/usage.c

@@ -140,8 +140,8 @@ void print_usage(void) {
   printf("                    --incremental and --delta; inert with --whole-file,\n");
   printf("                    --no-delta, or --no-incremental)\n");
   printf("  --no-fuzzy          Disable --fuzzy\n");
-  printf("  --delta-block <n>   Delta block size in bytes (default: %d)\n",
-         DELTA_BLOCK_SIZE_DEFAULT);
+  printf("  --delta-block <n>, --block-size <n>\n");
+  printf("                    Delta block size in bytes (default: %d)\n", DELTA_BLOCK_SIZE_DEFAULT);
   printf("  --delta-max <n>     Max file size for delta transfer (default: %llu)\n",
          DELTA_MAX_FILE_SIZE);
   printf("  -j, --threads       Enable multithreading\n");
@@ -165,9 +165,9 @@ void print_usage(void) {
   printf("                      setting an ACL the receiver is not permitted to\n");
   printf("                      set is warned and skipped, never fatal)\n");
   printf("  --fake-super        Store the source uid/gid/mode/mtime in a reserved\n");
-  printf("                      user.fastsync.stat xattr on each written file instead\n");
-  printf("                      of applying ownership (for a later privileged restore);\n");
-  printf("                      partial: full rsync fake-super replay is out of scope\n");
+  printf("                      user.fastsync.stat xattr on each written file and\n");
+  printf("                      re-apply it (fd-relative) on a privileged run; the\n");
+  printf("                      recording format diverges from rsync's user.rsync.%%stat%%\n");
   printf("  --chmod <changes>   Modify transferred permissions (rsync syntax)\n");
   printf("  --numeric-ids       Do not map uid/gid by name: use the source numeric\n");
   printf("                      ids directly when applying ownership\n");

src/shared/file.c

@@ -36,6 +36,44 @@ static bool write_all(int fd, const void* data, unsigned long long size) {
   return true;
 }
 
+/* A run of NUL bytes at least this long is emitted as a hole (lseek) rather
+ * than written, so the resulting file is genuinely sparse on the filesystem. */
+#define SPARSE_HOLE_MIN 4096U
+
+/* Sparse-aware writer (--sparse/-S).  Walks `data`; any all-zero run of at
+ * least SPARSE_HOLE_MIN bytes is skipped with lseek(SEEK_CUR) so the block is
+ * never allocated (a real hole on the destination); every other byte is written
+ * normally.  The file is pre-sized with ftruncate by the callers before this
+ * runs, so holes are guaranteed and the offset bookkeeping stays correct
+ * (each lseek advances the fd offset exactly as a write of that many bytes
+ * would).  After the final run, ftruncate(size) guarantees the logical size is
+ * exactly `size` even when the tail was a hole.  The full file image is in
+ * memory, so no wire change is needed.  Returns false on I/O error. */
+static bool write_all_sparse(int fd, const unsigned char* data, unsigned long long size) {
+  unsigned long long i = 0;
+  while (i < size) {
+    if (data[i] == 0) {
+      unsigned long long run_start = i;
+      while (i < size && data[i] == 0)
+        i++;
+      unsigned long long run_len = i - run_start;
+      if (run_len >= SPARSE_HOLE_MIN) {
+        if (lseek(fd, (off_t)run_len, SEEK_CUR) < 0)
+          return false;
+      } else if (!write_all(fd, data + run_start, run_len)) {
+        return false;
+      }
+    } else {
+      unsigned long long run_start = i;
+      while (i < size && data[i] != 0)
+        i++;
+      if (!write_all(fd, data + run_start, i - run_start))
+        return false;
+    }
+  }
+  return ftruncate(fd, (off_t)size) == 0;
+}
+
 /* Preallocate `size` bytes on `fd` before any data is written (--preallocate).
  * posix_fallocate reserves real disk blocks, so an out-of-space condition
  * (ENOSPC/EDQUOT) surfaces up front instead of partway through a transfer;
@@ -805,9 +843,15 @@ int file_open_private_dir(const char* dir_path) {
 static void restore_extra_fd(int fd, const FileMetadata* metadata, const FileXattrList* xattrs,
                              bool fake_super) {
   xattr_apply_fd(fd, xattrs);
-  if (fake_super && metadata)
+  if (fake_super && metadata) {
     fake_super_store_fd(fd, (uint32_t)metadata->uid, (uint32_t)metadata->gid,
                         (uint32_t)metadata->mode, metadata->mtime_sec, metadata->mtime_nsec);
+    /* Replay: re-apply the recorded uid/gid/mode/mtime fd-relative so a save
+       under --fake-super restores the attrs (when privileged) instead of only
+       recording them.  Best-effort; a non-root fchown failure is logged/skipped
+       by fake_super_restore_fd, never fatal. */
+    fake_super_restore_fd(fd);
+  }
 }
 
 static bool file_to_disk_secure_impl(const char* path, const void* data,
@@ -815,7 +859,8 @@ static bool file_to_disk_secure_impl(const char* path, const void* data,
                                      bool preallocate, const FileMetadata* metadata,
                                      bool preserve_executability, bool update, bool no_replace,
                                      bool use_fsync, const char* temp_dir,
-                                     const FileXattrList* xattrs, bool fake_super) {
+                                     const FileXattrList* xattrs, bool fake_super,
+                                     bool keep_partial) {
   char* leaf = NULL;
   int dirfd = file_open_secure_parent(path, &leaf, true);
   if (dirfd < 0)
@@ -852,7 +897,9 @@ static bool file_to_disk_secure_impl(const char* path, const void* data,
           if (sparse && data_size > 0)
             ok = ftruncate(fd, (off_t)data_size) == 0;
           if (ok || !sparse || data_size == 0)
-            ok = write_all(fd, data, data_size);
+            ok = sparse && data_size > 0
+                     ? write_all_sparse(fd, (const unsigned char*)data, data_size)
+                     : write_all(fd, data, data_size);
           if (ok)
             ok = ftruncate(fd, (off_t)data_size) == 0;
           /* Normalize the mode: apply the metadata-derived safe mode when the
@@ -875,6 +922,10 @@ static bool file_to_disk_secure_impl(const char* path, const void* data,
   } else {
     /* The --update newer-destination check runs first so a skipped file never
        creates an empty scratch directory behind it. */
+    /* True once the temp is being written: distinguishes a mid-write/metadata/
+       install failure (partial data may exist, --partial may retain it) from a
+       pre-write validation failure (nothing to retain). */
+    bool write_attempted = false;
     if (update && metadata) {
       /* This check protects the normal atomic path as far as possible.  A
          concurrent replacement can still occur before the final rename. */
@@ -947,11 +998,13 @@ static bool file_to_disk_secure_impl(const char* path, const void* data,
                       strerror(prealloc_rc));
       }
       if (prealloc_rc == 0) {
+        write_attempted = true;
         lseek(fd, 0, SEEK_SET);
         if (sparse && data_size > 0)
           ok = ftruncate(fd, (off_t)data_size) == 0;
         if (ok || (!sparse || data_size == 0))
-          ok = write_all(fd, data, data_size);
+          ok = sparse && data_size > 0 ? write_all_sparse(fd, (const unsigned char*)data, data_size)
+                                       : write_all(fd, data, data_size);
         if (ok && metadata)
           ok = file_restore_metadata_fd(fd, metadata, preserve_executability);
         if (ok)
@@ -986,8 +1039,19 @@ static bool file_to_disk_secure_impl(const char* path, const void* data,
           ok = false;
         }
       }
-      if (!ok)
-        unlinkat(scratch_dirfd >= 0 ? scratch_dirfd : dirfd, tmp, 0);
+      if (!ok) {
+        /* --partial retention (best-effort): on a failure that happened after
+           the temp held data (mid-write / metadata / fsync / install error),
+           keep the already-written temp at the final destination path instead
+           of unlinking it, so a later --append / --append-verify run can resume.
+           This only ever renames the already-written temp (never a corrupt
+           blend); the rename can fail (cross-device, permissions) and we then
+           fall through to the normal unlink cleanup.  Never retains when
+           keep_partial is off. */
+        if (!keep_partial || !write_attempted ||
+            renameat(scratch_dirfd >= 0 ? scratch_dirfd : dirfd, tmp, dirfd, leaf) != 0)
+          unlinkat(scratch_dirfd >= 0 ? scratch_dirfd : dirfd, tmp, 0);
+      }
       /* Once the temp fd was created the outcome is permanent: a write,
          metadata, fsync, close, linkat or renameat failure will not be fixed
          by retrying under a fresh name, so stop here.  Only the open-failure
@@ -1010,7 +1074,7 @@ bool file_to_disk_secure(const char* path, const void* data, unsigned long long
                          bool preserve_executability, const char* temp_dir) {
   return file_to_disk_secure_impl(path, data, data_size, inplace, sparse, preallocate, metadata,
                                   preserve_executability, false, false, false, temp_dir, NULL,
-                                  false);
+                                  false, false);
 }
 
 bool file_to_disk_secure_update(const char* path, const void* data, unsigned long long data_size,
@@ -1018,7 +1082,7 @@ bool file_to_disk_secure_update(const char* path, const void* data, unsigned lon
                                 const FileMetadata* metadata, bool preserve_executability,
                                 const char* temp_dir) {
   return file_to_disk_secure_impl(path, data, data_size, inplace, sparse, preallocate, metadata,
-                                  preserve_executability, true, false, false, temp_dir, NULL,
+                                  preserve_executability, true, false, false, temp_dir, NULL, false,
                                   false);
 }
 
@@ -1029,7 +1093,7 @@ bool file_to_disk_secure_with_fsync(const char* path, const void* data,
                                     const char* temp_dir) {
   return file_to_disk_secure_impl(path, data, data_size, inplace, sparse, preallocate, metadata,
                                   preserve_executability, false, false, use_fsync, temp_dir, NULL,
-                                  false);
+                                  false, false);
 }
 
 bool file_to_disk_secure_no_replace(const char* path, const void* data,
@@ -1037,22 +1101,24 @@ bool file_to_disk_secure_no_replace(const char* path, const void* data,
                                     const FileMetadata* metadata, bool preserve_executability,
                                     const char* temp_dir) {
   return file_to_disk_secure_impl(path, data, data_size, false, sparse, preallocate, metadata,
-                                  preserve_executability, false, true, false, temp_dir, NULL,
+                                  preserve_executability, false, true, false, temp_dir, NULL, false,
                                   false);
 }
 
 /* Receiver write-path variant that also applies the per-file xattrs (-X/-A)
  * and, under --fake-super, parks the source stat in the reserved xattr, on the
  * just-written file descriptor before the final rename.  `no_replace` / `update`
- * mirror the plain wrappers; see file_to_disk_secure_impl for the semantics. */
+ * mirror the plain wrappers; `keep_partial` enables --partial retention of a
+ * failed write's temp.  See file_to_disk_secure_impl for the semantics. */
 bool file_to_disk_secure_attrs(const char* path, const void* data, unsigned long long data_size,
                                bool inplace, bool sparse, bool preallocate,
                                const FileMetadata* metadata, bool preserve_executability,
                                bool update, bool no_replace, bool use_fsync,
-                               const FileXattrList* xattrs, bool fake_super, const char* temp_dir) {
+                               const FileXattrList* xattrs, bool fake_super, bool keep_partial,
+                               const char* temp_dir) {
   return file_to_disk_secure_impl(path, data, data_size, inplace, sparse, preallocate, metadata,
                                   preserve_executability, update, no_replace, use_fsync, temp_dir,
-                                  xattrs, fake_super);
+                                  xattrs, fake_super, keep_partial);
 }
 
 /* Atomic --link-dest install.  The destination is replaced (via a temporary
@@ -1155,7 +1221,7 @@ static bool file_to_disk_secure_link_impl(const char* path, const char* basis_pa
        by the filesystem).  Write a byte-identical local copy instead. */
     return file_to_disk_secure_attrs(path, data, data_size, false, false, preallocate, metadata,
                                      preserve_executability, false, false, use_fsync, xattrs,
-                                     fake_super, temp_dir);
+                                     fake_super, false, temp_dir);
   }
 
   if (scratch_dirfd >= 0)

src/shared/file.h

@@ -113,12 +113,14 @@ bool file_to_disk_secure_no_replace(const char* path, const void* data,
                                     const char* temp_dir);
 /* Receiver write-path variant that also applies per-file xattrs (-X/-A) and the
  * --fake-super stat xattr fd-relative before the final rename.  `update` /
- * `no_replace` / `use_fsync` mirror the plain wrappers above. */
+ * `no_replace` / `use_fsync` mirror the plain wrappers above; `keep_partial`
+ * enables --partial best-effort retention of a failed write's temp. */
 bool file_to_disk_secure_attrs(const char* path, const void* data, unsigned long long data_size,
                                bool inplace, bool sparse, bool preallocate,
                                const FileMetadata* metadata, bool preserve_executability,
                                bool update, bool no_replace, bool use_fsync,
-                               const FileXattrList* xattrs, bool fake_super, const char* temp_dir);
+                               const FileXattrList* xattrs, bool fake_super, bool keep_partial,
+                               const char* temp_dir);
 /* Atomic --link-dest install: replace `path` with a hard link to `basis_path`
    (via a temp name + rename); fall back to a byte-identical local copy from
    `data` when the link is impossible (EXDEV/EPERM/unsupported filesystem).

src/shared/file_receive.c

@@ -87,10 +87,10 @@ static FileSaveResult file_stage_delayed_update(const char* root_directory,
                                   config->preallocate, metadata, preserve_executability,
                                   config->use_fsync, NULL);
   } else {
-    ok =
-        file_to_disk_secure_attrs(staged_path, file->data->data, file->data->size, false, sparse,
-                                  config->preallocate, metadata, preserve_executability, false,
-                                  false, config->use_fsync, file->xattrs, config->fake_super, NULL);
+    ok = file_to_disk_secure_attrs(staged_path, file->data->data, file->data->size, false, sparse,
+                                   config->preallocate, metadata, preserve_executability, false,
+                                   false, config->use_fsync, file->xattrs, config->fake_super,
+                                   false, NULL);
   }
   if (!ok) {
     free(staged_path);
@@ -796,11 +796,11 @@ FileSaveResult file_save_to_disk_full(const char* root_directory, const File* fi
   } else {
     /* The plain no-replace / update / with-fsync engines, plus per-file xattr
        (-X/-A) and --fake-super application on the written fd. */
-    ok = file_to_disk_secure_attrs(disk_path, file->data->data, file->data->size, inplace, sparse,
-                                   config && config->preallocate, metadata, preserve_executability,
-                                   config && config->update, config && config->ignore_existing,
-                                   config && config->use_fsync, file->xattrs,
-                                   config ? config->fake_super : false, confined_temp);
+    ok = file_to_disk_secure_attrs(
+        disk_path, file->data->data, file->data->size, inplace, sparse,
+        config && config->preallocate, metadata, preserve_executability, config && config->update,
+        config && config->ignore_existing, config && config->use_fsync, file->xattrs,
+        config ? config->fake_super : false, config ? config->partial : false, confined_temp);
   }
   free(confined_temp);
   confined_temp = NULL;

src/shared/file_store.c

@@ -139,6 +139,44 @@ static bool write_all(int fd, const void* data, unsigned long long size) {
   return true;
 }
 
+/* A run of NUL bytes at least this long is emitted as a hole (lseek) rather
+ * than written, so the resulting file is genuinely sparse on the filesystem. */
+#define SPARSE_HOLE_MIN 4096U
+
+/* Sparse-aware writer (--sparse/-S).  Walks `data`; any all-zero run of at
+ * least SPARSE_HOLE_MIN bytes is skipped with lseek(SEEK_CUR) so the block is
+ * never allocated (a real hole on the destination); every other byte is written
+ * normally.  The file is pre-sized with ftruncate by the callers before this
+ * runs, so holes are guaranteed and the offset bookkeeping stays correct
+ * (each lseek advances the fd offset exactly as a write of that many bytes
+ * would).  After the final run, ftruncate(size) guarantees the logical size is
+ * exactly `size` even when the tail was a hole.  The full file image is in
+ * memory, so no wire change is needed.  Returns false on I/O error. */
+static bool write_all_sparse(int fd, const unsigned char* data, unsigned long long size) {
+  unsigned long long i = 0;
+  while (i < size) {
+    if (data[i] == 0) {
+      unsigned long long run_start = i;
+      while (i < size && data[i] == 0)
+        i++;
+      unsigned long long run_len = i - run_start;
+      if (run_len >= SPARSE_HOLE_MIN) {
+        if (lseek(fd, (off_t)run_len, SEEK_CUR) < 0)
+          return false;
+      } else if (!write_all(fd, data + run_start, run_len)) {
+        return false;
+      }
+    } else {
+      unsigned long long run_start = i;
+      while (i < size && data[i] != 0)
+        i++;
+      if (!write_all(fd, data + run_start, i - run_start))
+        return false;
+    }
+  }
+  return ftruncate(fd, (off_t)size) == 0;
+}
+
 bool file_store_write_secure(const char* path, const void* data, unsigned long long data_size,
                              bool inplace, bool sparse, const FileMetadata* metadata,
                              bool preserve_executability) {
@@ -151,8 +189,12 @@ bool file_store_write_secure(const char* path, const void* data, unsigned long l
   if (inplace) {
     fd = openat(dirfd, leaf, O_WRONLY | O_CREAT | O_TRUNC | O_CLOEXEC | O_NOFOLLOW, 0644);
     if (fd >= 0) {
-      if (!sparse || data_size == 0 || ftruncate(fd, (off_t)data_size) == 0)
+      if (sparse && data_size > 0) {
+        if (ftruncate(fd, (off_t)data_size) == 0)
+          ok = write_all_sparse(fd, data, data_size);
+      } else {
         ok = write_all(fd, data, data_size);
+      }
       if (ok && metadata)
         ok = file_restore_metadata_fd(fd, metadata, preserve_executability);
     }
@@ -177,7 +219,8 @@ bool file_store_write_secure(const char* path, const void* data, unsigned long l
       if (sparse && data_size > 0)
         ok = ftruncate(fd, (off_t)data_size) == 0;
       if (ok || (!sparse || data_size == 0))
-        ok = write_all(fd, data, data_size);
+        ok = (sparse && data_size > 0) ? write_all_sparse(fd, (const unsigned char*)data, data_size)
+                                       : write_all(fd, data, data_size);
       if (ok && metadata)
         ok = file_restore_metadata_fd(fd, metadata, preserve_executability);
       if (close(fd) != 0)

src/shared/xattr.c

@@ -9,7 +9,10 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
+#include <sys/stat.h>
 #include <sys/xattr.h>
+#include <time.h>
+#include <unistd.h>
 
 /* ---- lifecycle ---- */
 
@@ -328,4 +331,40 @@ void fake_super_store_fd(int fd, uint32_t uid, uint32_t gid, uint32_t mode, int6
     log_message(LOG_LEVEL_WARNING, "--fake-super: could not store %s on destination file: %s",
                 FAKESUPER_XATTR, strerror(errno));
   }
+}
+
+/* --fake-super replay: read the freshly-stored record and re-apply the source
+ * stat fd-relative.  A privileged (root) run can actually change the owner;
+ * a non-root run logs-and-skips the fchown (never fatal, mirroring the normal
+ * metadata identity path) and still applies mode/mtime where permitted. */
+bool fake_super_restore_fd(int fd) {
+  if (fd < 0)
+    return false;
+  char record[128];
+  ssize_t len = fgetxattr(fd, FAKESUPER_XATTR, record, sizeof(record) - 1);
+  if (len < 0)
+    return false; /* absent or filesystem without xattrs: silent no-op */
+  record[len] = '\0';
+  unsigned long ul_uid, ul_gid, ul_mode;
+  long long mtime_sec;
+  long mtime_nsec;
+  if (sscanf(record, "%lu:%lu:%lo:%lld:%ld", &ul_uid, &ul_gid, &ul_mode, &mtime_sec, &mtime_nsec) !=
+      5)
+    return false; /* malformed record: skip, never fatal */
+
+  /* Owner is applied best-effort only: a non-root process cannot chown and must
+     not abort the transfer for that reason (FastSync identity philosophy). */
+  if (fchown(fd, (uid_t)ul_uid, (gid_t)ul_gid) != 0 && errno != EPERM && errno != EACCES &&
+      errno != EINVAL)
+    log_message(LOG_LEVEL_WARNING, "--fake-super: could not restore owner on destination file: %s",
+                strerror(errno));
+  if (fchmod(fd, (mode_t)(ul_mode & 07777U)) != 0)
+    log_message(LOG_LEVEL_WARNING, "--fake-super: could not restore mode on destination file: %s",
+                strerror(errno));
+  struct timespec times[2] = {{.tv_sec = 0, .tv_nsec = UTIME_OMIT},
+                              {.tv_sec = (time_t)mtime_sec, .tv_nsec = mtime_nsec}};
+  if (futimens(fd, times) != 0)
+    log_message(LOG_LEVEL_WARNING, "--fake-super: could not restore mtime on destination file: %s",
+                strerror(errno));
+  return true;
 }

src/shared/xattr.h

@@ -86,4 +86,12 @@ bool xattr_apply_fd(int fd, const FileXattrList* list);
 void fake_super_store_fd(int fd, uint32_t uid, uint32_t gid, uint32_t mode, int64_t mtime_sec,
                          int64_t mtime_nsec);
 
+/* --fake-super replay: parse the FAKESUPER_XATTR record previously written on
+ * `fd` by fake_super_store_fd and re-apply uid/gid/mode/mtime fd-relative.
+ * Best-effort: absence of the xattr or a malformed record is a silent no-op
+ * that never fails the transfer, and fchown is applied only when permitted
+ * (a non-root EPERM is logged and skipped, matching FastSync's identity
+ * philosophy).  Returns true when the xattr was present and parsed. */
+bool fake_super_restore_fd(int fd);
+
 #endif